<?php
/**
 * Authentication Routes
 * 
 * Handles user authentication, registration, and token management.
 */

require_once '../lib/Auth.php';
require_once '../lib/Validation.php';

$auth = new Auth();
$validation = new Validation();
$response = new Response();

// Get request data
$input = json_decode(file_get_contents('php://input'), true) ?? [];

switch ($_SERVER['REQUEST_METHOD']) {
    case 'POST':
        $action = $_GET['action'] ?? '';
        
        switch ($action) {
            case 'login':
                // Validate required fields
                $required_fields = ['email', 'password'];
                $validation_result = $validation->validateRequired($input, $required_fields);
                
                if (!$validation_result['valid']) {
                    $response->validationError($validation_result['errors']);
                }
                
                // Validate email
                $email_result = $validation->validateEmail($input['email']);
                if (!$email_result['valid']) {
                    $response->validationError(['email' => $email_result['message']]);
                }
                
                // Attempt login
                $result = $auth->login($input['email'], $input['password']);
                $response->success($result, 'Login successful');
                break;
                
            case 'register':
                // Validate required fields
                $required_fields = ['name', 'email', 'password'];
                $validation_result = $validation->validateRequired($input, $required_fields);
                
                if (!$validation_result['valid']) {
                    $response->validationError($validation_result['errors']);
                }
                
                // Validate email
                $email_result = $validation->validateEmail($input['email']);
                if (!$email_result['valid']) {
                    $response->validationError(['email' => $email_result['message']]);
                }
                
                // Validate password
                $password_result = $validation->validatePassword($input['password']);
                if (!$password_result['valid']) {
                    $response->validationError(['password' => $password_result['message']]);
                }
                
                // Attempt registration
                $result = $auth->register(
                    $validation->sanitize($input['name']),
                    $validation->sanitize($input['email']),
                    $input['password'],
                    $input['role'] ?? 'customer'
                );
                $response->success($result, 'Registration successful');
                break;
                
            case 'refresh':
                // Refresh token endpoint (placeholder for future implementation)
                $response->success(['token' => 'new_token_here'], 'Token refreshed');
                break;
                
            default:
                $response->error('Invalid action specified', 400);
                break;
        }
        break;
        
    case 'PUT':
        // Change password
        $user_data = $auth->protectRoute();
        
        $required_fields = ['current_password', 'new_password'];
        $validation_result = $validation->validateRequired($input, $required_fields);
        
        if (!$validation_result['valid']) {
            $response->validationError($validation_result['errors']);
        }
        
        // Validate new password
        $password_result = $validation->validatePassword($input['new_password']);
        if (!$password_result['valid']) {
            $response->validationError(['new_password' => $password_result['message']]);
        }
        
        $auth->changePassword(
            $user_data['user_id'],
            $input['current_password'],
            $input['new_password']
        );
        
        $response->success(null, 'Password changed successfully');
        break;
        
    default:
        $response->error('Method not allowed', 405);
        break;
}