<?php
include 'koneksi.php';
include 'notification_helper.php';
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(["status" => "error", "message" => "Method tidak diizinkan"]);
    exit;
}

$required = ['name', 'username', 'password', 'pin'];
foreach ($required as $field) {
    if (!isset($_POST[$field]) || trim($_POST[$field]) === '') {
        echo json_encode(["status" => "error", "message" => "Field $field wajib diisi"]);
        exit;
    }
}

$name = trim($_POST['name']);
$username = trim($_POST['username']);
$password = trim($_POST['password']);
$pin = trim($_POST['pin']);

if (!preg_match('/^\d{6}$/', $pin)) {
    echo json_encode(["status" => "error", "message" => "PIN harus 6 digit angka"]);
    exit;
}

$cek = $pdo->prepare("SELECT COUNT(*) FROM account WHERE username = ?");
$cek->execute([$username]);
if ($cek->fetchColumn() > 0) {
    echo json_encode(["status" => "error", "message" => "Username sudah digunakan"]);
    exit;
}

$passwordHash = password_hash($password, PASSWORD_DEFAULT);
// Karena ada requirement password hash & menampilkan password asli via PIN:
$passwordEnc = $password;


$foto = '';
if (isset($_FILES['foto']) && $_FILES['foto']['error'] === UPLOAD_ERR_OK) {
    $allowed = ['jpg', 'jpeg', 'png', 'gif', 'webp'];
    $ext = strtolower(pathinfo($_FILES['foto']['name'], PATHINFO_EXTENSION));

    if (!in_array($ext, $allowed)) {
        echo json_encode(["status" => "error", "message" => "Format foto tidak didukung"]);
        exit;
    }

    if ($_FILES['foto']['size'] > 5 * 1024 * 1024) {
        echo json_encode(["status" => "error", "message" => "Ukuran foto maksimal 5MB"]);
        exit;
    }

    $uploadDir = __DIR__ . '/uploads/';
    if (!is_dir($uploadDir)) {
        mkdir($uploadDir, 0755, true);
    }

    $fotoName = 'acc_' . time() . '_' . random_int(1000, 9999) . '.' . $ext;
    $targetPath = $uploadDir . $fotoName;

    if (move_uploaded_file($_FILES['foto']['tmp_name'], $targetPath)) {
        $foto = 'uploads/' . $fotoName;
    }
    else {
        echo json_encode(["status" => "error", "message" => "Gagal mengupload foto"]);
        exit;
    }
}
else {
    echo json_encode(["status" => "error", "message" => "Foto wajib diupload"]);
    exit;
}

try {
    $stmt = $pdo->prepare("
        INSERT INTO account (name, username, password, password_enc, pin, foto, status)
        VALUES (?, ?, ?, ?, ?, ?, 'rejected')
    ");
    $stmt->execute([$name, $username, $passwordHash, $passwordEnc, $pin, $foto]);
    $newId = $pdo->lastInsertId();

    send_notification($pdo, 'mdi-account-plus', 'Pendaftaran Akun Baru', "Admin menambahkan akun baru: {$name} ({$username}).", "Status: Menunggu Persetujuan. Silahkan setujui jika valid.", false);

    echo json_encode([
        "status" => "success",
        "message" => "Akun berhasil didaftarkan",
        "id_account" => $newId
    ]);

}
catch (PDOException $e) {
    echo json_encode([
        "status" => "error",
        "message" => "Gagal menyimpan: " . $e->getMessage()
    ]);
}
?>