<?php
// ============================================================
// loginUsingCredentialsWithoutGoogle.php
// مخصص لدخول الفاحصين (Testers) بالإيميل والباسورد
// ============================================================

require_once __DIR__ . '/../../core/bootstrap.php';

$email = filterRequest('email');
$password = filterRequest('password');
$audience = filterRequest('aud') ?? 'siro-driver-android'; // الافتراضي
$fingerprint = filterRequest('fingerPrint') ?? filterRequest('fingerprint');

// 1. تطبيق حد معدل الطلبات (Rate Limiting) للفاحصين: 3 محاولات بالدقيقة لكل IP
$rateLimiter = new RateLimiter($redis);
$rateLimiter->enforce(RateLimiter::identifier(), 'tester_login');

if (!$email || !$password) {
    echo json_encode(["status" => "failure", "message" => "Email and password are required"]);
    exit();
}

// 2. التحقق من أن الحساب مخصص للفحص فقط (isTest check)
$allowedTesterEmailsEnv = getenv('ALLOWED_TESTER_EMAILS') ?: '';
$allowedEmails = array_filter(array_map('trim', explode(',', $allowedTesterEmailsEnv)));
if (empty($allowedEmails)) {
    $allowedEmails = [
        'driver_tester@siromove.com',
        'passenger_tester@siromove.com',
    ];
}

$cleanEmail = strtolower(trim($email));
$isTester = in_array($cleanEmail, $allowedEmails) || 
            substr($cleanEmail, -13) === '@siromove.com' ||
            str_contains($cleanEmail, 'tester') ||
            str_contains($cleanEmail, 'reviewer');

// تشفير الإيميل لاستخدامه في الاستعلام
$encryptedEmail = $encryptionHelper->encryptData($email);

try {
    $con = Database::get('main');

    // Auto-seed/create tester driver if it doesn't exist
    if ($cleanEmail === 'driver_tester@siromove.com') {
        $stmtCheck = $con->prepare("SELECT id FROM driver WHERE email = :email LIMIT 1");
        $stmtCheck->bindParam(':email', $encryptedEmail);
        $stmtCheck->execute();
        if (!$stmtCheck->fetch()) {
            $driverId = 'tester_driver_id_2026';
            $phone = '+962790000002';
            $hashedPassword = password_hash('SiroDriver2026!', PASSWORD_DEFAULT);

            $encryptedPhone = $encryptionHelper->encryptData($phone);
            $encryptedFirstName = $encryptionHelper->encryptData('Driver');
            $encryptedLastName = $encryptionHelper->encryptData('Tester');
            $encryptedGender = $encryptionHelper->encryptData('Male');
            $encryptedBirthdate = $encryptionHelper->encryptData('1990-01-01');
            $encryptedSite = $encryptionHelper->encryptData('Jordan');

            // Insert driver
            $insert = $con->prepare("INSERT INTO driver (id, phone, email, password, gender, birthdate, site, first_name, last_name) 
                VALUES (:id, :phone, :email, :password, :gender, :birthdate, :site, :first_name, :last_name)");
            $insert->execute([
                ':id' => $driverId,
                ':phone' => $encryptedPhone,
                ':email' => $encryptedEmail,
                ':password' => $hashedPassword,
                ':gender' => $encryptedGender,
                ':birthdate' => $encryptedBirthdate,
                ':site' => $encryptedSite,
                ':first_name' => $encryptedFirstName,
                ':last_name' => $encryptedLastName
            ]);

            // Ensure phone_verification row exists
            $stmtPhone = $con->prepare("SELECT * FROM phone_verification WHERE phone_number = :phone LIMIT 1");
            $stmtPhone->bindParam(':phone', $encryptedPhone);
            $stmtPhone->execute();
            if (!$stmtPhone->fetch()) {
                $insertPhone = $con->prepare("INSERT INTO phone_verification (phone_number, is_verified) VALUES (:phone, 1)");
                $insertPhone->bindParam(':phone', $encryptedPhone);
                $insertPhone->execute();
            } else {
                $updatePhone = $con->prepare("UPDATE phone_verification SET is_verified = 1 WHERE phone_number = :phone");
                $updatePhone->bindParam(':phone', $encryptedPhone);
                $updatePhone->execute();
            }

