<?php

// declare(strict_types=1);


namespace App\Controllers;
use App\Helpers\MailHelper;
use App\Controllers\LoginController;
use App\Helpers\DepositHelper;
use App\Helpers\JWTToken;
use App\Helpers\HttpRequestHelper;
use App\Helpers\RestAuthHelper;

use CodeIgniter\HTTP\IncomingRequest;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use Psr\Log\LoggerInterface;
use CodeIgniter\API\ResponseTrait;


use App\Models\EmployeeModel;
use App\Models\AuthHistoryModel;
use App\Models\LevelContactModel;

use Firebase\JWT\JWT;
// require_once('../vendor/autoload.php');


class RestAuthenticationController extends AdminController
{   
    use ResponseTrait;

    /** Default grace period after token_time_out epoch before cron clears it (seconds). */
    private const RESET_TOKEN_TIMEOUT_BUFFER_SECONDS_DEFAULT = 180;


    protected $myLogger;
    protected $employeeModel;
    protected $authHistoryModel;
    protected $hrModel;

    
    public function __construct()
    {
        // set_session_context('Client');
        $this->myLogger = \Config\Services::mylogger();

        $this->employeeModel       = new EmployeeModel();
        $this->authHistoryModel    = new AuthHistoryModel();
        $this->hrModel    = new LevelContactModel();
                
    }

    public function index()
    {   
        $this->myLogger->logme('error','Rest Authentication function called');
        $data =["id"=>"2", "role"=>"staff"];

        print_r(JWTToken::encode($data));
    }

    public function logined()
    {

        $this->myLogger->logme('error','Rest Authentication function called');

        echo "Rest Authentication Logined Success........";
    }

    private function callThirdPartyAPI($postData , $endPoint)
    {
        $client = \Config\Services::curlrequest();
        $url = env('POST_ENROLLMENT_BASEURL').$endPoint; 
        $headers = [
                        'App-Signature' => getenv('APP_SIGNATURE'),
                   ];
        $response = $client->post( $url, ['json' => $postData, 'headers' => $headers , 'http_errors' => false   ] );
        // return json_decode($response->getBody(), true);
        return $response->getBody();
    }


    public function callThirdPartyGETAPI($queryParams, $endPoint, $params = [])
    {
        $client = \Config\Services::curlrequest();
        $url = env('POST_ENROLLMENT_BASEURL') . $endPoint;

        $options = [
            'query'       => $queryParams,
            'http_errors' => false,
            'headers'     => [
                'App-Signature' => getenv('APP_SIGNATURE'),
                'Accept'        => 'application/json'
            ]
        ];

        if (!empty($params['token'])) {
            $options['headers']['Authorization'] = 'Bearer ' . $params['token'];
        }


        $response = $client->get($url, $options);

        return $response->getBody();
    }


    // employee auth api's start

    public function verifyEmployeeWithMobileNumber()
    {   
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Verify Employee With Mobile Number: Function called");

        try {
            $data = $this->request->getJSON();
            $mobile_number = $data->mobile_number;

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Received mobile_number = " . $mobile_number);
          
            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['mobile_number' => $mobile_number]); 

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: No employee data found both PRE & POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                $result = ['user_verification' => false , 'message' => "User not found"];
                recordRateLimitFailure();
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }


            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: employee data both PRE & POST = " . json_encode($empdata));

            
            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Using PRE data");
            }

            $otp = random_int(100000, 999999);
            $default_otp     = env('DEFAULT_OTP') ?? '';
            $is_send_sms_otp = filter_var(env('IS_SEND_SMS_OTP') ?? true, FILTER_VALIDATE_BOOLEAN);

            if(!empty($default_otp)){
                $otp = $default_otp;
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Sending default otp");
            }

            if($mobile_number == '9442741776') {   
                $otp = '123456';
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: setting 123456 for IOS APP TESTING = " . json_encode($employeeData));
            }
            
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Final employee data to verify = " . json_encode($employeeData));
            
            if (isset($employeeData['employee_id'])) 
            {
                
                //check the resend otp (with in 60 seconds don't allow another otp to send)
                $check = canSendOtp($employeeData);
                if (!$check['allowed']) {
                    return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests
                }

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Employee verified with ID = " . $employeeData['employee_id']);
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');

                
                $sql = "
                    UPDATE employees
                    INNER JOIN employee_polices ON employee_polices.employee_id = employees.id
                    SET employees.otp = ?
                    WHERE employees.id = ?
                    AND employees.relationship = 'self'
                    AND employees.is_active = 1
                    AND employee_polices.is_active = 1
                    AND employee_polices.status IN ('draft', 'enrolled')
                ";

                $db = db_connect();
                $update = $db->query($sql, [$otp, $employeeData['employee_id']]);

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: OTP update query executed. SQL = " . $db->getLastQuery());

                if($update)
                {

                    //If post-enrollment data exist update the same otp generated from pre-enrollment.
                    if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                        $data->otp = $otp;
                        $data->client_id = $empdata['post']['client_id']; 
                        $data->employee_id = $empdata['post']['employee_id']; 
                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Attached otp, client_id and employee_id from POST data to update the otp");

                        $this->callThirdPartyAPI($data, 'updateEmpOTP');
                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Calling callThirdPartyAPI for updateEmpOTP");
                    }

                    //skip sms for live test no
                    if($mobile_number == '9442741776' || $is_send_sms_otp == false) {

                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: skip SMS sent for IOS APP TESTING = " . ($mobile_number));
                        $result = ['user_verification' => true ,'message' => "Verified Successfully" ];
                        return $this->respond(['status' => 'success','code' => 200,'data' => $result, 'is_sms_send' => false],200);
                    }

                    //send sms 
                    $SMSResult = sendOtpSms($mobile_number, $otp);
                    if ($SMSResult['status'] == 'success') 
                    {
                        $result = ['user_verification' => true ,'message' => "Verified Successfully" ];
                        return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
                    }else{
                        $result = ['user_verification' => false, 'message' => "SMS sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }

                }else{

                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: OTP update query Failed. SQL = " . $db->getLastQuery());

                    $result = ['user_verification' => false, 'message' => "Try again. , try again"];
                    return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);

                }
                

            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Employee ID not found, calling third-party API to POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');

                // Call the third-party API function
                $reqData = $this->request->getJSON();
                $reqData->otp = $otp;  
                return $this->callThirdPartyAPI($reqData,'verifyEmployeeNumber');
            }
        } catch (\Throwable $th) {

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() . " --- Trace: " . $th->getTraceAsString());
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $th],500);
        }
    }

    public function verifyEmployeeWithEmailId()
    {   
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');        
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Verify Employee With EmailId: Function called");

        try {

            $data = $this->request->getJSON();
            $email = $data->email;
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Received Email ID = " . $email);

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email]); 


            $otp = random_int(100000, 999999);

            $default_otp     = env('DEFAULT_OTP') ?? '';
            $is_send_email_otp = filter_var(env('IS_SEND_EMAIL_OTP') ?? true, FILTER_VALIDATE_BOOLEAN);

            if(!empty($default_otp)){
                $otp = $default_otp;
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Sending default otp");
            }

            //only retail policy
            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: No employee data found both PRE & POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');

                $retailUserdata = RestAuthHelper::getRetailUserData(['email_id' => $email]);
                // print_r($retailUserdata); die;

                if (!empty($retailUserdata)) {

                    $retailApiParams['client_id'] = $retailUserdata['id'];
                    $retailApiParams['email_id'] = $email;
                    $retailApiParams['otp'] = $otp;

