<?php
include "koneksi.php";
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(["status" => "error", "message" => "Method tidak diizinkan"]);
    exit;
}

$id  = isset($_POST['id_occupant']) ? $_POST['id_occupant'] : '';
$pin = isset($_POST['pin']) ? $_POST['pin'] : '';

if (empty($id) || empty($pin)) {
    echo json_encode(["status" => "error", "message" => "ID dan PIN wajib diisi"]);
    exit;
}

try {
    $stmt = $pdo->prepare("SELECT pin, password_enc FROM occupant WHERE id_occupant = ?");
    $stmt->execute([$id]);
    $row = $stmt->fetch();

    if (!$row) {
        echo json_encode(["status" => "error", "message" => "Data tidak ditemukan"]);
        exit;
    }

    if ($row['pin'] !== $pin) {
        echo json_encode(["status" => "error", "message" => "PIN salah"]);
        exit;
    }

    // Decrypt password
    $encKey = 'FbR!sk7@Occ2024#SecretKey';
    $data = base64_decode($row['password_enc']);
    $parts = explode('::', $data, 2);

    if (count($parts) === 2) {
        $iv = $parts[0];
        $encrypted = $parts[1];
        $decrypted = openssl_decrypt($encrypted, 'AES-256-CBC', $encKey, 0, $iv);
        
        if ($decrypted !== false) {
            echo json_encode(["status" => "success", "password" => $decrypted]);
        } else {
            echo json_encode(["status" => "error", "message" => "Gagal mendekripsi password"]);
        }
    } else {
        echo json_encode(["status" => "error", "message" => "Data password terenkripsi tidak valid"]);
    }

} catch (PDOException $e) {
    echo json_encode(["status" => "error", "message" => "Terjadi kesalahan server"]);
}
?>