<?php
declare(strict_types=1);

ini_set('display_errors', '1');
error_reporting(E_ALL);
session_start();

if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}

$config = require __DIR__ . '/../config/database.php';

$dsn = sprintf(
    'mysql:host=%s;dbname=%s;charset=%s',
    $config['host'],
    $config['dbname'],
    $config['charset'] ?? 'utf8mb4'
);

$pdo = new PDO(
    $dsn,
    $config['user'],
    $config['pass'],
    [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    ]
);

$currentUserId = (int)$_SESSION['user_id'];
$loggedIn = true;
$errors = [];
$successMessage = '';
$pageTitle = 'Benutzerverwaltung';
$headerIntroPre = 'Administration';
$headerIntroTitle = 'Benutzerkonten verwalten';
$headerIntroSub = 'Konten freischalten, deaktivieren und Rollen verwalten';

function h(?string $value): string
{
    return htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8');
}

function redirectToAdminUsers(): void
{
    header('Location: admin_users.php');
    exit;
}

function sendActivationNotification(string $username, string $email, ?string $displayName): void
{
    $subject = 'Dein SkyView-Konto wurde freigeschaltet';
    $recipientName = $displayName !== null && $displayName !== '' ? $displayName : $username;
    $messageLines = [
        'Hallo ' . $recipientName . ',',
        '',
        'dein Benutzerkonto bei SkyView wurde soeben freigeschaltet.',
        'Du kannst dich ab sofort mit deinen Zugangsdaten anmelden.',
        '',
        'Benutzername: ' . $username,
        '',
        'Viele Gruesse',
        'Astronomiemuseum der Sternwarte Sonneberg',
    ];

    $headers = [
        'MIME-Version: 1.0',
        'Content-Type: text/plain; charset=UTF-8',
        'From: noreply@astronomiemuseum.de',
        'Reply-To: tm@astronomiemuseum.de',
    ];

    try {
        mail(
            $email,
            $subject,
            implode(PHP_EOL, $messageLines),
            implode("\r\n", $headers)
        );
    } catch (Throwable $e) {
        error_log('Activation notification mail failed: ' . $e->getMessage());
    }
}

if (empty($_SESSION['admin_users_csrf'])) {
    $_SESSION['admin_users_csrf'] = bin2hex(random_bytes(16));
}

$stmtCurrentUser = $pdo->prepare("
    SELECT `id`, `username`, `display_name`, `role`, `is_active`
    FROM `app_users`
    WHERE `id` = :id
    LIMIT 1
");
$stmtCurrentUser->execute([':id' => $currentUserId]);
$currentUser = $stmtCurrentUser->fetch();

if (
    !$currentUser ||
    $currentUser['role'] !== 'admin' ||
    (int)$currentUser['is_active'] !== 1
) {
    $_SESSION = [];
    session_destroy();
    header('Location: login.php');
    exit;
}

if (isset($_SESSION['admin_users_flash_success'])) {
    $successMessage = (string)$_SESSION['admin_users_flash_success'];
    unset($_SESSION['admin_users_flash_success']);
}

if (isset($_SESSION['admin_users_flash_errors']) && is_array($_SESSION['admin_users_flash_errors'])) {
    $errors = array_values($_SESSION['admin_users_flash_errors']);
    unset($_SESSION['admin_users_flash_errors']);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = $_POST['action'] ?? '';
    $targetUserId = (int)($_POST['user_id'] ?? 0);
    $csrfToken = (string)($_POST['csrf_token'] ?? '');

    if (!hash_equals($_SESSION['admin_users_csrf'], $csrfToken)) {
        $errors[] = 'Die Sitzung ist abgelaufen. Bitte die Seite neu laden.';
    }

    $stmtTargetUser = $pdo->prepare("
        SELECT `id`, `username`, `email`, `display_name`, `role`, `is_active`
        FROM `app_users`
        WHERE `id` = :id
        LIMIT 1
    ");

    $targetUser = null;
    if ($targetUserId > 0) {
        $stmtTargetUser->execute([':id' => $targetUserId]);
        $targetUser = $stmtTargetUser->fetch();
    }

    if (!$targetUser) {
        $errors[] = 'Das ausgewählte Benutzerkonto wurde nicht gefunden.';
    }

    if ($targetUser && $targetUserId === $currentUserId && in_array($action, ['deactivate_user', 'change_role', 'delete_user'], true)) {
        $errors[] = 'Das eigene Administrationskonto kann hier nicht deaktiviert, geloescht oder umgestellt werden.';
    }

    if (empty($errors) && $targetUser) {
        $stmtActiveAdminCount = $pdo->query("
            SELECT COUNT(*)
            FROM `app_users`
            WHERE `role` = 'admin' AND `is_active` = 1
        ");
        $activeAdminCount = (int)$stmtActiveAdminCount->fetchColumn();

