<?php 

//session_start();
error_reporting(E_ALL);
ini_set('display_errors', 1);
include('../config/dbcon.php');
include('myfunctions.php');

ob_start();

if(isset($_POST['register_btn']))

{

    $name = mysqli_real_escape_string($con,$_POST['name']);

    $email = mysqli_real_escape_string($con,$_POST['email']);

    $phone = mysqli_real_escape_string($con,$_POST['phone']);

    $password = mysqli_real_escape_string($con,$_POST['password']);

    $cpassword = mysqli_real_escape_string($con,$_POST['cpassword']);

    //email unique mi?

    $check_email_query = "SELECT email FROM users WHERE email='$email' ";

    $check_email_query_run = mysqli_query($con, $check_email_query);
    if(mysqli_num_rows($check_email_query_run) > 0)

    {

        redirect("../register.php", "Email already registered.");

    }

    else

    {


    //girilen şifreler aynı mı?
    
    if($password == $cpassword)

    {
        $hashedUserPw = enSifre($password);
        $insert_query = "INSERT INTO users (name,email,phone,password) VALUES ('$name','$email','$phone','$hashedUserPw')";

        $insert_query_run = mysqli_query($con,$insert_query);

        
        if($insert_query_run)

        {
            
            $_SESSION['message'] = "Registered Successfully";

            header('Location: ../login.php');

        exit();
        }

        else{

            redirect("../register.php", "Something went wrong.");

        }

        }

    

    else

    {

        redirect("../register.php", "Passwords do not match.");

    }



    }

}

else if(isset($_POST['login_btn']))

{

    $email = mysqli_real_escape_string($con,$_POST['email']);

    $password = mysqli_real_escape_string($con,$_POST['password']);


    $hashedUserPw = enSifre($password);
    $login_query = "SELECT * FROM users WHERE email='$email' AND password='$hashedUserPw' ";

    $login_query_run = mysqli_query($con,$login_query);



    if(mysqli_num_rows($login_query_run) > 0){

        $_SESSION['auth'] = true;



        $userdata = mysqli_fetch_array($login_query_run);

        $userid = $userdata['id'];

        $username = $userdata['name'];

        $useremail = $userdata['email'];

        $userphone = $userdata['phone'];

        $role_as = $userdata['role_as'];



        $_SESSION['auth_user'] = [

            'user_id' => $userid,

            'name' => $username,

            'email' => $useremail,

            'phone' => $userphone

        ];



        $_SESSION['role_as'] = $role_as;



        if($role_as == 1)

        {

        redirect("../admin/index.php", "Welcome to Dashboard");

        }

        else

        {

        redirect("../index.php", "Logged in successfully");

        }

    }

    else

    {

        redirect("../login.php", "Invalid Credentials");

    }

}
else if(isset($_POST['forgotpw_btn']))

{

    $email = mysqli_real_escape_string($con,$_POST['email']);
    $fp_query = "SELECT * FROM users WHERE email='$email' ";

    $fp_query_run = mysqli_query($con,$fp_query);
    if(mysqli_num_rows($fp_query_run) > 0){


        $userdata = mysqli_fetch_array($fp_query_run);

        $userid = $userdata['id'];
        $username = $userdata['name'];
        $useremail = $userdata['email'];
        $userphone = $userdata['phone'];
        $role_as = $userdata['role_as'];
        
        $hashedPwReset = enSifre($usermail);


        $to = "$email";
        $subject = "Password Reset";
        $message = "Click to reset your password : https://order.exelsiorhotels.com/forgotpassword.php?pwreset1=" . $username . "&pwreset2=" . $userid . "&pwreset3=" . $useremail . "&pwreset4=" . $userphone;
        $headers = "From: info@exelsiorhotels.com\r\n"; // Specify the sender's email address
        
        // Send the email
        $mailSent = mail($to, $subject, $message, $headers);

        redirect("../login.php", "Reset Mail Sent.");

    }

    else

    {

        redirect("../forgotpassword.php", "E-mail not found.");

    }

}

else if(isset($_POST['resetmailpw_btn']))

{
    $retrievedEmail = mysqli_real_escape_string($con,$_POST['email']);
    $retrievedName = mysqli_real_escape_string($con,$_POST['name']);
    $retrievedId = mysqli_real_escape_string($con,$_POST['id']);
    $retrievedPhone = mysqli_real_escape_string($con,$_POST['phone']);
    $password = mysqli_real_escape_string($con,$_POST['password']);
    $cpassword = mysqli_real_escape_string($con,$_POST['cpassword']);
    
    //girilen şifreler aynı mı?
    if($password == $cpassword)
    {
        $hashedUserPw = enSifre($password);
        $resetpw_query = "UPDATE users SET password = '$hashedUserPw' WHERE email = '$retrievedEmail' AND name = '$retrievedName' AND id = '$retrievedId' AND phone = '$retrievedPhone' ";
        $resetpw_query_run = mysqli_query($con, $resetpw_query);

            if ($resetpw_query_run) {
                // Password update successful
                redirect("../login.php", "Password Updated!");
            } else {
                // Password update failed
                echo "Failed to update password: " . mysqli_error($con);
            }
    }
    else
    {
        redirect("../forgotpassword.php?pwreset1=$retrievedName&pwreset2=$retrievedId&pwreset3=$retrievedEmail&pwreset4=$retrievedPhone", "Passwords do not match.");
    }

}

ob_end_flush();
?>