nhance/app/Controllers/RestAuthenticationController.php

<?php

// declare(strict_types=1);


namespace App\Controllers;
use App\Helpers\MailHelper;
use App\Controllers\LoginController;
use App\Helpers\DepositHelper;
use App\Helpers\JWTToken;
use App\Helpers\HttpRequestHelper;

use CodeIgniter\HTTP\IncomingRequest;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use Psr\Log\LoggerInterface;
use CodeIgniter\API\ResponseTrait;



use App\Models\EmployeeModel;
use App\Models\AuthHistoryModel;
use App\Models\LevelContactModel;
use App\Models\HRAccessControlModel;
use App\Models\ClientModel;
use App\Models\UserActivityHistoryModel;

use Firebase\JWT\JWT;
use Firebase\JWT\JWK;
use GuzzleHttp\Client;

// require_once('../vendor/autoload.php');



class RestAuthenticationController extends AdminController
{   
    use ResponseTrait;

    /** Default grace period after token_time_out epoch before cron clears it (seconds). */
    private const RESET_TOKEN_TIMEOUT_BUFFER_SECONDS_DEFAULT = 180;

    protected $myLogger;
    protected $employeeModel;
    protected $authHistoryModel;
    protected $hrModel;
    protected $hrAccessControlModel;
    protected $clientModel;
    protected $userActivityHistoryModel;

    
    public function __construct()
    {
        // set_session_context('Client');
        $this->myLogger = \Config\Services::mylogger();

        $this->employeeModel       = new EmployeeModel();
        $this->authHistoryModel    = new AuthHistoryModel();
        $this->hrModel    = new LevelContactModel();
        $this->hrAccessControlModel    = new HRAccessControlModel();
        $this->clientModel    = new ClientModel();
        $this->userActivityHistoryModel    = new UserActivityHistoryModel();
                
    }

    public function index()
    {   
        $this->myLogger->logme('error','Rest Authentication function called');
        $data =["id"=>"2", "role"=>"staff"];

        print_r(JWTToken::encode($data));
    }

    public function logined()
    {

        $this->myLogger->logme('error','Rest Authentication function called');

        echo "Rest Authentication Logined Success........";
    }




    public function verifyEmployeeWithMobileNumber()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Verify Employee With Mobile Number: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {
            $mobile_number = $this->request->getJSON()->mobile_number;
            $otp = $this->request->getJSON()->otp;
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Received mobile_number = " . $mobile_number);
          

            $employeeData = $this->employeeModel->select('employees.relationship,EP.employee_id')
                                    ->join('employee_polices EP', 'EP.employee_id = employees.id', 'inner') 
                                    ->where('employees.is_active', 1)
                                    ->where('employees.relationship', 'self')
                                    ->where('employees.emp_status !=', 'truncated')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('EP.is_active', 1)
                                    ->whereIn('EP.status', ['active', 'expired'])
                                    ->orderBy('employees.id', 'desc')
                                    ->first();

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: employeeData: " . json_encode($employeeData ?? []));        
        
            if (isset($employeeData['employee_id'])) 
            {

                //check the resend otp (with in 60 seconds don't allow another otp to send)
                $check = canSendOtp($employeeData);
                if (!$check['allowed']) {
                    return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests

                }

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Employee verified with ID = " . $employeeData['employee_id']);
                log_message('error', '  ');
                log_message('error', '************************ POST END ********************************');

               
                $sql = "
                    UPDATE employees
                    INNER JOIN employee_polices ON employee_polices.employee_id = employees.id
                    SET employees.otp = ?
                    WHERE employees.id = ?
                    AND employees.relationship = 'self'
                    AND employees.is_active = 1
                    AND employee_polices.is_active = 1
                    AND employee_polices.status IN ('active', 'expired')
                ";

                $db = db_connect();
                $update = $db->query($sql, [$otp, $employeeData['employee_id']]);

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: OTP update query executed. SQL = " . $db->getLastQuery());

                if($update)
                {
                    //send sms 
                    $SMSResult = sendOtpSms($mobile_number, $otp);
                    if ($SMSResult['status'] == 'success') 
                    {
                        $result = ['user_verification' => true ,'message' => "Verified Successfully" ];
                        return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
                    }else{
                        $result = ['user_verification' => false, 'message' => "SMS sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }

                }else{

                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: OTP update query Failed. SQL = " . $db->getLastQuery());

                    $result = ['user_verification' => false, 'message' => "Try again. , try again"];
                    return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);

                }

            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: No matching employee found");
                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');
                $result = ['user_verification' => false , 'message' => "User not found"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);

            }
        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithMobileNumber: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() .  " --- Trace: " . $th->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond(['status' => 'failed','code' => 500,'data' => $th->getMessage()],500);
        }
    }

    public function verifyEmployeeWithEmailId()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Verify Employee With EmailId: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Received payload = " . json_encode($this->request->getJSON() ?? []));


        try {

            $email = $this->request->getJSON()->email;
            $otp = $this->request->getJSON()->otp;
            $client_id = $this->request->getJSON()->client_id ?? null;


            $builder = $this->employeeModel->select('
                employees.relationship,
                EP.employee_id,
                employees.client_id,
                employees.client_branch_id,
                employees.email_corporate

            ')
                ->join('employee_polices EP', 'EP.employee_id = employees.id', 'inner')
                ->where('employees.is_active', 1)
                ->where('employees.relationship', 'Self')
                ->whereIn('employees.emp_status', ['active', 'expired'])
                ->where('employees.email_corporate', $email)
                ->where('EP.is_active', 1)
                ->whereIn('EP.status', ['active', 'expired']);

            if (!empty($client_id)) {
                $builder->where('employees.client_id', $client_id);
            }

            $builder->orderBy('employees.id', 'desc');
            $employeeData = $builder->first();

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: employeeData: " . json_encode($employeeData ?? []));        


            if (isset($employeeData['employee_id'])) {

                //check the resend otp (with in 60 seconds don't allow another otp to send)
                $check = canSendOtp($employeeData);
                if (!$check['allowed']) {
                    return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests
                }


                $builder = $this->employeeModel
                    ->where('email_corporate', $email)
                    ->where('relationship', 'Self')
                    ->where('is_active', 1)
                    ->where('id', $employeeData['employee_id']);

                if (!empty($client_id)) {
                    $builder->where('client_id', $client_id);
                }

                $update = $builder->set(['otp' => $otp])->update();
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: OTP update query executed. SQL = " . db_connect()->getLastQuery());

                    
                if ($update) {

                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: OTP updated successfully in POST DATABASE");
                    $common = [
                        'client_id' => $employeeData['client_id'],
                        'client_branch_id' => $employeeData['client_branch_id'],
                        'client_policy_id' => null,
                        'employee_policy_id' =>  null,
                        'employee_id' => $employeeData['employee_id'],
                        'mail_type' => 'otp_mail',
                    ];
                    $subject = 'Nhance user verification - OTP';
                    $mail_content = $otp . ' is your verification code for Nhance.';
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Sending OTP email to " . $employeeData['email_corporate']);
                    $res = MailHelper::send_email(['mail' => $employeeData['email_corporate'], 'subject' => $subject, 'common' => $common, 'message' => $mail_content]);
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Mail response = " . $res);

                    if (json_decode($res)->status == 'success') {
                        log_message('error', '  ');
                        log_message('error', ' ************************************* POST END **************************************** ');
                        log_message('error', '  ');
                        $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                        return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                    } else {
                        log_message('error', '  ');
                        log_message('error', ' ************************************* POST END **************************************** ');
                        log_message('error', '  ');
                        $result = ['user_verification' => false, 'message' => "Mail sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }
                } else {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: OTP update failed in POST DATABASE");
                    log_message('error', '  ');
                    log_message('error', ' ************************************* POST END **************************************** ');
                    log_message('error', '  ');
                    $result = ['user_verification' => false, 'message' => "Verification failed , try again"];
                    return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                }

            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Employee not found with email in the POST DATABASE");
                $result = ['user_verification' => false, 'message' => "User not found"];
                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
            }

        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() .  " --- Trace: " . $th->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond(['status' => 'failed', 'code' => 500, 'data' => $th], 500);
        }
    }

    public function updateEmpOTP()
    {   

        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Update Employee OTP: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateEmpOTP: Received payload = " . json_encode($this->request->getJSON() ?? []));

        
        $email = $this->request->getJSON()->email ?? null;
        $mobile_number = $this->request->getJSON()->mobile_number ?? null;
        $otp = $this->request->getJSON()->otp;
        $client_id = $this->request->getJSON()->client_id ?? null;
        $employee_id = $this->request->getJSON()->employee_id ?? null;

