<?php
include 'koneksi.php';
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(["status" => "error", "message" => "Method tidak diizinkan"]);
    exit;
}

if (!isset($_POST['id_occupant']) || trim($_POST['id_occupant']) === '') {
    echo json_encode(["status" => "error", "message" => "ID Occupant wajib"]);
    exit;
}

$id_occupant = trim($_POST['id_occupant']);

// Validasi occupant exists
$cek = $pdo->prepare("SELECT id_occupant, name FROM occupant WHERE id_occupant = ?");
$cek->execute([$id_occupant]);
$occupant = $cek->fetch();

if (!$occupant) {
    echo json_encode(["status" => "error", "message" => "Occupant tidak ditemukan"]);
    exit;
}

// Invalidate all previous active tokens for this occupant
$pdo->prepare("UPDATE foto_tokens SET status = 'used', used_at = NOW() WHERE id_occupant = ? AND status = 'active'")
    ->execute([$id_occupant]);

// Generate unique token
$token = hash('sha256', random_bytes(32) . $id_occupant . microtime(true));

try {
    $stmt = $pdo->prepare("INSERT INTO foto_tokens (id_occupant, token, status) VALUES (?, ?, 'active')");
    $stmt->execute([$id_occupant, $token]);

    // Build URL
    $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
    $host = $_SERVER['HTTP_HOST'];
    $basePath = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/\\');
    $url = $protocol . '://' . $host . $basePath . '/registrasi_foto.php?token=' . $token;

    echo json_encode([
        "status" => "success",
        "token"  => $token,
        "url"    => $url,
        "name"   => $occupant['name']
    ]);

} catch (PDOException $e) {
    echo json_encode([
        "status"  => "error",
        "message" => "Gagal generate token: " . $e->getMessage()
    ]);
}
?>