<?php
include 'config.php';
session_start();

// আপনার সিক্রেট অ্যাডমিন কি (এটি শুধুমাত্র আসল অ্যাডমিনরাই জানবে)
define('ADMIN_KEY', 'MySuperSecretKey123'); 

// ইমেইল পাঠানোর ফাংশন
function sendOTPEmail($to_email, $otp) {
    $subject = "Your Admin Verification OTP";
    $message = "Your secure OTP code is: " . $otp . "\nThis code is valid for 5 minutes.";
    $headers = "From: no-reply@yourdomain.com";
    
    // টেস্ট করার সুবিধার্থে সেশনে রেখে দেওয়া হলো
    $_SESSION['last_sent_otp'] = $otp; 
    // আসল সার্ভারে মেইল পাঠাতে নিচের লাইনটি আনকমেন্ট করুন
    // mail($to_email, $subject, $message, $headers);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $type = $_POST['type'] ?? '';

    // ========================================================
    // ১. অ্যাডমিন লগইন (Email + Password + OTP + Admin Key)
    // ========================================================
    if ($type === 'login') {
        $email = $_POST['email'] ?? '';
        $password = $_POST['password'] ?? '';
        $user_otp = $_POST['otp'] ?? '';
        $user_key = $_POST['admin_key'] ?? '';

        // প্রথম ধাপ: Admin Key সঠিক কিনা যাচাই করা
        if ($user_key !== ADMIN_KEY) {
            echo json_encode(["status" => "error", "message" => "Invalid Security Admin Key!"]);
            exit;
        }

        // দ্বিতীয় ধাপ: ডাটাবেজ থেকে ইমেইল চেক
        $stmt = $conn->prepare("SELECT id, username, password, otp_code, otp_expiry FROM admin WHERE email = ?");
        $stmt->bind_param("s", $email);
        $stmt->execute();
        $result = $stmt->get_result();

        if ($result->num_rows > 0) {
            $admin = $result->fetch_assoc();
            
            // তৃতীয় ধাপ: MD5 পাসওয়ার্ড চেক করা (পরিবর্তিত)
            if (md5($password) === $admin['password']) {
                
                // চতুর্থ ধাপ: OTP এবং তার মেয়াদ (Expiry) চেক করা
                $current_time = date('Y-m-d H:i:s');
                
                if ($admin['otp_code'] === $user_otp && $admin['otp_expiry'] >= $current_time) {
                    
                    // সফল লগইন - সেশন তৈরি
                    $_SESSION['admin_logged_in'] = true;
                    $_SESSION['admin_id'] = $admin['id'];
                    $_SESSION['admin_user'] = $admin['username'];
                    
                    // ব্যবহৃত OTP মুছে দেওয়া
                    $clear_otp = $conn->prepare("UPDATE admin SET otp_code = NULL, otp_expiry = NULL WHERE id = ?");
                    $clear_otp->bind_param("i", $admin['id']);
                    $clear_otp->execute();

                    echo json_encode(["status" => "success", "message" => "Login Successful! Welcome Admin."]);
                } else {
                    echo json_encode(["status" => "error", "message" => "Invalid or Expired OTP!"]);
                }
            } else {
                echo json_encode(["status" => "error", "message" => "Invalid Password!"]);
            }
        } else {
            echo json_encode(["status" => "error", "message" => "No Admin Found with this Email!"]);
        }
        $stmt->close();
    }

    // ========================================================
    // ২. লগইনের আগে OTP জেনারেট করার রিকোয়েস্ট
    // ========================================================
    if ($type === 'request_login_otp') {
        $email = $_POST['email'] ?? '';

        $stmt = $conn->prepare("SELECT id FROM admin WHERE email = ?");
        $stmt->bind_param("s", $email);
        $stmt->execute();
        $result = $stmt->get_result();

        if ($result->num_rows > 0) {
            $otp = rand(1000000000, 999999999999);
            $expiry = date('Y-m-d H:i:s', strtotime('+5 minutes'));