        $builder = $this->employeeModel
            ->where('relationship', 'Self')
            ->where('is_active', 1);

        if (!empty($email)) {
            $builder->where('email_corporate', $email);
        }

        if (!empty($mobile_number)) {
            $builder->where('mobile', $mobile_number);
        }


        if (!empty($client_id)) {
            $builder->where('client_id', $client_id);
        }

        if (!empty($employee_id)) {
            $builder->where('id', $employee_id);
        }

        $update = $builder->set(['otp' => $otp])->update();

        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateEmpOTP: Update result = " . json_encode($update));
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateEmpOTP: Last SQL = " . db_connect()->getLastQuery());

        log_message('error', '  ');
        log_message('error', ' ************************************* POST END **************************************** ');
        log_message('error', '  ');

        return true;

    }

 
    public function updateEmpMPIN()
    {
        try {
            log_message('error', 'MPIN update request received.');

            $requestData = $this->request->getJSON();
            log_message('debug', 'Request data: ' . json_encode($requestData));

            $client_id = $requestData->client_id ?? null;
            $employee_id = $requestData->employee_id ?? null;
            $mpin = $requestData->mpin ?? null;

            if (!$mpin) {
                log_message('error', 'MPIN is missing.');
                return $this->response->setJSON(['status' => false, 'message' => 'MPIN is required.']);
            }

            if (!$employee_id) {
                log_message('error', 'employee_id is missing.');
                return $this->response->setJSON(['status' => false, 'message' => 'employee_id is required.']);
            }

            $updated = $this->employeeModel->where('id', $employee_id)->set(['mpin' => $mpin])->update();

            if ($updated) {
                log_message('error', "MPIN updated successfully for employee ID: {$employee_id}");
                return $this->response->setJSON([
                    'status' => true,
                    'message' => 'MPIN updated successfully.'
                ]);
            } else {
                log_message('error', "Failed to update MPIN for employee ID: {$employee_id}");
                return $this->response->setJSON([
                    'status' => false,
                    'message' => 'Failed to update MPIN.'
                ]);
            }
        } catch (\Exception $e) {
            log_message('critical', 'Exception in updateEmpMPIN: ' . $e->getMessage());
            return $this->response->setJSON([
                'status' => false,
                'message' => 'Unexpected error occurred.',
                'error' => $e->getMessage()
            ]);
        }
    }

    public function getVerifiedUserData()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Get Verified User Data: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {
           
            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            $otp = isset($this->request->getJSON()->otp) ? $this->request->getJSON()->otp : null;
            $client_id = $this->request->getJSON()->client_id ?? null;

            if(empty($otp)){
                return $this->respond(['status' => 'OTP is required','code'   => 400,'message' => 'OTP is required'], 200);
            }

            if (empty($mobile_number) && empty($email_id)) {
                return $this->respond(['status' => 'failed','code'   => 400,'message' => 'Mobile number or Email ID is required'], 200);
            }

            if (isset($mobile_number)) 
            {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('relationship', 'self')->where('emp_status !=', 'truncated')->where('is_active', 1)->first();
                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.mobile', $mobile_number)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active', 'expired'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active', 'expired'])
                    ->where('otp', $otp);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('otp', $otp)->where('relationship', 'self')->where('emp_status !=', 'truncated')->where('is_active', 1)->first();
                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.email_corporate', $email_id)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active', 'expired'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active', 'expired'])
                    ->where('otp', $otp);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();
            }   
            
            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: employeeData: " . json_encode($employeeData ?? []));        

            
            if ($employeeData && isset($this->request->getJSON()->otp) ) 
            {
                $auth =  HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $data = [
                       'user_id' => $employeeData['id'],
                       'user_type' => 'employee',
                       'ip' => $auth['ip'],
                       'platform' => $auth['platform'],
                       'broswer' => $auth['browser'],
                    ];
                     $this->authHistoryModel->insert($data);                    
                }
              
                $employeeData['token_type'] = "post";
                $result = JWTToken::encode($employeeData);

                if(isset($this->request->getJSON()->otp)){ 
                    $this->employeeModel->where('id', $employeeData['id'])->where('otp', $otp)->where('relationship', 'self')->set(['otp'=>null])->update();
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Reset the otp to null");
                }

                log_message('error', '  '); 
                log_message('error', '************************ POST END ********************************');
                log_message('error', '  '); 

                return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);

            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Employee not verified POST"); 
                log_message('error', '  '); 
                log_message('error', '************************ POST END ********************************');
                log_message('error', '  '); 
                return $this->respond(['status' => 'failed','code' => 404,'data' => "", 'message' => 'Invalid OTP'],200);
            }
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() .  " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => "Invalid OTP", 'error' =>  $e->getMessage()],500);
        }
    }








    public function verifyHrWithMobileNumber()
    {
        try {
            $data = $this->request->getJSON();

            $mobile_number = $data->mobile_number;
            $otp = $data->otp;

            $HrData = $this->hrModel->where('mobile', $mobile_number)
                                    ->where('contact_type', 'client')
                                    ->where('is_active', 1)
                                    ->first();


            if ($HrData) {

                    //check the resend otp (with in 60 seconds don't allow another otp to send)
                    $check = canSendOtp($HrData);
                    if (!$check['allowed']) {
                        return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests
                    }
                
                    $sql = "UPDATE level_contacts SET otp = ? WHERE mobile = ? AND contact_type = 'client' AND is_active = 1";

                    $db = db_connect();
                    $update = $db->query($sql, [$otp, $mobile_number]);

                    if($update)
                    {
                        
                        //send sms 
                        $SMSResult = sendOtpSms($mobile_number, $otp);
                        if ($SMSResult['status'] == 'success') 
                        {
                            $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                            return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                        } else {
                            $result = ['user_verification' => false, 'message' => "SMS sending failed , try again"];
                            return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                        }

                    }else {
                        $result = ['user_verification' => false, 'message' => "SMS sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }

            } else {
                $result = ['user_verification' => false , 'message' => "User not found"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);

            }
        } catch (\Throwable $th) {
            return $this->respond(['status' => 'failed','code' => 500,'data' => $th],500);
        }
    }

    public function verifyHrWithEmail()
    {   
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyHrWithEmail: Received payload = " . json_encode($this->request->getJSON() ?? []));
        try {

            $data = $this->request->getJSON();
            $email = $data->email;
            $otp = $data->otp;
           
            $HrData = $this->hrModel->where('email', $email)
                                    ->where('contact_type', 'client')
                                    ->where('is_active', 1)
                                    ->first();
          
            if ($HrData) {

                //check the resend otp (with in 60 seconds don't allow another otp to send)
                $check = canSendOtp($HrData);
                if (!$check['allowed']) {
                    return $this->respond(['status'  => false,'message' => 'OTP already sent. Please wait before retrying.','retry_after_seconds' => $check['retry_after']], 429); // Too Many Requests
                }

                $sql = "
                        UPDATE level_contacts
                        SET otp = ?
                        WHERE email = ?
                        AND contact_type = 'client'
                        AND is_active = 1
                    ";

                $db = db_connect();
                $update = $db->query($sql, [$otp, $email]);

                if($update)
                {
                   
                   
                    $common = [
                        'login_type' => 'HR login',
                        'login_email' => $email,
                        'mail_type' => 'otp_mail'
                    ];
                    $subject = 'Nhance user verification - OTP';
                    $mail_content = $otp . ' is your verification code for Nhance.';
                    $res = MailHelper::send_email(['mail' => $email, 'subject' => $subject, 'common' => $common, 'message' => $mail_content]);
                    $this->myLogger->logme("error", $res);

                    if (json_decode($res)->status == 'success') {
                        $result = ['user_verification' => true, 'message' => "Verified Successfully"];
                        return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                    } else {
                        $result = ['user_verification' => false, 'message' => "Mail sending failed , try again"];
                        return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                    }
                } else {

                    $result = ['user_verification' => false, 'message' => "Verification failed , try again"];
                    return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
                }

            } else {
                $result = ['user_verification' => false, 'message' => "User not found"];
                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
            }
        } catch (\Throwable $th) {
             $errorData = [
                'message' => $th->getMessage(),
                'file'    => $th->getFile(),
                'line'    => $th->getLine(),
                'code'    => $th->getCode(),
                'trace'   => $th->getTraceAsString(),
                'trace_array' => $th->getTrace(), // full array version (optional)
                'function' => $th->getTrace()[0]['function'] ?? null,
                'class' => $th->getTrace()[0]['class'] ?? null,
            ];
            log_message('error', 'Error Data: ' . json_encode($errorData));
            return $this->respond(['status' => 'failed','code' => 500,'data' => $th],500);
        }
    }

    public function updateHROTP()
    {
       
        $email = $this->request->getJSON()->email ?? null;
        $mobile_number = $this->request->getJSON()->mobile_number ?? null;
        $otp = $this->request->getJSON()->otp ?? null;

