<?php

//**********************************************************************************************************//
// Method: POST
// Endpoint: user
// Params: email, password
function post_v1_auth_user( $args, $body, $uid, $is_admin, $db ) {
    $rules = [
        'lname' => 'req',
        'fname' => 'req',
        'email' => 'req,email',
        'password' => 'req',
    ];
    validate_body( $body, $rules );

    $ins = "INSERT INTO users (lname, fname, email, password_hash, active, created_at, updated_at) VALUES 
            ( '".$body['lname']."', '".$body['fname']."', '".$body['email']."', '".password_hash($body['password'], PASSWORD_BCRYPT)."', 1, ".time().", ".time()." )";
    if ($result = $db->query($ins)) {
        $user_id = qVal($db, "SELECT MAX(user_id) FROM users");
        response(200, ['success'=>true,'user_id'=>$user_id]);
    } else {
        response(400, ['success'=>false,'errors'=>[$db->error]]);
    }
}


//**********************************************************************************************************//
// Method: GET
// Endpoint: pwhash
// Params: pw
function get_v1_auth_pwhash( $args, $body, $uid, $is_admin, $db ) {
    echo password_hash($args[0], PASSWORD_BCRYPT);
}


//**********************************************************************************************************//
// Method: PUT
// Endpoint: user
// Params: oldpw, pw1, pw2
function put_v1_auth_setpw( $args, $body, $uid, $is_admin, $db ) {
    $rules = [
        'user_id' => 'req',
        'oldpw' => 'req',
        'pw1' => 'req',
        'pw2' => 'req',
    ];
    validate_body( $body, $rules );

    if ($body['pw1'] !== $body['pw2']) {
        response(200, ['success'=>false,'errors'=>['Passwords do not match.']]);
    }
    else {
        // check old password
        $user = qRow( $db, "SELECT * FROM users WHERE user_id='".$body['user_id']."'" );
        $valid_login = password_verify($body['oldpw'], $user['password_hash']);

        if ($valid_login) {
            // update password
            $db->query("UPDATE users SET password_hash='".password_hash($body['pw1'], PASSWORD_BCRYPT)."' WHERE user_id=".$body['user_id']);
            response(200, ['success'=>true]);
        } else {
            response(200, ['success'=>false,'errors'=>['Current password is incorrect.']]);
        }
    }
}


//**********************************************************************************************************//
// Method: POST
// Endpoint: token
// Params: email, password
function post_v1_auth_token( $args, $body, $uid, $is_admin, $db ) {
    $rules = [
        'email' => 'req,email',
        'password' => 'req',
    ];
    validate_body( $body, $rules );

    $sql = "SELECT * FROM users WHERE email='".$body['email']."'";
    $user = qRow( $db, $sql );

    $valid_login = !empty($user['user_id']);
    if ($valid_login) {
        $valid_login = password_verify($body['password'], $user['password_hash']);
    }

    if ($valid_login && $user['active']) {
        $token = new_token( $db, $user['user_id'] );
        $user['token'] = $token['token'];
        $user['token_expires'] = $token['expires'];
        $user['token_created'] = $token['created'];
        unset($user['password_hash']);
        response(200, ['success' => true, 'user' => $user]);

    } else if ($valid_login && !$user['active']) {
        response(401, ['success'=>false,'errors'=>['Account is deactivated.']]);

    } else {
        response(401, ['success'=>false,'errors'=>['Email / password combo is invalid.']]);
    }
}


//**********************************************************************************************************//
// Method: GET
// Endpoint: user
// Params: none
// Description: Returns user associated with an active token
function get_v1_auth_user( $args, $body, $uid, $is_admin, $db ) {
    validate_token( $uid );

    $sql = "SELECT * FROM users as u,
                          tokens as t 
            WHERE t.token='".$_SERVER['HTTP_AUTHORIZATION']."' AND t.user_id=u.user_id";
    $user = qRow( $db, $sql );

    $user['token_expires'] = $user['expires'];
    $user['token_created'] = $user['created'];
    unset($user['password_hash']);
    unset($user['token_id']);
    unset($user['expires']);
    unset($user['created']);

    response(200, ['success' => true, 'user' => $user]);
}


//**********************************************************************************************************//
// Method: GET
// Endpoint: plans
// Params: none
// Description: Returns all membership plans in system
function get_v1_auth_plans( $args, $body, $uid, $is_admin, $db ) {
    validate_token( $uid );

    $sql = "SELECT * FROM plans";
    $plans = qSet( $db, $sql );

    response(200, ['success' => true, 'plans' => $plans]);
}


//**********************************************************************************************************//
// Method: PUT
// Endpoint: plan
// Params: none
// Description: Updates a plan for a member group
function put_v1_auth_plan( $args, $body, $uid, $is_admin, $db ) {
    validate_token( $uid );

    // SET THE NEW PLAN ID FOR EACH GROUP MEMBER
    $db->query("UPDATE groups SET plan_id=".$body['plan_id']." WHERE group_id=".$body['group_id']);

    // If switching from household to individual, need to create new groups for each member.
    if ($body['plan_id'] == 1) {
        $sql1 = "SELECT paid_thru FROM groups WHERE group_id=".$body['group_id'];
        $sql2 = "SELECT * FROM group_member WHERE group_id=".$body['group_id'];
        $paid_thru = qVal( $db, $sql1 );
        $members = qSet( $db, $sql2 );

        try {
            for ($i=0; $i < count($members); $i++) {
                if ($i > 0) {                       /// SKIP THE FIRST USER
                    /// GET THE USER ID FROM MEMBER
                    $user_id = qVal($db, "SELECT user_id FROM members WHERE member_id=".$members[$i]['member_id']);

                    // CREATE NEW GROUP
                    $db->query("INSERT INTO groups ( user_id, plan_id, paid_thru ) VALUES ( 0, 1, ".$paid_thru.")");
                    $newId = $db->insert_id;

                    // APPLY NEW PLAN TO USER
                    $db->query("UPDATE group_member SET group_id=".$newId." WHERE member_id=".$members[$i]['member_id']);

                    // UPDATE USER ACCESS
                    $db->query("DELETE FROM group_user WHERE user_id=".$user_id);
                    $db->query("INSERT INTO group_user (group_id, user_id) VALUES (".$newId.", ".$user_id.")" );
                }
            }
        } catch (Exception $e) {
            response(400, ['success' => false, 'error' => $e]);
        }
    }
    response(200, ['success' => true]);
}