                    // update the otp in retail user
                    $api_response = $this->callThirdPartyAPI($retailApiParams, 'updateRetailUserAuthDetails');
                    $api_response = json_decode($api_response ?? '{}', true) ?? $api_response;
                    // print_r($api_response); die;
                    if (isset($api_response['status']) && $api_response['status'] == true) {

                        //send Email
                        $retail_common = [
                            'client_id' => $retailUserdata['id'],
                            'client_branch_id' => null,
                            'client_policy_id' => null,
                            'employee_policy_id' =>  null,
                            'employee_id' => null,
                            'mail_type' => 'retail_user_otp_mail',
                        ];

                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Sending Retail user OTP email to " . $email);
                        $res = $this->sendEmailOtp($email, $otp, $retail_common);

                        if (json_decode($res)->status == 'success') {
                            $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                            return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                        } else {
                            $result = ['user_verification' => false, 'message' => "Mail sending failed , try again"];
                            return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                        }
                    }
                }

                $result = ['user_verification' => false , 'message' => "User not found"];
                recordRateLimitFailure();
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: employee data both PRE & POST = " . json_encode($empdata));

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Using PRE data");
            } 

           
            if (isset($employeeData['employee_id'])) 
            {
                //check the resend otp (with in 60 seconds don't allow another otp to send)
                $check = canSendOtp($employeeData);
                if (!$check['allowed']) {
                    return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests
                }

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Valid employee found, generating OTP");

                $sql = "
                    UPDATE employees
                    INNER JOIN employee_polices ON employee_polices.employee_id = employees.id
                    SET employees.otp = ?
                    WHERE employees.id = ?
                    AND employees.relationship = 'self'
                    AND employees.is_active = 1
                    AND employee_polices.is_active = 1
                    AND employee_polices.status IN ('draft', 'enrolled')
                ";

                $db = db_connect();
               
                $update = $db->query($sql, [$otp, $employeeData['employee_id']]);

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: OTP update query executed. SQL = " . $db->getLastQuery());

                if($update)
                {   
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: OTP updated successfully in PRE DATABASE");
                    
                    //If post-enrollment data exist update the same otp generated from pre-enrollment.
                    if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                        $data->otp = $otp; 
                        $data->client_id = $empdata['post']['client_id']; 
                        $data->employee_id = $empdata['post']['employee_id']; 
                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Attached otp, client_id and employee_id from POST data to update the otp");

                        $this->callThirdPartyAPI($data, 'updateEmpOTP');
                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Calling callThirdPartyAPI for updateEmpOTP");
                    }

                    //send Email
                    $common = [
                        'client_id' => $employeeData['client_id'],
                        'client_branch_id' => $employeeData['client_branch_id'],
                        'client_policy_id' => null,
                        'employee_policy_id' =>  null,
                        'employee_id' => $employeeData['employee_id'],
                        'mail_type' => 'otp_mail',
                    ];

                    if($is_send_email_otp == false){
                        $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                        return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result, 'is_email_send' => false], 200);
                    }

                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Sending OTP email to " . $employeeData['email_corporate']);
                    $res = $this->sendEmailOtp($employeeData['email_corporate'], $otp, $common);
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Mail response = " . $res);

                    if (json_decode($res)->status == 'success') {
                        log_message('error', '  ');
                        log_message('error', '************************ PRE END ********************************');
                        $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                        return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                    } else {
                        log_message('error', '  ');
                        log_message('error', '************************ PRE END ********************************');
                        $result = ['user_verification' => false, 'message' => "Mail sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }

                } else {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: OTP update failed in PRE DATABASE");
                    log_message('error', '  ');
                    log_message('error', '************************ PRE END ********************************');
                    $result = ['user_verification' => false, 'message' => "Verification failed , try again"];
                    return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                }
            } else {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Employee not found with email in the PRE DATABASE, falling back to third-party API");

                // Call the third-party API function
                $apiParams = $this->request->getJSON();
                if (!empty($empdata['post']['client_id'])) {
                    $apiParams->client_id = $empdata['post']['client_id']; 
                }
                $apiParams->otp = $otp;
                return $this->callThirdPartyAPI($apiParams, 'verifyEmployeeEmailId');
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
            }
        } catch (\Throwable $th) {
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() .  " --- Trace: " . $th->getTraceAsString());
            return $this->respond(['status' => 'failed', 'code' => 500, 'data' => "", 'message' => $th], 500);
        }
    }

    public function getVerifiedUserData()
    {   
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Get Verified User Data: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {
           
            
            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            $otp = isset($this->request->getJSON()->otp) ? $this->request->getJSON()->otp : null;

            if(empty($otp)){
                recordRateLimitFailure();
                return $this->respond(['status' => 'OTP is required','code'   => 400,'message' => 'OTP is required'], 200);
            }

            if (empty($mobile_number) && empty($email_id)) {
                recordRateLimitFailure();
                return $this->respond(['status' => 'failed','code'   => 400,'message' => 'Mobile number or Email ID is required'], 200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Fetching empdata via RestAuthHelper");
            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'otp' => $otp, 'mobile_number' => $mobile_number ]); 
            

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: empdata is empty");

                $retailUserdata = RestAuthHelper::getRetailUserData(['email_id' => $email_id, 'mobile_number' => $mobile_number, 'otp' => $otp]);
                // print_r($retailUserdata); die;

                if (!empty($retailUserdata)) {

                    $retailApiParams['client_id'] = $retailUserdata['id'];
                    $retailApiParams['email_id'] = $email_id;
                    $retailApiParams['mobile_number'] = $mobile_number;
                    $retailApiParams['otp'] = $otp;

                    // Call the third-party API function
                    $apiResponse = $this->callThirdPartyAPI($retailApiParams, 'getVerifiedRetailUserData');
                    // print_r($apiResponse); die;
                    recordRateLimitFailure();
                    return $this->respond(['status' => 'failed', 'code' => 200, 'data' => [], 'post_enrollment' => json_decode($apiResponse, true)], 200);
                }

                recordRateLimitFailure();
                return $this->respond(['status' => 'Invalid OTP','code' => 404,'data' => "", 'message' => "Invalid OTP"],200);                
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: empdata = " . json_encode($empdata));

                
            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Using PRE data from empdata");
            } 

            
            $requestData = $this->request->getJSON();
            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData->client_id = $empdata['post']['client_id']; 
                $requestData->employee_id = $empdata['post']['employee_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Added client_id and employee_id to requestData for to get the POST employee data");
            }
            

            if ( $employeeData && isset($this->request->getJSON()->otp) ) 
            {   
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Verified employee found");
                $auth =  HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $data = [
                       'user_id' => $employeeData['id'],
                       'user_type' => 'employee',
                       'ip' => $auth['ip'],
                       'platform' => $auth['platform'],
                       'broswer' => $auth['browser'],
                    ];
                     $this->authHistoryModel->insert($data);                    
                }
              
                // print_r($employeeData); die;
                unset($employeeData['employee_id']);
                $employeeData['token_type'] = "pre";
                $result = JWTToken::encode($employeeData);
                
                if(isset($this->request->getJSON()->otp)){ 
                    $this->employeeModel->where('id', $employeeData['id'])->where('otp', $otp)->where('relationship', 'self')->set(['otp'=>null])->update();
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Reset the otp to null");
                }

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Calling third-party API - getVerifiedUserData to get the POST employee data");
                log_message('error', '  '); 
                log_message('error', '************************ PRE END ********************************');
                // Call the third-party API function
                $apiResponse = $this->callThirdPartyAPI($requestData,'getVerifiedUserData');
                return $this->respond(['status' => 'success','code' => 200,'data' => $result , 'post_enrollment'=> json_decode($apiResponse, true)],200);

