<?php
declare(strict_types=1);

require_once __DIR__ . '/config.php';

function golder_admin_expected_credentials(): array
{
    $user = trim(golder_env('GOLDER_ADMIN_USER', golder_env('GOLDER_ADMIN_API_USER', '')));
    $pass = (string)golder_env('GOLDER_ADMIN_PASS', golder_env('GOLDER_ADMIN_API_PASS', ''));
    return [
        'user' => $user,
        'pass' => $pass,
        'configured' => ($user !== '' && $pass !== ''),
    ];
}

function golder_admin_credentials_match(string $username, string $password): bool
{
    $expected = golder_admin_expected_credentials();
    if (empty($expected['configured'])) {
        return false;
    }
    return hash_equals((string)$expected['user'], $username) && hash_equals((string)$expected['pass'], $password);
}

function golder_admin_session_start(): void
{
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }
    session_name('golder_admin');
    session_start([
        'cookie_httponly' => true,
        'cookie_samesite' => 'Lax',
        'use_strict_mode' => true,
    ]);
}

function golder_admin_is_logged_in(): bool
{
    golder_admin_session_start();
    return !empty($_SESSION['golder_admin']['authenticated']);
}

function golder_admin_current_user(): string
{
    golder_admin_session_start();
    return (string)($_SESSION['golder_admin']['username'] ?? '');
}

function golder_admin_login(string $username, string $password): bool
{
    golder_admin_session_start();
    if (!golder_admin_credentials_match($username, $password)) {
        return false;
    }

    session_regenerate_id(true);
    $_SESSION['golder_admin'] = [
        'authenticated' => true,
        'username' => $username,
        'logged_in_at' => gmdate('Y-m-d H:i:s'),
    ];
    unset($_SESSION['golder_admin_csrf']);
    return true;
}

function golder_admin_logout(): void
{
    golder_admin_session_start();
    unset($_SESSION['golder_admin'], $_SESSION['golder_admin_csrf']);
}

function golder_admin_csrf_token(): string
{
    golder_admin_session_start();
    $token = (string)($_SESSION['golder_admin_csrf'] ?? '');
    if ($token === '') {
        $token = bin2hex(random_bytes(32));
        $_SESSION['golder_admin_csrf'] = $token;
    }
    return $token;
}

function golder_admin_verify_csrf(string $token): bool
{
    golder_admin_session_start();
    $expected = (string)($_SESSION['golder_admin_csrf'] ?? '');
    return $expected !== '' && hash_equals($expected, trim($token));
}

function golder_admin_api_basic_auth(): string
{
    $expected = golder_admin_expected_credentials();
    if (empty($expected['configured'])) {
        golder_json_error(500, 'ADMIN_AUTH_NOT_CONFIGURED', 'Admin credentials are not configured.');
    }

    $user = (string)($_SERVER['PHP_AUTH_USER'] ?? '');
    $pass = (string)($_SERVER['PHP_AUTH_PW'] ?? '');
    if (!golder_admin_credentials_match($user, $pass)) {
        header('WWW-Authenticate: Basic realm="Golder Admin API"');
        golder_json_error(401, 'UNAUTHORIZED', 'Invalid admin credentials.');
    }
    return $user;
}


