<?php
// -------------------- Secure session cookie params (before session_start) --------------------
$secure = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';

session_set_cookie_params([
    'lifetime' => 0,      // Session-Cookie (endet mit Browser), Remember-me macht "lang"
    'path'     => '/',
    'domain'   => '',
    'secure'   => $secure,
    'httponly' => true,
    'samesite' => 'Lax',
]);

session_start();

require_once "config/config.php";

// -------------------- Auto-Login via remember cookie (if no session) + ROTATION --------------------
if ((!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true) && !empty($_COOKIE['remember'])) {
    try {
        // optional housekeeping
        $pdo->exec("DELETE FROM remember_tokens WHERE expires_at < NOW()");

        $oldToken = (string)$_COOKIE['remember'];
        $oldHash  = hash('sha256', $oldToken);

        $stmt = $pdo->prepare("
            SELECT rt.id AS token_id,
                   rt.user_id,
                   UNIX_TIMESTAMP(rt.expires_at) AS exp,
                   u.username, u.name, u.role
            FROM remember_tokens rt
            JOIN users u ON u.id = rt.user_id
            WHERE rt.token_hash = :th
            LIMIT 1
        ");
        $stmt->execute([':th' => $oldHash]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);

        if ($row && (int)$row['exp'] > time()) {
            // ✅ valid token -> log in
            session_regenerate_id(true);

            $_SESSION["loggedin"] = true;
            $_SESSION["id"]       = (int)$row["user_id"];
            $_SESSION["username"] = $row["username"];
            $_SESSION["name"]     = $row["name"];
            $_SESSION["role"]     = $row["role"];

            // last_login auch bei Auto-Login aktualisieren
            $upd = $pdo->prepare("UPDATE users SET last_login = :ts WHERE id = :id");
            $upd->execute([
                ':ts' => time(),
                ':id' => (int)$row['user_id']
            ]);


            // ✅ TOKEN ROTATION: replace old token with a fresh one & extend expiry to 7 days
            $newToken = bin2hex(random_bytes(32));
            $newHash  = hash('sha256', $newToken);
            $newExp   = time() + 7 * 24 * 60 * 60; // 7 days

            $pdo->beginTransaction();
            try {
                // Update the existing token row (keeps 1 token per "cookie session")
                $upd = $pdo->prepare("
                    UPDATE remember_tokens
                    SET token_hash = :new_hash,
                        expires_at = FROM_UNIXTIME(:exp)
                    WHERE id = :tid
                    LIMIT 1
                ");
                $upd->execute([
                    ':new_hash' => $newHash,
                    ':exp'      => $newExp,
                    ':tid'      => (int)$row['token_id'],
                ]);

                $pdo->commit();
            } catch (Throwable $e) {
                $pdo->rollBack();
                // If rotation fails, fail closed-ish:
                // We'll still keep the session (user is in), but we remove cookie to avoid loops.
                setcookie('remember', '', [
                    'expires'  => time() - 3600,
                    'path'     => '/',
                    'secure'   => $secure,
                    'httponly' => true,
                    'samesite' => 'Lax',
                ]);
                header("location: dashboard.php");
                exit;
            }

            // Set new cookie
            setcookie('remember', $newToken, [
                'expires'  => $newExp,
                'path'     => '/',
                'secure'   => $secure,
                'httponly' => true,
                'samesite' => 'Lax',
            ]);

            header("location: dashboard.php");
            exit;
        } else {
            // invalid/expired token -> delete cookie
            setcookie('remember', '', [
                'expires'  => time() - 3600,
                'path'     => '/',
                'secure'   => $secure,
                'httponly' => true,
                'samesite' => 'Lax',
            ]);
        }
    } catch (Throwable $e) {
        // fail closed (do nothing, user stays logged out)
    }
}

// If already logged in -> go dashboard
if (isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true) {
    header("location: dashboard.php");
    exit;
}

$username = $password = "";
$username_err = $password_err = "";

if ($_SERVER["REQUEST_METHOD"] === "POST") {

    // Username prüfen
    if (empty(trim($_POST["username"] ?? ""))) {
        $username_err = "Bitte Username eingeben.";
    } else {
        $username = trim((string)$_POST["username"]);
    }

    $password = (string)($_POST["password"] ?? "");

    if (empty($username_err) && empty($password_err)) {

        $sql = "
            SELECT *
            FROM users
            WHERE username = :username
            LIMIT 1
        ";

        $stmt = $pdo->prepare($sql);
        $stmt->bindParam(":username", $username, PDO::PARAM_STR);

        if ($stmt->execute()) {

            if ($stmt->rowCount() === 1) {

                $user = $stmt->fetch(PDO::FETCH_ASSOC);

                $hash  = $user['password_hash'] ?? '';
                $first = (int)($user['first_login'] ?? 0);

                // 1️⃣ Nur wenn wirklich First Login ODER kein Hash vorhanden
                if ($first === 1 || empty($hash)) {
                    $_SESSION['set_pw_user'] = (int)$user['id'];
                    header("location: set_password.php");
                    exit;
                }

