<?php
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST');
header('Access-Control-Allow-Headers: Content-Type');

session_start();

$host = 'localhost';
$db   = 'tallyras_mytaskapp';
$user = 'tallyras_adminSameer';
$pass = 'Sameer@123';

try {
    $pdo = new PDO("mysql:host=$host;dbname=$db;charset=utf8mb4", $user, $pass, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
    ]);
} catch (PDOException $e) {
    echo json_encode(['success' => false, 'message' => 'Database connection failed']);
    exit;
}

$action = $_GET['action'] ?? '';

// 1. REGISTER
if ($action === 'register') {
    $data = json_decode(file_get_contents('php://input'), true);

    $userId = trim($data['userId'] ?? '');
    $username = trim($data['username'] ?? '');
    $email = strtolower(trim($data['email'] ?? ''));
    $password = $data['password'] ?? '';

    if (empty($userId) || empty($username) || empty($email) || empty($password)) {
        echo json_encode(['success' => false, 'message' => 'Tamam fields bharna zaroori hai!']);
        exit;
    }

    if (!preg_match('/^[a-zA-Z0-9._%+-]+@gmail\.com$/', $email)) {
        echo json_encode(['success' => false, 'message' => 'Keval valid @gmail.com email hi allowed hai!']);
        exit;
    }

    $stmtEmail = $pdo->prepare("SELECT COUNT(*) FROM users WHERE email = ?");
    $stmtEmail->execute([$email]);
    if ($stmtEmail->fetchColumn() > 0) {
        echo json_encode(['success' => false, 'message' => 'Ye email pehle se registered hai!']);
        exit;
    }

    $stmtUser = $pdo->prepare("SELECT COUNT(*) FROM users WHERE user_id = ?");
    $stmtUser->execute([$userId]);
    
    if ($stmtUser->fetchColumn() > 0) {
        $suggestions = [];
        $chkStmt = $pdo->prepare("SELECT COUNT(*) FROM users WHERE user_id = ?");

        while (count($suggestions) < 3) {
            $randNum = rand(100, 999);
            $candidateId = $userId . $randNum;
            $chkStmt->execute([$candidateId]);
            
            if ($chkStmt->fetchColumn() == 0 && !in_array($candidateId, $suggestions)) {
                $suggestions[] = $candidateId;
            }
        }
        
        echo json_encode([
            'success' => false,
            'message' => 'User ID pehle se li ja chuki hai.',
            'suggestions' => $suggestions
        ], JSON_UNESCAPED_UNICODE);
        exit;
    }

    $hashedPassword = password_hash($password, PASSWORD_BCRYPT);
    $insertStmt = $pdo->prepare("INSERT INTO users (user_id, username, email, password) VALUES (?, ?, ?, ?)");
    $result = $insertStmt->execute([$userId, $username, $email, $hashedPassword]);

    if ($result) {
        echo json_encode(['success' => true, 'message' => 'Registration successful!']);
    } else {
        echo json_encode(['success' => false, 'message' => 'Registration fail ho gaya, kripya dobara koshish karein.']);
    }
    exit;
}

// 2. LOGIN
if ($action === 'login') {
    $data = json_decode(file_get_contents('php://input'), true);
    $identifier = trim($data['identifier'] ?? '');
    $password = $data['password'] ?? '';

    $stmt = $pdo->prepare("SELECT * FROM users WHERE user_id = ? OR email = ?");
    $stmt->execute([$identifier, $identifier]);
    $user = $stmt->fetch();

    if ($user && password_verify($password, $user['password'])) {
        $_SESSION['user'] = [
            'userId' => $user['user_id'],
            'username' => $user['username'],
            'email' => $user['email'],
            'about' => $user['about'] ?? ''
        ];
        echo json_encode(['success' => true, 'user' => $_SESSION['user']], JSON_UNESCAPED_UNICODE);
    } else {
        echo json_encode(['success' => false, 'message' => 'Galat User ID/Email ya Password!']);
    }
    exit;
}

// 3. LOGOUT
if ($action === 'logout') {
    session_destroy();
    echo json_encode(['success' => true]);
    exit;
}

// 4. GET USER DATA
if ($action === 'get_user_data') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'isLoggedIn' => false]);
        exit;
    }

    $userId = $_SESSION['user']['userId'];

    $stmt = $pdo->prepare("SELECT exam_name FROM user_preferences WHERE user_id = ?");
    $stmt->execute([$userId]);
    $prefs = $stmt->fetchAll(PDO::FETCH_COLUMN);