        if (
            $action === 'deactivate_user' &&
            $targetUser['role'] === 'admin' &&
            (int)$targetUser['is_active'] === 1 &&
            $activeAdminCount <= 1
        ) {
            $errors[] = 'Der letzte aktive Admin kann nicht deaktiviert werden.';
        }

        if (
            $action === 'change_role' &&
            $targetUser['role'] === 'admin' &&
            ($_POST['role'] ?? '') !== 'admin' &&
            (int)$targetUser['is_active'] === 1 &&
            $activeAdminCount <= 1
        ) {
            $errors[] = 'Der letzte aktive Admin kann nicht zur Benutzerrolle herabgestuft werden.';
        }

        if (
            $action === 'delete_user' &&
            $targetUser['role'] === 'admin' &&
            (int)$targetUser['is_active'] === 1 &&
            $activeAdminCount <= 1
        ) {
            $errors[] = 'Der letzte aktive Admin kann nicht geloescht werden.';
        }
    }

    if (empty($errors) && $targetUser) {
        if ($action === 'activate_user') {
            $notifyUser = (int)($_POST['notify_user'] ?? 0) === 1;

            $stmtUpdate = $pdo->prepare("
                UPDATE `app_users`
                SET `is_active` = 1, `updated_at` = NOW()
                WHERE `id` = :id
            ");
            $stmtUpdate->execute([':id' => $targetUserId]);

            if ($notifyUser) {
                sendActivationNotification(
                    $targetUser['username'],
                    $targetUser['email'],
                    $targetUser['display_name']
                );
                $_SESSION['admin_users_flash_success'] = 'Benutzerkonto wurde freigeschaltet und der Benutzer wurde benachrichtigt.';
            } else {
                $_SESSION['admin_users_flash_success'] = 'Benutzerkonto wurde freigeschaltet.';
            }
            redirectToAdminUsers();
        }

        if ($action === 'deactivate_user') {
            $stmtUpdate = $pdo->prepare("
                UPDATE `app_users`
                SET `is_active` = 0, `updated_at` = NOW()
                WHERE `id` = :id
            ");
            $stmtUpdate->execute([':id' => $targetUserId]);
            $_SESSION['admin_users_flash_success'] = 'Benutzerkonto wurde deaktiviert.';
            redirectToAdminUsers();
        }

        if ($action === 'change_role') {
            $newRole = (string)($_POST['role'] ?? 'user');

            if (!in_array($newRole, ['user', 'admin'], true)) {
                $errors[] = 'Die gewählte Rolle ist ungültig.';
            } else {
                $stmtUpdate = $pdo->prepare("
                    UPDATE `app_users`
                    SET `role` = :role, `updated_at` = NOW()
                    WHERE `id` = :id
                ");
                $stmtUpdate->execute([
                    ':role' => $newRole,
                    ':id' => $targetUserId,
                ]);
                $_SESSION['admin_users_flash_success'] = 'Die Benutzerrolle wurde aktualisiert.';
                redirectToAdminUsers();
            }
        }

        if ($action === 'delete_user') {
            $stmtDelete = $pdo->prepare("
                DELETE FROM `app_users`
                WHERE `id` = :id
            ");
            $stmtDelete->execute([
                ':id' => $targetUserId,
            ]);
            $_SESSION['admin_users_flash_success'] = 'Benutzerkonto wurde geloescht. Zugehoerige Standorte und Satelliten wurden automatisch entfernt.';
            redirectToAdminUsers();
        }
    }

    if (!empty($errors)) {
        $_SESSION['admin_users_flash_errors'] = $errors;
        redirectToAdminUsers();
    }
}

$stats = [
    'total' => 0,
    'active' => 0,
    'pending' => 0,
    'admins' => 0,
];

$stmtStats = $pdo->query("
    SELECT
        COUNT(*) AS total_users,
        SUM(CASE WHEN `is_active` = 1 THEN 1 ELSE 0 END) AS active_users,
        SUM(CASE WHEN `is_active` = 0 THEN 1 ELSE 0 END) AS pending_users,
        SUM(CASE WHEN `role` = 'admin' THEN 1 ELSE 0 END) AS admin_users
    FROM `app_users`
");
$statsRow = $stmtStats->fetch();
if ($statsRow) {
    $stats['total'] = (int)$statsRow['total_users'];
    $stats['active'] = (int)$statsRow['active_users'];
    $stats['pending'] = (int)$statsRow['pending_users'];
    $stats['admins'] = (int)$statsRow['admin_users'];
}

$stmtUsers = $pdo->query("
    SELECT
        `id`,
        `username`,
        `email`,
        `display_name`,
        `role`,
        `is_active`,
        `last_login_at`,
        `created_at`,
        `updated_at`
    FROM `app_users`
    ORDER BY `is_active` ASC, `role` DESC, `created_at` DESC, `username` ASC
");
$users = $stmtUsers->fetchAll();
?>
<?php require __DIR__ . '/header.php'; ?>