            $update = $conn->prepare("UPDATE admin SET otp_code = ?, otp_expiry = ? WHERE email = ?");
            $update->bind_param("sss", $otp, $expiry, $email);
            
            if ($update->execute()) {
                sendOTPEmail($email, $otp);
                echo json_encode(["status" => "success", "message" => "OTP sent to your email. (Test OTP: $otp)"]);
            } else {
                echo json_encode(["status" => "error", "message" => "Failed to generate OTP."]);
            }
        } else {
            echo json_encode(["status" => "error", "message" => "Email not found!"]);
        }
        $stmt->close();
    }

    // ========================================================
    // ৩. অ্যাডমিন রেজিস্ট্রেশন (Admin Key ভেরিফিকেশন সহ)
    // ========================================================
    if ($type === 'register') {
        $username = $_POST['username'] ?? '';
        $email = $_POST['email'] ?? '';
        $password = $_POST['password'] ?? '';
        $user_key = $_POST['admin_key'] ?? '';

        // ইনপুট ফিল্ডগুলো খালি কিনা চেক করা (যাতে ব্ল্যাংক ডাটা ইনসার্ট না হয়)
        if (empty($username) || empty($email) || empty($password)) {
            echo json_encode(["status" => "error", "message" => "All fields (Username, Email, Password) are required!"]);
            exit;
        }

        // রেজিস্ট্রেশনের সময় মাস্টার Admin Key চেক
        if ($user_key !== ADMIN_KEY) {
            echo json_encode(["status" => "error", "message" => "Wrong Admin Key! You are not authorized to register."]);
            exit;
        }

        // ইমেইল বা ইউজারনেম ইতিমধ্যে আছে কিনা চেক করা
        $check = $conn->prepare("SELECT id FROM admin WHERE email = ? OR username = ?");
        $check->bind_param("ss", $email, $username);
        $check->execute();
        if ($check->get_result()->num_rows > 0) {
            echo json_encode(["status" => "error", "message" => "Username or Email already exists!"]);
        } else {
            // MD5 ৩২ ক্যারেক্টার হ্যাশ করার জন্য (পরিবর্তিত)
            $hashed_password = md5($password);

            $insert = $conn->prepare("INSERT INTO admin (username, email, password) VALUES (?, ?, ?)");
            $insert->bind_param("sss", $username, $email, $hashed_password);
            
            if ($insert->execute()) {
                echo json_encode(["status" => "success", "message" => "New Admin Registered Successfully!"]);
            } else {
                echo json_encode(["status" => "error", "message" => "Registration Failed! SQL Error: " . $insert->error]);
            }
            $insert->close();
        }
        $check->close();
    }

    // ========================================================
    // ৪. ফরগট পাসওয়ার্ড 
    // ========================================================
    if ($type === 'forgot_password') {
        $email = $_POST['email'] ?? '';
        $otp = $_POST['otp'] ?? '';
        $new_password = $_POST['new_password'] ?? '';

        $current_time = date('Y-m-d H:i:s');
        $stmt = $conn->prepare("SELECT id FROM admin WHERE email = ? AND otp_code = ? AND otp_expiry >= ?");
        $stmt->bind_param("sss", $email, $otp, $current_time);
        $stmt->execute();
        $result = $stmt->get_result();

        if ($result->num_rows > 0) {
            // পাসওয়ার্ড রিসেটের সময়ও MD5 ব্যবহার (পরিবর্তিত)
            $hashed_password = md5($new_password);

            $update = $conn->prepare("UPDATE admin SET password = ?, otp_code = NULL, otp_expiry = NULL WHERE email = ?");
            $update->bind_param("ss", $hashed_password, $email);
            
            if ($update->execute()) {
                echo json_encode(["status" => "success", "message" => "Password Reset Successfully!"]);
            } else {
                echo json_encode(["status" => "error", "message" => "Failed to reset password."]);
            }
        } else {
            echo json_encode(["status" => "error", "message" => "Invalid OTP or OTP Expired!"]);
        }
        $stmt->close();
    }

    $conn->close();
} else {
    echo json_encode(["status" => "error", "message" => "Invalid Request Method"]);
}
?>