<?php
include 'koneksi.php';
include 'run_background.php';

$botToken = "8184881871:AAFOz6uzIgxE7rk3WttcKKrr0DtcNGIt-Ho";
$website = "https://api.telegram.org/bot" . $botToken;

header('Content-Type: application/json');

$action = $_POST['action'] ?? '';
$chatId = $_POST['chat_id'] ?? '';

if (!$action || !$chatId) {
    echo json_encode(['success' => false, 'error' => 'Invalid parameters']);
    exit;
}

// Get occupant id
$stmt = $pdo->prepare("SELECT id_occupant FROM occupant WHERE telegram_id = ?");
$stmt->execute([$chatId]);
$occupant = $stmt->fetch(PDO::FETCH_ASSOC);
if (!$occupant) {
    echo json_encode(['success' => false, 'error' => 'Occupant not found']);
    exit;
}
$id_occupant = $occupant['id_occupant'];

$protocol = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http";
$host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : 'localhost';
$uri = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
$baseUrl = $protocol . "://" . $host . $uri;

// Remove the Manage message
$manPathMng = __DIR__ . '/manifest_manage.json';
if (file_exists($manPathMng)) {
    $mng = json_decode(file_get_contents($manPathMng), true) ?: [];
    if (isset($mng[$chatId])) {
        $msgData = $mng[$chatId];
        if (is_array($msgData)) {
            $msgId = $msgData['msg_id'];
            $userMsgId = $msgData['user_msg_id'] ?? null;
            @file_get_contents($website . "/deleteMessage?chat_id=$chatId&message_id=$msgId");
            if ($userMsgId) {
                @file_get_contents($website . "/deleteMessage?chat_id=$chatId&message_id=$userMsgId");
            }
        } else {
            $msgId = $msgData;
            @file_get_contents($website . "/deleteMessage?chat_id=$chatId&message_id=$msgId");
        }
        unset($mng[$chatId]);
        file_put_contents($manPathMng, json_encode($mng));
    }
}

// Clean old tokens
$manifestsToClean = ['manifest_pin_tokens.json', 'manifest_edit_tokens.json'];
foreach ($manifestsToClean as $mFile) {
    $mPath = __DIR__ . '/' . $mFile;
    if (file_exists($mPath)) {
        $mTkns = json_decode(file_get_contents($mPath), true) ?: [];
        $mChanged = false;
        foreach ($mTkns as $oldTk => $oldData) {
            if (isset($oldData['id_occupant']) && $oldData['id_occupant'] == $id_occupant) {
                if (isset($oldData['msg_id'])) {
                    @file_get_contents($website . "/deleteMessage?chat_id=$chatId&message_id={$oldData['msg_id']}");
                }
                if (isset($oldData['user_msg_id']) && $oldData['user_msg_id']) {
                    @file_get_contents($website . "/deleteMessage?chat_id=$chatId&message_id={$oldData['user_msg_id']}");
                }
                unset($mTkns[$oldTk]);
                $mChanged = true;
            }
        }
        if ($mChanged) {
            file_put_contents($mPath, json_encode($mTkns, JSON_PRETTY_PRINT));
        }
    }
}

// Handle action
if ($action === 'forgot_pin') {
    // Pre-check for photo
    $checkStmt = $pdo->prepare("SELECT foto FROM occupant WHERE id_occupant = ?");
    $checkStmt->execute([$id_occupant]);
    $chk = $checkStmt->fetch(PDO::FETCH_ASSOC);
    if (!$chk || empty($chk['foto'])) {
        $text = "⚠️ <b>Akses Ditolak</b>\n\nMaaf, Anda belum memiliki Data Foto Wajah yang terdaftar di sistem.\n\nSilakan gunakan menu <b>EDIT DATA</b> terlebih dahulu untuk mengunggah Foto Wajah Anda sebelum menggunakan fitur Verifikasi Biometrik.";
        file_get_contents($website . "/sendMessage?" . http_build_query(['chat_id' => $chatId, 'text' => $text, 'parse_mode' => 'HTML']));
        echo json_encode(['success' => false, 'error' => 'No photo']);
        exit;
    }

    $token = bin2hex(random_bytes(16));
    $manPath = __DIR__ . '/manifest_pin_tokens.json';
    $tkns = file_exists($manPath) ? (json_decode(file_get_contents($manPath), true) ?: []) : [];
    $tkns[$token] = ['id_occupant' => $id_occupant, 'created_at' => time(), 'expires_at' => time() + 300, 'user_msg_id' => 0];

    file_put_contents($manPath, json_encode($tkns, JSON_PRETTY_PRINT));
    
    echo json_encode(['success' => true, 'redirect_url' => 'verification.php?token=' . $token]);
    exit;
} elseif ($action === 'edit_data') {
    $token = bin2hex(random_bytes(16));
    $manPath = __DIR__ . '/manifest_edit_tokens.json';
    $tkns = file_exists($manPath) ? (json_decode(file_get_contents($manPath), true) ?: []) : [];
    $tkns[$token] = ['id_occupant' => $id_occupant, 'created_at' => time(), 'expires_at' => time() + 300, 'user_msg_id' => 0];

    file_put_contents($manPath, json_encode($tkns, JSON_PRETTY_PRINT));
    
    echo json_encode(['success' => true, 'redirect_url' => 'edit_data.php?token=' . $token]);
    exit;
}

echo json_encode(['success' => false, 'error' => 'Unknown action']);