    $stmt = $pdo->prepare("SELECT upheading, topic, subtopic, test_name as testName, marks_scored as marksScored, total_marks as totalMarks, correct, incorrect, unattempted, total_questions as totalQuestions, DATE_FORMAT(created_at, '%d/%m/%Y') as date FROM test_reports WHERE user_id = ? ORDER BY id DESC");
    $stmt->execute([$userId]);
    $reports = $stmt->fetchAll();

    echo json_encode([
        'success' => true,
        'isLoggedIn' => true,
        'user' => $_SESSION['user'],
        'preferences' => $prefs,
        'reports' => $reports
    ], JSON_UNESCAPED_UNICODE);
    exit;
}

// 5. SAVE PREFERENCES
if ($action === 'save_preferences') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'message' => 'Unauthorized']);
        exit;
    }
    $userId = $_SESSION['user']['userId'];
    $data = json_decode(file_get_contents('php://input'), true);
    $prefs = $data['preferences'] ?? [];

    $pdo->prepare("DELETE FROM user_preferences WHERE user_id = ?")->execute([$userId]);
    $stmt = $pdo->prepare("INSERT INTO user_preferences (user_id, exam_name) VALUES (?, ?)");
    foreach ($prefs as $pref) {
        $stmt->execute([$userId, $pref]);
    }
    echo json_encode(['success' => true]);
    exit;
}

// 6. SAVE TEST REPORT
if ($action === 'save_report') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'message' => 'Unauthorized']);
        exit;
    }
    $userId = $_SESSION['user']['userId'];
    $data = json_decode(file_get_contents('php://input'), true);

    $stmt = $pdo->prepare("INSERT INTO test_reports (user_id, upheading, topic, subtopic, test_name, marks_scored, total_marks, correct, incorrect, unattempted, total_questions) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
    $stmt->execute([
        $userId,
        $data['upheading'] ?? '',
        $data['topic'] ?? '',
        $data['subtopic'] ?? '',
        $data['testName'] ?? '',
        $data['marksScored'] ?? 0,
        $data['totalMarks'] ?? 0,
        $data['correct'] ?? 0,
        $data['incorrect'] ?? 0,
        $data['unattempted'] ?? 0,
        $data['totalQuestions'] ?? 0
    ]);
    echo json_encode(['success' => true]);
    exit;
}

// 7. GET QUESTIONS
if ($action === 'get_questions') {
    try {
        $stmt = $pdo->query("SELECT id, UPheading, topic, subtopic, testName, question, options, correct FROM questions ORDER BY id DESC");
        $questions = $stmt->fetchAll();

        foreach ($questions as &$q) {
            if (is_string($q['options'])) {
                $q['options'] = json_decode($q['options'], true);
            }
        }

        echo json_encode(['status' => 'success', 'data' => $questions], JSON_UNESCAPED_UNICODE);
    } catch (Exception $e) {
        echo json_encode(['status' => 'error', 'message' => $e->getMessage()]);
    }
    exit;
}

// 8. CLEAR REPORTS
if ($action === 'clear_reports') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'message' => 'Unauthorized']);
        exit;
    }
    $userId = $_SESSION['user']['userId'];
    $pdo->prepare("DELETE FROM test_reports WHERE user_id = ?")->execute([$userId]);
    echo json_encode(['success' => true]);
    exit;
}

// 9. UPDATE PROFILE
if ($action === 'update_profile') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'message' => 'Unauthorized']);
        exit;
    }
    $userId = $_SESSION['user']['userId'];
    $data = json_decode(file_get_contents('php://input'), true);

    $stmt = $pdo->prepare("UPDATE users SET username = ?, about = ? WHERE user_id = ?");
    $stmt->execute([$data['username'] ?? '', $data['about'] ?? '', $userId]);
    
    $_SESSION['user']['username'] = $data['username'] ?? '';
    $_SESSION['user']['about'] = $data['about'] ?? '';

    echo json_encode(['success' => true, 'user' => $_SESSION['user']], JSON_UNESCAPED_UNICODE);
    exit;
}


// 9.1 CHANGE PASSWORD (Profile Page Password Change)
if ($action === 'change_password') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'message' => 'Unauthorized! Pehle login karein.']);
        exit;
    }

    $userId = $_SESSION['user']['userId'];
    $data = json_decode(file_get_contents('php://input'), true);

    $currentPassword = $data['currentPassword'] ?? '';
    $newPassword = $data['newPassword'] ?? '';

    if (empty($currentPassword) || empty($newPassword)) {
        echo json_encode(['success' => false, 'message' => 'Donon password fields bharna zaroori hai!']);
        exit;
    }