            } else {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Employee not verified - calling third-party API fallback to get the POST employee data"); 
                log_message('error', '  '); 
                log_message('error', '************************ PRE END ********************************');
                // Call the third-party API function
                $apiResponse = $this->callThirdPartyAPI($requestData,'getVerifiedUserData');
                return $this->respond(['status' => 'failed','code' => 404,'data' => '' , 'post_enrollment'=> json_decode($apiResponse, true)],200);

            }

        } catch (\Exception $e) {
            $this->myLogger->logme("error", "Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() . " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => "Invalid OTP", 'error' => $e->getMessage()],500);
        }
    }

    // employee auth api's end

    public function sendEmailOtp($email, $otp, $common)
    {
        $subject = 'Nhance user verification - OTP';
        $mail_content = $otp . ' is your verification code for Nhance.';
        $response = MailHelper::send_email(['mail' => $email, 'subject' => $subject, 'common' => $common, 'message' => $mail_content]);

        return $response;
    }


    // HR auth api's start

    public function verifyHrWithMobileNumber()
    {
        try {

            $data = $this->request->getJSON();

            $mobile_number = $data->mobile_number;

            $HrData = $this->hrModel->where('mobile', $mobile_number)
                                    ->where('contact_type', 'client')
                                    ->where('is_active', 1)
                                    ->first();

            $otp = random_int(100000, 999999);

            $default_otp     = env('DEFAULT_OTP') ?? '';
            $is_send_sms_otp = filter_var(env('IS_SEND_SMS_OTP') ?? true, FILTER_VALIDATE_BOOLEAN);

            if(!empty($default_otp)){
                $otp = $default_otp;
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Sending default otp");
            }

            if ($HrData) 
            {

                    //check the resend otp (with in 60 seconds don't allow another otp to send)
                    $check = canSendOtp($HrData);
                    if (!$check['allowed']) {
                        return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests
                    }
                
                    $sql = "UPDATE level_contacts SET otp = ? WHERE mobile = ? AND contact_type = 'client' AND is_active = 1";

                    $db = db_connect();
                    $update = $db->query($sql, [$otp, $mobile_number]);

                    if($update)
                    {
                        //update otp in post-enrollment
                        $data->otp = $otp; 
                        $this->callThirdPartyAPI($data, 'updateHROTP');

                        if($is_send_sms_otp == false){
                            $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                            return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result, 'is_sms_send' => false], 200);
                        }

                        //send sms 
                        $SMSResult = sendOtpSms($mobile_number, $otp);
                        if ($SMSResult['status'] == 'success') 
                        {
                            $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                            return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                        } else {
                            $result = ['user_verification' => false, 'message' => "SMS sending failed , try again"];
                            return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                        }

                    }else {
                        $result = ['user_verification' => false, 'message' => "SMS sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }

            }else {

            // Call the third-party API function
            $reqData = $this->request->getJSON();
            $reqData->otp = $otp;  
            return $this->callThirdPartyAPI($reqData,'verifyHrWithMobileNumber');

            }

        } catch (\Throwable $th) {
            return $this->respond(['status' => 'failed','code' => 500,'data' => $th],500);
        }
    }

    public function verifyHrWithEmail()
    {
        try {

            $data = $this->request->getJSON();


            $email = $data->email;
           
            $HrData = $this->hrModel->where('email', $email)
                                    ->where('contact_type', 'client')
                                    ->where('is_active', 1)
                                    ->first();
          
            $otp = random_int(100000, 999999);

            $default_otp     = env('DEFAULT_OTP') ?? '';
            $is_send_email_otp = filter_var(env('IS_SEND_EMAIL_OTP') ?? true, FILTER_VALIDATE_BOOLEAN);

            if(!empty($default_otp)){
                $otp = $default_otp;
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Sending default otp");
            }

            $data->otp = $otp; 

            if ($HrData) {

                //check the resend otp (with in 60 seconds don't allow another otp to send)
                $check = canSendOtp($HrData);
                if (!$check['allowed']) {
                    return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests
                }
                
               
                $sql = "
                        UPDATE level_contacts
                        SET otp = ?
                        WHERE email = ?
                        AND contact_type = 'client'
                        AND is_active = 1
                    ";

                $db = db_connect();
                $update = $db->query($sql, [$otp, $email]);

                if($update)
                {   

                    $data->otp = $otp; 
                    $this->callThirdPartyAPI($data, 'updateHROTP');

                    if($is_send_email_otp == false){
                        $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                        return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result, 'is_email_send' => false], 200);
                    }

                    $common = [
                        'login_type' => 'HR login',
                        'login_email' => $email,
                        'mail_type' => 'otp_mail'
                    ];
                    $subject = 'Nhance user verification - OTP';
                    $mail_content = $otp . ' is your verification code for Nhance.';
                    $res = MailHelper::send_email(['mail' => $email, 'subject' => $subject, 'common' => $common, 'message' => $mail_content]);
                    $this->myLogger->logme("error", $res);

                    if (json_decode($res)->status == 'success') {
                        $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                        return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                    } else {
                        $result = ['user_verification' => false, 'message' => "Mail sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }
                } else {

                    $result = ['user_verification' => false, 'message' => "Verification failed , try again"];
                    return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                }

            } else {
               // Call the third-party API function
               return $this->callThirdPartyAPI($data,'verifyHrWithEmail');
            }

        } catch (\Throwable $th) {
            return $this->respond(['status' => 'failed','code' => 500,'data' => $th],500);
        }
    }
    
    public function getVerifiedHrData()
    {
        try {
            
            $otp = isset($this->request->getJSON()->otp) ? $this->request->getJSON()->otp : null;
            $email = isset($this->request->getJSON()->email) ? $this->request->getJSON()->email : null;
            $mobile_number = isset($this->request->getJSON()->mobile_no) ? $this->request->getJSON()->mobile_no : null;

            if (isset($mobile_number)) 
            {
                $hrData = $this->hrModel->where('mobile', $mobile_number)->where('contact_type', 'client')->where('is_active', 1)->where('otp', $otp)->first();
            }else{
                $hrData = $this->hrModel->where('email', $email)->where('contact_type', 'client')->where('is_active', 1)->where('otp', $otp)->first();
            }

            if ($hrData) 
            {

                $auth =  HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $data = [
                       'user_id' => $hrData['id'],
                       'user_type' => 'hr',
                       'ip' => $auth['ip'],
                       'platform' => $auth['platform'],
                       'broswer' => $auth['browser'],
                    ];

                    $this->authHistoryModel->insert($data);
                                        
                }
              

                if(isset($this->request->getJSON()->mobile_no)){ 

                    $getAllhrData = $this->hrModel->select('level_contacts.id ,level_contacts.mobile , level_contacts.email , clients.id as client_id, clients.client_name, clients.short_name , client_branch.id as client_branch_id,client_branch.branch_name , client_branch.post_branch_id')
                                            ->join('client_branch', 'level_contacts.ref_id = client_branch.id', 'left')
                                            ->join('clients', 'client_branch.client_id = clients.id', 'left')
                                            ->where('level_contacts.mobile', $mobile_number )
                                            ->where('level_contacts.contact_type', 'client')
                                            ->where('level_contacts.is_active', 1)
                                            ->where('clients.is_active', 1)
                                            ->where('client_branch.is_active', 1)
                                            ->findAll();
                    //set otp value null
                    $this->hrModel->where('mobile', $mobile_number)->where('otp', $otp)->where('contact_type', 'client')->set(['otp'=>null])->update();

