<?
php

header("Content-Type: text/plain; charset=UTF-8");

// Połączenie z bazą danych
require_once __DIR__ . "/db.php";

if (!isset($conn) || $conn->connect_error) {
    http_response_code(500);
    exit("server_error");
}

$conn->set_charset("utf8mb4");

// Funkcje osiągnięć
require_once __DIR__ . "/api/achievement_functions.php";

// Dane logowania
$username = trim($_POST["username"] ?? "");
$userPassword = $_POST["password"] ?? "";

if ($username === "" || $userPassword === "") {
    $conn->close();
    exit("missing_data");
}

// Pobieramy dane użytkownika
$sql = "SELECT id, username, password, role, ban_until
        FROM accounts
        WHERE username = ?
        LIMIT 1";

$stmt = $conn->prepare($sql);

if (!$stmt) {
    http_response_code(500);
    $conn->close();
    exit("server_error");
}

$stmt->bind_param("s", $username);
$stmt->execute();

$result = $stmt->get_result();

if ($result->num_rows !== 1) {

    echo "user_not_found";

} else {

    $row = $result->fetch_assoc();

    // Sprawdzamy hasło
    if (!password_verify($userPassword, $row["password"])) {

        echo "wrong_password";

    // Sprawdzamy blokadę konta
    } elseif (
        !empty($row["ban_until"]) &&
        strtotime($row["ban_until"]) > time()
    ) {

        echo "banned|" . $row["ban_until"];

    } else {

        // Generujemy token sesji
        $token = bin2hex(random_bytes(32));

        // Zapisujemy token na koncie
        $update = $conn->prepare(
            "UPDATE accounts
             SET session_token = ?
             WHERE id = ?"
        );

        if (!$update) {

            http_response_code(500);
            echo "server_error";

        } else {

            $update->bind_param("si", $token, $row["id"]);

            if ($update->execute()) {

                // Przyznajemy osiągnięcie pierwszego logowania
                grant_achievement(
                    $conn,
                    (int)$row["id"],
                    "first_login"
                );

                echo "success|"
                    . $row["role"] . "|"
                    . $row["id"] . "|"
                    . $token;

            } else {

                http_response_code(500);
                echo "server_error";
            }

            $update->close();
        }
    }
}

$stmt->close();
$conn->close();

?>