       

        $builder = $this->hrModel
            ->where('contact_type', 'client')
            ->where('is_active', 1);

        if (!empty($email)) {
            $builder->where('email', $email);
        } elseif (!empty($mobile_number)) {
            $builder->where('mobile', $mobile_number);
        }

        $builder->set(['otp' => $otp])->update();

        if ($this->hrModel->db->affectedRows() > 0) {
            return true;
        }

      
    }

    

    public function getVerifiedHrData()
    {
        try {

            $otp = isset($this->request->getJSON()->otp) ? $this->request->getJSON()->otp : null;
            $email = isset($this->request->getJSON()->email) ? $this->request->getJSON()->email : null;
            $mobile_number = isset($this->request->getJSON()->mobile_no) ? $this->request->getJSON()->mobile_no : null;

            if (isset($mobile_number)) 
            {
                $hrData = $this->hrModel->where('mobile', $mobile_number)->where('contact_type', 'client')->where('is_active', 1)->where('otp', $otp)->first();
            }else{
                $hrData = $this->hrModel->where('email', $email)->where('contact_type', 'client')->where('is_active', 1)->where('otp', $otp)->first();
            }

            if ($hrData) 
            {

                $auth =  HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $data = [
                       'user_id' => $hrData['id'],
                       'user_type' => 'hr',
                       'ip' => $auth['ip'],
                       'platform' => $auth['platform'],
                       'broswer' => $auth['browser'],
                    ];

                    $this->authHistoryModel->insert($data);
                                        
                }


                if(isset($this->request->getJSON()->mobile_no)){ 

                    $getAllhrData = $this->hrModel->select('level_contacts.id ,level_contacts.mobile , level_contacts.email , clients.id as client_id, clients.client_name, clients.short_name , client_branch.id as client_branch_id,client_branch.branch_name , client_branch.pre_branch_id')
                                            ->join('client_branch', 'level_contacts.ref_id = client_branch.id', 'left')
                                            ->join('clients', 'client_branch.client_id = clients.id', 'left')
                                            ->where('level_contacts.mobile', $mobile_number )
                                            ->where('level_contacts.contact_type', 'client')
                                            ->where('level_contacts.is_active', 1)
                                            ->where('clients.is_active', 1)
                                            ->where('client_branch.is_active', 1)
                                            ->findAll();
                    //set otp value null
                    $this->hrModel->where('mobile', $mobile_number)->where('otp', $otp)->where('contact_type', 'client')->set(['otp'=>null])->update();

                }else if(isset($this->request->getJSON()->email)){ 

                    $getAllhrData = $this->hrModel->select('level_contacts.id ,level_contacts.mobile , level_contacts.email , clients.id as client_id, clients.client_name, clients.short_name , client_branch.id as client_branch_id,client_branch.branch_name , client_branch.pre_branch_id')
                                            ->join('client_branch', 'level_contacts.ref_id = client_branch.id', 'left')
                                            ->join('clients', 'client_branch.client_id = clients.id', 'left')
                                            ->where('level_contacts.email', $email )
                                            ->where('level_contacts.contact_type', 'client')
                                            ->where('level_contacts.is_active', 1)
                                            ->where('clients.is_active', 1)
                                            ->where('client_branch.is_active', 1)
                                            ->findAll();
                    //set otp value null
                    $this->hrModel->where('email', $email)->where('otp', $otp)->where('contact_type', 'client')->set(['otp'=>null])->update();
                }

                if(count($getAllhrData))
                {
                    
                    foreach ($getAllhrData as $key => $value) {

                        $HRAccessData = $this->hrAccessControlModel
                                ->where('post_client_id',$value['client_id'])
                                ->where('post_branch_id', $value['client_branch_id'])
                                ->where('post_hr_id', $value['id'])
                                ->get()->getRowArray();

                       
                        if (!empty($HRAccessData) && isset($HRAccessData['allowed_modules'])) {

                            $decoded = json_decode($HRAccessData['allowed_modules'], true) ?? [];
                            $allowedActivePolicies = json_decode($HRAccessData['allowed_active_policies'] ?? '[]', true) ?? [];
                            if (!is_array($allowedActivePolicies)) {
                                $allowedActivePolicies = [];
                            }

                            if (empty($allowedActivePolicies) && is_array($decoded)) {
                                if (isset($decoded['post']) && is_array($decoded['post'])) {
                                    $decoded['post'] = array_values(array_filter(
                                        $decoded['post'],
                                        static fn($module) => (int) $module !== 4
                                    ));
                                } elseif (!isset($decoded['pre']) && !isset($decoded['post'])) {
                                    $decoded = array_values(array_filter(
                                        $decoded,
                                        static fn($module) => (int) $module !== 4
                                    ));
                                }
                                $HRAccessData['allowed_modules'] = json_encode($decoded);
                            }

                            $claimsSubMenu = [];
                            $hasClaimsModule = false;
                            if (is_array($decoded)) {
                                if (isset($decoded['post']) && is_array($decoded['post'])) {
                                    $hasClaimsModule = in_array(4, array_map('intval', $decoded['post']), true);
                                } elseif (!isset($decoded['pre']) && !isset($decoded['post'])) {
                                    $hasClaimsModule = in_array(4, array_map('intval', $decoded), true);
                                }
                            }

                            if ($hasClaimsModule) {
                                $claimsSubMenu[] = 'EB';

                                $hasNonEbPolicy = false;
                                if (!empty($allowedActivePolicies)) {
                                    $db = \Config\Database::connect();
                                    $policyAllocgRows = $db->table('client_policy')
                                        ->select('policy_type.allocg')
                                        ->join('policy_type', 'policy_type.id = client_policy.policy_type_id', 'left')
                                        ->whereIn('client_policy.id', $allowedActivePolicies)
                                        ->get()
                                        ->getResultArray();

                                    foreach ($policyAllocgRows as $policyRow) {
                                        if (($policyRow['allocg'] ?? '') !== 'EB') {
                                            $hasNonEbPolicy = true;
                                            break;
                                        }
                                    }
                                }

                                if ($hasNonEbPolicy) {
                                    $claimsSubMenu[] = 'Non-EB';
                                }
                            }

                            $getAllhrData[$key]['allowed_modules'] = $decoded;
                            $getAllhrData[$key]['claims_sub_menu'] = $claimsSubMenu;
                            $HRAccessData['pre_client_id'] = md5($HRAccessData['pre_client_id']);
                            $HRAccessData['post_client_id'] = md5($HRAccessData['post_client_id']);
                            $HRAccessData['claims_sub_menu'] = $claimsSubMenu;

                            print_r($HRAccessData); die;

                            $token = JWTToken::encode($HRAccessData);
                            $getAllhrData[$key]['token'] = $token;
                            
                        } else {
                            $getAllhrData[$key]['allowed_modules'] = [];
                            $getAllhrData[$key]['claims_sub_menu'] = [];
                            $getAllhrData[$key]['token'] = "";
                        }
                       
                    }

                    return $this->respond(['status' => 'success','code' => 200,'data' => $getAllhrData ],200);

                }else {

                    return $this->respond(['status' => 'failed','code' => 404,'data' => "" , 'message' => 'Invalid OTP' ],200);
                }

               

              


            } else {

                return $this->respond(['status' => 'failed','code' => 404,'data' => "" , 'message' => 'Invalid OTP' ],200);
            }
        } catch (\Exception $e) {
            return $this->respond(['status' => 'failed','code' => 500,'data' => $e->getMessage()],500);
        }
    }


    public function getHRAccessData( $hr_id = null , $request_for = 'post_enrollment')
    {
        $hr_id = $this->request->getGet('hr_id') ?? $hr_id;
        $request_for = $this->request->getGet('request_for') ?? $request_for;

        if($request_for == 'pre_enrollment'){ $idField = 'pre_hr_id';  }else{  $idField = 'post_hr_id'; }

        $data = $this->hrAccessControlModel->where($idField , $hr_id)->where('is_active' , 1)->first();

        if($request_for == 'post_enrollment'){ return $data ?? []; }

        return $this->respond(['status' => (($data) ? 'success' : 'failed'),'code' => (($data) ? 200 : 404),'data' => $data ], 200);
    }



    public function getUserIdFromToken()
    {
        $id = JWTToken::getUserIdFromToken();
        // echo $id['id'];
        echo "Id----> ";
        print_r($id);
        $role = JWTToken::getUserRoleFromToken();
        echo "  Role----> ";
        echo $role;


