<?php
// app/Controllers/AuthController.php

class AuthController {
    public function showLogin() {
        if (isset($_SESSION['user_id'])) {
            $this->redirect($_SESSION['role']);
        }
        require_once 'app/Views/auth/login.php';
    }

    public function login() {
        $email    = $_POST['email'] ?? '';
        $password = $_POST['password'] ?? '';

        $db   = getDB();
        $stmt = $db->prepare('SELECT * FROM users WHERE email = ? LIMIT 1');
        $stmt->execute([$email]);
        $user = $stmt->fetch();

        if ($user && password_verify($password, $user['password'])) {
            if ($user['status'] !== 'active') {
                $_SESSION['error'] = 'Account is not active.';
                header('Location: /login'); exit;
            }

            // Enforce staff limits on login
            if ($user['restaurant_id'] && !FeatureGate::isUserAllowed($user['id'], $user['restaurant_id'], $user['role'])) {
                $_SESSION['error'] = 'Login suspended. This user account exceeds your subscription package limits. Please contact your restaurant administrator.';
                header('Location: /login'); exit;
            }

            $_SESSION['user_id']       = $user['id'];
            $_SESSION['role']          = $user['role'];
            $_SESSION['restaurant_id'] = $user['restaurant_id'];
            $_SESSION['name']          = $user['name'];
            $_SESSION['email']         = $user['email'];
            $_SESSION['phone']         = $user['phone'] ?? '';
            $_SESSION['currency']      = $user['currency'] ?? '$';
            $_SESSION['logo']          = $user['logo'] ?? '';

            if ($user['restaurant_id']) {
                $rStmt = $db->prepare('SELECT name, status, currency FROM restaurants WHERE id = ?');
                $rStmt->execute([$user['restaurant_id']]);
                $restaurant = $rStmt->fetch();

                if (!$restaurant || $restaurant['status'] !== 'active') {
                    $_SESSION['error'] = 'Restaurant account is suspended or inactive.';
                    header('Location: /login'); exit;
                }
                $_SESSION['restaurant_name'] = $restaurant['name'];
                $_SESSION['currency']        = $restaurant['currency'] ?? '$';
            }

            $this->redirect($user['role']);
        } else {
            $_SESSION['error'] = 'Invalid email or password.';
            header('Location: /login'); exit;
        }
    }

    private function redirect($role) {
        $map = [
            'superadmin' => '/superadmin/dashboard',
            'admin'      => '/admin/dashboard',
            'cashier'    => '/pos',
            'waiter'     => '/waiter',
            'kitchen'    => '/kitchen',
            'inventory'  => '/inventory',
            'hr_manager' => '/hr',
        ];
        header('Location: ' . ($map[$role] ?? '/login'));
        exit;
    }

    public function logout() {
        session_destroy();
        header('Location: /login'); exit;
    }
}