            // Ensure CarRegistration row exists
            $stmtCar = $con->prepare("SELECT * FROM CarRegistration WHERE driverID = :driverID LIMIT 1");
            $stmtCar->bindParam(':driverID', $driverId);
            $stmtCar->execute();
            if (!$stmtCar->fetch()) {
                $insertCar = $con->prepare("INSERT INTO CarRegistration (driverID, vin, car_plate, make, model, year, expiration_date, color, owner, color_hex, fuel) 
                    VALUES (:driverID, :vin, :car_plate, 'Toyota', 'Prius', 2020, '2030-01-01', 'White', :owner, '#FFFFFF', 'Petrol')");
                $encryptedVin = $encryptionHelper->encryptData('TESTVIN1234567890');
                $encryptedPlate = $encryptionHelper->encryptData('155186');
                $encryptedOwner = $encryptionHelper->encryptData('Driver Tester');
                $insertCar->execute([
                    ':driverID' => $driverId,
                    ':vin' => $encryptedVin,
                    ':car_plate' => $encryptedPlate,
                    ':owner' => $encryptedOwner
                ]);
            } else {
                $updateCar = $con->prepare("UPDATE CarRegistration SET make = 'Toyota', model = 'Prius', year = 2020 WHERE driverID = :driverID");
                $updateCar->bindParam(':driverID', $driverId);
                $updateCar->execute();
            }
        }
    }
    
    // SQL لاسترجاع المستخدم بناءً على البريد الإلكتروني المشفر
    $sql = "SELECT
        driver.*,
        phone_verification.is_verified,
        CarRegistration.make,
        CarRegistration.model,
        CarRegistration.year
    FROM driver
    LEFT JOIN phone_verification ON phone_verification.phone_number = driver.phone
    LEFT JOIN CarRegistration ON CarRegistration.driverID = driver.id
    WHERE
        driver.email = :email
    LIMIT 1";

    $stmt = $con->prepare($sql);
    $stmt->bindParam(':email', $encryptedEmail);
    $stmt->execute();

    $data = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($data) {
        // التحقق من أن الحساب معلم كحساب فحص في قاعدة البيانات أو البيئة
        $isTestInDb = (isset($data['is_test']) && $data['is_test'] == 1) || (isset($data['isTest']) && $data['isTest'] == 1);
        if (!$isTestInDb && !$isTester) {
            jsonError("Access denied. Not a tester account.");
            exit();
        }
        // فحص الباسورد (في نظامنا، يمكن أن يكون الباسورد هو HMAC أو نص عادي للفاحصين)
        // لنفترض أن الفاحص له باسورد عادي أو مشفر بـ bcrypt
        if (password_verify($password, $data['password']) || $password === $data['password']) {
            unset($data['password']);

            // فك تشفير الحقول الحساسة
            $data['phone'] = $encryptionHelper->decryptData($data['phone']);
            $data['email'] = $encryptionHelper->decryptData($data['email']);
            $data['gender'] = $encryptionHelper->decryptData($data['gender']);
            $data['birthdate'] = $encryptionHelper->decryptData($data['birthdate']);
            $data['site'] = $encryptionHelper->decryptData($data['site']);
            $data['first_name'] = $encryptionHelper->decryptData($data['first_name']);
            $data['last_name'] = $encryptionHelper->decryptData($data['last_name']);
            if(isset($data['employmentType'])) $data['employmentType'] = $encryptionHelper->decryptData($data['employmentType']);
            if(isset($data['maritalStatus'])) $data['maritalStatus'] = $encryptionHelper->decryptData($data['maritalStatus']);

            // توليد الـ JWT بصلاحية (tester) لتميزهم عن السائقين الفعليين
            $jwtService = new JwtService($redis);
            $jwt = $jwtService->generateAccessToken($data['id'], 'tester', $audience, $fingerprint);

            echo json_encode([
                "status" => "success",
                "jwt" => $jwt,
                "data" => [$data] // مطابق لنسق التطبيق الذي يتوقع مصفوفة
            ], JSON_UNESCAPED_UNICODE);
        } else {
            jsonError("Incorrect password.");
        }
    } else {
        jsonError("User does not exist.");
    }
} catch (Exception $e) {
    error_log("[Tester Login Error] " . $e->getMessage());
    jsonError("Server error occurred.");
} finally {
    $stmt = null;
    $con = null;
}
exit();
?>