    // Current Password Verify karein
    $stmt = $pdo->prepare("SELECT password FROM users WHERE user_id = ?");
    $stmt->execute([$userId]);
    $user = $stmt->fetch();

    if ($user && password_verify($currentPassword, $user['password'])) {
        // Naya Password Hash karke update karein
        $hashedPassword = password_hash($newPassword, PASSWORD_BCRYPT);
        $updateStmt = $pdo->prepare("UPDATE users SET password = ? WHERE user_id = ?");
        $updateStmt->execute([$hashedPassword, $userId]);

        echo json_encode(['success' => true, 'message' => 'Password safaltapurvak badal diya gaya hai!']);
    } else {
        echo json_encode(['success' => false, 'message' => 'Aapka purana password galat hai!']);
    }
    exit;
}


// 10. SUBMIT PAYMENT
if ($action === 'submit_payment') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'message' => 'Pehle Login karein!']);
        exit;
    }

    $userId = $_SESSION['user']['userId'];
    $email = $_SESSION['user']['email'];
    $utr = trim($_POST['utr'] ?? '');
    $months = intval($_POST['months'] ?? 1);
    $amount = floatval($_POST['amount'] ?? 0);

    if (empty($utr) || $amount <= 0 || !isset($_FILES['proof_image'])) {
        echo json_encode(['success' => false, 'message' => 'Details aur proof upload karein.']);
        exit;
    }

    $uploadDir = 'uploads/payments/';
    if (!file_exists($uploadDir)) {
        mkdir($uploadDir, 0777, true);
    }

    $fileExt = strtolower(pathinfo($_FILES['proof_image']['name'], PATHINFO_EXTENSION));
    $allowedExts = ['jpg', 'jpeg', 'png', 'webp'];

    if (!in_array($fileExt, $allowedExts)) {
        echo json_encode(['success' => false, 'message' => 'Keval Image files allowed hain.']);
        exit;
    }

    $targetFile = $uploadDir . time() . '_' . rand(1000, 9999) . '.' . $fileExt;

    if (move_uploaded_file($_FILES['proof_image']['tmp_name'], $targetFile)) {
        $stmt = $pdo->prepare("INSERT INTO payments (user_id, email, utr, months, amount, proof_image, status) VALUES (?, ?, ?, ?, ?, ?, 'PENDING')");
        $stmt->execute([$userId, $email, $utr, $months, $amount, $targetFile]);
        echo json_encode(['success' => true, 'message' => 'Payment submit ho gaya! Admin approval ka wait karein.']);
    } else {
        echo json_encode(['success' => false, 'message' => 'Upload fail ho gaya. Folder permissions check karein.']);
    }
    exit;
}

// 11. GET PAYMENT STATUS
if ($action === 'get_payment_status') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'premiumStatus' => 'INACTIVE']);
        exit;
    }

    $userId = $_SESSION['user']['userId'];
    $stmt = $pdo->prepare("SELECT status, expiry_date FROM payments WHERE user_id = ? ORDER BY id DESC LIMIT 1");
    $stmt->execute([$userId]);
    $payment = $stmt->fetch();

    if ($payment) {
        $dbStatus = $payment['status'];
        $expiry = $payment['expiry_date'];
        
        if ($dbStatus === 'APPROVED' && $expiry && strtotime($expiry) > time()) {
            echo json_encode([
                'success' => true,
                'premiumStatus' => 'ACTIVE',
                'isPremium' => true,
                'expiryDate' => date("d M Y, h:i A", strtotime($expiry))
            ]);
            exit;
        }
    }
    
    echo json_encode([
        'success' => true,
        'premiumStatus' => 'INACTIVE',
        'isPremium' => false,
        'expiryDate' => null
    ]);
    exit;
}

// 12. VERIFY RAZORPAY PAYMENT
if ($action === 'verify_razorpay_payment') {
    if (!isset($_SESSION['user'])) {
        echo json_encode(['success' => false, 'message' => 'User logged in nahi hai!']);
        exit;
    }

    $data = json_decode(file_get_contents('php://input'), true);

    $paymentId = trim($data['razorpay_payment_id'] ?? '');
    $months = intval($data['months'] ?? 1);
    $amount = floatval($data['amount'] ?? 0);
    $userId = $_SESSION['user']['userId'];
    $email = $_SESSION['user']['email'];

    if (empty($paymentId) || $amount <= 0) {
        echo json_encode(['success' => false, 'message' => 'Invalid Payment Details!']);
        exit;
    }

