<?php
// auth/login.php
session_start();
require_once '../config/db.php';
require_once '../includes/functions.php';

if ($_SERVER["REQUEST_METHOD"] == "POST") {

    $user = trim($_POST['username'] ?? '');
    $pass = trim($_POST['password'] ?? '');

    if (empty($user) || empty($pass)) {
        $_SESSION['login_error'] = "กรุณากรอก Username และ Password";
        header("location: ../index.php");
        exit;
    }

    $pass_md5 = MD5($pass);

    $sql = "SELECT HR_CID, HR_PASSWORD, HR_STATUS_ID, HR_PREFIX_NAME, HR_FNAME, HR_LNAME 
            FROM hr_person a  
            LEFT OUTER JOIN hr_prefix e ON a.HR_PREFIX_ID=e.HR_PREFIX_ID 
            WHERE a.HR_USERNAME = :user LIMIT 1";

    try {
        $stmt = $pdo_hos->prepare($sql);
        $stmt->execute(['user' => $user]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$row) {
            $_SESSION['login_error'] = "ไม่พบบัญชีผู้ใช้นี้";
            add_log($pdo_sys, $user, 'Unknown', 'Login Failed', 'User not found');
            header("location: ../index.php");
            exit;
        }

        if (strtolower($row['HR_PASSWORD']) !== strtolower($pass_md5)) {
            $_SESSION['login_error'] = "รหัสผ่านไม่ถูกต้อง";
            add_log($pdo_sys, $row['HR_CID'], $row['HR_FNAME'], 'Login Failed', 'Incorrect password');
            header("location: ../index.php");
            exit;
        }

        if ($row['HR_STATUS_ID'] !== '01') {
            $_SESSION['login_error'] = "บัญชีผู้ใช้นี้ถูกปิดการใช้งานไปแล้ว";
            add_log($pdo_sys, $row['HR_CID'], $row['HR_FNAME'], 'Login Failed', 'Account disabled');
            header("location: ../index.php");
            exit;
        }

        unset($_SESSION['login_error']);

        // Check Role (RBAC)
        $role = null;
        global $master_super_admin_cid;
        
        if ($row['HR_CID'] === $master_super_admin_cid) {
            $role = 'superadmin';
        } else {
            // Check in system_users table
            $stmt_sys = $pdo_sys->prepare("SELECT role FROM system_users WHERE cid = :cid");
            $stmt_sys->execute(['cid' => $row['HR_CID']]);
            $sys_user = $stmt_sys->fetch();
            
            if ($sys_user) {
                $role = $sys_user['role'];
            } else {
                $role = 'user'; // Default role for authenticated hospital staff
            }
        }

        $_SESSION['loggedin'] = true;
        $_SESSION['role'] = $role;
        $_SESSION['fullname'] = $row['HR_PREFIX_NAME'] . $row['HR_FNAME'] . " " . $row['HR_LNAME'];
        $_SESSION['cid'] = $row['HR_CID'];
        //$_SESSION['dep_id'] = $row['HR_DEPARTMENT_SUB_SUB_ID'];
        //$_SESSION['department'] = $row['HR_DEPARTMENT_SUB_SUB_NAME'];

        // Add Log
        add_log($pdo_sys, $_SESSION['cid'], $_SESSION['fullname'], 'Login Success', "User logged in successfully (Role: $role)");

        header("location: ../dashboard.php");
        exit;
    } catch (PDOException $e) {
        $_SESSION['login_error'] = "เกิดข้อผิดพลาดของระบบ: " . $e->getMessage();
        header("location: ../index.php");
        exit;
    }
} else {
    header("location: ../index.php");
    exit;
}
?>