<?php
session_start();

date_default_timezone_set('Asia/Jakarta');

require_once(__DIR__ . '/../include/db_config.php');
require_once(__DIR__ . '/../lib/BillingService.class.php');
require_once(__DIR__ . '/../lib/WhatsAppNotification.class.php');

// Determine Owner ID for displaying correct contact info
$ownerId = 0;

// 1. Detect from URL (ref/owner) - useful for isolated links
if (isset($_GET['owner']) && is_numeric($_GET['owner'])) {
    $ownerId = (int)$_GET['owner'];
} elseif (isset($_GET['ref'])) {
    // Resolve username to ID
    try {
        $db = getDBConnection();
        if ($db) {
            $stmt = $db->prepare("SELECT id FROM mikrobil_user_accounts WHERE username = ?");
            $stmt->execute([trim($_GET['ref'])]);
            $uid = $stmt->fetchColumn();
            if ($uid) {
                $ownerId = (int)$uid;
            }
        }
    } catch (Exception $e) { }
}

// 2. Detect from Pending Login Session (if returning from OTP page)
if ($ownerId === 0 && isset($_SESSION['billing_portal_pending_login']['owner_id'])) {
    $ownerId = (int)$_SESSION['billing_portal_pending_login']['owner_id'];
}

if (isset($_SESSION['billing_portal_customer_id']) && (int)$_SESSION['billing_portal_customer_id'] > 0) {
    header('Location: billing_portal.php');
    exit;
}

$identifier = '';
if (isset($_GET['identifier'])) {
    $identifier = trim($_GET['identifier']);
} elseif (isset($_GET['service'])) {
    $identifier = trim($_GET['service']);
} elseif (isset($_GET['pppoe'])) {
    $identifier = trim($_GET['pppoe']);
} elseif (isset($_GET['username'])) {
    $identifier = trim($_GET['username']);
}
$otpCodeInput = '';
$error = $_SESSION['billing_portal_flash_error'] ?? null;
$success = $_SESSION['billing_portal_flash_success'] ?? null;
unset($_SESSION['billing_portal_flash_error'], $_SESSION['billing_portal_flash_success']);

try {
    $billingService = new BillingService();
} catch (Throwable $e) {
    http_response_code(500);
    echo 'Tidak dapat memuat layanan billing: ' . htmlspecialchars($e->getMessage());
    exit;
}

$contactHeading = $billingService->getSetting('billing_portal_contact_heading', 'Butuh bantuan? Hubungi Admin ISP', $ownerId);
$contactWhatsapp = $billingService->getSetting('billing_portal_contact_whatsapp', '082272199412', $ownerId);
$contactEmail = $billingService->getSetting('billing_portal_contact_email', 'emailanda@domainanda.com', $ownerId);
$contactBody = $billingService->getSetting('billing_portal_contact_body', 'Jam operasional: 08.00 - 22.00', $ownerId);

$otpEnabled = $billingService->getSetting('billing_portal_otp_enabled', '0', $ownerId) === '1';
$otpDigits = (int)$billingService->getSetting('billing_portal_otp_digits', '6', $ownerId);
$otpExpiry = (int)$billingService->getSetting('billing_portal_otp_expiry_minutes', '5', $ownerId);
$otpMaxAttempts = (int)$billingService->getSetting('billing_portal_otp_max_attempts', '5', $ownerId);

$otpDigits = max(4, min(8, $otpDigits));
$otpExpiry = max(1, min(30, $otpExpiry));
$otpMaxAttempts = max(1, min(10, $otpMaxAttempts));

$pendingLogin = $_SESSION['billing_portal_pending_login'] ?? null;
$stage = 'identifier';
if ($otpEnabled && $pendingLogin && is_array($pendingLogin)) {
    $stage = 'otp';
    $identifier = $pendingLogin['identifier'] ?? '';
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = $_POST['action'] ?? 'request';

    if ($action === 'cancel_pending') {
        unset($_SESSION['billing_portal_pending_login']);
        $stage = 'identifier';
        $success = null;
    } elseif ($action === 'request_login') {
        $identifier = trim($_POST['identifier'] ?? '');

        if ($identifier === '') {
            $error = 'Mohon masukkan nomor telepon, ID layanan, atau PPPoE username.';
            $stage = 'identifier';
        } else {
            try {
                $customer = $billingService->findCustomerForPortal($identifier);

                if (!$customer) {
                    $error = 'Data pelanggan tidak ditemukan. Pastikan nomor telepon atau ID benar.';
                } else {
                    // Update settings based on Customer's Owner ID
                    $customerOwnerId = (int)($customer['owner_id'] ?? 0);
                    $ownerId = $customerOwnerId; // Update global ownerId for view
                    
