<?php

require_once __DIR__ . '/../connect.php';

$email = filterRequest('email');
$phone = filterRequest('phone');
$password = filterRequest('password');

if (empty($phone) && empty($email)) {
    echo json_encode(["status" => "Failure", "data" => "Phone or email is required."]);
    exit;
}

/**
 * البحث عن الحساب.
 *
 * سابقاً كان يقارن القيمة الخام بالعمود المشفّر مباشرةً، وهو ما ينجح فقط لأن
 * التشفير الحالي حتمي (CBC بـ IV ثابت). الفهرس الأعمى يجعل هذا الاستعلام
 * مستقلاً عن أسلوب التشفير، فلا ينكسر تسجيل الدخول عند الانتقال إلى AES-GCM.
 *
 * تُبقى المقارنتان القديمتان في نفس الشرط كاحتياط للحسابات التي لم تُفهرس بعد.
 */
global $blindIndex;

$conditions = [];
$params = [':password' => $password];

if (!empty($phone)) {
    $conditions[] = "passengers.phone = :phone";
    $params[':phone'] = $phone;

    $phoneBidx = $blindIndex ? $blindIndex->index('passengers.phone', $phone) : null;
    if ($phoneBidx) {
        $conditions[] = "passengers.phone_bidx = :phone_bidx";
        $params[':phone_bidx'] = $phoneBidx;
    }
}
if (!empty($email)) {
    $conditions[] = "passengers.email = :email";
    $params[':email'] = $email;

    $emailBidx = $blindIndex ? $blindIndex->index('passengers.email', $email) : null;
    if ($emailBidx) {
        $conditions[] = "passengers.email_bidx = :email_bidx";
        $params[':email_bidx'] = $emailBidx;
    }
}
$where = implode(' OR ', $conditions);

$sql = "SELECT
    passengers.`id`,
    passengers.`phone`,
    passengers.`email`,
    passengers.`password`,
    passengers.`gender`,
    passengers.`birthdate`,
    passengers.`site`,
    passengers.`first_name`,
    passengers.`last_name`,
    passengers.`education`,
    passengers.`employmentType`,
    passengers.`maritalStatus`,
    passengers.`created_at`,
    passengers.`updated_at`,
    email_verifications.verified
FROM
    `passengers`
LEFT JOIN email_verifications ON email_verifications.email = passengers.email
WHERE
    $where";
$stmt = $con->prepare($sql);
$stmt->execute($params);
$data = $stmt->fetchAll(PDO::FETCH_ASSOC);
$count = $stmt->rowCount();

if ($count > 0) {
    $stored_password = $data[0]['password'];
    if (password_verify($password, $stored_password)) {
        unset($data[0]['password']);
        echo json_encode([
            "status" => "success",
            "count" => $count,
            "data" => $data
        ]);
    } else {
        // The password is incorrect
        echo json_encode([
            "status" => "Failure",
            "data" => "Incorrect password."
        ]);
        // jsonError("Incorrect password.");
    }
    } else {
        echo json_encode([
                "status" => "Failure",
                "data" => "Invalid credentials."
            ]);
    }
$con = null;

?>