<?php
defined('BASEPATH') OR exit('No direct script access allowed');

/**
 * Two-Factor Authentication Settings Controller
 * Allows users to manage their 2FA settings
 */
class TwoFactorController extends MY_Controller
{
    public function __construct()
    {
        parent::__construct();

        // Ensure user is authenticated
        if (!AUTHENTICATED) {
            redirect('login');
            return;
        }

        $this->load->library('TwoFactorAuth');
        $this->load->model('beheer/User_model');
    }

    /**
     * Show 2FA settings page
     */
    public function index()
    {
        $data = [
            'user' => $this->user,
            'version' => $this->version
        ];

        $this->load->view('pages/beheer/twofactor/settings_view', $data);
    }

    /**
     * Enable 2FA for the user
     * POST parameters:
     * - method: 'email' or 'authenticator'
     */
    public function enable()
    {
        $method = $this->clean_input('method');

        if (!in_array($method, ['email', 'authenticator'])) {
            return $this->json(['success' => false, 'message' => 'Ongeldige methode']);
        }

        $secret = null;
        $qrCodeUrl = null;

        // If authenticator method, generate secret
        if ($method === 'authenticator') {
            $secret = $this->twofactorauth->generateSecret();
            $qrCodeUrl = $this->twofactorauth->getQRCodeUrl(
                $secret,
                $this->user->username,
                'DBOIS'
            );
        }

        // Update user record
        $data = [
            'two_factor_enabled' => 'T',
            'two_factor_method' => $method,
            'two_factor_secret' => $secret
        ];

        $this->User_model->update_record($data, $this->user->id);

        $response = [
            'success' => true,
            'message' => 'Tweefactorauthenticatie ingeschakeld',
            'method' => $method
        ];

        if ($method === 'authenticator') {
            $response['secret'] = $secret;
            $response['qrCodeUrl'] = $qrCodeUrl;
        }

        return $this->json($response);
    }

    /**
     * Verify authenticator setup
     * POST parameters:
     * - code: The 6-digit code from Google Authenticator
     */
    public function verifySetup()
    {
        $code = $this->clean_input('code');

        if (!$this->user->two_factor_secret) {
            return $this->json(['success' => false, 'message' => 'Geen geheim gevonden']);
        }

        $isValid = $this->twofactorauth->verifyCode($this->user->two_factor_secret, $code);

        if ($isValid) {
            return $this->json(['success' => true, 'message' => 'Code geverifieerd']);
        } else {
            return $this->json(['success' => false, 'message' => 'Ongeldige code']);
        }
    }

    /**
     * Disable 2FA for the user
     */
    public function disable()
    {
        $data = [
            'two_factor_enabled' => 'F',
            'two_factor_method' => null,
            'two_factor_secret' => null
        ];

        $this->User_model->update_record($data, $this->user->id);

        // Clean up any existing OTP codes
        $this->load->model('beheer/UserOtp_model');
        $this->UserOtp_model->deleteUserOTPs($this->user->id);

        return $this->json([
            'success' => true,
            'message' => 'Tweefactorauthenticatie uitgeschakeld'
        ]);
    }

    /**
     * Change 2FA method
     * POST parameters:
     * - method: 'email' or 'authenticator'
     */
    public function changeMethod()
    {
        $method = $this->clean_input('method');

        if (!in_array($method, ['email', 'authenticator'])) {
            return $this->json(['success' => false, 'message' => 'Ongeldige methode']);
        }

        // If user is not enabled for 2FA, they should use enable endpoint
        if ($this->user->two_factor_enabled !== 'T') {
            return $this->json(['success' => false, 'message' => '2FA is niet ingeschakeld']);
        }

        $secret = null;
        $qrCodeUrl = null;

        // If switching to authenticator, generate new secret
        if ($method === 'authenticator') {
            $secret = $this->twofactorauth->generateSecret();
            $qrCodeUrl = $this->twofactorauth->getQRCodeUrl(
                $secret,
                $this->user->username,
                'DBOIS'
            );
        }

        $data = [
            'two_factor_method' => $method,
            'two_factor_secret' => $secret
        ];

        $this->User_model->update_record($data, $this->user->id);

        $response = [
            'success' => true,
            'message' => '2FA methode gewijzigd',
            'method' => $method
        ];

        if ($method === 'authenticator') {
            $response['secret'] = $secret;
            $response['qrCodeUrl'] = $qrCodeUrl;
        }

        return $this->json($response);
    }

    /**
     * Get current 2FA status
     */
    public function status()
    {
        $response = [
            'enabled' => $this->user->two_factor_enabled === 'T',
            'method' => $this->user->two_factor_method
        ];

        return $this->json($response);
    }
}