        $tokenArray = JWTToken::decodeToken();
        echo "  TokenArray---->  ";
        print_r($tokenArray);
    }


    public function saveMpin()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Save Mpin: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {
   
            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            $client_id = $this->request->getJSON()->client_id ?? null;

            if (isset($mobile_number)) {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('relationship', 'self')->first();
                $builder = $this->employeeModel
                                ->select('employees.*')
                                ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                ->where('employees.mobile', $mobile_number)
                                ->where('employees.relationship', 'Self')
                                ->where('employee_polices.is_active', 1)
                                ->whereIn('employee_polices.status', ['active', 'expired'])
                                ->where('employees.is_active', 1)
                                ->whereIn('employees.emp_status', ['active', 'expired']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('relationship', 'self')->first();
                $builder = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.email_corporate', $email_id)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['active', 'expired'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['active', 'expired']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();
            }

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: employeeData: " . json_encode($employeeData ?? []));        

            $mpin = $this->request->getJSON()->mpin;
            $is_mpin_skipped = $this->request->getJSON()->is_mpin_skipped;
            $is_biometric_enabled = $this->request->getJSON()->is_biometric_enabled;
          
            $mpin_data_to_updata = [
                'mpin' => $mpin,
                'is_mpin_skipped' => $is_mpin_skipped,
                'is_biometric_enabled' => $is_biometric_enabled
            ];

            if ($employeeData) {
                $id= $employeeData["id"];
                $updateMpin = $this->employeeModel->where('id', $id)->set( $mpin_data_to_updata)->update();

                if($updateMpin){
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: MPIN updated successfully");
                    log_message('error', '  ');
                    log_message('error', ' ************************************* POST END **************************************** ');
                    log_message('error', '  ');
                    $result = ['user_verification' => true , 'message' => "Mpin Updated"];
                    return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
                }else{
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: MPIN update failed");
                    log_message('error', '  ');
                    log_message('error', ' ************************************* POST END **************************************** ');
                    log_message('error', '  ');
                    $result = ['user_verification' => true , 'message' => "Mpin Not Updated"];
                    return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
                }
            } else {
                 $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Employee not found in the POST");
                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');
                $result = ['user_verification' => false , 'message' => "User not found"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);

            }
            
        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - saveMpin: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() .  " --- Trace: " . $th->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $th],500);
        }
    }

    public function updateMpin()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Update Mpin: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            $old_mpin = $this->request->getJSON()->old_mpin;
            $mpin = $this->request->getJSON()->new_mpin;
            $client_id = $this->request->getJSON()->client_id ?? null;

            if($old_mpin == $mpin)
            {
                $result = ['mpin_verification' => false , 'message' => "New MPIN must be different from the old MPIN"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
            }

            // if (isset($mobile_number)) 
            // {
            //     $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('mpin', $old_mpin)->where('relationship', 'self')->first();
            // }else{
            //     $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('mpin', $old_mpin)->where('relationship', 'self')->first();
            // }

            if (isset($mobile_number)) {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('mpin', $old_mpin)->where('relationship', 'self')->first();
                $builder = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['active'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['active'])
                                    ->where('employees.mpin', $old_mpin);
                                    
                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();
                
            } else {
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('mpin', $old_mpin)->where('relationship', 'self')->first();
                   $builder = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.email_corporate', $email_id)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['active'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['active'])
                                    ->where('employees.mpin', $old_mpin);

                    if (!empty($client_id)) {
                        $builder->where('employees.client_id', $client_id);
                    }

                    $employeeData = $builder->orderBy('employees.id', 'desc')->first();
            }
          
            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: employeeData: " . json_encode($employeeData ?? []));        
            
            if ($employeeData) {
                $id= $employeeData["id"];
                $updateMpin = $this->employeeModel->where('id', $id)->set('mpin', $mpin)->update();
                if($updateMpin){
                     $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: MPIN updated successfully");
                    log_message('error', '  ');
                    log_message('error', ' ************************************* POST END **************************************** ');
                    log_message('error', '  ');
                    $result = ['mpin_verification' => true , 'message' => "Mpin Updated"];
                    return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
                }else{
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: MPIN update failed");
                    log_message('error', '  ');
                    log_message('error', ' ************************************* POST END **************************************** ');
                    log_message('error', '  ');
                    $result = ['mpin_verification' => true , 'message' => "Mpin Not Updated"];
                    return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
                }
               
               
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Employee not found in the POST. Old MPIN is incorrect");
                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');
                $result = ['mpin_verification' => false , 'message' => "Old MPIN is incorrect"];
                return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);

            }
        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMpin: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() .  " --- Trace: " . $th->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $th],500);
        }
    }

    // public function verifyMpin()
    // {
    //     try {

    //         $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
    //         $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
    //         $mpin = $this->request->getJSON()->mpin;
    //         if (isset($mobile_number)) 
    //         {
    //             // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('relationship', 'self')->first();
    //             $employeeData = $this->employeeModel
    //                     ->select('employees.*')
    //                     ->join('employee_polices', 'employees.id = employee_polices.employee_id')
    //                     ->where('employees.mobile', $mobile_number)
    //                     ->where('employees.relationship', 'Self')
    //                     ->where('employee_polices.is_active', 1)
    //                     ->whereIn('employee_polices.status', ['active'])
    //                     ->where('employees.is_active', 1)
    //                     ->whereIn('employees.emp_status', ['active'])
    //                     ->get();
    //         }else{
    //             // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('relationship', 'self')->first();
    //             $employeeData = $this->employeeModel
    //                 ->select('employees.*')
    //                 ->join('employee_polices', 'employees.id = employee_polices.employee_id')
    //                 ->where('employees.email_corporate', $email_id)
    //                 ->where('employee_polices.is_active', 1)
    //                 ->whereIn('employee_polices.status', ['active'])
    //                 ->where('employees.is_active', 1)
    //                 ->whereIn('employees.emp_status', ['active'])
    //                 ->where("employees.relationship", "Self") // RAW SQL condition
    //                 ->first();

    //         }
    //         if ($employeeData && $mpin == $employeeData["mpin"]) {

    //             $auth =  HttpRequestHelper::getRequestInfo();
    //             if ($auth) {
    //                 $data = [
    //                    'user_id' => $employeeData['id'],
    //                    'user_type' => 'employee',
    //                    'ip' => $auth['ip'],
    //                    'platform' => $auth['platform'],
    //                    'broswer' => $auth['browser'],
    //                 ];

    //                 $authdata= $this->authHistoryModel->insert($data);

    //             }

    //             $result = JWTToken::encode($employeeData);
    //             // $result = $employeeData;
    //             return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);
    //         } else {
    //             return $this->respond(['status' => 'failed','code' => 404,'data' => ""],200);
    //         }
    //     } catch (\Exception $e) {
    //         return $this->respond(['status' => 'failed','code' => 500,'data' => $e->getMessage()],500);
    //     }
    // }

    public function verifyMpin()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Verify Mpin: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {
            $requestData = $this->request->getJSON(true); 

            $mobile_number = $requestData['mobile_number'] ?? null;
            $email_id      = $requestData['email_id'] ?? null;
            $mpin          = $requestData['mpin'] ?? null;
            $client_id = $requestData['client_id'] ?? null;
            // print_r($mpin);

            if (!$mpin) {
                return $this->respond(['status' => 'failed', 'code' => 400, 'data'   => "", 'message' => 'MPIN is required'], 400);
            }

            if ($mobile_number) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.mobile', $mobile_number)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();


            } elseif ($email_id) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.email_corporate', $email_id)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {
                return $this->respond(['status' => 'failed', 'code' => 400, 'data'   => "", 'message' => 'Mobile number or Email ID is required'], 400);
            }

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: employeeData: " . json_encode($employeeData ?? []));        

            // print_r($employeeData); die;

            if ($employeeData && isset($employeeData['mpin']) && $mpin === $employeeData['mpin']) {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Verified employee found");

                $auth = HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $this->authHistoryModel->insert([
                        'user_id'  => $employeeData['id'],
                        'user_type' => 'employee',
                        'ip'       => $auth['ip'],
                        'platform' => $auth['platform'],
                        'broswer'  => $auth['browser'], // Note: typo in 'broswer' retained if it's your actual DB field
                    ]);
                }

                $employeeData['token_type'] = "post";
                $token = JWTToken::encode($employeeData);