                    // Refresh settings for OTP message context
                    $contactHeading = $billingService->getSetting('billing_portal_contact_heading', 'Butuh bantuan? Hubungi Admin ISP', $customerOwnerId);
                    $contactWhatsapp = $billingService->getSetting('billing_portal_contact_whatsapp', '082272199412', $customerOwnerId);
                    $contactEmail = $billingService->getSetting('billing_portal_contact_email', 'emailanda@domainanda.com', $customerOwnerId);
                    $contactBody = $billingService->getSetting('billing_portal_contact_body', 'Jam operasional: 08.00 - 22.00', $customerOwnerId);
                    
                    $otpEnabled = $billingService->getSetting('billing_portal_otp_enabled', '0', $customerOwnerId) === '1';
                    // Note: digits/expiry logic stays consistent or can be re-fetched if needed, but usually config changes aren't drastic per user.
                    // For safety, let's re-fetch critical OTP params too
                    $otpDigits = (int)$billingService->getSetting('billing_portal_otp_digits', '6', $customerOwnerId);
                    $otpExpiry = (int)$billingService->getSetting('billing_portal_otp_expiry_minutes', '5', $customerOwnerId);
                    $otpMaxAttempts = (int)$billingService->getSetting('billing_portal_otp_max_attempts', '5', $customerOwnerId);
                    
                    $otpDigits = max(4, min(8, $otpDigits));
                    $otpExpiry = max(1, min(30, $otpExpiry));
                    $otpMaxAttempts = max(1, min(10, $otpMaxAttempts));

                    if (!$otpEnabled) {
                        $_SESSION['billing_portal_customer_id'] = (int)$customer['id'];
                        $_SESSION['billing_portal_last_login'] = time();
                        header('Location: billing_portal.php');
                        exit;
                    } else {
                        $phone = trim($customer['phone'] ?? '');
                        if ($phone === '') {
                            $error = 'Nomor WhatsApp pelanggan belum terisi. Hubungi admin untuk memperbarui data.';
                        } else {
                            $billingService->cleanupExpiredPortalOtps();
                            $otpCode = $billingService->createPortalOtp((int)$customer['id'], $identifier, $otpDigits, $otpExpiry, $otpMaxAttempts);

                            $expiresAt = (new DateTimeImmutable('now', new DateTimeZone('Asia/Jakarta')))->modify('+' . $otpExpiry . ' minutes');
                            $formattedExpiry = $expiresAt->format('d M Y H:i');

                            $messageLines = [];
                            $messageLines[] = '🔐 *Kode OTP Portal Pelanggan*';
                            $messageLines[] = '';
                            $messageLines[] = 'Kode OTP: *' . $otpCode . '*';
                            $messageLines[] = 'Berlaku sampai: ' . $formattedExpiry . ' WIB';
                            $messageLines[] = '';
                            $messageLines[] = 'Jangan bagikan kode ini kepada siapa pun.';
                            if (!empty($contactHeading)) {
                                $messageLines[] = '';
                                $messageLines[] = $contactHeading;
                            }
                            if (!empty($contactWhatsapp)) {
                                $messageLines[] = 'WA Admin: ' . $contactWhatsapp;
                            }
                            if (!empty($contactEmail)) {
                                $messageLines[] = 'Email: ' . $contactEmail;
                            }
                            if (!empty($contactBody)) {
                                $messageLines[] = $contactBody;
                            }

                            $notification = new WhatsAppNotification($customerOwnerId);
                            $waPayload = implode("\n", $messageLines);
                            // Use specific owner's notification settings if handled by WhatsAppNotification class internally?
                            // Currently WhatsAppNotification might use global settings. 
                            // TODO: Check WhatsAppNotification if it supports owner_id context.
                            // For now, at least the MESSAGE CONTENT (contact info) is correct.
                            $sent = $notification->sendPlainMessage($phone, $waPayload);

