<?php
declare(strict_types=1);

require_once __DIR__ . '/helpers.php';
require_once __DIR__ . '/totp.php';

const LOGIN_MAX_FAILS = 5;           // per IP within the window: the IP is locked out
const LOGIN_MAX_FAILS_USER = 10;     // per username within the window: audited + shown to the owner (no lockout)
const LOGIN_WINDOW_MIN = 15;
const PRE_AUTH_TTL = 300;            // seconds between a correct password and the OTP step
const SESSION_IDLE_MIN = 30;
const SESSION_ABSOLUTE_HOURS = 8;
const SESSION_ROTATE_MIN = 15;
const PASSWORD_MIN = 10;

/** Short fingerprint of the password hash; a password change invalidates every other session. */
function password_fingerprint(string $hash): string
{
    return substr(hash('sha256', $hash), 0, 16);
}

function current_admin(): ?array
{
    start_session();
    $a = $_SESSION['admin'] ?? null;
    if (!$a) {
        return null;
    }
    $now = time();
    if ($now - ($_SESSION['seen'] ?? 0) > SESSION_IDLE_MIN * 60
        || $now - ($_SESSION['started'] ?? 0) > SESSION_ABSOLUTE_HOURS * 3600) {
        logout_admin();
        return null;
    }
    if ($now - ($_SESSION['rotated'] ?? 0) > SESSION_ROTATE_MIN * 60) {
        session_regenerate_id(true);
        $_SESSION['rotated'] = $now;
    }
    $_SESSION['seen'] = $now;
    return $a;
}

/**
 * Why a logged-in session is no longer valid, or null when it is: the account
 * may have been deactivated, its password changed, or it logged in elsewhere.
 */
/** The admin's current database row (read once per request). */
function admin_db_row(int $id, bool $fresh = false): ?array
{
    static $rows = [];
    if ($fresh || !array_key_exists($id, $rows)) {
        $st = db()->prepare('SELECT * FROM admins WHERE id = ?');
        $st->execute([$id]);
        $rows[$id] = $st->fetch() ?: null;
    }
    return $rows[$id];
}

function admin_session_problem(array $a): ?string
{
    $row = admin_db_row($a['id']);
    if (!$row || !(int)$row['is_active']) {
        return 'inactive';
    }
    if (!hash_equals((string)($_SESSION['pwv'] ?? ''), password_fingerprint($row['password_hash']))) {
        return 'password';
    }
    if (!hash_equals((string)($_SESSION['login_at'] ?? ''), (string)$row['last_login_at'])) {
        return 'elsewhere';   // one active session per account: the newest login wins
    }
    return null;
}

function require_admin(): array
{
    send_security_headers(true);
    $a = current_admin();
    if (!$a) {
        redirect(base_url('admin/login.php'));
    }
    if ($reason = admin_session_problem($a)) {
        logout_admin();
        redirect(base_url('admin/login.php?reason=' . $reason));
    }
    // Role and pending password change are read from the database on every
    // request, so a change by a super admin applies immediately.
    $row = admin_db_row($a['id']);
    $a['role'] = $row['role'] === 'super_admin' ? 'super_admin' : 'admin';
    $a['must_change'] = (int)$row['must_change_password'] === 1;
    return $a;
}

function is_super_admin(array $me): bool
{
    return ($me['role'] ?? '') === 'super_admin';
}

/**
 * Re-authentication before managing other admins: the acting admin types
 * their own password. Wrong answers count like failed logins (IP lockout).
 */
function reauth_ok(array $me, string $password): bool
{
    $row = admin_db_row($me['id'], true);
    $ok = $row && password_verify($password, $row['password_hash']);
    if (!$ok) {
        db()->prepare('INSERT INTO login_attempts (ip, username, success) VALUES (?,?,0)')
            ->execute([client_ip(), substr('reauth:' . $me['username'], 0, 50)]);
    }
    return $ok;
}

