<?php

namespace App\Controllers;

use App\Core\Controller;
use App\Helpers\Auth;
use App\Helpers\Csrf;
use App\Helpers\SessionHelper;
use App\Models\StaffProfile;
use App\Models\User;
use PDO;

class ProfileController extends Controller
{
    private PDO $pdo;  // Declare property manually

    public function __construct(PDO $pdo)
    {
        $this->pdo = $pdo; // Assign manually (PHP 7.4 style)
    }

    public function show(): void
    {
        Auth::requireRole(['staff']);
        $user = SessionHelper::user();
        $profileModel = new StaffProfile($this->pdo);
        $profile = $profileModel->findByUserId($user['id']) ?? [];
        $leaveStats = $profileModel->getLeaveStats($user['id']);

        $this->view('profile/index', [
            'csrf' => Csrf::field(),
            'user' => $user,
            'profile' => $profile,
            'leaveStats' => $leaveStats,
            'message' => SessionHelper::flash('message'),
            'error' => SessionHelper::flash('error'),
        ]);
    }

    public function update(): void
    {
        Auth::requireRole(['staff']);

        if (!Csrf::validate($_POST['_token'] ?? null)) {
            SessionHelper::flash('error', 'Invalid CSRF token');
            header('Location: index.php?route=profile');
            exit;
        }

        $user = SessionHelper::user();
        $userModel = new User($this->pdo);
        $currentUser = $userModel->find($user['id']);

        if (!$currentUser) {
            SessionHelper::flash('error', 'User not found.');
            header('Location: index.php?route=profile');
            exit;
        }

        $email = filter_var($_POST['email'] ?? '', FILTER_VALIDATE_EMAIL) ?: null;
        $phone = trim($_POST['phone'] ?? '');
        $address = trim($_POST['address'] ?? '');
        $bankName = trim($_POST['bank_name'] ?? '');
        $accountNo = trim($_POST['account_no'] ?? '');

        if (!$email) {
            SessionHelper::flash('error', 'Email tidak sah.');
            header('Location: index.php?route=profile');
            exit;
        }

        $profileModel = new StaffProfile($this->pdo);
        $profile = $profileModel->findByUserId($user['id']) ?? [];

        $userModel->update($user['id'], [
            'name' => $currentUser['name'],
            'email' => $email,
            'active' => $currentUser['active'] ?? 1,
        ]);

        $profileModel->updateByUserId($user['id'], [
            'address' => $address,
            'phone' => $phone,
            'hire_date' => $profile['hire_date'] ?? null,
            'location' => $profile['location'] ?? null,
            'bank_name' => $bankName,
            'account_no' => $accountNo,
            'allowed_leave' => $profile['allowed_leave'] ?? 0,
        ]);

        // Update session email
        SessionHelper::setUser(array_merge($user, ['email' => $email]));

        SessionHelper::flash('message', 'Profil dikemaskini.');
        header('Location: index.php?route=profile');
    }
}


