<?php

require_once __DIR__ . '/../config/constants.php';

function getAuthToken(): ?string {
    $header = $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '';
    if (empty($header) && function_exists('getallheaders')) {
        $headers = getallheaders();
        $header = $headers['Authorization'] ?? $headers['authorization'] ?? '';
    }
    if (preg_match('/Bearer\s+(.+)/i', $header, $m)) {
        return $m[1];
    }
    return null;
}

function requireAuth(): string {
    $token = getAuthToken();
    if (!$token) {
        http_response_code(401);
        echo json_encode(['error' => 'Authentication required']);
        exit;
    }
    $user = verifyToken($token);
    if (!$user) {
        http_response_code(401);
        echo json_encode(['error' => 'Invalid or expired token']);
        exit;
    }
    // Ban enforcement — check if player is banned
    $userId = $user['id'] ?? null;
    if ($userId) {
        require_once __DIR__ . '/supabase.php';
        $sdb = supabaseService();
        $profiles = $sdb->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'is_banned,ban_expires_at', 'limit' => 1]);
        if (!empty($profiles) && !isset($profiles['error']) && ($profiles[0]['is_banned'] ?? false)) {
            $banExpires = $profiles[0]['ban_expires_at'] ?? null;
            if (!$banExpires || strtotime($banExpires) > time()) {
                http_response_code(403);
                echo json_encode(['error' => 'Account banned', 'ban_expires_at' => $banExpires]);
                exit;
            }
        }
    }
    return $token;
}

function requireAuthUser(): array {
    $token = getAuthToken();
    if (!$token) {
        http_response_code(401);
        echo json_encode(['error' => 'Authentication required']);
        exit;
    }
    $user = verifyToken($token);
    if (!$user) {
        http_response_code(401);
        echo json_encode(['error' => 'Invalid or expired token']);
        exit;
    }
    $userId = $user['id'] ?? null;
    if ($userId) {
        require_once __DIR__ . '/supabase.php';
        $sdb = supabaseService();
        $profiles = $sdb->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'is_banned,ban_expires_at', 'limit' => 1]);
        if (!empty($profiles) && !isset($profiles['error']) && ($profiles[0]['is_banned'] ?? false)) {
            $banExpires = $profiles[0]['ban_expires_at'] ?? null;
            if (!$banExpires || strtotime($banExpires) > time()) {
                http_response_code(403);
                echo json_encode(['error' => 'Account banned', 'ban_expires_at' => $banExpires]);
                exit;
            }
        }
    }
    return $user;
}

function verifyToken(string $token): ?array {
    $url = SUPABASE_AUTH . '/user';
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        'apikey: ' . SUPABASE_ANON_KEY,
        'Authorization: Bearer ' . $token
    ]);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($httpCode !== 200) return null;
    return json_decode($response, true);
}

function getUserId(string $token): ?string {
    $user = verifyToken($token);
    return $user['id'] ?? null;
}

function jsonResponse(array $data, int $code = 200): void {
    http_response_code($code);
    header('Content-Type: application/json');
    echo json_encode($data, JSON_UNESCAPED_UNICODE);
    exit;
}

function jsonError(string $msg, int $code = 400): void {
    jsonResponse(['error' => $msg], $code);
}

function getInput(): array {
    $raw = file_get_contents('php://input');
    return json_decode($raw, true) ?? [];
}
