<?php

declare(strict_types=1);

require_once __DIR__ . '/includes/platform-bootstrap.php';

$admin = platform_require_login($pdo);

$errors = [];
$newRecoveryCodes = null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = (string) (
        $_POST['action'] ?? ''
    );

    if (!platform_verify_csrf(
        $_POST['csrf_token'] ?? null
    )) {
        $errors[] =
            'Istunto vanheni. Päivitä sivu ja yritä uudelleen.';
    } elseif ($action === 'change_password') {
        $currentPassword = (string) (
            $_POST['current_password'] ?? ''
        );

        $factor = trim(
            (string) (
                $_POST['factor'] ?? ''
            )
        );

        $newPassword = (string) (
            $_POST['new_password'] ?? ''
        );

        $confirmation = (string) (
            $_POST[
                'new_password_confirmation'
            ] ?? ''
        );

        $errors = array_merge(
            $errors,
            platform_password_errors(
                $newPassword,
                (string) $admin['username']
            )
        );

        if (!hash_equals(
            $newPassword,
            $confirmation
        )) {
            $errors[] =
                'Uusi salasana ja vahvistus eivät vastaa toisiaan.';
        }

        if (
            $newPassword !== ''
            && password_verify(
                $newPassword,
                (string) $admin['password_hash']
            )
        ) {
            $errors[] =
                'Uuden salasanan pitää olla eri kuin nykyinen salasana.';
        }

        if (
            $errors === []
            && !platform_verify_reauthentication(
                $pdo,
                $admin,
                $currentPassword,
                $factor
            )
        ) {
            $errors[] =
                'Nykyinen salasana tai MFA-koodi on virheellinen.';
        }

        if ($errors === []) {
            $passwordHash = password_hash(
                $newPassword,
                PASSWORD_DEFAULT
            );

            if (!is_string($passwordHash)) {
                $errors[] =
                    'Salasanan suojaaminen epäonnistui.';
            } else {
                try {
                    $pdo->beginTransaction();

                    $statement = $pdo->prepare(
                        'UPDATE platform_admins
                         SET
                            password_hash =
                                :password_hash,
                            password_changed_at =
                                CURRENT_TIMESTAMP,
                            force_password_change = 0,
                            failed_login_count = 0,
                            locked_until = NULL
                         WHERE id = :id'
                    );

                    $statement->execute([
                        'password_hash' =>
                            $passwordHash,
                        'id' => (int) $admin['id'],
                    ]);

                    $supportStatement = $pdo->prepare(
                        "UPDATE platform_support_sessions
                         SET
                            ended_at = COALESCE(
                                ended_at,
                                CURRENT_TIMESTAMP
                            ),
                            ended_reason = COALESCE(
                                ended_reason,
                                'admin_password_changed'
                            )
                         WHERE platform_admin_id = :platform_admin_id
                           AND ended_at IS NULL"
                    );

                    $supportStatement->execute([
                        'platform_admin_id' =>
                            (int) $admin['id'],
                    ]);

                    platform_audit_log(
                        $pdo,
                        'platform.password_changed',
                        'Kehittäjätilin salasana vaihdettiin. Aktiiviset tukitilat päätettiin.'
                    );

                    $pdo->commit();

                    session_regenerate_id(true);

                    $now = time();

                    $_SESSION[
                        'platform_authenticated_at'
                    ] = $now;

                    $_SESSION[
                        'platform_last_activity_at'
                    ] = $now;

                    $_SESSION[
                        'platform_last_regenerated_at'
                    ] = $now;

                    $_SESSION[
                        'platform_mfa_verified_at'
                    ] = $now;

                    unset(
                        $_SESSION[
                            'platform_csrf_token'
                        ]
                    );

                    platform_set_flash(
                        'success',
                        'Kehittäjätilin salasana vaihdettiin ja aktiiviset tukitilat päätettiin.'
                    );

                    platform_redirect(
                        '/platform/account.php'
                    );
                } catch (Throwable $exception) {
                    if ($pdo->inTransaction()) {
                        $pdo->rollBack();
                    }

                    error_log(
                        'Kehittäjäsalasanan vaihto epäonnistui: '
                        . $exception->getMessage()
                    );

                    $errors[] =
                        'Salasanan vaihtaminen epäonnistui.';
                }
            }
        }
    } elseif ($action === 'regenerate_recovery_codes') {
        $currentPassword = (string) (
            $_POST['current_password'] ?? ''
        );

        $factor = trim(
            (string) (
                $_POST['factor'] ?? ''
            )
        );

        if (!platform_verify_reauthentication(
            $pdo,
            $admin,
            $currentPassword,
            $factor
        )) {
            $errors[] =
                'Nykyinen salasana tai MFA-koodi on virheellinen.';
        }

        if ($errors === []) {
            try {
                $newRecoveryCodes =
                    platform_generate_recovery_codes();