/**
 * The logged-in admin on a public page, or null. Never redirects, and never
 * starts a session for visitors who have no admin session cookie.
 */
function viewing_admin(): ?array
{
    if (empty($_COOKIE[SESSION_COOKIE])) {
        return null;
    }
    $a = current_admin();
    if ($a && admin_session_problem($a)) {
        logout_admin();
        return null;
    }
    return $a;
}

function admin_count(): int
{
    return (int)db()->query('SELECT COUNT(*) FROM admins')->fetchColumn();
}

/**
 * True when this IP has too many failures. There is deliberately no lockout
 * per username (anyone could lock an admin out by guessing on purpose); the
 * CAPTCHA and the OTP step slow down distributed guessing instead, and the
 * owner is told about failed attempts at the next login.
 */
function login_locked(): bool
{
    $st = db()->prepare('SELECT COUNT(*) FROM login_attempts WHERE ip = ? AND success = 0 AND created_at > (NOW() - INTERVAL ' . LOGIN_WINDOW_MIN . ' MINUTE)');
    $st->execute([client_ip()]);
    return (int)$st->fetchColumn() >= LOGIN_MAX_FAILS;
}

/** Failed password/OTP attempts recorded for a username since a moment (null = last 30 days). */
function failed_attempts_since(string $username, ?string $since): int
{
    $st = db()->prepare('SELECT COUNT(*) FROM login_attempts WHERE username IN (?, ?) AND success = 0 AND created_at > ?');
    $st->execute([substr($username, 0, 50), substr('otp:' . $username, 0, 50), $since ?: date('Y-m-d H:i:s', time() - 30 * 86400)]);
    return (int)$st->fetchColumn();
}

/** Keeps the attempts table small; called on login. */
function prune_login_attempts(): void
{
    if (random_int(1, 50) === 1) {
        db()->exec('DELETE FROM login_attempts WHERE created_at < (NOW() - INTERVAL 30 DAY)');
    }
}

/** Step 1 of the login: the admin row when username and password are right, else null. */
function verify_credentials(string $username, string $password): ?array
{
    $st = db()->prepare('SELECT * FROM admins WHERE username = ? AND is_active = 1');
    $st->execute([$username]);
    $row = $st->fetch();
    // Verify against a dummy hash when the user does not exist to keep timing similar.
    static $dummy = null;
    if ($dummy === null) {
        $dummy = password_hash(bin2hex(random_bytes(8)), PASSWORD_DEFAULT);
    }
    prune_login_attempts();
    $ok = password_verify($password, $row['password_hash'] ?? $dummy) && $row;
    db()->prepare('INSERT INTO login_attempts (ip, username, success) VALUES (?,?,?)')
        ->execute([client_ip(), substr($username, 0, 50), $ok ? 1 : 0]);
    if (!$ok) {
        // A burst of failures on one username is recorded for the admins (no lockout, see login_locked()).
        if (failed_attempts_since($username, date('Y-m-d H:i:s', time() - LOGIN_WINDOW_MIN * 60)) === LOGIN_MAX_FAILS_USER) {
            db()->prepare("INSERT INTO audit_log (action, summary, ip) VALUES ('login.suspicious', ?, ?)")
                ->execute(['Percobaan login gagal beruntun untuk username ' . substr($username, 0, 50), client_ip()]);
        }
        return null;
    }
    if (password_needs_rehash($row['password_hash'], PASSWORD_DEFAULT)) {
        $row['password_hash'] = password_hash($password, PASSWORD_DEFAULT);
        db()->prepare('UPDATE admins SET password_hash = ? WHERE id = ?')->execute([$row['password_hash'], $row['id']]);
    }
    return $row;
}

/**
 * After a correct password the admin is NOT logged in yet: the session only
 * remembers who passed step 1. Mode 'verify' asks for the OTP code, mode
 * 'enroll' sets up the authenticator first (2FA is mandatory).
 */
function begin_second_factor(array $row): void
{
    start_session();
    session_regenerate_id(true);
    $_SESSION['pre_auth'] = [
        'id'   => (int)$row['id'],
        'mode' => (int)$row['otp_enabled'] === 1 ? 'verify' : 'enroll',
        'exp'  => time() + PRE_AUTH_TTL,
    ];
}

