<?php
// /elms/includes/lecturer_auth.php
declare(strict_types=1);

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

require_once __DIR__ . '/db.php';

if (!isset($mysqli) && isset($conn)) {
    $mysqli = $conn;
}

/*
|--------------------------------------------------------------------------
| Lecturer Auth Standard
|--------------------------------------------------------------------------
| Allowed role only: lecturer
| Admin / Coordinator / Student cannot access lecturer portal
|--------------------------------------------------------------------------
*/

$loginUrl = '/elms/lecturer/login.php';

$userId = (int)(
    $_SESSION['elms_user_id']
    ?? $_SESSION['user_id']
    ?? $_SESSION['lecturer_id']
    ?? 0
);

$userRole = strtolower(trim((string)(
    $_SESSION['elms_user_role']
    ?? $_SESSION['user_role']
    ?? $_SESSION['lecturer_role']
    ?? ''
)));

if ($userId <= 0 || $userRole !== 'lecturer') {
    session_unset();
    session_destroy();

    header("Location: {$loginUrl}");
    exit;
}

/*
|--------------------------------------------------------------------------
| Optional DB re-check
| This confirms lecturer still exists and role is still lecturer
|--------------------------------------------------------------------------
*/

$LECTURER_USER = [
    'id'    => $userId,
    'name'  => $_SESSION['elms_user_name'] ?? $_SESSION['user_name'] ?? $_SESSION['lecturer_name'] ?? 'Lecturer',
    'email' => $_SESSION['elms_user_email'] ?? $_SESSION['user_email'] ?? '',
    'role'  => 'lecturer',
];

if (isset($mysqli) && $mysqli instanceof mysqli) {
    $stmt = $mysqli->prepare("
        SELECT id, name, email, role, status
        FROM elms_users
        WHERE id = ?
        LIMIT 1
    ");

    if ($stmt) {
        $stmt->bind_param("i", $userId);
        $stmt->execute();
        $res = $stmt->get_result();
        $dbUser = $res->fetch_assoc();
        $stmt->close();

        if (!$dbUser || strtolower((string)$dbUser['role']) !== 'lecturer') {
            session_unset();
            session_destroy();

            header("Location: {$loginUrl}");
            exit;
        }

        if (isset($dbUser['status']) && strtolower((string)$dbUser['status']) !== 'active') {
            session_unset();
            session_destroy();

            header("Location: {$loginUrl}?inactive=1");
            exit;
        }

        $LECTURER_USER = [
            'id'    => (int)$dbUser['id'],
            'name'  => (string)($dbUser['name'] ?? 'Lecturer'),
            'email' => (string)($dbUser['email'] ?? ''),
            'role'  => 'lecturer',
        ];

        $_SESSION['elms_user_id']    = $LECTURER_USER['id'];
        $_SESSION['elms_user_name']  = $LECTURER_USER['name'];
        $_SESSION['elms_user_email'] = $LECTURER_USER['email'];
        $_SESSION['elms_user_role']  = 'lecturer';
    }
}

function lecturer_user(): array
{
    global $LECTURER_USER;
    return $LECTURER_USER;
}

function lecturer_h(?string $value): string
{
    return htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8');
}