<?php
/**
 * pages/profile.php — My profile and change password (both roles)
 */
require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../includes/db.php';
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';

require_login();

// Load current user data fresh from DB
$stmt = db()->prepare(
    'SELECT u.id, u.name, u.email, u.username, u.role, u.last_login,
            a.name AS agency_name
       FROM users u
       LEFT JOIN agencies a ON a.id = u.agency_id
      WHERE u.id = ?'
);
$stmt->execute([current_user_id()]);
$user = $stmt->fetch();

if (!$user) {
    // Should never happen — active session always has a valid user
    logout_user();
    redirect(base_url('login.php'));
}

$page_title  = 'My Profile';
$active_page = 'profile';
require_once __DIR__ . '/../templates/head.php';
?>

<?php require_once __DIR__ . '/../templates/header.php'; ?>
<?php require_once __DIR__ . '/../templates/sidebar.php'; ?>

<div class="nxl-everything">
    <div class="nxl-container">
        <div class="main-content" style="padding-top: 80px;">

            <div class="page-header mb-4">
                <h4 class="fw-bold mb-0">My Profile</h4>
            </div>

            <?php render_flash(); ?>

            <div class="row g-4">

                <!-- ── Profile info card ────────────────────────────────── -->
                <div class="col-lg-6">
                    <div class="card border-0 shadow-sm h-100">
                        <div class="card-header bg-white py-3">
                            <h6 class="fw-bold mb-0">Account Information</h6>
                        </div>
                        <div class="card-body p-4">
                            <form method="POST" action="<?= base_url('actions/profile-save.php') ?>" novalidate>
                                <?= csrf_field() ?>

                                <!-- Full Name -->
                                <div class="mb-3">
                                    <label class="form-label fw-semibold">Full Name <span class="text-danger">*</span></label>
                                    <input type="text" name="name" class="form-control"
                                           value="<?= e($user['name']) ?>"
                                           required maxlength="200">
                                </div>

                                <!-- Email -->
                                <div class="mb-3">
                                    <label class="form-label fw-semibold">Email Address <span class="text-danger">*</span></label>
                                    <input type="email" name="email" class="form-control"
                                           value="<?= e($user['email']) ?>"
                                           required maxlength="200">
                                </div>

                                <!-- Username (read-only) -->
                                <div class="mb-3">
                                    <label class="form-label fw-semibold">Username</label>
                                    <input type="text" class="form-control bg-light" value="<?= e($user['username']) ?>" readonly>
                                    <div class="form-text">Username cannot be changed. Contact a super admin if needed.</div>
                                </div>

                                <!-- Role / Agency (read-only info) -->
                                <div class="mb-4">
                                    <label class="form-label fw-semibold">Role</label>
                                    <div>
                                        <?= $user['role'] === 'super_admin'
                                            ? '<span class="badge bg-primary">Super Admin</span>'
                                            : '<span class="badge bg-secondary">Agency User</span>' ?>
                                        <?php if ($user['agency_name']): ?>
                                        — <?= e($user['agency_name']) ?>
                                        <?php endif; ?>
                                    </div>
                                </div>

                                <button type="submit" class="btn btn-primary">Save Changes</button>
                            </form>
                        </div>
                    </div>
                </div>

                <!-- ── Change password card ─────────────────────────────── -->
                <div class="col-lg-6">
                    <div class="card border-0 shadow-sm h-100">
                        <div class="card-header bg-white py-3">
                            <h6 class="fw-bold mb-0">Change Password</h6>
                        </div>
                        <div class="card-body p-4">
                            <form method="POST" action="<?= base_url('actions/password-change.php') ?>" novalidate>
                                <?= csrf_field() ?>

                                <!-- Current password -->
                                <div class="mb-3">
                                    <label class="form-label fw-semibold">Current Password <span class="text-danger">*</span></label>
                                    <input type="password" name="current_password" class="form-control"
                                           placeholder="Your current password" required autocomplete="current-password">
                                </div>

                                <!-- New password -->
                                <div class="mb-3">
                                    <label class="form-label fw-semibold">New Password <span class="text-danger">*</span></label>
                                    <input type="password" name="new_password" class="form-control"
                                           placeholder="Minimum 8 characters" required minlength="8"
                                           autocomplete="new-password">
                                </div>

                                <!-- Confirm new password -->
                                <div class="mb-4">
                                    <label class="form-label fw-semibold">Confirm New Password <span class="text-danger">*</span></label>
                                    <input type="password" name="new_password_confirm" class="form-control"
                                           placeholder="Repeat new password" required autocomplete="new-password">
                                </div>

                                <button type="submit" class="btn btn-warning">Update Password</button>
                            </form>
                        </div>
                    </div>
                </div>

                <!-- ── Account details card ─────────────────────────────── -->
                <div class="col-12">
                    <div class="card border-0 shadow-sm">
                        <div class="card-body d-flex flex-wrap gap-4 py-3">
                            <div>
                                <div class="text-muted small">Last Login</div>
                                <div class="fw-semibold"><?= $user['last_login'] ? fmt_datetime($user['last_login']) : 'First login' ?></div>
                            </div>
                        </div>
                    </div>
                </div>

            </div><!-- /.row -->

<?php require_once __DIR__ . '/../templates/footer.php'; ?>
