<?php
// Auth guards — require functions.php (and session_start) before this file.

function require_login(): array {
    if (empty($_SESSION['user_id'])) {
        if (identity_is_federated()) {
            sso_resolve_session($GLOBALS['pdo']);
        }
        if (empty($_SESSION['user_id'])) {
            if (SSO_REQUIRED) {
                // Bounce through this platform's local login stub instead of
                // sending id.andmore.pt's return_to straight at a protected
                // page. The stub (views/auth/login.php) carries the
                // ?from=sso loop-guard and loads the full functions.php
                // bootstrap before calling sso_resolve_session().
                $_rl_return = APP_BASE_URL . 'views/auth/login.php?from=sso';
                $_rl_qs     = '?return_to=' . urlencode($_rl_return)
                            . '&platform='  . urlencode(PLATFORM_SLUG);
                header('Location: ' . ANDMORE_ID_URL . 'auth/login.php' . $_rl_qs);
            } else {
                $return = $_SERVER['REQUEST_URI'] ?? '';
                $qs     = $return ? ('?return_to=' . urlencode($return)) : '';
                header('Location: ' . base_url('views/auth/login.php' . $qs));
            }
            exit;
        }
    }
    return $_SESSION['user'];
}

// ─── Role ladder ─────────────────────────────────────────────────────────────
//   sysadmin — super-admin (backups, platform update, app_base_url).
//   admin    — full staff access except those three sysadmin-only items.
//   staff    — works only on items assigned to them (e.g. sessions where
//              photographer_id = users.id). Cannot manage other users,
//              templates, settings, etc.
//   client   — portal-only.
// is_admin()/require_admin() = sysadmin OR admin. is_staff()/require_staff()
// also includes the plain `staff` role.

// Resolves the dashboard path for a given role. Used by index.php, the auth
// pages, and require_admin()'s bounce fallback so all four agree on routing.
function post_login_destination(string $role): string {
    return match ($role) {
        'sysadmin', 'admin' => 'views/admin/dashboard.php',
        'staff'             => 'views/staff/dashboard.php',
        'client'            => 'views/user/dashboard.php',
        default             => 'index.php',
    };
}

// Accepts sysadmin + admin only. Plain staff and clients are bounced to the
// dashboard appropriate for their role (avoids redirect loops when an admin-
// only page bounces a staff user).
function require_admin(): array {
    $user = require_login();
    if (!in_array($user['role'], ['sysadmin', 'admin'])) {
        header('Location: ' . base_url(post_login_destination($user['role'] ?? '')));
        exit;
    }
    return $user;
}

// Accepts sysadmin + admin + staff — anyone who can act on assignments.
// Clients are redirected to the public index.
function require_staff(): array {
    $user = require_login();
    if (!in_array($user['role'], ['sysadmin', 'admin', 'staff'])) {
        header('Location: ' . base_url('index.php'));
        exit;
    }
    return $user;
}

// Ownership guard for staff-scoped pages (edit/update_status/send_email/etc).
// Sysadmin and admin pass for any session. Plain staff only pass when the
// session's photographer_id matches their user id. Mismatches bounce back to
// the role-appropriate sessions list.
function require_session_ownership(array $session): array {
    $user = require_staff();
    if (in_array($user['role'], ['sysadmin', 'admin'], true)) return $user;
    if ((int) ($session['photographer_id'] ?? 0) !== (int) $user['id']) {
        header('Location: ' . base_url('views/sessions/index.php'));
        exit;
    }
    return $user;
}

// Sysadmin-only pages (backups, platform update, sensitive settings).
// Plain admins are sent back to their dashboard.
function require_sysadmin(): array {
    $user = require_login();
    if ($user['role'] !== 'sysadmin') {
        header('Location: ' . base_url(post_login_destination($user['role'] ?? '')));
        exit;
    }
    return $user;
}

function current_user(): ?array {
    return $_SESSION['user'] ?? null;
}

// True for sysadmin + admin (NOT plain staff).
function is_admin(): bool {
    return in_array(current_user()['role'] ?? '', ['sysadmin', 'admin']);
}

// True for any backoffice user (sysadmin + admin + staff). Use this to show
// a UI element that any non-client backoffice user should see.
function is_staff(): bool {
    return in_array(current_user()['role'] ?? '', ['sysadmin', 'admin', 'staff']);
}

function is_sysadmin(): bool {
    return (current_user()['role'] ?? '') === 'sysadmin';
}

// True for plain admins (not sysadmin, not staff). Useful for "hide from
// sysadmin" edge cases; most code wants is_admin() or is_sysadmin().
function is_admin_role(): bool {
    return (current_user()['role'] ?? '') === 'admin';
}

// True for plain staff only — the assignment-only role. Used to scope queries
// to "photographer_id = me" instead of returning all sessions.
function is_staff_role(): bool {
    return (current_user()['role'] ?? '') === 'staff';
}

// Back-compat shim: every is_designer() caller now means "is plain admin".
function is_designer(): bool {
    return is_admin_role();
}

function auth_set_session(array $user): void {
    // Rotate the session id on every privilege change (login, SSO resolve,
    // password reset). Defeats session fixation: an attacker who pre-seeded
    // FOTO_SESS now ends up holding a dead id while the real user gets a fresh
    // one. The CSRF token is rotated alongside the session id.
    if (session_status() === PHP_SESSION_ACTIVE) {
        session_regenerate_id(true);
        unset($_SESSION['csrf_token']);
    }
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['user']    = [
        'id'          => $user['id'],
        'name'        => $user['name'],
        'email'       => $user['email'],
        'role'        => $user['role'],
        // Carried so sso_resolve_session() can detect when the am_sso cookie
        // identifies a different person than the current local session.
        'andmore_id'  => isset($user['andmore_id']) ? (int) $user['andmore_id'] : null,
    ];
}