                }else if(isset($this->request->getJSON()->email)){ 

                    $getAllhrData = $this->hrModel->select('level_contacts.id ,level_contacts.mobile , level_contacts.email , clients.id as client_id, clients.client_name, clients.short_name , client_branch.id as client_branch_id,client_branch.branch_name , client_branch.post_branch_id')
                                            ->join('client_branch', 'level_contacts.ref_id = client_branch.id', 'left')
                                            ->join('clients', 'client_branch.client_id = clients.id', 'left')
                                            ->where('level_contacts.email', $email )
                                            ->where('level_contacts.contact_type', 'client')
                                            ->where('level_contacts.is_active', 1)
                                            ->where('clients.is_active', 1)
                                            ->where('client_branch.is_active', 1)
                                            ->findAll();
                    //set otp value null
                    $this->hrModel->where('email', $email)->where('otp', $otp)->where('contact_type', 'client')->set(['otp'=>null])->update();
                }


                if(count($getAllhrData))
                {


                    $db2 = \Config\Database::connect('postDB');
                    foreach ($getAllhrData as $key => $value) {

                        $HRAccessData = $db2->table('hr_access_control hr')
                                ->where('hr.pre_client_id',$value['client_id'])
                                ->where('hr.pre_branch_id', $value['client_branch_id'])
                                ->where('hr.pre_hr_id', $value['id'])
                                ->get()->getRowArray();

                       
                        if (!empty($HRAccessData) && isset($HRAccessData['allowed_modules'])) {

                            // $decoded = json_decode($HRAccessData['allowed_modules'], true);
                            // $getAllhrData[$key]['allowed_modules'] = $decoded;
                            // $HRAccessData['pre_client_id'] = md5($HRAccessData['pre_client_id']);
                            // $HRAccessData['post_client_id'] = md5($HRAccessData['post_client_id']);

                            $decoded = json_decode($HRAccessData['allowed_modules'], true) ?? [];
                            $allowedActivePolicies = json_decode($HRAccessData['allowed_active_policies'] ?? '[]', true) ?? [];
                            if (!is_array($allowedActivePolicies)) {
                                $allowedActivePolicies = [];
                            }

                            if (empty($allowedActivePolicies) && is_array($decoded)) {
                                if (isset($decoded['post']) && is_array($decoded['post'])) {
                                    $decoded['post'] = array_values(array_filter(
                                        $decoded['post'],
                                        static fn($module) => (int) $module !== 4
                                    ));
                                } elseif (!isset($decoded['pre']) && !isset($decoded['post'])) {
                                    $decoded = array_values(array_filter(
                                        $decoded,
                                        static fn($module) => (int) $module !== 4
                                    ));
                                }
                                $HRAccessData['allowed_modules'] = json_encode($decoded);
                            }

                            $claimsSubMenu = [];
                            $hasClaimsModule = false;
                            if (is_array($decoded)) {
                                if (isset($decoded['post']) && is_array($decoded['post'])) {
                                    $hasClaimsModule = in_array(4, array_map('intval', $decoded['post']), true);
                                } elseif (!isset($decoded['pre']) && !isset($decoded['post'])) {
                                    $hasClaimsModule = in_array(4, array_map('intval', $decoded), true);
                                }
                            }

                            if ($hasClaimsModule) {
                                $claimsSubMenu[] = 'EB';

                                $hasNonEbPolicy = false;
                                if (!empty($allowedActivePolicies)) {
                                    $db = \Config\Database::connect();
                                    $policyAllocgRows = $db->table('client_policy')
                                        ->select('policy_type.allocg')
                                        ->join('policy_type', 'policy_type.id = client_policy.policy_type_id', 'left')
                                        ->whereIn('client_policy.id', $allowedActivePolicies)
                                        ->get()
                                        ->getResultArray();

                                    foreach ($policyAllocgRows as $policyRow) {
                                        if (($policyRow['allocg'] ?? '') !== 'EB') {
                                            $hasNonEbPolicy = true;
                                            break;
                                        }
                                    }
                                }

                                if ($hasNonEbPolicy) {
                                    $claimsSubMenu[] = 'Non-EB';
                                }
                            }

                            $getAllhrData[$key]['allowed_modules'] = $decoded;
                            $getAllhrData[$key]['claims_sub_menu'] = $claimsSubMenu;
                            $HRAccessData['pre_client_id'] = md5($HRAccessData['pre_client_id']);
                            $HRAccessData['post_client_id'] = md5($HRAccessData['post_client_id']);

                            $token = JWTToken::encode($HRAccessData);
                            $getAllhrData[$key]['token'] = $token;
                            
                        } else {
                            $getAllhrData[$key]['allowed_modules'] = [];
                            $getAllhrData[$key]['token'] = "";
                        }
                       
                    }


                    // Call the third-party API function
                    $apiResponse = $this->callThirdPartyAPI($this->request->getJSON(),'getVerifiedHrData');
                    return $this->respond(['status' => 'success','code' => 200,'data' => $getAllhrData , 'post_enrollment'=> json_decode($apiResponse, true)],200);

                }else {

                    // Call the third-party API function
                    $apiResponse = $this->callThirdPartyAPI($this->request->getJSON(),'getVerifiedHrData');
                     recordRateLimitFailure();
                    return $this->respond(['status' => 'failed','code' => 404,'data' => "" , 'post_enrollment'=> json_decode($apiResponse, true)],200);
                }

               
            } else {

                // Call the third-party API function
                $apiResponse = $this->callThirdPartyAPI($this->request->getJSON(),'getVerifiedHrData');
                 recordRateLimitFailure();
                return $this->respond(['status' => 'failed','code' => 404,'data' => "" , 'post_enrollment'=> json_decode($apiResponse, true)],200);
            }
        } catch (\Exception $e) {
            return $this->respond(['status' => 'failed','code' => 500,'data' => $e->getMessage()],500);
        }
    }


    public function getUserIdFromToken()
    {
        $id = JWTToken::getUserIdFromToken();
        // echo $id['id'];
        echo "Id----> ";
        print_r($id);
        $role = JWTToken::getUserRoleFromToken();
        echo "  Role----> ";
        echo $role;


        $tokenArray = JWTToken::decodeToken();
        echo "  TokenArray---->  ";
        print_r($tokenArray);
    }


    public function saveMpin()
    {   
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Save Mpin: Function called");
        $payload = $this->request->getJSON() ?? [];
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Request payload = " . json_encode($payload));

        try {
   
            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number ]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: No employee data found both PRE and POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                $result = ['user_verification' => false , 'message' => "User not found"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: empdata = " . json_encode($empdata));

            if (isset($mobile_number)) {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('relationship', 'self')->first();
                $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->orderBy('id', 'desc')
                                    ->first();
            } else {
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('relationship', 'self')->first();
                   $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.email_corporate', $email_id)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->orderBy('id', 'desc')
                                    ->first();
            }

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Using PRE data from empdata");
            } 

            $mpin = $this->request->getJSON()->mpin;
            $is_mpin_skipped = $this->request->getJSON()->is_mpin_skipped;
            $is_biometric_enabled = $this->request->getJSON()->is_biometric_enabled;
          
            $mpin_data_to_updata = [
                'mpin' => $mpin,
                'is_mpin_skipped' => $is_mpin_skipped,
                'is_biometric_enabled' => $is_biometric_enabled
            ];

            $requestData = $this->request->getJSON();
            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData->client_id = $empdata['post']['client_id']; 
                $requestData->employee_id = $empdata['post']['employee_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Added client_id & employee_id to requestData to get the POST employee data");
            }
            
            if ($employeeData) {
                $id= $employeeData["id"];
                $updateMpin = $this->employeeModel->where('id', $id)->set($mpin_data_to_updata)->update();
                if($updateMpin){
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: MPIN updated successfully");
                    log_message('error', '  ');
                    log_message('error', '************************ PRE END ********************************');
                    $this->callThirdPartyAPI($requestData, 'saveMpin');
                    $result = ['user_verification' => true , 'message' => "Mpin Updated"];
                    return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
                }else{
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: MPIN update failed");
                    log_message('error', '  ');
                    log_message('error', '************************ PRE END ********************************');
                    $result = ['user_verification' => true , 'message' => "Mpin Not Updated"];
                    return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
                }
               
