<?php
// ============================================================
// loginUsingCredentialsWithoutGoogle.php
// مخصص لدخول الفاحصين (Testers) بالإيميل والباسورد
// ============================================================

require_once __DIR__ . '/../../core/bootstrap.php';

$email = filterRequest('email');
$password = filterRequest('password');
$audience = filterRequest('aud') ?? 'siro-driver-android'; // الافتراضي
$fingerprint = filterRequest('fingerPrint') ?? filterRequest('fingerprint');

// 1. حد معدل الطلبات مطبّق على الجميع (الحد مرفوع إلى 30/دقيقة في RateLimiter)
$rateLimiter = new RateLimiter($redis);
$rateLimiter->enforce(RateLimiter::identifier(), 'tester_login');

// 2. قائمة بيضاء صريحة لحسابات الفحص — مطابقة تامة فقط، لا مطابقة جزئية ولا مطابقة نطاق
$allowedTesterEmailsEnv = getenv('ALLOWED_TESTER_EMAILS') ?: ($_ENV['ALLOWED_TESTER_EMAILS'] ?? '');
$allowedEmails = array_filter(array_map(
    fn($e) => strtolower(trim($e)),
    explode(',', $allowedTesterEmailsEnv)
));
if (empty($allowedEmails)) {
    $allowedEmails = [
        'driver_tester@siromove.com',
        'passenger_tester@siromove.com',
    ];
}

$cleanEmail = strtolower(trim((string) $email));
$isTester = in_array($cleanEmail, $allowedEmails, true);

if (!$email || !$password) {
    echo json_encode(["status" => "failure", "message" => "Email and password are required"]);
    exit();
}

try {
    $con = Database::get('main');
    
    $encryptedEmail = $encryptionHelper->encryptData($email);
    global $blindIndex;
    $emailBidx = $blindIndex ? $blindIndex->index('driver.email', $email) : null;

    $sql = "SELECT
        driver.*,
        phone_verification.is_verified,
        CarRegistration.make,
        CarRegistration.model,
        CarRegistration.year
    FROM driver
    LEFT JOIN phone_verification ON phone_verification.phone_number = driver.phone_key
    LEFT JOIN CarRegistration ON CarRegistration.driverID = driver.id
    WHERE
        driver.email = :email OR (:email_bidx IS NOT NULL AND driver.email_bidx = :email_bidx)
    LIMIT 1";

    $stmt = $con->prepare($sql);
    $stmt->execute([':email' => $encryptedEmail, ':email_bidx' => $emailBidx]);

    $data = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($data) {
        $isTestInDb = (isset($data['is_test']) && $data['is_test'] == 1) || (isset($data['isTest']) && $data['isTest'] == 1);
        if (!$isTestInDb && !$isTester) {
            jsonError("Access denied. Not a tester account.");
            exit();
        }

        if (password_verify($password, $data['password'] ?? '')) {
            unset($data['password']);

            if(isset($data['phone'])) $data['phone'] = $encryptionHelper->decryptData($data['phone']);
            if(isset($data['email'])) $data['email'] = $encryptionHelper->decryptData($data['email']);
            if(isset($data['gender'])) $data['gender'] = $encryptionHelper->decryptData($data['gender']);
            if(isset($data['birthdate'])) $data['birthdate'] = $encryptionHelper->decryptData($data['birthdate']);
            if(isset($data['site'])) $data['site'] = $encryptionHelper->decryptData($data['site']);
            if(isset($data['first_name'])) $data['first_name'] = $encryptionHelper->decryptData($data['first_name']);
            if(isset($data['last_name'])) $data['last_name'] = $encryptionHelper->decryptData($data['last_name']);

            $jwtService = new JwtService($redis);
            $jwt = $jwtService->generateAccessToken($data['id'], 'tester', $audience, $fingerprint);

            echo json_encode([
                "status" => "success",
                "jwt" => $jwt,
                "data" => [$data]
            ], JSON_UNESCAPED_UNICODE);
        } else {
            jsonError("Incorrect password.");
        }
    } else {
        jsonError("User does not exist.");
    }
} catch (Throwable $e) {
    error_log("[Tester Login Error] " . $e->getMessage() . " in " . $e->getFile() . ":" . $e->getLine());
    jsonError("Server error occurred.");
} finally {
    $stmt = null;
    $con = null;
}
exit();
?>