<?php
// loginWalletAdmin.php (Modified for Intaleq Admin Integration)
require_once realpath(__DIR__ . '/../vendor/autoload.php');
require_once 'load_env.php';
$env_file = '/home/intaleq-wallet/env/.env';
loadEnvironment($env_file);

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

include "functions.php";

// --- استدعاء المفاتيح ---
$secretKey = getenv('SECRET_KEY');
$allowed1 = getenv('allowedWallet1');
$allowed2 = getenv('allowedWallet2');
$passwordnewpassenger = getenv('passwordnewpassenger');
$issuer = 'Tripz-Wallet';  
$allowedAudiences = array_filter([$allowed1, $allowed2]);

// --- إعداد رؤوس CORS ---
header('Content-Type: application/json');
header("Access-Control-Allow-Origin: https://walletintaleq.intaleq.xyz"); // Wallet admin only
header("Access-Control-Allow-Methods: POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Device-FP");

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

// --- التحقق من المفاتيح ---
if (empty($secretKey) || empty($passwordnewpassenger) || empty($allowedAudiences)) {
    http_response_code(500);
    die(json_encode(['error' => 'Server configuration error']));
}

try {
    $id = filterRequest('id') ?? '';
    $password = filterRequest('password') ?? '';
    $audience = filterRequest('aud') ?? '';
    $fingerPrint = filterRequest('fingerPrint');

    if (empty($id) || empty($password) || empty($audience) || empty($fingerPrint)) {
        http_response_code(400);
        die(json_encode(['error' => 'Missing required parameters.']));
    }

    if (!in_array($audience, $allowedAudiences)) {
        http_response_code(403);
        die(json_encode(['error' => 'Invalid audience']));
    }

    // --- الاتصال بقاعدة البيانات ---
    $dbname = getenv('DB_PAYMENT_NAME') ?: (getenv('dbname') ?: 'payment');
    $dbHost = getenv('DB_PAYMENT_HOST') ?: (getenv('DB_HOST') ?: 'mysql');
    $dsn = "mysql:host=$dbHost;dbname=$dbname;charset=utf8mb4";
    $dbuser = getenv('DB_PAYMENT_USER') ?: (getenv('USER') ?: 'root');
    $dbpass = getenv('DB_PAYMENT_PASS') ?: (getenv('PASS') ?: getenv('MYSQL_ROOT_PASSWORD'));

    $con = new PDO($dsn, $dbuser, $dbpass, [
        PDO::ATTR_EMULATE_PREPARES => false,
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
    ]);

    // --- التحقق من الهوية ---
    // تعديل: البحث باستخدام المعرف (id) أو البصمة (fingerprint)
    $stmt = $con->prepare("SELECT * FROM `adminUser` WHERE `username` = ? OR `device_number` = ? LIMIT 1");
    $stmt->execute([$id, $fingerPrint]);
    $user = $stmt->fetch();

    if (!$user) {
        // ⚠️ CRIT-01 FIX: إزالة backdoor الدخول بكلمة سر plaintext
        // لا يمكن الدخول إلا عبر مستخدمين مسجلين في قاعدة البيانات
        http_response_code(403);
        echo json_encode(['error' => 'User not found']);
        exit;
    }

    // التحقق من كلمة السر باستخدام password_verify (آمن)
    if (!password_verify($password, $user['password'])) {
        http_response_code(403);
        echo json_encode(['error' => 'Invalid credentials']);
        exit;
    }

    // --- إنشاء JWT ---
    $payload = [
        'user_id'     => $id,
        'fingerPrint' => $fingerPrint,
        'exp'         => time() + 3600, // زيادة وقت الصلاحية لـ ساعة
        'iat'         => time(),
        'iss'         => $issuer,
        'aud'         => $audience
    ];

    $jwt  = JWT::encode($payload, $secretKey, 'HS256');
    $hmac = hash_hmac('sha256', $id, getenv('SECRET_KEY_HMAC'));

    echo json_encode([
        'status'     => 'success',
        'jwt'        => $jwt,
        'hmac'       => $hmac,
        'expires_in' => 3600
    ]);
    http_response_code(200);

} catch (Exception $e) {
    // HIGH-05 FIX: لا تكشف رسائل الخطأ التفصيلية
    error_log('[loginWalletAdmin] Error: ' . $e->getMessage());
    http_response_code(500);
    echo json_encode(['error' => 'An internal error occurred. Please try again later.']);
}