                            if ($sent) {
                                $_SESSION['billing_portal_pending_login'] = [
                                    'customer_id' => (int)$customer['id'],
                                    'identifier' => $identifier,
                                    'phone' => $phone,
                                    'name' => $customer['name'] ?? '',
                                    'requested_at' => time(),
                                    'owner_id' => $customerOwnerId, // Persist owner ID for next page load
                                ];
                                $success = 'Kode OTP telah dikirim ke WhatsApp ' . htmlspecialchars($phone) . '. Masukkan kode untuk melanjutkan.';
                                $error = null;
                                $stage = 'otp';
                            } else {
                                $error = 'Gagal mengirim kode OTP. Pastikan gateway WhatsApp aktif dan nomor pelanggan valid.';
                                $stage = 'identifier';
                            }
                        }
                    }
                }
            } catch (Throwable $e) {
                $error = 'Terjadi kesalahan saat memproses login: ' . $e->getMessage();
            }
        }
    } elseif ($action === 'verify_otp' && $otpEnabled) {
        $otpCodeInput = trim($_POST['otp_code'] ?? '');
        $pending = $_SESSION['billing_portal_pending_login'] ?? null;

        if (!$pending) {
            $error = 'Sesi OTP tidak ditemukan. Silakan masukkan kembali ID layanan.';
            $stage = 'identifier';
        } elseif ($otpCodeInput === '') {
            $error = 'Mohon masukkan kode OTP yang diterima.';
            $stage = 'otp';
        } else {
            $verify = $billingService->verifyPortalOtp((int)$pending['customer_id'], $pending['identifier'], $otpCodeInput);

            if ($verify['success']) {
                unset($_SESSION['billing_portal_pending_login']);
                $_SESSION['billing_portal_customer_id'] = (int)$pending['customer_id'];
                $_SESSION['billing_portal_last_login'] = time();
                header('Location: billing_portal.php');
                exit;
            } else {
                $error = $verify['message'] ?? 'Kode OTP tidak valid.';
                if (in_array($verify['reason'], ['expired', 'attempts_exceeded', 'not_found'], true)) {
                    unset($_SESSION['billing_portal_pending_login']);
                    $stage = 'identifier';
                } else {
                    $stage = 'otp';
                }
            }
        }
    }
}

$theme = 'default';
$themecolor = '#3a4149';
if (file_exists(__DIR__ . '/../include/theme.php')) {
    include(__DIR__ . '/../include/theme.php');
}
$themeAsset = ($theme === 'darkgreen') ? 'dark' : $theme;
?>
<!DOCTYPE html>
<html lang="id">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Login Billing Pelanggan</title>
    <meta name="theme-color" content="<?= $themecolor; ?>" />
    <link rel="stylesheet" type="text/css" href="../css/font-awesome/css/font-awesome.min.css" />
    <link rel="stylesheet" href="../css/mikrobil-ui.<?= $themeAsset; ?>.min.css">
    <link rel="stylesheet" href="../css/theme-darkgreen.css">
    <link rel="icon" href="../img/favicon.svg" type="image/svg+xml" sizes="any" />
    <link rel="icon" href="../img/favicon.png" type="image/png" sizes="32x32" />
    <link rel="apple-touch-icon" href="../img/favicon.png" />
    <style>
        :root {
            --dg-text: #f8fafc;
            --dg-muted: #94a3b8;
            --dg-panel: rgba(15, 23, 42, 0.78);
            --dg-panel-strong: rgba(15, 23, 42, 0.92);
            --dg-border: rgba(148, 163, 184, 0.18);
            --dg-border-strong: rgba(148, 163, 184, 0.28);
            --dg-accent: #93c5fd;
            --dg-accent-2: #1e293b;
            --dg-accent-3: #334155;
            --dg-col-bg: rgba(51, 65, 85, 0.35);
            --primary-color: #334155;
            --primary-dark: rgba(51, 65, 85, 0.85);
            --info-color: #334155;
            --bg-color: radial-gradient(1100px 650px at 18% 8%, rgba(51, 65, 85, 0.18), transparent 60%), radial-gradient(900px 500px at 88% 12%, rgba(30, 41, 59, 0.14), transparent 60%), linear-gradient(135deg, #050816, #0f172a 35%, #111827);
        }
        body { background: var(--bg-color); font-family: 'Source Sans Pro', Arial, sans-serif; color: var(--dg-text); }
        .login-wrapper { min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px; }
        .login-card { background: var(--dg-panel); border-radius: 14px; box-shadow: var(--dg-shadow); border: 1px solid var(--dg-border); width: 100%; max-width: 420px; padding: 32px; }
        .login-card h1 { margin: 0 0 12px; font-size: 24px; color: var(--dg-text); font-weight: 700; }
        .login-card p.subtitle { margin: 0 0 24px; color: var(--dg-muted); font-size: 14px; }
        .form-group { margin-bottom: 18px; }
        label { display: block; font-size: 14px; font-weight: 600; color: rgba(248, 251, 255, 0.92); margin-bottom: 6px; }
        .form-control { width: 100%; padding: 10px 12px; border: 1px solid var(--dg-border); border-radius: 12px; font-size: 14px; background: rgba(15, 23, 42, 0.35); color: var(--dg-text); transition: border-color 0.2s, box-shadow 0.2s; }
        .form-control:focus { border-color: var(--primary-color); outline: none; box-shadow: 0 0 0 3px rgba(51, 65, 85, 0.25); }
        .btn-primary { width: 100%; padding: 12px; border: 1px solid var(--dg-border-strong); border-radius: 12px; background: linear-gradient(135deg, var(--dg-accent-2), var(--dg-accent-3)); color: #f8fafc; font-size: 15px; font-weight: 800; cursor: pointer; transition: background 0.2s; }
        .btn-primary:hover { background: linear-gradient(135deg, #334155, #475569); }
        .info-text { font-size: 13px; color: var(--dg-muted); margin-top: 10px; line-height: 1.5; }
        .alert {
            padding: 12px 16px;
            border-radius: 6px;
            margin-bottom: 18px;
            font-size: 14px;
            border: 1px solid transparent;
            box-sizing: border-box;
            width: 100%;
            display: flex;
            align-items: flex-start;
            gap: 8px;
        }
        .alert strong { display: inline-block; min-width: 64px; }
        .alert-error { background: #fee2e2; color: #991b1b; border-color: #fecaca; }
        .alert-success { background: #dcfce7; color: #166534; border-color: #bbf7d0; }
    </style>
</head>
<body>
<div class="login-wrapper">
    <div class="login-card">
        <h1><i class="fa fa-lock"></i> Portal Pelanggan</h1>
        <p class="subtitle">Masukkan nomor telepon yang terdaftar di billing atau ID layanan lain (service number / PPPoE username).</p>