                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');

                return $this->respond(['status' => 'success','code'   => 200,'data'   => $token], 200);
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Employee not verified in POST. Invalid MPIN"); 
                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');

                return $this->respond(['status' => 'failed','code'   => 404, 'data'   => "", 'message'   => 'Invalid MPIN'], 200);
            }
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyMpin: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() .  " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond(['status' => 'failed','code'   => 500, 'data'   => "", 'message'  => $e->getMessage()], 500);
        }
    }

    public function checkMpin()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Check Mpin: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {
            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            // $mpin = $this->request->getJSON()->mpin;
            $client_id = $this->request->getJSON()->client_id ?? null;


            if (isset($mobile_number)) 
            {
                // $employeeData = $this->employeeModel->where('mobile', $mobile_number)->where('relationship', 'self')->first();
                $builder = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->whereIn('employee_polices.status', ['active', 'expired'])
                                    ->where('employees.is_active', 1)
                                    ->whereIn('employees.emp_status', ['active', 'expired']);
                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            }else{
                // $employeeData = $this->employeeModel->where('email_corporate', $email_id)->where('relationship', 'self')->first();
                $builder = $this->employeeModel
                        ->select('employees.*')
                        ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                        ->where('employees.email_corporate', $email_id)
                        ->where('employees.relationship', 'Self')
                        ->where('employee_polices.is_active', 1)
                        ->whereIn('employee_polices.status', ['active', 'expired'])
                        ->where('employees.is_active', 1)
                        ->whereIn('employees.emp_status', ['active', 'expired']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();
            }

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: employeeData: " . json_encode($employeeData ?? []));        

            if ($employeeData &&  $employeeData["mpin"] != null) {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Mpin - Exist");
                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');
                return $this->respond(['status' => 'success','code' => 200,'data' => "", 'message' => "Mpin - exist" , 'Mpin' =>$employeeData["mpin"], 'is_mpin_skipped' => $employeeData['is_mpin_skipped'] ?? '0', 'is_biometric_enabled' => $employeeData['is_biometric_enabled'] ?? '0'],200);
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Mpin - not found");
                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');
                return $this->respond(['status' => 'failed','code' => 404,'data' => "", 'message' => "Mpin - not found", 'Mpin' =>null],200);
            }

        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkMpin: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() .  " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');

            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $e->getMessage()],500);
        }
    }

    public function forgotMPIN()
    {   
        log_message('error', '  ');
        log_message('error', ' ************************************* POST START **************************************** ');
        log_message('error', '  ');
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Forgot MPIN: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $json = $this->request->getJSON();
            $mobile_number = $json->mobile_number ?? null;
            $email_id = $json->email_id ?? null;
            $client_id = $json->client_id ?? null;

            // Step 1: Check input
            if (!$mobile_number && !$email_id) {
                log_message('error', 'Mobile number and email ID are both missing.');
                return $this->respond([
                    'status' => 'failed',
                    'code' => 400,
                    'message' => 'Mobile number or email ID is required.'
                ], 400);
            }

            // Step 2: Fetch employee data
            if ($mobile_number) {

                log_message('error', 'Looking up employee by mobile number: ' . $mobile_number);
                $builder = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.mobile', $mobile_number)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->where('employee_polices.status', ['active'])
                                    ->where('employees.is_active', 1)
                                    ->where('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {

                log_message('error', 'Looking up employee by email: ' . $email_id);
                $builder = $this->employeeModel
                                    ->select('employees.*')
                                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                                    ->where('employees.email_corporate', $email_id)
                                    ->where('employees.relationship', 'Self')
                                    ->where('employee_polices.is_active', 1)
                                    ->where('employee_polices.status', ['active'])
                                    ->where('employees.is_active', 1)
                                    ->where('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();
            }

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: employeeData: " . json_encode($employeeData ?? []));        


            // Step 3: Found employee
            if (!empty($employeeData)) {
                log_message('error', 'Employee found: ID = ' . $employeeData['id']);

                $updateData = [
                    'mpin' => null,
                    'is_mpin_skipped' => null,
                    'is_biometric_enabled' => null
                ];

                log_message('error', 'Updating employee MPIN fields to null for ID: ' . $employeeData['id']);

                $updated = $this->employeeModel
                    ->where('id', $employeeData['id'])
                    ->set($updateData)
                    ->update();

                if ($updated) {
                    log_message('error', 'MPIN reset successful for employee ID: ' . $employeeData['id']);
                    return $this->respond([
                        'status' => 'success',
                        'code' => 200,
                        'message' => 'MPIN reset successfully.'
                    ], 200);
                } else {
                    log_message('error', 'Failed to update MPIN fields for employee ID: ' . $employeeData['id']);
                    return $this->respond([
                        'status' => 'failed',
                        'code' => 500,
                        'message' => 'Could not reset MPIN values.',
                    ], 500);
                }
            } else {
                // Step 4: Not found in local DB — call external fallback
                log_message('error', 'Employee not found locally');
                return $this->respond(['status' => 'failed','code' => 404,'data' => "Employee not found"],200);            
            }
        } catch (\Throwable $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - forgotMPIN: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() .  " --- Trace: " . $e->getTraceAsString());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond([
                'status' => 'failed',
                'code' => 500,
                'message' => 'Server error: ' . $e->getMessage()
            ], 500);
        }
    }


    // TokenController.php
    public function bookstackLoginToken()
    {
        $session = \Config\Services::session();
        $user_data = session()->get('userData');
        $user = $user_data->email;
        $secret = getenv('bookstack.token');
        // $user = 'staff@staff.com';
        $name = $user_data->first_name ?? 'User';

        $payload = [
            'email' => $user,
            'name' => $name,
            'exp' => time() + (60 * 60 * 24) // expires in 1 day
        ];

        // dd($payload);
        $token = base64_encode(json_encode($payload));
        $signature = hash_hmac('sha256', $token, $secret);
        $bookStackUrl = getenv('bookstack.baseURL');

        $url = $bookStackUrl . urlencode($token) . '&sig=' . $signature;
        return redirect()->to($url);
    }

    public function getPostEmployeeDataForAuth()
    {
        $params = $this->request->getJSON(true);
        // print_r( $params); die;

        $mobile_number = $params['mobile_number'] ?? null;
        $email_id      = $params['email_id'] ?? null;
        $otp      = $params['otp'] ?? null;
        $old_mpin      = $params['old_mpin'] ?? null;

        if (empty($mobile_number) && empty($email_id)) {
            return $this->respond([
                'status' => 'failed',
                'message' => 'Mobile number or Email ID is required.',
                'data' => [],
            ], 200);
        }

        if (!empty($mobile_number)) {

            $builder = $this->employeeModel
                ->select('employees.id as employee_id, employees.*')
                ->join('employee_polices EP', 'EP.employee_id = employees.id', 'inner')
                ->where('employees.is_active', 1)
                ->where("TRIM(employees.relationship) = 'self'", null, false)
                ->whereIn('employees.emp_status', ['active', 'expired'])
                ->where('employees.mobile', $mobile_number)
                ->where('EP.is_active', 1)
                ->whereIn('EP.status', ['active', 'expired']);

            if (!empty($otp)) {
                $builder->where('employees.otp', $otp);
            }
                
            if (!empty($old_mpin)) {
                $builder->where('employees.mpin', $old_mpin);
            }
                
            $employeeData = $builder->orderBy('employees.id', 'desc')->first();

        } else {
            $builder = $this->employeeModel
                ->select('employees.id as employee_id, employees.*')
                ->join('employee_polices EP', 'EP.employee_id = employees.id', 'inner')
                ->where('employees.is_active', 1)
                ->where("TRIM(employees.relationship) = 'self'", null, false)
                ->whereIn('employees.emp_status', ['active', 'expired'])
                ->where('employees.email_corporate', $email_id)
                ->where('EP.is_active', 1)
                ->whereIn('EP.status', ['active', 'expired']);

            if (!empty($otp)) {
                $builder->where('employees.otp', $otp);
            }

            if (!empty($old_mpin)) {
                $builder->where('employees.mpin', $old_mpin);
            }

            $employeeData = $builder->orderBy('employees.id', 'desc')->first();
        }

        if ($employeeData) {

            $client_data = $this->clientModel->where('is_active', 1)->where('id', $employeeData['client_id'])->first();
            $employeeData['client_short_name'] = $client_data['short_name'];

            return $this->respond([
                'status' => 'success',
                'data' => $employeeData,
            ], 200);
        }

        return $this->respond([
            'status' => 'failed',
            'message' => 'No employee found.',
            'code' => 404,
            'data' => [],
        ], 200);
    }

    public function logHrActivity()
    {
        $log_data = $this->request->getJSON();
        // print_r($json);die();
        $this->userActivityHistoryModel->insert($log_data);
         return $this->respond(['status' => 'success','code' => 200,'data' => "logged",],200);

    }

    public function verifyToken()
    {
        $json = $this->request->getJSON();
        $idToken = $json->token ?? null;

        if (!$idToken) {
            return $this->fail("Token is missing", 400);
        }

        try {
            $client = new Client();

