<?php
require_once 'admin/core/Database.php';

class User {
    private $db;

    public function __construct() {
        $this->db = new Database();
    }

    public function login($username, $password) {
        $stmt = $this->db->conn->prepare("SELECT * FROM admin_users WHERE username = :username LIMIT 1");
        $stmt->bindParam(':username', $username);
        $stmt->execute();
        $user = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$user) return false;

        //  Check secure hash first
        if (password_verify($password, $user['password'])) {
            // Optional: rehash if algorithm changed
            if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
                $newHash = password_hash($password, PASSWORD_DEFAULT);
                $update = $this->db->conn->prepare("UPDATE admin_users SET password = :p WHERE id = :id");
                $update->execute([':p' => $newHash, ':id' => $user['id']]);
            }
            return $user;
        }

        //   Check old MD5 hash (migration)
        if (strlen($user['password']) === 32 && $user['password'] === md5($password)) {
            // Rehash to secure hash
            $newHash = password_hash($password, PASSWORD_DEFAULT);
            $update = $this->db->conn->prepare("UPDATE admin_users SET password = :p WHERE id = :id");
            $update->execute([':p' => $newHash, ':id' => $user['id']]);
            return $user;
        }

        return false;
    }

    public function countAllUsers() {
        $stmt = $this->db->conn->prepare("SELECT COUNT(*) as total FROM users");
        $stmt->execute();
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        return $row ? $row['total'] : 0;
    }

   public function getAllUsers() {
        $stmt = $this->db->conn->query("SELECT * FROM users ORDER BY id DESC");
        return $stmt->fetchAll(PDO::FETCH_ASSOC);
    }

    public function emailExists($email) {
        $stmt = $this->db->conn->prepare("SELECT id FROM users WHERE email=:email LIMIT 1");
        $stmt->execute([':email' => $email]);
        return $stmt->fetch(PDO::FETCH_ASSOC) ? true : false;
    }

    public function register($data) {
        $stmt = $this->db->conn->prepare("INSERT INTO users (username, phone, email, password, user_type) VALUES (:username, :phone, :email, :password, :user_type)");
        return $stmt->execute([
            ':username' => $data['username'],
            ':phone' => $data['phone'],
            ':email' => $data['email'],
            ':password' => password_hash($data['password'], PASSWORD_DEFAULT),
            ':user_type' => $data['user_type']
        ]);
    }

    public function updateUser($id, $data) {
        $fields = "username=:username, phone=:phone, email=:email, user_type=:user_type";
        $params = [
            ':username' => $data['username'],
            ':phone' => $data['phone'],
            ':email' => $data['email'],
            ':user_type' => $data['user_type'],
            ':id' => $id
        ];

        if (!empty($data['password'])) {
            $fields .= ", password=:password";
            $params[':password'] = password_hash($data['password'], PASSWORD_DEFAULT);
        }

        $stmt = $this->db->conn->prepare("UPDATE users SET $fields WHERE id=:id");
        return $stmt->execute($params);
    }

    public function deleteUser($id) {
        $stmt = $this->db->conn->prepare("DELETE FROM users WHERE id=:id");
        return $stmt->execute([':id' => $id]);
    }
} 



// public function login($username, $password) {
//     $stmt = $this->db->conn->prepare("SELECT * FROM admin_users WHERE username = :username LIMIT 1");
//     $stmt->bindParam(':username', $username);
//     $stmt->execute();
//     $user = $stmt->fetch(PDO::FETCH_ASSOC);

//     if (!$user) return false;

//     // Only MD5 password check
//     if ($user['password'] === md5($password)) {
//         return $user;
//     }

//     return false;
// }