        <?php if ($error): ?>
            <div class="alert alert-error"><strong>Gagal:</strong> <?= htmlspecialchars($error); ?></div>
        <?php endif; ?>

        <?php if ($success): ?>
            <div class="alert alert-success"><strong>Berhasil:</strong> <?= htmlspecialchars($success); ?></div>
        <?php endif; ?>

        <?php if ($stage === 'identifier'): ?>
            <form method="post" autocomplete="off">
                <input type="hidden" name="action" value="request_login">
                <div class="form-group">
                    <label for="identifier">PPPoE Username / ID Layanan / Nomor Telepon</label>
                    <input type="text" name="identifier" id="identifier" class="form-control" value="<?= htmlspecialchars($identifier); ?>" placeholder="Masukkan PPPoE Username, ID Layanan, atau No. HP" required>
                </div>
                <button type="submit" class="btn-primary">Lanjutkan</button>
            </form>
        <?php elseif ($stage === 'otp'): ?>
            <form method="post" autocomplete="off">
                <input type="hidden" name="action" value="verify_otp">
                <div class="form-group">
                    <label for="otp_code">Kode OTP</label>
                    <input type="text" name="otp_code" id="otp_code" class="form-control" value="<?= htmlspecialchars($otpCodeInput); ?>" placeholder="Masukkan 6 digit OTP" required>
                </div>
                <button type="submit" class="btn-primary">Verifikasi OTP</button>
            </form>
            <form method="post" style="margin-top:10px;">
                <input type="hidden" name="action" value="cancel_pending">
                <button type="submit" class="btn btn-default" style="width:100%;">Ganti Nomor / ID Lain</button>
            </form>
        <?php endif; ?>

        <p class="info-text">
            <?= htmlspecialchars($contactHeading); ?><br>
            <?php if (!empty($contactWhatsapp)): ?>Telp/WhatsApp: <?= htmlspecialchars($contactWhatsapp); ?><br><?php endif; ?>
            <?php if (!empty($contactEmail)): ?>Email: <?= htmlspecialchars($contactEmail); ?><br><?php endif; ?>
            <?= nl2br(htmlspecialchars($contactBody)); ?>
        </p>
    </div>
</div>
</body>
</html>
