<?php
require_once '../config.php';

if (isset($_POST['login_user'])) {

    $uid = mysqli_real_escape_string($db, $_POST['user_id']);
    $password = mysqli_real_escape_string($db, $_POST['password']);

    $user_q = mysqli_query($db, "SELECT * FROM `users` WHERE COALESCE(working_status, '')='' AND (`email`='$uid' OR `employee_id`='$uid') ");
    $user_count = mysqli_num_rows($user_q);

    if ($user_count > 0) {

        $user = mysqli_fetch_assoc($user_q);

        $check = password_verify($password, $user['password']);

        if ($check) {
            $_SESSION['user_id'] = $user['id'];
            $_SESSION['user_role'] = $user['role'];
            $_SESSION['user_name'] = $user['name'];
            $_SESSION['user_email'] = $user['email'];
            $_SESSION['emp_id'] = $user['employee_id'];
            $_SESSION['image'] = $user['image'];
            $_SESSION['hash_email'] = $user['hash_email'];

            $token = bin2hex(random_bytes(32)); // Generate a secure token
            $hashed_token = hash('sha256', $token); // Hash the token
            
            mysqli_query($db, "UPDATE users SET remember_token='$hashed_token', last_login_time=NOW() WHERE email='$user[email]' ");
            setcookie('RememberMe', $hashed_token, time() + 86400 * 2, "/");

            echo "<script>location.href='../myProfile';</script>";
        } else {
            echo "<script>alert('User or Password are Invalid !');</script>";
            // echo "<script>location.href='../index.php';</script>";
        }
    } else {
        echo "<script>alert('User Not Exist !');</script>";
    }
    echo "<script>location.href='../index';</script>";
}


if (isset($_POST['resetPassword'])) {

    $eid = mysqli_real_escape_string($db, $_POST['employee_id']);
    $key = mysqli_real_escape_string($db, $_POST['resetKey']);

    $reset = mysqli_num_rows(mysqli_query($db, "SELECT * FROM `reset_password_key` WHERE `key`='$key' "));

    if ($reset > 0) {

        $password = mysqli_real_escape_string($db, $_POST['password']);
        $cPassword = mysqli_real_escape_string($db, $_POST['cPassword']);

        if ($password == $cPassword) {
            $pass = password_hash($password, PASSWORD_BCRYPT);

            $q = mysqli_query($db, "update users set password='$pass' where employee_id='$eid' ");

            if ($q) {
                echo "<script>alert('Password Reset Successfully !');</script>";

                $delete = mysqli_query($db, "DELETE FROM `reset_password_key` WHERE `key`='$key' ");
                if ($delete) {
                    echo "<script>location.href='../index';</script>";
                } else {
                    echo mysqli_error($db);
                }
            } else {
                echo mysqli_error($db);
            }
        } else {
            echo "<script>alert('Passwords Should be Same !');</script>";
            echo "<script>location.href='../resetPassword?key=$key';</script>";
        }
    } else {
        echo "<script>alert('Invalid reset Link !');</script>";
        echo "<script>location.href='../resetPassword';</script>";
    }
}