                $statement = $pdo->prepare(
                    'UPDATE platform_admins
                     SET recovery_codes_json =
                        :recovery_codes_json
                     WHERE id = :id'
                );

                $statement->execute([
                    'recovery_codes_json' =>
                        platform_hash_recovery_codes(
                            $newRecoveryCodes
                        ),
                    'id' => (int) $admin['id'],
                ]);

                platform_audit_log(
                    $pdo,
                    'platform.recovery_codes_regenerated',
                    'Kehittäjätilin palautuskoodit uusittiin.'
                );
            } catch (Throwable $exception) {
                error_log(
                    'Palautuskoodien uusiminen epäonnistui: '
                    . $exception->getMessage()
                );

                $newRecoveryCodes = null;

                $errors[] =
                    'Palautuskoodien uusiminen epäonnistui.';
            }
        }
    }
}

$platformPageTitle = 'Kehittäjätili';
$platformActivePage = 'account';

require __DIR__ . '/includes/header.php';

?>
<div class="platform-page-heading">
    <div>
        <p class="platform-eyebrow">
            Turvallisuus
        </p>

        <h1>Kehittäjätili</h1>

        <p class="platform-description">
            Hallitse kehittäjätilin salasanaa ja kertakäyttöisiä palautuskoodeja.
        </p>
    </div>
</div>

<?php foreach ($errors as $error): ?>
    <div class="platform-alert platform-alert-error">
        <?= platform_e($error) ?>
    </div>
<?php endforeach; ?>

<?php if (is_array($newRecoveryCodes)): ?>
    <section class="platform-panel platform-danger-zone">
        <p class="platform-eyebrow">
            Näytetään vain kerran
        </p>

        <h2>Uudet palautuskoodit</h2>

        <p class="platform-muted">
            Aiemmat palautuskoodit eivät enää toimi. Tallenna nämä
            salasanahallintaan tai turvalliseen offline-paikkaan.
        </p>

        <div class="platform-recovery-codes">
            <?php foreach ($newRecoveryCodes as $code): ?>
                <code>
                    <?= platform_e($code) ?>
                </code>
            <?php endforeach; ?>
        </div>
    </section>
<?php endif; ?>

<div class="platform-grid-two">
    <section class="platform-panel">
        <h2>Vaihda salasana</h2>

        <p class="platform-muted">
            Salasanan vaihtaminen päättää kaikki aktiiviset tukitilat.
        </p>

        <form method="post" class="platform-form">
            <input
                type="hidden"
                name="action"
                value="change_password"
            >

            <input
                type="hidden"
                name="csrf_token"
                value="<?= platform_e(
                    platform_csrf_token()
                ) ?>"
            >

            <label class="platform-field">
                <span>Nykyinen salasana *</span>

                <input
                    type="password"
                    name="current_password"
                    autocomplete="current-password"
                    required
                >
            </label>

            <label class="platform-field">
                <span>MFA- tai palautuskoodi *</span>

                <input
                    type="text"
                    name="factor"
                    maxlength="30"
                    autocomplete="one-time-code"
                    required
                >
            </label>

            <label class="platform-field">
                <span>Uusi salasana *</span>

                <input
                    type="password"
                    name="new_password"
                    minlength="16"
                    maxlength="200"
                    autocomplete="new-password"
                    required
                >
            </label>

            <label class="platform-field">
                <span>Uusi salasana uudelleen *</span>

                <input
                    type="password"
                    name="new_password_confirmation"
                    minlength="16"
                    maxlength="200"
                    autocomplete="new-password"
                    required
                >
            </label>

            <button
                class="platform-button platform-button-primary"
                type="submit"
            >
                Vaihda salasana
            </button>
        </form>
    </section>

    <section class="platform-panel">
        <h2>Uudet palautuskoodit</h2>

        <p class="platform-muted">
            Uusiminen mitätöi kaikki aiemmat palautuskoodit välittömästi.
        </p>

        <form method="post" class="platform-form">
            <input
                type="hidden"
                name="action"
                value="regenerate_recovery_codes"
            >

            <input
                type="hidden"
                name="csrf_token"
                value="<?= platform_e(
                    platform_csrf_token()
                ) ?>"
            >

            <label class="platform-field">
                <span>Nykyinen salasana *</span>

                <input
                    type="password"
                    name="current_password"
                    autocomplete="current-password"
                    required
                >
            </label>

            <label class="platform-field">
                <span>MFA- tai palautuskoodi *</span>

                <input
                    type="text"
                    name="factor"
                    maxlength="30"
                    autocomplete="one-time-code"
                    required
                >
            </label>

            <button
                class="platform-button platform-button-secondary"
                type="submit"
            >
                Luo uudet palautuskoodit
            </button>
        </form>
    </section>
</div>

<?php

require __DIR__ . '/includes/footer.php';