               
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Employee not found in final check, calling third-party API to the POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                return $this->callThirdPartyAPI($requestData, 'saveMpin');
            }

        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() . " --- Trace: " . $th->getTraceAsString());
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $th],500);
        }
    }

    public function updateMpin()
    {   
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Update Mpin: Function called");
        
        $payload = $this->request->getJSON() ?? [];
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Request payload = " . json_encode($payload));

        try {

            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            $old_mpin = $this->request->getJSON()->old_mpin;
            $mpin = $this->request->getJSON()->new_mpin;

            if($old_mpin == $mpin)
            {
                $result = ['mpin_verification' => false , 'message' => "New MPIN must be different from the old MPIN"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number, 'old_mpin' => $old_mpin ]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: No employee data found both PRE and POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');

                $result = ['mpin_verification' => false , 'message' => "Old MPIN is incorrect"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: empdata = " . json_encode($empdata));

            if (isset($mobile_number)) {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('mpin', $old_mpin)->where('relationship', 'self')->first();
                $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->where('employees.mpin', $old_mpin)
                                    ->orderBy('id', 'desc')
                                    ->first();
            } else {
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('mpin', $old_mpin)->where('relationship', 'self')->first();
                   $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.email_corporate', $email_id)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->where('employees.mpin', $old_mpin)
                                    ->orderBy('id', 'desc')
                                    ->first();
            }
          
            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Using PRE data from empdata");
            } 

            $requestData = $this->request->getJSON();
            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData->client_id = $empdata['post']['client_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Added client_id & employee_id to requestData to get the POST employee data");
            }
            
            if ($employeeData) {

                $id= $employeeData["id"];
                $updateMpin = $this->employeeModel->where('id', $id)->set('mpin', $mpin)->update();
                if($updateMpin){
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: MPIN updated successfully");
                    log_message('error', '  ');
                    log_message('error', '************************ PRE END ********************************');
                    $this->callThirdPartyAPI($requestData, 'updateMpin');
                    $result = ['mpin_verification' => true , 'message' => "Mpin Updated"];
                    return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
                }else{
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: MPIN update failed");
                    log_message('error', '  ');
                    log_message('error', '************************ PRE END ********************************');

                    $result = ['mpin_verification' => true , 'message' => "Mpin Not Updated"];
                    return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
                }
    
            } else {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Employee not found in final check, calling third-party API to the POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                return $this->callThirdPartyAPI($requestData, 'updateMpin');

            }

        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() . " --- Trace: " . $th->getTraceAsString());
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $th],500);
        }
    }

    public function verifyMpin()
    {
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Verify Mpin: Function called");

        $payload = $this->request->getJSON() ?? [];
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Request payload = " . json_encode($payload));

        try {

            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            $mpin = $this->request->getJSON()->mpin;

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: No employee data found both PRE and POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                return $this->respond(['status' => 'failed', 'code'   => 404, 'data' => ""], 200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: empdata = " . json_encode($empdata));

            if (isset($mobile_number)) {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('relationship', 'self')->first();
                 $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->orderBy('id', 'desc')
                                    ->first();
            } else {
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('relationship', 'self')->first();
                    $employeeData = $this->employeeModel
                        ->select('employees.*')
                        ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                        ->where('employees.email_corporate', $email_id)
                        ->where('employees.relationship', 'Self')
                        ->where('employee_polices.is_active', 1)
                        ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                        ->where('employees.is_active', 1)
                        ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                        ->orderBy('id', 'desc')
                        ->first();
            }

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Using PRE data from empdata");
            } 

            $requestData = $this->request->getJSON();
            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData->client_id = $empdata['post']['client_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Added client_id to requestData to get the POST employee data");
            }


            if ($employeeData && $mpin == $employeeData["mpin"]) {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Verified employee found");

                $auth =  HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $data = [
                        'user_id' => $employeeData['id'],
                        'user_type' => 'employee',
                        'ip' => $auth['ip'],
                        'platform' => $auth['platform'],
                        'broswer' => $auth['browser'],
                    ];

                    $authdata = $this->authHistoryModel->insert($data);
                }

                unset($employeeData['employee_id']);
                $employeeData['token_type'] = "pre";
                $result = JWTToken::encode($employeeData);

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Calling third-party API - verifyMpin to get the POST employee data");
                log_message('error', '  '); 
                log_message('error', '************************ PRE END ********************************');

                // Call the third-party API function
                $apiResponse = $this->callThirdPartyAPI($requestData, 'verifyMpin');
                return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result, 'post_enrollment' => json_decode($apiResponse, true)], 200);
            } else {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Employee not verified - calling third-party API fallback to get the POST employee data"); 
                log_message('error', '  '); 
                log_message('error', '************************ PRE END ********************************');


                // Call the third-party API function
                $apiResponse = $this->callThirdPartyAPI($requestData, 'verifyMpin');
                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => "", 'post_enrollment' => json_decode($apiResponse, true)], 200);

                //$apiResponse = $this->callThirdPartyAPI($this->request->getJSON(),'/getVerifiedUserData');
                // return $this->respond(['status' => 'failed','code' => 404,'data' => "", 'post_enrollment'=> json_decode($apiResponse, true)],200);

            }

        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() . " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            return $this->respond(['status' => 'failed', 'code' => 500, 'data' => "", 'message' => $e->getMessage()], 500);
            return $this->respond(['status' => 'failed', 'code' => 200, 'post_enrollment' => json_decode($apiResponse, true)], 200);
        }
    }

    public function checkMpin()
    { 
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Check Mpin: Function called");

        $payload = $this->request->getJSON() ?? [];
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Request payload = " . json_encode($payload));

        try {
            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number, 'check_mpin' => true]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: No employee data found both PRE and POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');

                return $this->respond(['status' => 'failed','code' => 404,'data' => "Mpin - not found", 'Mpin' =>null],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: empdata = " . json_encode($empdata));

            if (isset($mobile_number)) 
            {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('relationship', 'self')->first();
                $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->orderBy('id', 'desc')
                                    ->first();
            }else{
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('relationship', 'self')->first();
                 $employeeData = $this->employeeModel
                        ->select('employees.*')
                        ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                        ->where('employees.email_corporate', $email_id)
                        ->where('employees.relationship', 'Self')
                        ->where('employee_polices.is_active', 1)
                        ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                        ->where('employees.is_active', 1)
                        ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                        ->orderBy('id', 'desc')
                        ->first();
            }

                      
            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Using PRE data from empdata");
            } 

            $requestData = $this->request->getJSON();
            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData->client_id = $empdata['post']['client_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Added client_id to requestData to get the POST employee data");
            }
            
            
            if ($employeeData &&  $employeeData["mpin"] != null) {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Mpin - Exist");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                return $this->respond(['status' => 'success','code' => 200,'data' => "", 'message' => "Mpin - exist" , 'Mpin' =>$employeeData["mpin"], 'is_mpin_skipped' => $employeeData['is_mpin_skipped'] ?? '0', 'is_biometric_enabled' => $employeeData['is_biometric_enabled'] ?? '0' ],200);
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Mpin - not found in PRE so call the thirdpartapi to the POST to check the MPIN");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                // return $this->respond(['status' => 'failed','code' => 404,'data' => "Mpin - not found", 'Mpin' =>null],200);
                return $this->callThirdPartyAPI($requestData, 'checkMpin');
            }
            