                // 2️⃣ Passwort prüfen
                if (!password_verify($password, $hash)) {
                    $password_err = "Falsches Passwort.";
                } else {

                    session_regenerate_id(true);

                    $_SESSION["loggedin"] = true;
                    $_SESSION["id"]       = (int)$user["id"];
                    $_SESSION["username"] = $user["username"];
                    $_SESSION["name"]     = $user["name"];
                    $_SESSION["role"]     = $user["role"];

                    // Remember-me (7 Tage), nur wenn Checkbox gesetzt
                    if (!empty($_POST['remember'])) {
                        $token = bin2hex(random_bytes(32));
                        $tokenHash = hash('sha256', $token);
                        $expires = time() + 7 * 24 * 60 * 60; // 7 days

                        // optional housekeeping
                        $pdo->exec("DELETE FROM remember_tokens WHERE expires_at < NOW()");

                        $ins = $pdo->prepare("
                            INSERT INTO remember_tokens (user_id, token_hash, expires_at)
                            VALUES (:uid, :th, FROM_UNIXTIME(:exp))
                        ");
                        $ins->execute([
                            ':uid' => (int)$user['id'],
                            ':th'  => $tokenHash,
                            ':exp' => $expires
                        ]);

                        setcookie('remember', $token, [
                            'expires'  => $expires,
                            'path'     => '/',
                            'secure'   => $secure,
                            'httponly' => true,
                            'samesite' => 'Lax',
                        ]);
                    }

                    // last_login setzen
                    $upd = $pdo->prepare("UPDATE users SET last_login = :ts WHERE id = :id");
                    $upd->execute([
                        ':ts' => time(),
                        ':id' => (int)$user['id']
                    ]);

                    header("location: dashboard.php");
                    exit;
                }

            } else {
                $username_err = "Dieser Benutzer existiert nicht.";
            }

        } else {
            echo "Fehler. Bitte später erneut versuchen.";
        }
    }
}
?>
<!DOCTYPE html>
<html lang="de">
<head>
<meta charset="UTF-8">
<title>ANJUMA Login</title>

<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">

<style>
body {
  background: #ffffff;
  height: 100vh;
  display: flex;
  justify-content: center;
  align-items: center;
  font-family: 'Segoe UI', sans-serif;
  margin: 0;
  overflow-x: hidden;
}

.login-card {
  width: 90%;
  max-width: 380px;
  background: #fff;
  border-radius: 16px;
  padding: 30px;
  box-shadow: 0 6px 25px rgba(0,0,0,0.08);
  text-align: center;
  animation: fadeIn 0.4s ease-out;
  border: 1px solid #f1f1f1;
}

.login-logo {
  width: 200px;
  max-width: 100%;
  margin-bottom: 12px;
}

@media (max-width: 480px) {
  .login-card { padding: 22px; }
  h4 { font-size: 1.2rem; }
  .btn-login { padding: 10px; font-size: 15px; }
}

.form-control {
  border-radius: 10px;
  padding: 12px;
  border: 1px solid #dcdcdc;
  font-size: 15px;
}

.form-control:focus {
  border-color: #0d6efd;
  box-shadow: 0 0 0 2px rgba(13,110,253,0.15);
}

.btn-login {
  width: 100%;
  padding: 12px;
  border-radius: 10px;
  font-size: 16px;
  background: #0d6efd;
  color: white;
  font-weight: 600;
  transition: 0.2s;
}

.btn-login:hover {
  background: #0b5ed7;
  transform: translateY(-2px);
}

.error {
  color: #d9534f;
  font-size: 0.85rem;
  margin-top: 4px;
  text-align: left;
}
</style>
</head>

<body>
<div class="login-card">

  <img src="ANJUMA_LOGO.png" class="login-logo" alt="ANJUMA Logo">

  <h4 class="mb-3">Willkommen zurück</h4>

  <form action="" method="post">

    <div class="text-start mb-3">
      <label class="mb-1">Username</label>
      <input type="text" name="username" class="form-control"
             value="<?php echo htmlspecialchars($username, ENT_QUOTES, 'UTF-8'); ?>">
      <?php if (!empty($username_err)) echo "<div class='error'>".htmlspecialchars($username_err, ENT_QUOTES, 'UTF-8')."</div>"; ?>
    </div>

    <div class="text-start mb-2">
      <label class="mb-1">Passwort</label>
      <input type="password" name="password" class="form-control">
      <?php if (!empty($password_err)) echo "<div class='error'>".htmlspecialchars($password_err, ENT_QUOTES, 'UTF-8')."</div>"; ?>
    </div>

    <div class="form-check text-start mb-4">
        <input class="form-check-input" type="checkbox" name="remember" id="remember" value="1" checked>
        <label class="form-check-label" for="remember">Angemeldet bleiben</label>
    </div>

    <button type="submit" class="btn btn-login">Einloggen</button>

  </form>
</div>
</body>
</html>