            // Get JWK keys from Firebase
            $jwk = json_decode($client->get("https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com")->getBody(), true);

            // Decode JWT using the JWK set
            $decoded = JWT::decode($idToken, JWK::parseKeySet($jwk));

            // Optional: Check audience and issuer
            $aud = "nhance-ee8d1"; // replace with your Firebase project ID
            if ($decoded->aud !== $aud || $decoded->iss !== "https://securetoken.google.com/{$aud}") {
                return $this->fail("Invalid token audience or issuer", 401);
            }

            // You can now use $decoded->uid or $decoded->phone_number
            return $this->respond(['status' => 'success', 'uid' => $decoded->user_id ?? '', 'phone' => $decoded->phone_number ?? ''], 200);
        } catch (\Exception $e) {
            return $this->fail("Invalid Token: " . $e->getMessage(), 401);
        }
    }

    // -------------- PASSWORD API'S -------------------------------------------------------------------------------------------------------------

    public function savePassword()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Received payload = " . json_encode($this->request->getJSON() ?? []));
        try {

            $payload = $this->request->getJSON();
            $mobile_number = $payload->mobile_number ?? null;
            $email_id = $payload->email_id ?? null;
            $client_id = $payload->client_id ?? null;
            $plain_password = $payload->password ?? null;
            $confirm_password = $payload->confirm_password ?? null;

            if (empty($plain_password) || empty($confirm_password)) {
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'Both password cannot be empty'], 400);
            }

            if($plain_password !== $confirm_password){
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'Password and confirm password not matched'], 400);
            }

            // Build employee query
            if ($mobile_number) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.mobile', $mobile_number)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active', 'expired'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active', 'expired']);
                if (!empty($client_id)) $builder->where('employees.client_id', $client_id);
                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.email_corporate', $email_id)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active', 'expired'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active', 'expired']);
                if (!empty($client_id)) $builder->where('employees.client_id', $client_id);
                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            }

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Last Executed Query: " . $lastQuery);
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: employeeData: " . json_encode($employeeData ?? []));
            

            if ($employeeData) {
                $id = $employeeData['id'];
                $hashedPassword = password_hash($plain_password, PASSWORD_DEFAULT);

                $updateData = [
                    'password' => $hashedPassword,
                ];

                $updated = $this->employeeModel->where('id', $id)->set($updateData)->update();

                if ($updated) {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Password saved successfully");
                    $result = ['user_verification' => true, 'message' => "Password saved successfully"];
                    return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
                } else {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Password save failed");
                    $result = ['user_verification' => true, 'message' => "Password not saved"];
                    return $this->respond(['status' => 'failed', 'code' => 500, 'data' => $result], 200);
                }
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Employee not found");
                $result = ['user_verification' => false, 'message' => "User not found"];
                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
            }
        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Exception: " . $th->getMessage() . " --- Line: " . $th->getLine() . " --- Trace: " . $th->getTraceAsString());
            $errorData = [
                'message' => $th->getMessage(),
                'file'    => $th->getFile(),
                'line'    => $th->getLine(),
                'code'    => $th->getCode(),
                'trace'   => $th->getTraceAsString(),
                'trace_array' => $th->getTrace(), // full array version (optional)
                'function' => $th->getTrace()[0]['function'] ?? null,
                'class' => $th->getTrace()[0]['class'] ?? null,
            ];
            return $this->respond(['status' => 'failed', 'code' => 500, 'message' => $th->getMessage(), 'errorData' => $errorData], 500);
        }
    }

    public function changePassword()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - changePassword: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $payload = $this->request->getJSON(true);
            $mobile_number = $payload['mobile_number'] ?? null;
            $email_id      = $payload['email_id'] ?? null;
            $client_id     = $payload['client_id'] ?? null;
            $old_password  = $payload['old_password'] ?? null;
            $new_password  = $payload['new_password'] ?? null;
            $confirm_password  = $payload['confirm_password'] ?? null;

            if (!$mobile_number && !$email_id) {
                return $this->respond(['status' => 'failed','code'   => 400,'message' => 'Mobile number or Email ID is required'], 400);
            }

            if (empty($new_password) || empty($confirm_password) || empty($old_password)) {
                return $this->respond(['status' => 'failed', 'code'   => 400, 'message' => 'old_password , New password and Confirm password are required' ], 400);
            }

            if($new_password !== $confirm_password){
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'New password and confirm password not matched'], 400);
            }

            // Build employee query
            if ($mobile_number) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.mobile', $mobile_number)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active', 'expired'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active', 'expired']);
                if (!empty($client_id)) $builder->where('employees.client_id', $client_id);
                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.email_corporate', $email_id)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active', 'expired'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active', 'expired']);
                if (!empty($client_id)) $builder->where('employees.client_id', $client_id);
                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            }

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: Last Executed Query: " . $lastQuery);
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - savePassword: employeeData: " . json_encode($employeeData ?? []));

            if ($employeeData && password_verify($old_password, $employeeData['password'])) {

                // Hash new password
                $newHashedPassword = password_hash($new_password, PASSWORD_DEFAULT);

                // Update password and clear OTP
                $updated = $this->employeeModel->update($employeeData['id'], [
                    'password' => $newHashedPassword,
                ]);

                if ($updated) {
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - changePassword: Password updated successfully");
                    return $this->respond(['status' => 'success','code' => 200,'message' => 'Password changed successfully'], 200);
                } else {
                    return $this->respond(['status' => 'failed','code' => 500,'message' => 'Failed to update password' ], 500);
                }

            }else{
                return $this->respond(['status' => 'failed', 'code' => 404, 'message' => 'Old password is incorrect'], 404);
            }

        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - changePassword: Exception: " . $th->getMessage());
            return $this->respond(['status' => 'failed', 'code' => 500, 'message' => $th->getMessage()], 500);
        }
    }

    public function verifyPassword()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $requestData   = $this->request->getJSON(true);
            $mobile_number = $requestData['mobile_number'] ?? null;
            $email_id      = $requestData['email_id'] ?? null;
            $password      = $requestData['password'] ?? null;
            $client_id     = $requestData['client_id'] ?? null;

            if(!$mobile_number && !$email_id){
                return $this->respond(['status' => 'failed', 'code' => 400, 'data' => "", 'message' => 'Mobile number or Email ID is required'], 400);
            }

            if (!$password) {
                return $this->respond(['status' => 'failed', 'code' => 400, 'data' => "", 'message' => 'Password is required'], 400);
            }

            // 🔹 Fetch employee data
            if ($mobile_number) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.mobile', $mobile_number)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } elseif ($email_id) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.email_corporate', $email_id)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } 

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Last Executed Query: " . $lastQuery);
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: employeeData: " . json_encode($employeeData ?? []));

            // 🔹 Verify password hash
            if ($employeeData && isset($employeeData['password']) && password_verify($password, $employeeData['password'])) {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Verified employee found");

                // ✅ Log authentication error
                $auth = HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $this->authHistoryModel->insert([
                        'user_id'  => $employeeData['id'],
                        'user_type' => 'employee',
                        'ip'       => $auth['ip'],
                        'platform' => $auth['platform'],
                        'broswer'  => $auth['browser'],
                    ]);
                }

                // ✅ Generate JWT token
                $employeeData['token_type'] = "post";
                $token = JWTToken::encode($employeeData);

                return $this->respond(['status' => 'success', 'code' => 200, 'data' => $token], 200);

            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Invalid password or employee not found");
                log_message('error', '  ');
                log_message('error', ' ************************************* POST END **************************************** ');
                log_message('error', '  ');

                return $this->respond(['status' => 'failed', 'code' => 404, 'data' => "", 'message' => 'Invalid password'], 200);
            }
            
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine());
            log_message('error', '  ');
            log_message('error', ' ************************************* POST END **************************************** ');
            log_message('error', '  ');
            return $this->respond(['status' => 'failed', 'code' => 500, 'data' => "", 'message' => $e->getMessage()], 500);
        }
    }

    public function verifyOtp()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $requestData   = $this->request->getJSON(true);
            $mobile_number = $requestData['mobile_number'] ?? null;
            $email_id      = $requestData['email_id'] ?? null;
            $client_id     = $requestData['client_id'] ?? null;
            $otp           = $requestData['otp'] ?? null;

            if(!$mobile_number && !$email_id){
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'Mobile number or Email ID is required'], 400);
            }

            if (!$otp) {
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'OTP is required'], 400);
            }

            // 🔹 Fetch employee data
            if ($mobile_number) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.mobile', $mobile_number)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.email_corporate', $email_id)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } 

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Last Executed Query: " . $lastQuery);
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: employeeData: " . json_encode($employeeData ?? []));