    $expiryDate = date('Y-m-d H:i:s', strtotime("+$months months"));

    try {
        $stmt = $pdo->prepare("INSERT INTO payments (user_id, email, razorpay_payment_id, months, amount, status, expiry_date) VALUES (?, ?, ?, ?, ?, 'APPROVED', ?)");
        $result = $stmt->execute([$userId, $email, $paymentId, $months, $amount, $expiryDate]);

        if ($result) {
            echo json_encode([
                'success' => true, 
                'message' => 'Payment successful aur status APPROVED ho gaya!',
                'expiryDate' => $expiryDate
            ]);
        } else {
            echo json_encode(['success' => false, 'message' => 'Database me save nahi ho paya.']);
        }
    } catch (Exception $e) {
        echo json_encode(['success' => false, 'message' => 'Error: ' . $e->getMessage()]);
    }
    exit;
}


// 13. GET QR IMAGE
if ($action === 'get_qr_image') {
    try {
        $stmt = $pdo->query("SELECT qr_image FROM admin_settings ORDER BY id DESC LIMIT 1");
        $qr = $stmt->fetchColumn();
        
        if ($qr) {
            echo json_encode([
                'status' => 'success',
                'qr_url' => 'admin/uploads/' . $qr
            ]);
            exit;
        }
    } catch (Exception $e) {
        // Fallback code
    }

    $uploadDir = 'admin/uploads/';
    $files = glob($uploadDir . '*.{jpg,jpeg,png,webp}', GLOB_BRACE);

    if (!empty($files)) {
        usort($files, function($a, $b) {
            return filemtime($b) - filemtime($a);
        });
        echo json_encode([
            'status' => 'success',
            'qr_url' => $files[0]
        ]);
    } else {
        echo json_encode([
            'status' => 'error',
            'qr_url' => 'images/my_qr_code.png',
            'message' => 'No QR found in admin uploads'
        ]);
    }
    exit;
}


/*

// 13. GET QR IMAGE
if ($action === 'get_qr_image') {
    try {
        $stmt = $pdo->prepare("SELECT setting_value FROM system_settings WHERE setting_key = 'qr_image_path'");
        $stmt->execute();
        $qrPath = $stmt->fetchColumn();
        
        if ($qrPath) {
            echo json_encode([
                'status' => 'success',
                'qr_url' => $qrPath
            ]);
            exit;
        }
    } catch (Exception $e) {
        // Fallback below
    }

    $uploadDir = 'uploads/';
    $files = glob($uploadDir . '*.{jpg,jpeg,png,webp}', GLOB_BRACE);

    if (!empty($files)) {
        usort($files, function($a, $b) {
            return filemtime($b) - filemtime($a);
        });
        echo json_encode([
            'status' => 'success',
            'qr_url' => $files[0]
        ]);
    } else {
        echo json_encode([
            'status' => 'error',
            'qr_url' => '',
            'message' => 'No QR found'
        ]);
    }
    exit;
}*/

// 14. SAVE TIMER SETTING
if ($action === 'save_timer') {
    try {
        $data = json_decode(file_get_contents('php://input'), true);
        $duration = intval($data['duration'] ?? 5);

        $pdo->exec("CREATE TABLE IF NOT EXISTS system_settings (
            setting_key VARCHAR(100) PRIMARY KEY,
            setting_value TEXT
        )");

        $stmt = $pdo->prepare("INSERT INTO system_settings (setting_key, setting_value) 
                                VALUES ('test_duration', ?) 
                                ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)");
        
        if ($stmt->execute([$duration])) {
            echo json_encode(["status" => "success", "message" => "Timer successfully saved!"]);
        } else {
            echo json_encode(["status" => "error", "message" => "Database save failed"]);
        }
    } catch (Exception $e) {
        echo json_encode(["status" => "error", "message" => $e->getMessage()]);
    }
    exit;
}

// 15. GET TIMER SETTING
if ($action === 'get_timer') {
    try {
        $stmt = $pdo->prepare("SELECT setting_value FROM system_settings WHERE setting_key = 'test_duration'");
        $stmt->execute();
        $row = $stmt->fetch();

        if ($row) {
            echo json_encode(["status" => "success", "duration" => intval($row['setting_value'])]);
        } else {
            echo json_encode(["status" => "success", "duration" => 5]);
        }
    } catch (Exception $e) {
        echo json_encode(["status" => "error", "message" => $e->getMessage()]);
    }
    exit;
}

// DEFAULT FALLBACK
echo json_encode(['success' => false, 'message' => 'Invalid Action']);
?>