<div class="admin-users-layout">
    <section class="card admin-users-summary-card">
        <h2>Uebersicht</h2>
        <p class="hint">Hier kannst du Benutzerkonten freischalten, deaktivieren, loeschen und zwischen <strong>user</strong> und <strong>admin</strong> wechseln.</p>

        <?php if ($successMessage !== ''): ?>
            <p class="msg-success"><?= h($successMessage) ?></p>
        <?php endif; ?>

        <?php if (!empty($errors)): ?>
            <ul class="msg-error">
                <?php foreach ($errors as $error): ?>
                    <li><?= h((string)$error) ?></li>
                <?php endforeach; ?>
            </ul>
        <?php endif; ?>

        <div class="admin-stats-grid">
            <div class="admin-stat-box">
                <span class="admin-stat-label">Gesamt</span>
                <strong><?= $stats['total'] ?></strong>
            </div>
            <div class="admin-stat-box">
                <span class="admin-stat-label">Aktiv</span>
                <strong><?= $stats['active'] ?></strong>
            </div>
            <div class="admin-stat-box admin-stat-box-warning">
                <span class="admin-stat-label">Warten auf Freischaltung</span>
                <strong><?= $stats['pending'] ?></strong>
            </div>
            <div class="admin-stat-box">
                <span class="admin-stat-label">Admins</span>
                <strong><?= $stats['admins'] ?></strong>
            </div>
        </div>
    </section>

    <section class="card admin-users-table-card">
        <h2>Benutzerkonten</h2>
        <div class="admin-users-table-wrap">
            <table class="data-table admin-users-table">
                <thead>
                    <tr>
                        <th>Benutzer</th>
                        <th>Status</th>
                        <th>Rolle</th>
                        <th>Registriert</th>
                        <th>Letzter Login</th>
                        <th>Aktionen</th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach ($users as $userRow): ?>
                        <?php
                        $isSelf = (int)$userRow['id'] === $currentUserId;
                        $isActive = (int)$userRow['is_active'] === 1;
                        $statusLabel = $isActive ? 'Aktiv' : 'Wartet auf Freischaltung';
                        ?>
                        <tr>
                            <td>
                                <div class="admin-user-main">
                                    <strong><?= h($userRow['display_name'] ?: $userRow['username']) ?></strong>
                                    <span><?= h($userRow['username']) ?></span>
                                    <span><?= h($userRow['email']) ?></span>
                                    <?php if ($isSelf): ?>
                                        <span class="admin-user-self">Dieses Konto</span>
                                    <?php endif; ?>
                                </div>
                            </td>
                            <td>
                                <span class="status-badge <?= $isActive ? 'status-badge-active' : 'status-badge-pending' ?>">
                                    <?= h($statusLabel) ?>
                                </span>
                            </td>
                            <td>
                                <span class="role-badge <?= $userRow['role'] === 'admin' ? 'role-badge-admin' : 'role-badge-user' ?>">
                                    <?= h($userRow['role']) ?>
                                </span>
                            </td>
                            <td><?= h($userRow['created_at']) ?></td>
                            <td><?= h($userRow['last_login_at'] ?: 'Noch nie') ?></td>
                            <td>
                                <div class="admin-actions">
                                    <form method="post" class="admin-inline-form js-activate-user-form" data-username="<?= h($userRow['username']) ?>">
                                        <input type="hidden" name="csrf_token" value="<?= h($_SESSION['admin_users_csrf']) ?>">
                                        <input type="hidden" name="user_id" value="<?= (int)$userRow['id'] ?>">
                                        <input type="hidden" name="notify_user" value="0">
                                        <?php if ($isActive): ?>
                                            <input type="hidden" name="action" value="deactivate_user">
                                            <button type="submit" class="btn btn-danger btn-sm"<?= $isSelf ? ' disabled' : '' ?>>Deaktivieren</button>
                                        <?php else: ?>
                                            <input type="hidden" name="action" value="activate_user">
                                            <button type="submit" class="btn btn-primary btn-sm">Freischalten</button>
                                        <?php endif; ?>
                                    </form>

                                    <form method="post" class="admin-inline-form admin-role-form">
                                        <input type="hidden" name="csrf_token" value="<?= h($_SESSION['admin_users_csrf']) ?>">
                                        <input type="hidden" name="action" value="change_role">
                                        <input type="hidden" name="user_id" value="<?= (int)$userRow['id'] ?>">
                                        <select name="role"<?= $isSelf ? ' disabled' : '' ?>>
                                            <option value="user"<?= $userRow['role'] === 'user' ? ' selected' : '' ?>>user</option>
                                            <option value="admin"<?= $userRow['role'] === 'admin' ? ' selected' : '' ?>>admin</option>
                                        </select>
                                        <button type="submit" class="btn btn-secondary btn-sm"<?= $isSelf ? ' disabled' : '' ?>>Rolle speichern</button>
                                    </form>

