<?php

include('helpers.php');
include('cors.php');

$action = $_GET['action'];

if ($_SERVER['REQUEST_METHOD'] == 'GET') {

// Create connection
    $db = new mysqli('localhost', 'awaldron_accomods', '$7FuE1MuvBp', 'awaldron_accomods');
    if ($db->connect_errno) {
        $data = ['success' => false, 'error' => $db->connect_error];
        header('Content-Type: application/json');
        echo json_encode($data);
        exit();
    }

// AUTHENTICATE *****************************************************************/
    if ($action == 'login') {
        $u = filter_var($_GET['u'], FILTER_VALIDATE_EMAIL);
        $p = $_GET['p'];
        $sql = "SELECT id, uuid, email, fname, lname, access, expires FROM users WHERE email='" . $u . "' AND pass='" . md5($p) . "'";
        $result = $db->query($sql);

        if ($result->num_rows > 0) {
            $user = $result->fetch_assoc();
            $expires = str_replace('-', '', $user['expires']);
            $today = date('Ymd');

            if ($user['access']==1 && ($today <= $expires)) {
                $login = json_decode(backdoor_login());
                $data = [
                    'success' => true,
                    'access_token' => 'Ebp/iVQK1EOxtCuecMBxKQ==aNr0ihK0R0emRCdY30thfA==', 			//$login->access_token,
                    'isCustomer' => true,
                    'organization' => 'accomods',
                    'token_type' => 'bearer',
                    'userId' => $login->userId,
                    'userName' => $u,
                    'access' => $user['access'],
                    'expires' => $user['expires']
                ];
            } else if ($user['access']==0) {
                $data = ['success' => false, 'msg' => 'this account has been disabled'];
            } else if ($today > $expires) {
                $data = ['success' => false, 'msg' => 'this school license has expired'];
            } else {
                $data = ['success' => false];
            }

        } else {
            $data = ['success' => false];
        }
    }


// BACKDOOR AUTHENTICATION ******************************************************/
    if ($action == 'bd') {
//    $data = backdoor_login();
//
//    header('Content-Type: application/json');
//    echo $data;
        exit;
    }


// REGISTER *****************************************************************/
    if ($action == 'reg') {

        $email = filter_var($_GET['email'], FILTER_VALIDATE_EMAIL);
        $fname = filter_var($_GET['fname'], FILTER_SANITIZE_STRING);
        $lname = filter_var($_GET['lname'], FILTER_SANITIZE_STRING);
        $school = filter_var($_GET['school'], FILTER_SANITIZE_STRING);
        $code = filter_var($_GET['code'], FILTER_SANITIZE_STRING);
        $phone = filter_var($_GET['phone'], FILTER_SANITIZE_STRING);
        $pw = md5($_GET['pw']);
        $expires = date('Y-m-d', strtotime('+1 years'));

        if ($_GET['type'] === 'district') {
            $sql = "SELECT expires FROM users WHERE school_code='".$code."' LIMIT 0,1";
            $result = $db->query($sql);

            if ($result->num_rows > 0) {
                $row = $result->fetch_assoc();
                $expires = $row['expires'];
            }
        }

        $sql = "INSERT INTO users (`uuid`, `email`, `fname`, `lname`, `pass`, `ptxt`, `phone`, `school_code`, `school_name`, `expires`) VALUES (";
        $sql .= "'',";
        $sql .= "'" . $email . "',";
        $sql .= "'" . $fname . "',";
        $sql .= "'" . $lname . "',";
        $sql .= "'" . $pw . "',";
        $sql .= "'',";
        $sql .= "'" . $phone . "',";
        $sql .= "'" . $code . "',";
        $sql .= "'" . $school . "',";
        $sql .= "'" . $expires . "'";
        $sql .= ")";

        if ($result = $db->query($sql)) {
            $login = json_decode(backdoor_login());

            $data = [
                'success' => true,
                'access_token' => $login->access_token,
                'isCustomer' => true,
                'organization' => 'accomods',
                'token_type' => 'bearer',
                'userId' => $login->userId,
                'userName' => $email
            ];

        } else {
            $data = ['success' => false, 'error' => $db->error];
        }

    }


// UPDATE PASSWORD *****************************************************************/
    if ($action == 'updatepw') {
        $u = $_GET['u'];
        $p = $_GET['p'];
        $p1 = $_GET['p1'];
        $p2 = $_GET['p2'];

        if ($p1 === $p2) {
            $sql = "SELECT id, uuid, email, fname, lname FROM users WHERE email='" . $u . "' AND pass='" . md5($p) . "'";
            $userOk = $db->query($sql);

            if ($userOk->num_rows > 0) {
                $upd = $db->query("UPDATE users SET pass='" . md5($p1) . "', ptxt='' WHERE email='" . $u . "'");
                if ($upd === true) {
                    $data = ['success' => true, 'debug' => $userOk->num_rows];
                } else {
                    $data = ['success' => false, 'error' => 'Update failed.', 'debug' => $userOk->num_rows];
                }

            } else {
                $data = ['success' => false, 'error' => 'No matching user found.', 'debug' => $userOk->num_rows, 'data' => $_GET];
            }
        } else {
            $data = ['success' => false, 'error' => 'Passwords do not match.'];
        }
    }


// GET PROFILE ************************************************************************/
    if ($action == 'profile') {
        $u = filter_var($_GET['u'], FILTER_VALIDATE_EMAIL);
        $sql = "SELECT id, uuid, email, fname, lname, school_code, school_name FROM users WHERE email='" . $u . "'";
        $result = $db->query($sql);

        if ($result->num_rows > 0) {
            $user = $result->fetch_assoc();
            $login = json_decode(backdoor_login());

            $data = [
                'success' => true,
                'profile' => [
                    'Id' => $login->userId,
                    'PictureUrl' => '/static/img/avatars/default.png',
                    'Name' => [
                        'First' => $user['fname'],
                        'Middle' => '',
                        'Last' => $user['lname']
                    ],
                    'EmailAddress' => $u,
                    'Addresses' => null,
                    'IsExternalCreatingUserSettings' => null,
                    'Attributes' => null,
                    'School' => [
                        'Name' => $user['school_name'],
                        'Code' => $user['school_code'],
                        'Personnel' => null
                    ]

                ]
            ];

            // GET DISTRICT ASSOCIATES
            if (strlen($user['school_code']) > 0 && $user['school_code'] !== 'INDIVIDUAL_ACCOUNT') {
                $sql2 = "SELECT email, fname, lname FROM users WHERE school_code='".$user['school_code']."' AND id <> ".$user['id']." ORDER BY lname ASC, fname ASC";
                $res2 = $db->query($sql2);

                $associates = [];
                while ($assoc = $res2->fetch_assoc()) {
                    $associates[] = [
                        'First' => $assoc['fname'],
                        'Last' => $assoc['lname'],
                        'Email' => $assoc['email']
                    ];
                }
                $data['profile']['School']['Personnel'] = $associates;
            }

        } else {
            $data = ['success' => false, 'error' => 'No matching users.'];
        }
    }

    mysqli_close($db);
    header('Content-Type: application/json');
    echo json_encode($data);
}
else {
    $data = ['success' => false, 'error' => 'Bad request'];
    header('Content-Type: application/json');
    echo json_encode($data);
}