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() . " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $e->getMessage()],500);
        }
    }

    public function forgotMPIN()
    {   
        log_message('error', '  ');
        log_message('error', '************************ PRE START ********************************');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Forgot Mpin: Function called");

        $payload = $this->request->getJSON() ?? [];
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: Request payload = " . json_encode($payload));

        try {

            $json = $this->request->getJSON();
            $mobile_number = $json->mobile_number ?? null;
            $email_id = $json->email_id ?? null;

            // Step 1: Check input
            if (!$mobile_number && !$email_id) {
                log_message('error', 'Mobile number and email ID are both missing.');
                return $this->respond([
                    'status' => 'failed',
                    'code' => 400,
                    'message' => 'Mobile number or email ID is required.'
                ], 400);
            }

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMpin: No employee data found both PRE and POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');

                return $this->respond(['status' => 'failed','code' => 404,'data' => "Mpin - not found", 'Mpin' =>null],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: empdata = " . json_encode($empdata));

            // Step 2: Fetch employee data
            if ($mobile_number) {
                log_message('info', 'Looking up employee by mobile number: ' . $mobile_number);
                $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->orderBy('id', 'desc')
                                    ->first();
            } else {
                log_message('info', 'Looking up employee by email: ' . $email_id);
                $employeeData = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.email_corporate', $email_id)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['draft', 'enrolled'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['draft', 'enrolled'])
                                    ->orderBy('id', 'desc')
                                    ->first();
            }

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: Using PRE data from empdata");
            } 

            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $json->client_id = $empdata['post']['client_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: Added client_id to requestData to get the POST employee data");
            }

            // Step 3: Found employee
            if (!empty($employeeData)) {
                log_message('info', 'Employee found: ID = ' . $employeeData['id']);

                $updateData = [
                    'mpin' => null,
                    'is_mpin_skipped' => null,
                    'is_biometric_enabled' => null
                ];

                log_message('info', 'Updating employee MPIN fields to null for ID: ' . $employeeData['id']);

                $updated = $this->employeeModel->where('id', $employeeData['id'])->set($updateData)->update();

                if ($updated) {
                    $this->callThirdPartyAPI($json, 'forgotMPIN');
                    log_message('info', 'MPIN reset successful for employee ID: ' . $employeeData['id']);
                    log_message('error', '  ');
                    log_message('error', '************************ PRE END ********************************');
                    return $this->respond(['status' => 'success','code' => 200,'message' => 'MPIN reset successfully.' ], 200);
                } else {
                    log_message('error', 'Failed to update MPIN fields for employee ID: ' . $employeeData['id']);
                    log_message('error', '  ');
                    log_message('error', '************************ PRE END ********************************');
                    return $this->respond([
                        'status' => 'failed',
                        'code' => 500,
                        'message' => 'Could not reset MPIN values.',
                    ], 500);
                }
            } else {
                // Step 4: Not found in local DB — call external fallback
                log_message('warning', 'Employee not found locally. Falling back to third-party API.');
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                return $this->callThirdPartyAPI($json, 'forgotMPIN');
            }
        } catch (\Throwable $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() . " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', '************************ PRE END ********************************');
            return $this->respond(['status' => 'failed','code' => 500,'message' => 'Server error: ' . $e->getMessage() ], 500);
        }
    }

    public function logHrActivity()
    {
        $log_data = $this->request->getJSON();
        $postDB = \Config\Database::connect('postDB');
        // print_r($json);die();
        $postDB->table('user_activity_history')->insert($log_data);
        return $this->respond(['status' => 'success','code' => 200,'data' => "logged",],200);

    }

    // -------------- EMP MOBILE NUMBER UPDATE API'S -------------------------------------------------------------------------------------------------------------

    public function updateMobileNumber()
    {
        log_message('error', '  ');
        log_message('error', ' ************************************* UPDATE MOBILE START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $payload = $this->request->getJSON(true);

            $email_id       = $payload['email_id'] ?? null;
            $new_mobile     = $payload['new_mobile_number'] ?? null;

            if (empty($email_id) || empty($new_mobile)) {
                return $this->respond([
                    'status'  => 'failed',
                    'code'    => 400,
                    'message' => 'Email ID and new mobile number are required'
                ], 400);
            }

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: No employee data found both PRE & POST");
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');
                $result = ['user_verification' => false , 'message' => "User not found"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Using PRE data");
            } 

            if (isset($employeeData['employee_id'])) 
            {
                // Update mobile number
                $updated = $this->employeeModel->update($employeeData['employee_id'], [
                    'mobile' => $new_mobile,
                ]);

                if ($updated) {

                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Mobile number updated successfully");
                    log_message('error', '  ');
                    log_message('error', ' ************************************* UPDATE MOBILE END **************************************** ');
                    log_message('error', '  ');

                     //If post-enrollment data exist update the same mobile number from pre-enrollment.
                    if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {

                        $payload['client_id'] = $empdata['post']['client_id']; 
                        $payload['employee_id'] = $empdata['post']['employee_id']; 
                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Client_id and employee_id from POST data to update the Mobile number");

                        $this->callThirdPartyAPI($payload, 'updateMobileNumber');
                        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Calling callThirdPartyAPI for updateMobileNumber");
                    }

                    return $this->respond([
                        'status'  => 'success',
                        'code'    => 200,
                        'message' => 'Mobile number updated successfully',
                    ], 200);

                } else {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Failed to update mobile number");
                    return $this->respond([
                        'status'  => 'failed',
                        'code'    => 500,
                        'message' => 'Failed to update mobile number'
                    ], 500);
                }
                
            }else{

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Employee not found with email in the PRE DATABASE, falling back to third-party API");

                // Call the third-party API function
                if (!empty($empdata['post']['client_id'])) {
                    $payload->client_id = $empdata['post']['client_id']; 
                }
                return $this->callThirdPartyAPI($payload, 'updateMobileNumber');
                log_message('error', '  ');
                log_message('error', '************************ PRE END ********************************');

            }

        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Exception: " . $th->getMessage());

            $errorData = [
                'message' => $th->getMessage(),
                'file'    => $th->getFile(),
                'line'    => $th->getLine(),
                'code'    => $th->getCode(),
                'trace'   => $th->getTraceAsString(),
                'trace_array' => $th->getTrace(), // full array version (optional)
                'function' => $th->getTrace()[0]['function'] ?? null,
                'class' => $th->getTrace()[0]['class'] ?? null,
            ];

            return $this->respond([
                'status'  => 'failed',
                'code'    => 500,
                'message' => 'Exception occurred',
                'error_data' => $errorData
            ], 500);
        }
    }

    // ------------------------------------------------------------------------------------------------------------------------------------------------------------

    public function savePassword()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Received payload = " . json_encode($this->request->getJSON() ?? []));
        try {

            $payload = $this->request->getJSON();
            // print_r($payload); die;
            $mobile_number = $payload->mobile_number ?? null;
            $email_id = $payload->email_id ?? null;
            $client_id = $payload->client_id ?? null;
            $plain_password = $payload->password ?? null;
            $confirm_password = $payload->confirm_password ?? null;

            if (empty($plain_password) || empty($confirm_password)) {
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'Both password cannot be empty'], 400);
            }

            if($plain_password !== $confirm_password){
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'Password and confirm password not matched'], 400);
            }

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number ]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: No employee data found both PRE and POST");
                $result = ['user_verification' => false , 'message' => "User not found"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: empdata = " . json_encode($empdata));

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Using PRE data from empdata");
            } 

            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $payload->client_id = $empdata['post']['client_id']; 
                $payload->employee_id = $empdata['post']['employee_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Added client_id & employee_id to requestData to get the POST employee data");
            }

            if (isset($employeeData['employee_id'])) {

                $id = $employeeData['employee_id'];
                $hashedPassword = password_hash($plain_password, PASSWORD_DEFAULT);