                                    <form method="post" class="admin-inline-form js-delete-user-form" data-username="<?= h($userRow['username']) ?>">
                                        <input type="hidden" name="csrf_token" value="<?= h($_SESSION['admin_users_csrf']) ?>">
                                        <input type="hidden" name="action" value="delete_user">
                                        <input type="hidden" name="user_id" value="<?= (int)$userRow['id'] ?>">
                                        <button type="submit" class="btn btn-danger btn-sm"<?= $isSelf ? ' disabled' : '' ?>>Benutzer loeschen</button>
                                    </form>
                                </div>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        </div>
    </section>
</div>

<dialog class="admin-dialog" id="activateNotifyDialog">
    <form method="dialog" class="admin-dialog-card">
        <h3>Benutzer benachrichtigen?</h3>
        <p id="activateNotifyDialogText">Soll der Benutzer benachrichtigt werden?</p>
        <div class="admin-dialog-actions">
            <button type="button" class="btn btn-secondary" data-notify-choice="no">Nein</button>
            <button type="button" class="btn btn-primary" data-notify-choice="yes">Ja</button>
        </div>
    </form>
</dialog>

<dialog class="admin-dialog" id="deleteUserDialog">
    <form method="dialog" class="admin-dialog-card">
        <h3>Benutzer loeschen?</h3>
        <p id="deleteUserDialogText">Soll dieser Benutzer wirklich geloescht werden?</p>
        <div class="admin-dialog-actions">
            <button type="button" class="btn btn-secondary" data-delete-choice="no">Abbrechen</button>
            <button type="button" class="btn btn-danger" data-delete-choice="yes">Loeschen</button>
        </div>
    </form>
</dialog>

<script>
(function () {
    const dialog = document.getElementById('activateNotifyDialog');
    const dialogText = document.getElementById('activateNotifyDialogText');
    const activateForms = document.querySelectorAll('.js-activate-user-form');
    const deleteDialog = document.getElementById('deleteUserDialog');
    const deleteDialogText = document.getElementById('deleteUserDialogText');
    const deleteForms = document.querySelectorAll('.js-delete-user-form');

    if (!dialog || !dialogText || activateForms.length === 0 || typeof dialog.showModal !== 'function') {
        return;
    }

    let pendingForm = null;
    let pendingDeleteForm = null;

    activateForms.forEach(function (form) {
        const actionInput = form.querySelector('input[name="action"]');
        if (!actionInput || actionInput.value !== 'activate_user') {
            return;
        }

        form.addEventListener('submit', function (event) {
            event.preventDefault();
            pendingForm = form;

            const username = form.getAttribute('data-username') || 'dieser Benutzer';
            dialogText.textContent = 'Benutzer "' + username + '" benachrichtigen?';
            dialog.showModal();
        });
    });

    dialog.querySelectorAll('[data-notify-choice]').forEach(function (button) {
        button.addEventListener('click', function () {
            if (!pendingForm) {
                dialog.close();
                return;
            }

            const notifyInput = pendingForm.querySelector('input[name="notify_user"]');
            if (notifyInput) {
                notifyInput.value = button.getAttribute('data-notify-choice') === 'yes' ? '1' : '0';
            }

            dialog.close();
            pendingForm.submit();
            pendingForm = null;
        });
    });

    dialog.addEventListener('cancel', function () {
        pendingForm = null;
    });

    if (deleteDialog && deleteDialogText && deleteForms.length > 0 && typeof deleteDialog.showModal === 'function') {
        deleteForms.forEach(function (form) {
            form.addEventListener('submit', function (event) {
                event.preventDefault();
                pendingDeleteForm = form;

                const username = form.getAttribute('data-username') || 'dieser Benutzer';
                deleteDialogText.textContent = 'Benutzer "' + username + '" wirklich loeschen? Standorte und Satelliten dieses Kontos werden ebenfalls entfernt.';
                deleteDialog.showModal();
            });
        });

        deleteDialog.querySelectorAll('[data-delete-choice]').forEach(function (button) {
            button.addEventListener('click', function () {
                if (!pendingDeleteForm) {
                    deleteDialog.close();
                    return;
                }

                if (button.getAttribute('data-delete-choice') === 'yes') {
                    deleteDialog.close();
                    pendingDeleteForm.submit();
                    pendingDeleteForm = null;
                    return;
                }

                deleteDialog.close();
                pendingDeleteForm = null;
            });
        });

        deleteDialog.addEventListener('cancel', function () {
            pendingDeleteForm = null;
        });
    }
})();
</script>

<?php require __DIR__ . '/footer.php'; ?>