<?php
defined('BASEPATH') OR exit('No direct script access allowed');

class Auth extends CI_Controller {

    public function __construct()
    {
        parent::__construct();
    }

    public function index()
    {
        if ($this->session->userdata('logged_in')) {
            redirect('dashboard');
        }

        $this->load->view('auth/login');
    }

    public function process_login()
    {
        if (strtoupper($this->input->method()) !== 'POST') {
            show_error('Metode request tidak diizinkan.', 405);
        }

        $lockedUntil = (int) $this->session->userdata('login_locked_until');
        if ($lockedUntil > time()) {
            $remaining = max(1, (int) ceil(($lockedUntil - time()) / 60));
            $this->session->set_flashdata('error', 'Terlalu banyak percobaan login. Coba kembali dalam ' . $remaining . ' menit.');
            redirect('auth');
            return;
        }

        $username = trim((string) $this->input->post('username', true));
        $password = (string) $this->input->post('password');

        if ($username === '' || $password === '') {
            $this->session->set_flashdata('error', 'Username dan password wajib diisi.');
            redirect('auth');
            return;
        }

        $user = $this->db->get_where('v_users', ['username' => $username])->row();

        if ($user && (int)$user->role_is_active === 1 && password_verify($password, $user->password)) {

            $this->session->sess_regenerate(true);
            $this->session->unset_userdata(array('login_attempts', 'login_locked_until'));

            // Decode permissions
            $permissions = json_decode($user->permissions, true);
            if (!is_array($permissions)) {
                $permissions = [];
            }
            $role = $this->db->select('is_super_admin')->get_where('roles', array('id' => (int)$user->role_id))->row();

            $session_data = [
                'user_id'       => $user->id,
                'nama'          => $user->nama,
                'username'      => $user->username,
                'role'          => $user->nama_role,
                'role_id'       => (int) $user->role_id,
                'is_super_admin'=> $role && (int)$role->is_super_admin === 1,
                'permissions'   => $permissions,
                'logged_in'     => TRUE
            ];

            $this->session->set_userdata($session_data);

            // 🔥 LOG LOGIN BERHASIL
            log_activity(
                'Auth',
                'login',
                'User '.$user->username.' berhasil login',
                'success'
            );

            redirect('dashboard');

        } else {

            $attempts = (int) $this->session->userdata('login_attempts') + 1;
            $this->session->set_userdata('login_attempts', $attempts);

            if ($attempts >= 5) {
                $this->session->set_userdata(array(
                    'login_attempts' => 0,
                    'login_locked_until' => time() + 300
                ));
            }

            // 🔥 LOG LOGIN GAGAL
            log_activity(
                'Auth',
                'login_failed',
                'Login gagal untuk username: '.$username,
                'failed'
            );

            $this->session->set_flashdata('error', 'Username atau password salah.');
            redirect('auth');
        }
    }

    public function logout()
    {
        $username = $this->session->userdata('username');

        // 🔥 LOG LOGOUT (SEBELUM DESTROY SESSION)
        log_activity(
            'Auth',
            'logout',
            'User '.$username.' logout',
            'success'
        );

        $this->session->sess_destroy();
        redirect('auth');
    }
}
?>