<?php
declare(strict_types=1);

require_once __DIR__ . '/session_store.php';

function golder_web_cookie_secure(): bool
{
    return !empty($_SERVER['HTTPS']) && strtolower((string)$_SERVER['HTTPS']) !== 'off';
}

function golder_web_app_session_start(): void
{
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }

    ini_set('session.use_only_cookies', '1');
    ini_set('session.use_strict_mode', '1');
    session_set_cookie_params([
        'lifetime' => 0,
        'path' => '/',
        'secure' => golder_web_cookie_secure(),
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
    session_start();
}

function golder_clear_web_app_customer_session(): void
{
    unset(
        $_SESSION['customer'],
        $_SESSION['tenant'],
        $_SESSION['profile'],
        $_SESSION['user'],
        $_SESSION['web_session_uuid'],
        $_SESSION['web_session_token']
    );
}

function golder_current_web_session_payload(): array
{
    golder_web_app_session_start();
    return [
        'session_id' => trim((string)($_SESSION['web_session_uuid'] ?? '')),
        'session_token' => trim((string)($_SESSION['web_session_token'] ?? '')),
        'heartbeat_interval_seconds' => golder_web_session_heartbeat_interval_seconds(),
        'timeout_seconds' => golder_web_session_timeout_seconds(),
    ];
}

function golder_validate_current_web_customer_session(PDO $master): ?array
{
    golder_web_app_session_start();

    $customer = $_SESSION['customer'] ?? null;
    if (!is_array($customer) || (int)($customer['id'] ?? 0) <= 0) {
        return null;
    }

    $sessionUuid = trim((string)($_SESSION['web_session_uuid'] ?? ''));
    $sessionToken = trim((string)($_SESSION['web_session_token'] ?? ''));
    if ($sessionUuid === '' || $sessionToken === '') {
        return null;
    }

    $sessionRow = golder_validate_web_session($master, $sessionUuid, $sessionToken);
    if (!$sessionRow) {
        return null;
    }

    if ((int)($sessionRow['customer_id'] ?? 0) !== (int)($customer['id'] ?? 0)) {
        golder_close_web_session($master, $sessionUuid, 'customer_mismatch');
        return null;
    }

    return $sessionRow;
}

function golder_require_current_web_customer_session(PDO $master): array
{
    golder_web_app_session_start();
    $customer = $_SESSION['customer'] ?? null;
    if (!is_array($customer) || (int)($customer['id'] ?? 0) <= 0) {
        golder_json_error(401, 'UNAUTHORIZED', 'Login is required.');
    }

    $sessionRow = golder_validate_current_web_customer_session($master);
    if (!$sessionRow) {
        golder_clear_web_app_customer_session();
        golder_json_error(401, 'SESSION_EXPIRED', 'Session expired or disconnected.');
    }

    return [
        'customer' => $customer,
        'customer_id' => (int)($customer['id'] ?? 0),
        'session_uuid' => trim((string)($_SESSION['web_session_uuid'] ?? '')),
        'session_token' => trim((string)($_SESSION['web_session_token'] ?? '')),
        'session' => $sessionRow,
    ];
}