/** [admin row, mode] of a login waiting for its second factor, or null. */
function pending_login(): ?array
{
    start_session();
    $p = $_SESSION['pre_auth'] ?? null;
    if (!$p || time() > $p['exp']) {
        unset($_SESSION['pre_auth']);
        return null;
    }
    $row = admin_db_row($p['id'], true);
    if (!$row || !(int)$row['is_active']) {
        unset($_SESSION['pre_auth']);
        return null;
    }
    return [$row, $p['mode']];
}

/** Wrong OTP codes for this username within the window. */
function otp_failures(string $username): int
{
    $st = db()->prepare('SELECT COUNT(*) FROM login_attempts WHERE username = ? AND success = 0 AND created_at > (NOW() - INTERVAL ' . LOGIN_WINDOW_MIN . ' MINUTE)');
    $st->execute([substr('otp:' . $username, 0, 50)]);
    return (int)$st->fetchColumn();
}

function record_otp_attempt(string $username, bool $ok): void
{
    db()->prepare('INSERT INTO login_attempts (ip, username, success) VALUES (?,?,?)')
        ->execute([client_ip(), substr('otp:' . $username, 0, 50), $ok ? 1 : 0]);
}

/** Final step: creates the admin session after password + second factor. */
function complete_login(array $row, string $method): void
{
    unset($_SESSION['pre_auth']);
    $failed = failed_attempts_since($row['username'], $row['last_login_at']);
    // The login time doubles as the session marker: any later login on another
    // device changes it and ends this session (see require_admin()).
    $row['last_login_at'] = date('Y-m-d H:i:s');
    db()->prepare('UPDATE admins SET last_login_at = ? WHERE id = ?')->execute([$row['last_login_at'], $row['id']]);
    login_admin($row);
    audit('login', 'Masuk ke halaman admin (' . $method . ')');
    if ($failed > 0) {
        flash('info', "Ada $failed percobaan login gagal pada akun Anda sejak login terakhir. Bila itu bukan Anda, segera ganti password dan hubungi super admin.");
    }
}

function login_admin(array $row): void
{
    start_session();
    session_regenerate_id(true);
    $_SESSION['admin'] = ['id' => (int)$row['id'], 'username' => $row['username'], 'name' => $row['full_name']];
    $_SESSION['pwv'] = password_fingerprint($row['password_hash']);
    $_SESSION['login_at'] = (string)$row['last_login_at'];
    $_SESSION['seen'] = $_SESSION['started'] = $_SESSION['rotated'] = time();
    unset($_SESSION['csrf']);   // fresh CSRF token for the authenticated session
}

function logout_admin(): void
{
    start_session();
    $_SESSION = [];
    if (ini_get('session.use_cookies')) {
        $p = session_get_cookie_params();
        setcookie(session_name(), '', time() - 3600, $p['path'], $p['domain'] ?? '', (bool)$p['secure'], true);
    }
    session_destroy();
}

/** Returns an error message or null. */
function validate_new_admin(string $username, string $name, string $password, string $confirm): ?string
{
    if (!preg_match('/^[a-z0-9._-]{3,50}$/', $username)) {
        return 'Username 3–50 karakter: huruf kecil, angka, titik, minus, atau garis bawah.';
    }
    if (trim($name) === '' || mb_strlen($name) > 120 || preg_match('/[[:cntrl:]<>]/u', $name)) {
        return 'Nama lengkap wajib diisi, maksimal 120 karakter, tanpa karakter khusus < >.';
    }
    return validate_password($password, $confirm, $username);
}

function validate_password(string $password, string $confirm, string $username = ''): ?string
{
    if (mb_strlen($password) < PASSWORD_MIN || strlen($password) > 72) {
        return 'Password ' . PASSWORD_MIN . '–72 karakter.';
    }
    if (!preg_match('/[A-Za-z]/', $password) || !preg_match('/\d/', $password) || !preg_match('/[^A-Za-z\d]/', $password)) {
        return 'Password harus berisi huruf, angka, dan simbol.';
    }
    if ($username !== '' && stripos($password, $username) !== false) {
        return 'Password tidak boleh memuat username.';
    }
    if ($password !== $confirm) {
        return 'Konfirmasi password tidak sama.';
    }
    return null;
}