                $updateData = [
                    'password' => $hashedPassword,
                ];

                $updated = $this->employeeModel->where('id', $id)->set($updateData)->update();

                if ($updated) {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Password saved successfully");
                    $this->callThirdPartyAPI($payload, 'savePassword');
                    $result = ['user_verification' => true, 'message' => "Password saved successfully"];
                    return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                } else {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Password save failed");
                    $result = ['user_verification' => true, 'message' => "Password not saved"];
                    return $this->respond(['status' => 'failed', 'code' => 500, 'data' => $result], 200);
                }
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Employee not found with email or mobile in the PRE DATABASE, falling back to third-party API");
                $result = ['user_verification' => false, 'message' => "User not found"];
                return $this->callThirdPartyAPI($payload, 'savePassword');
            }

        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() . " --- Trace: " . $th->getTraceAsString());
            $errorData = [
                'message' => $th->getMessage(),
                'file'    => $th->getFile(),
                'line'    => $th->getLine(),
                'code'    => $th->getCode(),
                'trace'   => $th->getTraceAsString(),
                'trace_array' => $th->getTrace(), // full array version (optional)
                'function' => $th->getTrace()[0]['function'] ?? null,
                'class' => $th->getTrace()[0]['class'] ?? null,
            ];
            return $this->respond(['status' => 'failed', 'code' => 500, 'message' => $th->getMessage(), 'error_data' => $errorData], 500);
        }
    }

    public function changePassword()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - changePassword: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $payload = $this->request->getJSON(true);
            $mobile_number = $payload['mobile_number'] ?? null;
            $email_id      = $payload['email_id'] ?? null;
            $client_id     = $payload['client_id'] ?? null;
            $old_password  = $payload['old_password'] ?? null;
            $new_password  = $payload['new_password'] ?? null;
            $confirm_password  = $payload['confirm_password'] ?? null;

            if (empty($new_password) || empty($confirm_password) || empty($old_password)) {
                return $this->respond(['status' => 'failed', 'code'   => 400, 'message' => 'old_password , New password and Confirm password are required' ], 400);
            }

            // Fetch employee details
            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number ]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: No employee data found both PRE and POST");
                $result = ['user_verification' => false , 'message' => "User not found"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: empdata = " . json_encode($empdata));

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Using PRE data from empdata");
            } 

            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $payload['client_id'] = $empdata['post']['client_id']; 
                $payload['employee_id'] = $empdata['post']['employee_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Added client_id & employee_id to requestData to get the POST employee data");
            }

            if (isset($employeeData['employee_id']) && password_verify($old_password, $employeeData['password'])) {

                // Hash new password
                $newHashedPassword = password_hash($new_password, PASSWORD_DEFAULT);

                // Update password and clear OTP
                $updated = $this->employeeModel->update($employeeData['employee_id'], [
                    'password' => $newHashedPassword,
                ]);

                if ($updated) {
                    
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - changePassword: Password updated successfully");

                    // Call the third-party API function
                    $this->callThirdPartyAPI($payload, 'changePassword');
                    return $this->respond(['status' => 'success','code' => 200,'message' => 'Password changed successfully' ], 200);
                } else {
                    return $this->respond(['status' => 'failed','code' => 500,'message' => 'Failed to update password'], 500);
                }

            }else{

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - changePassword: Employee not verified - calling third-party API fallback to get the POST employee data"); 

                // Call the third-party API function
                return $this->callThirdPartyAPI($payload, 'changePassword');
            }

        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - changePassword: Exception: " . $th->getMessage());
            return $this->respond(['status' => 'failed', 'code' => 500, 'message' => $th->getMessage()], 500);
        }
    }

    public function verifyPassword()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $requestData   = $this->request->getJSON(true);
            $mobile_number = $requestData['mobile_number'] ?? null;
            $email_id      = $requestData['email_id'] ?? null;
            $client_id     = $requestData['client_id'] ?? null;
            $password      = $requestData['password'] ?? null;

            if (!$password) {
                return $this->respond(['status' => 'failed', 'code' => 400, 'data' => "", 'message' => 'Password is required'], 400);
            }

            // 🔹 Fetch employee data
            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: No employee data found both PRE and POST");
                return $this->respond(['status' => 'failed', 'code'   => 404, 'data' => ""], 200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: empdata = " . json_encode($empdata));

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Using PRE data from empdata");
            } 

            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData['client_id'] = $empdata['post']['client_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Added client_id to requestData to get the POST employee data");
            }

            // 🔹 Verify password hash
            if (isset($employeeData['employee_id']) && password_verify($password, $employeeData['password'])) {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Verified employee found");

                // ✅ Log authentication info
                $auth = HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $this->authHistoryModel->insert([
                        'user_id'  => $employeeData['employee_id'],
                        'user_type' => 'employee',
                        'ip'       => $auth['ip'],
                        'platform' => $auth['platform'],
                        'broswer'  => $auth['browser'],
                    ]);
                }

                // ✅ Generate JWT token
                unset($employeeData['employee_id']);
                $employeeData['token_type'] = "pre";
                $token = JWTToken::encode($employeeData);

                // Call the third-party API function
                $apiResponse = $this->callThirdPartyAPI($requestData, 'verifyPassword');
                return $this->respond(['status' => 'success', 'code' => 200, 'data' => $token, 'post_enrollment' => json_decode($apiResponse, true)], 200);

            } else {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Employee not verified - calling third-party API fallback to get the POST employee data"); 

                // Call the third-party API function
                $apiResponse = $this->callThirdPartyAPI($requestData, 'verifyPassword');
                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => "", 'post_enrollment' => json_decode($apiResponse, true)], 200);
            }
            
        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine());
            $errorData = [
                'message' => $th->getMessage(),
                'file'    => $th->getFile(),
                'line'    => $th->getLine(),
                'code'    => $th->getCode(),
                'trace'   => $th->getTraceAsString(),
                'trace_array' => $th->getTrace(), // full array version (optional)
                'function' => $th->getTrace()[0]['function'] ?? null,
                'class' => $th->getTrace()[0]['class'] ?? null,
            ];
            return $this->respond(['status' => 'failed', 'code' => 500, 'data' => "", 'message' => $th->getMessage(), 'error_data' => $errorData], 500);
        }
    }

    public function verifyOtp()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $requestData = $this->request->getJSON(true);
            $mobile_number = $requestData['mobile_number'] ?? null;
            $email_id      = $requestData['email_id'] ?? null;
            $client_id     = $requestData['client_id'] ?? null;
            $otp      = $requestData['otp'] ?? null;

            if (!$otp) {
                return $this->respond(['status' => 'failed', 'code' => 400, 'data' => "", 'message' => 'OTP is required'], 400);
            }

            // 🔹 Fetch employee data
            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: No employee data found both PRE and POST");
                return $this->respond(['status' => 'failed', 'code'   => 404, 'data' => ""], 200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: empdata = " . json_encode($empdata));

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Using PRE data from empdata");
            } 

            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData['client_id'] = $empdata['post']['client_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Added client_id to requestData to get the POST employee data");
            }

            // 🔹 Verify password hash
            if ($employeeData && $employeeData['otp'] == $otp) {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Verified employee found");
                $this->employeeModel->where('id', $employeeData['id'])->where('otp', $otp)->where('relationship', 'self')->set(['otp'=>null])->update();
                return $this->respond(['status' => 'success', 'code' => 200, 'message' => "OTP verified succesfully"], 200);

            } else {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Employee not verified - calling third-party API fallback to get the POST employee data"); 