            // 🔹 Verify otp
            if ($employeeData && $employeeData['otp'] == $otp) {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: OTP Verified employee found");
                $this->employeeModel->where('id', $employeeData['id'])->where('otp', $otp)->where('relationship', 'self')->set(['otp'=>null])->update();
                return $this->respond(['status' => 'success', 'code' => 200, 'message' => "OTP verified succesfully"], 200);
            } else {

                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: OTP verification failed, OTP not found in the post db"); 
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => "OTP verification failed"], 200);
            }
            
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyOtp: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine());
            return $this->respond(['status' => 'failed', 'code' => 500, 'data' => "", 'message' => $e->getMessage()], 500);
        }
    }

    public function checkPassword()
    { 
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Request payload = " . json_encode($this->request->getJSON() ?? []));

        try {

            $payload = $this->request->getJSON() ?? [];
            $mobile_number = $payload->mobile_number ?? null;
            $email_id      = $payload->email_id ?? null;

            if(!$mobile_number && !$email_id){
                return $this->respond(['status' => 'failed', 'code' => 400, 'message' => 'Mobile number or Email ID is required'], 400);
            }

            // 🔹 Fetch employee data
            if ($mobile_number) {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.mobile', $mobile_number)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } else {

                $builder = $this->employeeModel
                    ->select('employees.*')
                    ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                    ->where('employees.email_corporate', $email_id)
                    ->where('employees.relationship', 'Self')
                    ->where('employee_polices.is_active', 1)
                    ->whereIn('employee_polices.status', ['active'])
                    ->where('employees.is_active', 1)
                    ->whereIn('employees.emp_status', ['active']);

                if (!empty($client_id)) {
                    $builder->where('employees.client_id', $client_id);
                }

                $employeeData = $builder->orderBy('employees.id', 'desc')->first();

            } 

            $lastQuery = $this->employeeModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: Last Executed Query: " . $lastQuery);
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyPassword: employeeData: " . json_encode($employeeData ?? []));
            
            if ($employeeData &&  $employeeData["password"] != null) {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Mpin - Exist");
                return $this->respond(['status' => 'success','code' => 200,'data' => "", 'message' => "Password - exist"],200);
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - checkPassword: Password - not found in PRE so call the thirdpartapi to the POST to check the MPIN");
                return $this->respond(['status' => 'failed','code' => 200,'data' => "", 'message' => "Password - not exist"],200);
            }
            
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() . " --- Trace: " . $e->getTraceAsString());
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => $e->getMessage()],500);
        }
    }

    // -------------- EMP MOBILE NUMBER UPDATE API'S -------------------------------------------------------------------------------------------------------------

    public function updateMobileNumber()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Received payload = " . json_encode($this->request->getJSON() ?? []));
        try {

            $payload = $this->request->getJSON(true);

            $email_id       = $payload['email_id'] ?? null;
            $client_id      = $payload['client_id'] ?? null;
            $new_mobile     = $payload['new_mobile_number'] ?? null;

            if (empty($email_id) || empty($new_mobile)) {
                return $this->respond([
                    'status'  => 'failed',
                    'code'    => 400,
                    'message' => 'Email ID and new mobile number are required'
                ], 400);
            }

            // Fetch employee by email
            $builder = $this->employeeModel
                ->select('employees.*')
                ->join('employee_polices', 'employees.id = employee_polices.employee_id')
                ->where('employees.email_corporate', $email_id)
                ->where('employees.relationship', 'Self')
                ->where('employees.is_active', 1)
                ->whereIn('employees.emp_status', ['active'])
                ->where('employee_polices.is_active', 1)
                ->whereIn('employee_polices.status', ['active']);

            if (!empty($client_id)) {
                $builder->where('employees.client_id', $client_id);
            }

            $employeeData = $builder->orderBy('employees.id', 'desc')->first();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: employeeData: " . json_encode($employeeData ?? []));

            if (!$employeeData) {
                return $this->respond([
                    'status'  => 'failed',
                    'code'    => 404,
                    'message' => 'User not found with this Email ID'
                ], 404);
            }

            // Update mobile number
            $updated = $this->employeeModel->update($employeeData['id'], [
                'mobile' => $new_mobile,
            ]);

            if ($updated) {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Mobile number updated successfully");
                log_message('error', '  ');
                log_message('error', ' ************************************* UPDATE MOBILE END **************************************** ');
                log_message('error', '  ');

                return $this->respond([
                    'status'  => 'success',
                    'code'    => 200,
                    'message' => 'Mobile number updated successfully'
                ], 200);
            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Failed to update mobile number");
                return $this->respond([
                    'status'  => 'failed',
                    'code'    => 500,
                    'message' => 'Failed to update mobile number'
                ], 500);
            }
        } catch (\Throwable $th) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - updateMobileNumber: Exception: " . $th->getMessage());
            return $this->respond([
                'status'  => 'failed',
                'code'    => 500,
                'message' => $th->getMessage()
            ], 500);
        }
    }

    public function getRetailUserData()
    {
        $params = $this->request->getJSON(true);
        // print_r( $params); die;

        $mobile_number = $params['mobile_number'] ?? null;
        $email_id      = $params['email_id'] ?? null;
        $otp           = $params['otp'] ?? null;
        $old_mpin      = $params['old_mpin'] ?? null;

        if (empty($mobile_number) && empty($email_id)) {
            return $this->respond(['status' => 'failed', 'message' => 'Mobile number or Email ID is required.', 'data' => [],], 200);
        }

        if (!empty($mobile_number)) {

            $builder = $this->clientModel
                ->select('clients.*')
                ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
                ->where('policy_transaction.is_active', 1)
                ->where('clients.is_active', 1)
                ->where('clients.phone', $mobile_number);

            if (!empty($otp)) {
                $builder->where('clients.otp', $otp);
            }

            if (!empty($old_mpin)) {
                $builder->where('clients.mpin', $old_mpin);
            }

            $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
        } else {

            $builder = $this->clientModel
                ->select('clients.*')
                ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
                ->where('policy_transaction.is_active', 1)
                ->where('clients.is_active', 1)
                ->where('clients.email', $email_id);

            if (!empty($otp)) {
                $builder->where('clients.otp', $otp);
            }

            if (!empty($old_mpin)) {
                $builder->where('clients.mpin', $old_mpin);
            }

            $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
        }

        if ($retailUserData) {
            return $this->respond(['status' => 'success', 'data' => $retailUserData,], 200);
        }

        return $this->respond(['status' => 'failed', 'message' => 'No employee found.', 'code' => 404, 'data' => [],], 200);
    }

    public function updateRetailUserAuthDetails()
    {
        try {

            log_message('error', 'Retail Auth Update Request Received');

            $requestData = $this->request->getJSON();

            $client_id      = $requestData->client_id      ?? null;
            $email_id       = $requestData->email_id       ?? null;
            $mobile_number  = $requestData->mobile_number  ?? null;
            $otp            = $requestData->otp            ?? null;
            $mpin           = $requestData->mpin           ?? null;
            $password       = $requestData->password       ?? null;

            /** Check if at least one identification exists */
            if (!$client_id && !$email_id && !$mobile_number) {
                log_message('error', 'Identification missing: Need client_id or mobile/email.');
                return $this->respond(['status' => false,'message' => 'client_id, email or mobile number is required.']);
            }

            /** Find client by ID or Email or Mobile */
            $clientQuery = $this->clientModel->where('is_active', 1);

            if ($client_id) {
                $clientQuery->where('id', $client_id);
            } elseif ($email_id) {
                $clientQuery->where('email', $email_id);
            } elseif ($mobile_number) {
                $clientQuery->where('phone', $mobile_number);
            }

            $clientData = $clientQuery->get()->getRowArray();

            /** If no client found, return error */
            if (!$clientData) {
                log_message('error', 'Client not found for given identifier.');
                return $this->respond(['status' => false,'message' => 'Client not found.']);
            }

            /** Now update fields that exist in request */
            $updateData = [];

            if ($otp) {
                $updateData['otp'] = $otp;
            }

            if ($mpin) {
                $updateData['mpin'] = password_hash($mpin, PASSWORD_DEFAULT); // Secure MPIN Hash
            }

            if ($password) {
                $updateData['password'] = password_hash($password, PASSWORD_DEFAULT); // Secure Password Hash
            }

            /** If nothing to update */
            if (empty($updateData)) {
                log_message('error', 'No valid fields to update (OTP/MPIN/Password missing)');
                return $this->respond(['status' => false,'message' => 'No valid credentials provided for update.']);
            }

