<?php

namespace App\Filters;

use App\Helpers\JWTToken;
use App\Models\EmployeeModel;
use App\Models\LevelContactModel;
use App\Filters\Cors;
use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use ReflectionClass;

require_once('../vendor/autoload.php');


class AuthJWT implements FilterInterface
{
    protected Cors $corsFilter;

    public function __construct()
    {
        $this->corsFilter  = new Cors();
    }

    // public function before(RequestInterface $request, $arguments = null)
    // {
    //     $jwt = $request->getHeaderLine('Authorization');

    //     if ($jwt) {
    //         if (JWTToken::validateJWT($jwt)) {
    //             $data = JWTToken::validateJWT($jwt);
    //             $data = json_decode($data);
                
    //             $id = $data->decoded->id; 
    //             if(isset($data->decoded->emp_code)){
    //                 $model = new EmployeeModel();
    //                 $user_data = $model->where('id', $id)->first();

    //                 if($user_data['token_time_out'] > time()){     
    //                     $data =["token_time_out" => time() + getenv('TOKENTIMEOUT') ];
    //                     $model->update($id, $data);
    //                     return true;
    //                 }else{

    //                     // if($user_data['token_time_out'] != "" && $user_data['token_time_out'] != NULL)
                            
    //                     $data =["token_time_out" => ''];
    //                     $model->update($id, $data);
    //                     header('Content-Type: application/json');
    //                     http_response_code(401);
    //                     // $error = json_encode(["status" => 401, "message" => $data->message]);
    //                     $error = json_encode(["status" => 401, "message" => "Token is Invalid"]);
    //                     echo $error;
    //                     exit;
    //                 }
    //             }else{
    //                 $model = new LevelContactModel();
    //                 $hr_data = $model->where('id', $id)->first();

    //                 if($hr_data['token_time_out'] > time()){     
    //                     $data =["token_time_out" => time() + getenv('TOKENTIMEOUT') ];
    //                     $model->update($id, $data);
    //                     return true;
    //                 }else{
    //                     $data =["token_time_out" => ''];
    //                     $model->update($id, $data);
    //                     header('Content-Type: application/json');
    //                     http_response_code(401);
    //                     // $error = json_encode(["status" => 401, "message" => $data->message]);
    //                     $error = json_encode(["status" => 401, "message" => "Token is Invalid"]);
    //                     echo $error;
    //                     exit;
    //                 }
    //             }
                
    //         }
    //     } else {
    //         header('Content-Type: application/json');
    //         http_response_code(403);
    //         $error = json_encode(["status" => 403, "message" => "Access Forbidden!"]);
    //         echo $error;
    //         exit();
    //     }
    // }

    public function before(RequestInterface $request, $arguments = null)
    {
        $authHeader = $request->getHeaderLine('Authorization');

        if (!$authHeader) {
            return $this->reject($request, 403, 'Access Forbidden');
        }

        $result = JWTToken::validateJWT($authHeader);

        if ($result['status'] !== true) {
            return $this->reject($request, 401, $result['message']);
        }

        $decoded = $result['decoded'];
        $id      = $decoded['id'] ?? null;

        if (!$id) {
            return $this->reject($request, 401, 'Invalid token payload');
        }

        if (isset($decoded['emp_code'])) {
            $model = new EmployeeModel();
        } else {
            $model = new LevelContactModel();
            $id    = $decoded['pre_hr_id'] ?? null;
        }

        $user = $model->find($id);

        if (!$user || $user['token_time_out'] <= time()) {
            $model->update($id, ['token_time_out' => null]);
            // print_r('Token expired'); die();
            return $this->reject($request, 401, 'Token expired');
        }

        // Refresh sliding expiration
        $newExpiry = time() + getenv('TOKENTIMEOUT');

        if (!isset($decoded['emp_code'])) {
            // HR user: refresh token_time_out across all branches (same mobile/email)
            // so switching branches doesn't cause an unexpected expiry
            $field = !empty($user['mobile']) ? 'mobile' : 'email';
            $model->where($field, $user[$field])
                  ->where('contact_type', 'client')
                  ->where('is_active', 1)
                  ->update(null, ['token_time_out' => $newExpiry]);
        } else {
            $model->update($id, ['token_time_out' => $newExpiry]);
        }

        return true;
    }

    private function reject(RequestInterface $request, int $code, string $message): ResponseInterface
    {
        $response = service('response');
        $response->setStatusCode($code);
        $response->setContentType('application/json');
        $response->setBody(json_encode(['status' => $code, 'message' => $message]));

        $this->corsFilter->after($request, $response);
        
        return $response;
    }

    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
    {
        // Do something here after the response is sent
    }

    
}