                // Call the third-party API function
                return $this->callThirdPartyAPI($requestData, 'verifyOtp');
            }
            
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine());
            return $this->respond(['status' => 'failed', 'code' => 500, 'data' => "", 'message' => $e->getMessage()], 500);
        }
    }

    public function checkPassword()
    { 
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Request payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $payload = $this->request->getJSON() ?? [];
            $mobile_number = $payload->mobile_number ?? null;
            $email_id      = $payload->email_id ?? null;

            $empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'mobile_number' => $mobile_number, 'check_mpin' => true]); 
            // print_r($empdata); die;

            if(empty($empdata)){
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: No employee data found both PRE and POST");
                return $this->respond(['status' => 'failed','code' => 404,'data' => "Mpin - not found", 'Mpin' =>null],200);
            }

            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: empdata = " . json_encode($empdata));

            $employeeData = [];
            if (isset($empdata['pre']) && !empty($empdata['pre'])) {
                $employeeData = $empdata['pre'];
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Using PRE data from empdata");
            } 

            $requestData = $this->request->getJSON();
            if (isset($empdata['post']['client_id']) && !empty($empdata['post']['client_id'])) {
                $requestData->client_id = $empdata['post']['client_id']; 
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Added client_id to requestData to get the POST employee data");
            }
            
            
            if ($employeeData &&  $employeeData["password"] != null) {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Mpin - Exist");
                return $this->respond(['status' => 'success','code' => 200,'data' => "", 'message' => "Password - exist"],200);
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Password - not found in PRE so call the thirdpartapi to the POST to check the MPIN");
                return $this->callThirdPartyAPI($requestData, 'checkPassword');
            }
            
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() . " --- Trace: " . $e->getTraceAsString());
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $e->getMessage()],500);
        }
    }


    public function logout()
    {
        return $this->respond([
            'status'  => true,
            'message' => 'Logged out successfully'
        ], 200);
        
        $authHeader = $this->request->getHeaderLine('Authorization');

        if (!$authHeader) {
            return $this->respond([
                'status'  => false,
                'message' => 'Authorization token missing'
            ], 401);
        }

        // Validate JWT (your hardened function)
        $result = JWTToken::validateJWT($authHeader);

        if ($result['status'] !== true) {
            return $this->respond([
                'status'  => false,
                'message' => 'Invalid or expired token'
            ], 401);
        }

        $decoded = $result['decoded'];
        $userId  = $decoded['pre_hr_id'] ?? null;

        if (!$userId) {
            return $this->respond([
                'status'  => false,
                'message' => 'Invalid token payload'
            ], 401);
        }

        // Identify user type
        if (isset($decoded['emp_code'])) {
            $model = new EmployeeModel();
        } else {
            $model = new LevelContactModel();
        }

        // Invalidate token server-side
        $model->update($userId, [
            'token_time_out' => null
        ]);

        return $this->respond([
            'status'  => true,
            'message' => 'Logged out successfully'
        ], 200);
    }


    public function resetTokenTimeOutOLD($bufferSeconds = null)
    {
        if (!is_cli()) {
            return $this->respond([
                'status'  => false,
                'message' => 'This endpoint is CLI only.'
            ], 403);
        }

        $envBuffer = (int) (getenv('TOKEN_TIMEOUT_RESET_BUFFER_SECONDS') ?: 300);
        $buffer = is_numeric($bufferSeconds) ? (int) $bufferSeconds : $envBuffer;
        if ($buffer < 0) {
            $buffer = 0;
        }

        $cutoffEpoch = time() - $buffer;
        $db = db_connect();

        $db->table('level_contacts')
            ->where('token_time_out IS NOT NULL', null, false)
            ->where('token_time_out <=', $cutoffEpoch)
            ->set(['token_time_out' => null])
            ->update();
        $levelContactsUpdated = $db->affectedRows();

        $db->table('employees')
            ->where('token_time_out IS NOT NULL', null, false)
            ->where('token_time_out <=', $cutoffEpoch)
            ->set(['token_time_out' => null])
            ->update();
        $employeesUpdated = $db->affectedRows();

        $result = [
            'status' => true,
            'message' => 'Token timeout reset completed.',
            'buffer_seconds' => $buffer,
            'cutoff_epoch' => $cutoffEpoch,
            'updated' => [
                'level_contacts' => $levelContactsUpdated,
                'employees' => $employeesUpdated,
                'total' => $levelContactsUpdated + $employeesUpdated,
            ],
        ];

        echo json_encode($result, JSON_UNESCAPED_SLASHES) . PHP_EOL;
        return;
    }


     /**
     * Cron: clear expired token_time_out on active employees (epoch expiry + buffer).
     *
     * Buffer default: 3 minutes. Override in .env: TOKEN_TIMEOUT_RESET_BUFFER_SECONDS
     *
     * php public/index.php cli/reset-token-timeout
     */
    public function resetTokenTimeOut()
    {
        if (! is_cli()) {
            return $this->respond([
                'status'  => false,
                'message' => 'This endpoint is CLI only.',
            ], 403);
        }

        $buffer = (int) (getenv('TOKEN_TIMEOUT_RESET_BUFFER_SECONDS')
            ?: self::RESET_TOKEN_TIMEOUT_BUFFER_SECONDS_DEFAULT);
        if ($buffer < 0) {
            $buffer = self::RESET_TOKEN_TIMEOUT_BUFFER_SECONDS_DEFAULT;
        }

        $cutoffEpoch              = time() - $buffer;
        $resetTokenTimeoutCronRan = date('Y-m-d H:i:s');

        $rows = $this->employeeModel
            ->select('id')
            ->where('token_time_out IS NOT NULL', null, false)
            ->where('is_active', 1)
            ->where('emp_status', 'active')
            ->where('token_time_out <=', $cutoffEpoch)
            ->findAll();

        $employeeIds = array_map(static fn (array $row): int => (int) $row['id'], $rows);

        if ($employeeIds !== []) {
            $this->employeeModel
                ->whereIn('id', $employeeIds)
                ->set(['token_time_out' => null])
                ->update();
        }

        $logPayload = $employeeIds !== []
            ? json_encode([
                'employee_ids'                      => $employeeIds,
                'reset_token_timeout_cron_ran_at' => $resetTokenTimeoutCronRan,
            ])
            : json_encode(['reset_token_timeout_cron_ran_at' => $resetTokenTimeoutCronRan]);

        $this->myLogger->logme('error', 'reset-token-timeout cron: ' . $logPayload);

        $result = [
            'status'                          => true,
            'message'                         => 'Token timeout reset completed.',
            'buffer_seconds'                  => $buffer,
            'cutoff_epoch'                    => $cutoffEpoch,
            'reset_token_timeout_cron_ran_at' => $resetTokenTimeoutCronRan,
            'updated'        => [
                'employees'    => count($employeeIds),
                'employee_ids' => $employeeIds,
            ],
        ];

        echo json_encode($result, JSON_UNESCAPED_SLASHES) . PHP_EOL;
    }


    public function getSamlDomainsList()
    {
        try {

            $samlDomains = db_connect()
                ->table('saml_client')
                ->select('email_domain')
                ->get()
                ->getResultArray();

            return $this->respond([
                'status' => 'success',
                'code'   => 200,
                'data'   => array_column($samlDomains, 'email_domain'),
            ], 200);

        } catch (\Throwable $th) {
            
            log_message('error', 'REST-AUTH-CONTROLLER - getSamlDomainsList error: ' . $th->getMessage());
            return $this->respond([
                'status'  => 'failed',
                'code'    => 500,
                'message' => 'Unable to fetch SAML domains at the moment.',
            ], 500);
        }
    }
}