<?php
include 'koneksi.php';
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(["status" => "error", "message" => "Method tidak diizinkan"]);
    exit;
}

if (!isset($_POST['id_account']) || empty($_POST['id_account'])) {
    echo json_encode(["status" => "error", "message" => "ID Account hilang"]);
    exit;
}

$id       = $_POST['id_account'];
$name     = trim($_POST['name']);
$username = trim($_POST['username']);

// Cek username bentrok
$cek = $pdo->prepare("SELECT COUNT(*) FROM account WHERE username = ? AND id_account != ?");
$cek->execute([$username, $id]);
if ($cek->fetchColumn() > 0) {
    echo json_encode(["status" => "error", "message" => "Username sudah digunakan"]);
    exit;
}

$updateFoto = false;
$fotoPath = '';

if (isset($_FILES['foto']) && $_FILES['foto']['error'] === UPLOAD_ERR_OK) {
    $allowed = ['jpg', 'jpeg', 'png', 'gif', 'webp'];
    $ext = strtolower(pathinfo($_FILES['foto']['name'], PATHINFO_EXTENSION));

    if (!in_array($ext, $allowed)) {
        echo json_encode(["status" => "error", "message" => "Format foto tidak didukung"]);
        exit;
    }

    $uploadDir = __DIR__ . '/uploads/';
    if (!is_dir($uploadDir)) mkdir($uploadDir, 0755, true);

    $fotoName = 'acc_' . time() . '_' . random_int(1000, 9999) . '.' . $ext;
    $targetPath = $uploadDir . $fotoName;

    if (move_uploaded_file($_FILES['foto']['tmp_name'], $targetPath)) {
        $fotoPath = 'uploads/' . $fotoName;
        $updateFoto = true;
        
        // hapus foto lama
        $q = $pdo->prepare("SELECT foto FROM account WHERE id_account = ?");
        $q->execute([$id]);
        $oldFoto = $q->fetchColumn();
        if ($oldFoto && file_exists(__DIR__ . '/' . $oldFoto) && strpos($oldFoto, 'images/faces/') === false) {
            @unlink(__DIR__ . '/' . $oldFoto);
        }
    }
}

try {
    $sql = "";
    $params = [];

    // Jika user menginput password baru
    if (isset($_POST['password']) && trim($_POST['password']) !== '') {
        $newPass = trim($_POST['password']);
        $passHash = password_hash($newPass, PASSWORD_DEFAULT);
        
        if ($updateFoto) {
            $sql = "UPDATE account SET name = ?, username = ?, password = ?, password_enc = ?, foto = ? WHERE id_account = ?";
            $params = [$name, $username, $passHash, $newPass, $fotoPath, $id];
        } else {
            $sql = "UPDATE account SET name = ?, username = ?, password = ?, password_enc = ? WHERE id_account = ?";
            $params = [$name, $username, $passHash, $newPass, $id];
        }
    } else {
        if ($updateFoto) {
            $sql = "UPDATE account SET name = ?, username = ?, foto = ? WHERE id_account = ?";
            $params = [$name, $username, $fotoPath, $id];
        } else {
            $sql = "UPDATE account SET name = ?, username = ? WHERE id_account = ?";
            $params = [$name, $username, $id];
        }
    }

    $stmt = $pdo->prepare($sql);
    $stmt->execute($params);

    echo json_encode(["status" => "success"]);
} catch (PDOException $e) {
    echo json_encode(["status" => "error", "message" => "Gagal mengubah: " . $e->getMessage()]);
}
?>