<?php
require_once __DIR__ . '/../../../Models/AppSetting.php';
require_once __DIR__ . '/../../../Models/Database.php';

class SettingController {
    private $db;

    public function __construct() {
        $this->db = Database::getInstance();
    }

    public function index() {
        $settingModel = new AppSetting();
        $settings = $settingModel->getAllSettings();

        // Fetch logged-in admin profile
        $adminId = $_SESSION['admin_id'] ?? null;
        $admin = null;
        if ($adminId) {
            $stmt = $this->db->prepare("SELECT * FROM admins WHERE id = ?");
            $stmt->execute([$adminId]);
            $admin = $stmt->fetch();
        }

        $activeTab = $_GET['tab'] ?? 'global';

        require __DIR__ . '/../../../../views/admin/settings/index.php';
    }

    public function updateSettings() {
        if ($_SERVER['REQUEST_METHOD'] !== 'POST') return;

        $settings = $_POST['settings'] ?? [];
        foreach ($settings as $key => $value) {
            $stmt = $this->db->prepare("UPDATE app_settings SET setting_value = ? WHERE setting_key = ?");
            $stmt->execute([$value, $key]);
        }

        header("Location: ?page=settings&tab=global&success=Settings updated successfully");
        exit;
    }

    public function updateProfile() {
        if ($_SERVER['REQUEST_METHOD'] !== 'POST') return;
        
        $adminId = $_SESSION['admin_id'] ?? null;
        if (!$adminId) {
            header("Location: ?page=settings&tab=profile&error=Unauthorized");
            exit;
        }

        $name = $_POST['name'] ?? '';
        $email = $_POST['email'] ?? '';
        
        if (empty($name) || empty($email)) {
            header("Location: ?page=settings&tab=profile&error=Name and Email are required");
            exit;
        }

        $stmt = $this->db->prepare("UPDATE admins SET name = ?, email = ?, updated_at = NOW() WHERE id = ?");
        $stmt->execute([$name, $email, $adminId]);
        
        $_SESSION['admin_name'] = $name;
        header("Location: ?page=settings&tab=profile&success=Profile updated successfully");
        exit;
    }

    public function updatePassword() {
        if ($_SERVER['REQUEST_METHOD'] !== 'POST') return;

        $adminId = $_SESSION['admin_id'] ?? null;
        if (!$adminId) {
            header("Location: ?page=settings&tab=security&error=Unauthorized");
            exit;
        }

        $oldPassword = $_POST['old_password'] ?? '';
        $newPassword = $_POST['new_password'] ?? '';
        $confirmPassword = $_POST['confirm_password'] ?? '';

        if (empty($oldPassword) || empty($newPassword)) {
            header("Location: ?page=settings&tab=security&error=All fields are required");
            exit;
        }

        if ($newPassword !== $confirmPassword) {
            header("Location: ?page=settings&tab=security&error=Passwords do not match");
            exit;
        }

        $stmt = $this->db->prepare("SELECT password FROM admins WHERE id = ?");
        $stmt->execute([$adminId]);
        $admin = $stmt->fetch();

        if (!password_verify($oldPassword, $admin['password'])) {
            header("Location: ?page=settings&tab=security&error=Incorrect current password");
            exit;
        }

        $hashedPassword = password_hash($newPassword, PASSWORD_DEFAULT);
        $stmt = $this->db->prepare("UPDATE admins SET password = ?, updated_at = NOW() WHERE id = ?");
        $stmt->execute([$hashedPassword, $adminId]);

        header("Location: ?page=settings&tab=security&success=Password changed successfully");
        exit;
    }
}