            /** Update */
            $updated = $this->clientModel->where('id', $clientData['id'])->set($updateData)->update();

            if ($updated) {
                log_message('error', "Credentials updated successfully for Client ID: {$clientData['id']}");
                return $this->respond(['status' => true,'message' => 'Credentials updated successfully.']);
            } else {
                log_message('error', "Failed updating credentials for Client ID: {$clientData['id']}");
                return $this->respond(['status' => false,'message' => 'Failed to update credentials.']);
            }

        } catch (\Exception $e) {

            log_message('error', 'Exception in updateRetailAuthDetails: ' . $e->getMessage());
            return $this->respond(['status' => false,'message' => 'Unexpected error occurred.','error' => $e->getMessage()], 500);
        }
    }

    public function getVerifiedRetailUserData()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Received payload = " . json_encode($this->request->getJSON() ?? []));

        try {
           
            $mobile_number = isset($this->request->getJSON()->mobile_number) ? $this->request->getJSON()->mobile_number : null;
            $email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
            $otp = isset($this->request->getJSON()->otp) ? $this->request->getJSON()->otp : null;
            $client_id = $this->request->getJSON()->client_id ?? null;

            if(empty($otp)){
                return $this->respond(['status' => 'OTP is required','code'   => 400,'message' => 'OTP is required'], 200);
            }

            if (empty($mobile_number) && empty($email_id)) {
                return $this->respond(['status' => 'failed','code'   => 400,'message' => 'Mobile number or Email ID is required'], 200);
            }

            if (!empty($mobile_number)) {

                $builder = $this->clientModel
                    ->select('clients.*')
                    ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
                    ->where('policy_transaction.is_active', 1)
                    ->where('policy_transaction.action_type', "inception")
                    ->where('clients.is_active', 1)
                    ->where('clients.phone', $mobile_number);

                if (!empty($otp)) {
                    $builder->where('clients.otp', $otp);
                }

                if (!empty($old_mpin)) {
                    $builder->where('clients.mpin', $old_mpin);
                }

                $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
            } else {

                $builder = $this->clientModel
                    ->select('clients.*')
                    ->join('policy_transaction', 'policy_transaction.client_id = clients.id')
                    ->where('policy_transaction.is_active', 1)
                    ->where('policy_transaction.action_type', "inception")
                    ->where('clients.is_active', 1)
                    ->where('clients.email', $email_id);

                if (!empty($otp)) {
                    $builder->where('clients.otp', $otp);
                }

                if (!empty($old_mpin)) {
                    $builder->where('clients.mpin', $old_mpin);
                }

                $retailUserData = $builder->orderBy('clients.id', 'desc')->first();
            } 
            
            $lastQuery = $this->clientModel->db->getLastQuery();
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Last Executed Query: " . $lastQuery);        
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: retailUserData: " . json_encode($retailUserData ?? []));        

            
            if ($retailUserData && isset($this->request->getJSON()->otp) ) 
            {
                $auth =  HttpRequestHelper::getRequestInfo();
                if ($auth) {
                    $data = [
                       'user_id' => $retailUserData['id'],
                       'user_type' => 'retail_user',
                       'ip' => $auth['ip'],
                       'platform' => $auth['platform'],
                       'broswer' => $auth['browser'],
                    ];
                    $this->authHistoryModel->insert($data);                    
                }
              
                $retailUserData['client_id'] = null;
                $retailUserData['client_branch_id'] = null;
                $retailUserData['emp_code'] = null;
                $retailUserData['emp_status'] = null;
                $retailUserData['name'] = $retailUserData['client_name'];
                $retailUserData['email_corporate'] = $retailUserData['email'];
                $retailUserData['mobile'] = $retailUserData['phone'];
                $retailUserData['token_type'] = "retail";
                $result = JWTToken::encode($retailUserData);

                if(isset($this->request->getJSON()->otp)){ 
                    $this->clientModel->where('id', $retailUserData['id'])->where('otp', $otp)->set(['otp'=>null])->update();
                    $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Reset the otp to null");
                }


                return $this->respond(['status' => 'success','code' => 200,'data' => $result],200);

            } else {
                $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Employee not verified POST"); 
                return $this->respond(['status' => 'failed','code' => 404,'data' => "", 'message' => 'Invalid OTP'],200);
            }
        } catch (\Exception $e) {
            $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedRetailUserData: Exception: " . $e->getMessage() . " --- Line: " . $e->getLine() .  " --- Trace: " . $e->getTraceAsString());
            return $this->respond(['status' => 'failed','code' => 500,'data' => "", 'message' => "Invalid OTP", 'error' =>  $e->getMessage()],500);
        }
    }

    public function logout()
    {
         return $this->respond([
            'status'  => true,
            'message' => 'Logged out successfully'
        ], 200);
        $authHeader = $this->request->getHeaderLine('Authorization');

        if (!$authHeader) {
            return $this->respond([
                'status'  => false,
                'message' => 'Authorization token missing'
            ], 401);
        }

        // Validate JWT (your hardened function)
        $result = JWTToken::validateJWT($authHeader);

        if ($result['status'] !== true) {
            return $this->respond([
                'status'  => false,
                'message' => 'Invalid or expired token'
            ], 401);
        }

        $decoded = $result['decoded'];
        $userId  = $decoded['post_hr_id'] ?? null;

        if (!$userId) {
            return $this->respond([
                'status'  => false,
                'message' => 'Invalid token payload'
            ], 401);
        }

        // Identify user type
        if (isset($decoded['emp_code'])) {
            $model = new EmployeeModel();
        } else {
            $model = new LevelContactModel();
        }

        // Invalidate token server-side
        $model->update($userId, [
            'token_time_out' => null
        ]);

        return $this->respond([
            'status'  => true,
            'message' => 'Logged out successfully'
        ], 200);
    }

    /**
     * Cron: clear expired token_time_out on active employees (epoch expiry + buffer).
     *
     * Buffer default: 3 minutes. Override in .env: TOKEN_TIMEOUT_RESET_BUFFER_SECONDS
     *
     * php public/index.php cli/reset-token-timeout
     */
    public function resetTokenTimeOut()
    {
        if (! is_cli()) {
            return $this->respond([
                'status'  => false,
                'message' => 'This endpoint is CLI only.',
            ], 403);
        }

        $buffer = (int) (getenv('TOKEN_TIMEOUT_RESET_BUFFER_SECONDS')
            ?: self::RESET_TOKEN_TIMEOUT_BUFFER_SECONDS_DEFAULT);
        if ($buffer < 0) {
            $buffer = self::RESET_TOKEN_TIMEOUT_BUFFER_SECONDS_DEFAULT;
        }

        $cutoffEpoch              = time() - $buffer;
        $resetTokenTimeoutCronRan = date('Y-m-d H:i:s');

        $rows = $this->employeeModel
            ->select('id')
            ->where('token_time_out IS NOT NULL', null, false)
            ->where('is_active', 1)
            ->where('emp_status', 'active')
            ->where('token_time_out <=', $cutoffEpoch)
            ->findAll();

        $employeeIds = array_map(static fn (array $row): int => (int) $row['id'], $rows);

        if ($employeeIds !== []) {
            $this->employeeModel
                ->whereIn('id', $employeeIds)
                ->set(['token_time_out' => null])
                ->update();
        }

        $logPayload = $employeeIds !== []
            ? json_encode([
                'employee_ids'                      => $employeeIds,
                'reset_token_timeout_cron_ran_at' => $resetTokenTimeoutCronRan,
            ])
            : json_encode(['reset_token_timeout_cron_ran_at' => $resetTokenTimeoutCronRan]);

        $this->myLogger->logme('error', 'reset-token-timeout cron: ' . $logPayload);

        $result = [
            'status'                          => true,
            'message'                         => 'Token timeout reset completed.',
            'buffer_seconds'                  => $buffer,
            'cutoff_epoch'                    => $cutoffEpoch,
            'reset_token_timeout_cron_ran_at' => $resetTokenTimeoutCronRan,
            'updated'        => [
                'employees'    => count($employeeIds),
                'employee_ids' => $employeeIds,
            ],
        ];

        echo json_encode($result, JSON_UNESCAPED_SLASHES) . PHP_EOL;
    }


    public function getTokenforSamulssOAuthLogin()
    {
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getTokenforSamulssOAuthLogin: Function called");
        $this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getTokenforSamulssOAuthLogin: Received payload = " . json_encode($this->request->getJSON() ?? []));

        $id = $this->request->getGet('id') ?? null;
        if(!$id){
            return $this->respond(['status' => 'failed','code' => 400,'message' => 'ID is required'], 200);
        }

        $user = $this->employeeModel->where('id', $id)->first();
        if(!$user){
            return $this->respond(['status' => 'failed','code' => 400,'message' => 'User not found'], 200);
        }   

        $token = JWTToken::encode($user);
        return $this->respond(['status' => 'success','code' => 200,'data' => $token], 200);

    }

}