<?php

declare(strict_types=1);

require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';

use App\ConfigLoader;
use App\LdapProvisioner;
use App\RegistrationAccess;

session_start();

$projectRoot = dirname(__DIR__, 3);
$config = ConfigLoader::load($projectRoot, 'registration');
$access = new RegistrationAccess($config);

if (!$access->canManage()) {
    http_response_code(403);
    echo 'Kein Zugriff auf LDAP-Test.';
    exit;
}

$ldap = new LdapProvisioner($config);
$csrfToken = (string) ($_SESSION['ldap_test_token'] ?? '');

if ($csrfToken === '') {
    $csrfToken = bin2hex(random_bytes(16));
    $_SESSION['ldap_test_token'] = $csrfToken;
}

$serviceResult = $ldap->testServiceBind();
$messages = [];
$errors = [];
$loginForm = ['username' => '', 'password' => ''];
$passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => ''];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $postedToken = (string) ($_POST['csrf_token'] ?? '');

    if ($postedToken === '' || !hash_equals($csrfToken, $postedToken)) {
        $errors[] = 'Die Formularprüfung ist fehlgeschlagen.';
    } else {
        $action = (string) ($_POST['action'] ?? '');

        if ($action === 'test-login') {
            $loginForm['username'] = trim((string) ($_POST['username'] ?? ''));
            $loginForm['password'] = (string) ($_POST['password'] ?? '');

            if ($loginForm['username'] === '' || $loginForm['password'] === '') {
                $errors[] = 'Für den Login-Test sind Benutzername und Passwort erforderlich.';
            } else {
                $result = $ldap->testUserCredentials($loginForm['username'], $loginForm['password']);

                if ($result['success'] ?? false) {
                    $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? '');
                } else {
                    $errors[] = (string) ($result['message'] ?? 'LDAP-Login fehlgeschlagen.');
                }
            }
        }

        if ($action === 'change-password') {
            $passwordForm['username'] = trim((string) ($_POST['username'] ?? ''));
            $passwordForm['current_password'] = (string) ($_POST['current_password'] ?? '');
            $passwordForm['new_password'] = (string) ($_POST['new_password'] ?? '');
            $passwordForm['new_password_confirm'] = (string) ($_POST['new_password_confirm'] ?? '');

            if ($passwordForm['username'] === '') {
                $errors[] = 'Für die Passwortänderung ist ein Benutzername erforderlich.';
            }

            if ($passwordForm['current_password'] === '') {
                $errors[] = 'Bitte das aktuelle Passwort angeben, damit der Login vorab geprüft werden kann.';
            }

            if (strlen($passwordForm['new_password']) < 12) {
                $errors[] = 'Das neue Passwort muss mindestens 12 Zeichen lang sein.';
            }

            if ($passwordForm['new_password'] !== $passwordForm['new_password_confirm']) {
                $errors[] = 'Die neuen Passwörter stimmen nicht überein.';
            }

            if ($errors === []) {
                $loginCheck = $ldap->testUserCredentials($passwordForm['username'], $passwordForm['current_password']);

                if (!(bool) ($loginCheck['success'] ?? false)) {
                    $errors[] = 'Der Vorab-Login mit aktuellem Passwort ist fehlgeschlagen: ' . (string) ($loginCheck['message'] ?? '');
                } else {
                    $result = $ldap->updateUserPassword($passwordForm['username'], $passwordForm['new_password']);

                    if ($result['success'] ?? false) {
                        $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? '');
                        $passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => ''];
                    } else {
                        $errors[] = (string) ($result['message'] ?? 'Passwortänderung fehlgeschlagen.');
                    }
                }
            }
        }
    }
}
?><!DOCTYPE html>
<html lang="de">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>LDAP-Test</title>
    <link rel="stylesheet" href="/assets/auth/login.css">
</head>
<body>
    <main class="login-shell">
        <section class="login-panel login-panel-wide">
            <div class="login-panel-top">
                <p class="login-kicker">Kusche.Berlin</p>
                <h1>LDAP-Test</h1>
                <p class="login-copy">Hier kannst du direkt den LDAP-Login prüfen und das Passwort inklusive Samba-Feldern aktualisieren.</p>
            </div>

            <div class="login-notice <?= ($serviceResult['success'] ?? false) ? 'login-notice-success' : 'login-notice-error' ?>">
                <strong>Service-Bind</strong>
                <p><?= htmlspecialchars((string) ($serviceResult['message'] ?? ''), ENT_QUOTES) ?></p>
            </div>

            <?php if ($messages !== []): ?>
                <div class="login-notice login-notice-success">
                    <strong>Ergebnis</strong>
                    <ul class="login-list">
                        <?php foreach ($messages as $message): ?>
                            <li><?= htmlspecialchars($message, ENT_QUOTES) ?></li>
                        <?php endforeach; ?>
                    </ul>
                </div>
            <?php endif; ?>

            <?php if ($errors !== []): ?>
                <div class="login-notice login-notice-error">
                    <strong>Bitte prüfen</strong>
                    <ul class="login-list">
                        <?php foreach ($errors as $error): ?>
                            <li><?= htmlspecialchars($error, ENT_QUOTES) ?></li>
                        <?php endforeach; ?>
                    </ul>
                </div>
            <?php endif; ?>

            <div class="admin-layout">
                <section class="admin-detail">
                    <h2>Login testen</h2>
                    <form class="login-form" method="post" action="/admin/ldap-test">
                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES) ?>">
                        <input type="hidden" name="action" value="test-login">

                        <label class="login-field">
                            <span>Benutzername</span>
                            <input type="text" name="username" value="<?= htmlspecialchars($loginForm['username'], ENT_QUOTES) ?>" required>
                        </label>

                        <label class="login-field">
                            <span>Passwort</span>
                            <input type="password" name="password" value="" required>
                        </label>

                        <div class="login-actions">
                            <button class="login-button login-button-primary" type="submit">LDAP-Login prüfen</button>
                        </div>
                    </form>
                </section>

                <section class="admin-detail">
                    <h2>Passwort ändern</h2>
                    <form class="login-form" method="post" action="/admin/ldap-test">
                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES) ?>">
                        <input type="hidden" name="action" value="change-password">

                        <label class="login-field">
                            <span>Benutzername</span>
                            <input type="text" name="username" value="<?= htmlspecialchars($passwordForm['username'], ENT_QUOTES) ?>" required>
                        </label>

                        <label class="login-field">
                            <span>Aktuelles Passwort</span>
                            <input type="password" name="current_password" value="" required>
                        </label>

                        <label class="login-field">
                            <span>Neues Passwort</span>
                            <input type="password" name="new_password" value="" required>
                        </label>

                        <label class="login-field">
                            <span>Neues Passwort wiederholen</span>
                            <input type="password" name="new_password_confirm" value="" required>
                        </label>

                        <div class="login-actions">
                            <button class="login-button login-button-primary" type="submit">Passwort im LDAP und SMB ändern</button>
                        </div>
                    </form>
                </section>
            </div>
        </section>
    </main>
</body>
</html>