<?php

ob_start();
session_start();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: login.php');
    exit;
}
include_once 'sites/config/config.php';
$value = isset($_POST['myemail']) ? $_POST['myemail'] : '';
$myemail = $conn->real_escape_string($value);
$mypassword = isset($_POST['mypassword']) ? $_POST['mypassword'] : '';

// Protect against SQL injection by escaping user input
$myemail = stripslashes($myemail);
$mypassword = stripslashes($mypassword);
$mypassword = sha1($mypassword . $salt);
$ad_id = isset($_POST['ad_id']) ? (int)$_POST['ad_id'] : 0;
$sql = "SELECT * FROM users WHERE email = ? AND password = ? AND ad_id = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param('ssi', $myemail, $mypassword, $ad_id);
$stmt->execute();
$result = $stmt->get_result();
// Check if the query returned exactly one row
if ($result->num_rows == 1) {
    $row = $result->fetch_assoc();

    // Start the session and set session variables
    $session_token = bin2hex(random_bytes(32)); // secure random token

    $_SESSION['registered'] = "registered";
    // $_SESSION['password'] = $mypassword;
    $_SESSION['email'] = $myemail;
    $_SESSION['user_id'] = $row['id'];
    $_SESSION['ad_id'] = $ad_id;
    $_SESSION['ad_title'] = 1;
    $_SESSION['session_token'] = $session_token;


    // Store the token in DB
    $update_token = $conn->prepare("UPDATE users SET session_token = ? WHERE id = ?");
    $update_token->bind_param("si", $session_token, $row['id']);
    $update_token->execute();
    $update_token->close();


    // Hash the password using SHA1 and a salt
    // $mypassword = sha1($mypassword . $salt);

    $check_sql = "SELECT category, disability, age, gender, csir_employee, ex_servicemen FROM primary_details WHERE user_id = ? LIMIT 1";
    $check_stmt = $conn->prepare($check_sql);
    $check_stmt->bind_param('i', $_SESSION['user_id']);
    $check_stmt->execute();
    $check_result = $check_stmt->get_result();

    if ($check_result->num_rows == 1) {
        $_SESSION['primary_saved'] = "Yes";
        $primary_details_row = $check_result->fetch_assoc();
        $_SESSION['category'] = $primary_details_row['category'];
        $_SESSION['disability'] = $primary_details_row['disability'];
        $_SESSION['gender'] = $primary_details_row['gender'];
        $_SESSION['csir_employee'] = $primary_details_row['csir_employee'];
        $_SESSION['ex_servicemen'] = $primary_details_row['ex_servicemen'];
        $_SESSION['age'] = $primary_details_row['age'];
    }

    $check_stmt->close();
    $_SESSION["app_submitted"] = "False"; // Default to False

    // Assuming the ad_id from the login form ($_POST['ad_id']) is the advertisement_id for the application
    $app_status_sql = "SELECT id, status FROM applications WHERE user_id = ? AND advertisement_id = ? ORDER BY created_at DESC LIMIT 1"; // Get the latest application for this ad, including the id
    $app_status_stmt = $conn->prepare($app_status_sql);

    if ($app_status_stmt) {
        $app_status_stmt->bind_param('ii', $_SESSION['user_id'], $ad_id); // Use $ad_id from the form as advertisement_id
        $app_status_stmt->execute();
        $app_status_result = $app_status_stmt->get_result();

        if ($app_status_result->num_rows == 1) {
            $application_row = $app_status_result->fetch_assoc();

            // Store the application ID in the session
            if (isset($application_row['id'])) {
                $_SESSION['application_id'] = $application_row['id'];
            }

            // Check the status
            if (isset($application_row['status']) && $application_row['status'] == 'submitted') {
                $_SESSION["app_submitted"] = "True";
            }
        }
        $app_status_stmt->close();
    } else {
        // Handle prepare error for application status query
        // You might want to log this error
        // error_log("Failed to prepare application status query: " . $conn->error);
    }

    // ---- END: Check application status ----

    echo "true";
} else {
    $row = $result->fetch_assoc();
    // echo "Email: " . $myemail . "<br>";
    // echo "Password: " . $mypassword . "<br>"; // Be cautious about echoing passwords!
    // echo "Ad ID: " . $ad_id . "<br>";
    // Echo other columns as needed
    // print_r($row); // To see all the data in the row
    // echo "<br>";
    echo "<div class=\"alert alert-danger alert-dismissable\"><button type=\"button\" class=\"close\" data-dismiss=\"alert\" aria-hidden=\"true\">&times;</button>Wrong Credentials/ Not Registered</div>";
}
// Close the prepared statement and connection
$stmt->close();
$conn->close();

ob_end_flush();