<?php
require_once "config.php";
require_once "jwt_helper.php";

$data = getJsonInput();
$username = trim($data["username"] ?? "");
$password = trim($data["password"] ?? "");

if ($username === "" || $password === "") {
    send(400, ["status" => "error", "message" => "username and password are required"]);
}

$mysqli = db();

$stmt = $mysqli->prepare("SELECT school_id, school_username, school_password, school_orgid, school_orgname, school_validity, school_photo FROM school WHERE school_username=? LIMIT 1");
$stmt->bind_param("s", $username);
$stmt->execute();
$result = $stmt->get_result();

if ($result->num_rows === 0) {
    send(401, ["status" => "error", "message" => "Invalid username or password"]);
}

$row = $result->fetch_assoc();

// Plain password check (TEMP)
if ($row["school_password"] !== $password) {
    send(401, ["status" => "error", "message" => "Invalid username or password"]);
}

$school_id = intval($row["school_id"]);
$org_id = intval($row["school_orgid"]);

// School Logo URL
$photo_file = $row["school_photo"] ?? "";
$school_logo_url = null;
if ($photo_file !== "") {
    $school_logo_url = "https://schoolweberp.com/uploads/" . $org_id . "/" . $photo_file;
}

// Create Access Token (JWT)
$access_token = jwtSign([
    "school_id" => $school_id,
    "org_id" => $org_id,
    "username" => $row["school_username"]
]);

// Create Refresh Token (random)
$refresh_token = bin2hex(random_bytes(48));
$expires_at = date("Y-m-d H:i:s", strtotime("+" . REFRESH_TOKEN_DAYS . " days"));

$stmt2 = $mysqli->prepare("INSERT INTO refresh_tokens (school_id, school_orgid, refresh_token, expires_at, revoked) VALUES (?, ?, ?, ?, 0)");
$stmt2->bind_param("iiss", $school_id, $org_id, $refresh_token, $expires_at);
$stmt2->execute();

send(200, [
    "status" => "success",
    "org_id" => $org_id,
    "school_orgname" => $row["school_orgname"],
    "school_validity" => $row["school_validity"],
    "school_logo_url" => $school_logo_url,
    "access_token" => $access_token,
    "access_expires_in_seconds" => ACCESS_TOKEN_EXPIRE_SECONDS,
    "refresh_token" => $refresh_token,
    "refresh_expires_days" => REFRESH_TOKEN_DAYS
]);