<?php

/** remote_add() // ambil data mikrotik lalu cek address aplikasi, jika address adalah "tunnel.manjapr.net" maka buat port nya di 2 mikrotik dan jika bukan maka buatnya langsung ke mikrotik nya
 * buat range port untuk remote ONU.
 * buat schedule untuk ubah port ke kosong
 */
class RemoteModem
{
    private $pdo;

    public function __construct($pdo)
    {
        $this->pdo = $pdo; // Inject PDO
    }

    public function remote_add($id_mikrotik, $ip_akses, $nama_user)
    {
        $mikrotik = new RouterosAPI();
        $mikrotik->debug = false;

        try {
            // 🔥 Ambil data Mikrotik
            $stmt = $this->pdo->prepare("SELECT ip_address, username, password, port_api, radius_nas_data 
                                         FROM setting_mikrotik 
                                         WHERE id = :id");
            $stmt->execute([':id' => $id_mikrotik]);
            $mikrotikUser = $stmt->fetch(PDO::FETCH_ASSOC);

            if (!$mikrotikUser) {
                return json_encode([
                    "status" => "error",
                    "message" => "Mikrotik dengan ID $id_mikrotik tidak ditemukan."
                ]);
            }

            // 🔥 Ambil remote-address jika tunnel
            $dataIP = json_decode($mikrotikUser['radius_nas_data']);
            $iptunnel = $dataIP->data->{'remote-address'} ?? null;

            do {
                $freePort = rand(10000, 19999);

                $stmt = $this->pdo->prepare("SELECT COUNT(*) FROM log_remote WHERE remote_port = :port");
                $stmt->execute([':port' => $freePort]);
                $count = $stmt->fetchColumn();
            } while ($count > 0);


            $Secret = "Remote-User-" . $nama_user;

            if ($mikrotikUser['ip_address'] === "tunnel.manjapro.net" && !empty($iptunnel)) {
                // 🔥 Koneksi ke Mikrotik pusat
                if (!$mikrotik->connect2('manjapro.net', 'apiapkmanjapro', 'apiapkmanjapro123321', 2887)) {
                    return json_encode([
                        "status" => "error",
                        "message" => "Gagal koneksi ke Mikrotik pusat."
                    ]);
                }

                // Tambah NAT di Mikrotik pusat
                $mikrotik->comm('/ip/firewall/nat/add', [
                    "chain"             => "dstnat",
                    "dst-address-list"  => "IP-Public",
                    "dst-port"          => $freePort,
                    "protocol"          => "tcp",
                    "action"            => "dst-nat",
                    "to-addresses"      => $iptunnel,
                    "to-ports"          => $freePort,
                    "comment"           => $Secret
                ]);
                $mikrotik->disconnect();

                // 🔥 Koneksi ke Mikrotik remote
                if (!$mikrotik->connect2($mikrotikUser['ip_address'], $mikrotikUser['username'], $mikrotikUser['password'], $mikrotikUser['port_api'])) {
                    return json_encode([
                        "status" => "error",
                        "message" => "Gagal koneksi ke Mikrotik remote."
                    ]);
                }

                // Tambah NAT di Mikrotik remote
                $mikrotik->comm('/ip/firewall/nat/add', [
                    "chain"             => "dstnat",
                    "dst-address"       => $iptunnel,
                    "dst-port"          => $freePort,
                    "protocol"          => "tcp",
                    "action"            => "dst-nat",
                    "to-addresses"      => $ip_akses,
                    "to-ports"          => 80,
                    "comment"           => $Secret
                ]);
                $mikrotik->disconnect();

                $jenis = "tunnel";

            } else {
                // 🔥 Koneksi ke Mikrotik langsung
                if (!$mikrotik->connect2($mikrotikUser['ip_address'], $mikrotikUser['username'], $mikrotikUser['password'], $mikrotikUser['port_api'])) {
                    return json_encode([
                        "status" => "error",
                        "message" => "Gagal koneksi ke Mikrotik."
                    ]);
                }

                // Tambah NAT di Mikrotik
                $mikrotik->comm('/ip/firewall/nat/add', [
                    "chain"             => "dstnat",
                    "dst-address"       => $mikrotikUser['ip_address'],
                    "dst-port"          => $freePort,
                    "protocol"          => "tcp",
                    "action"            => "dst-nat",
                    "to-addresses"      => $ip_akses,
                    "to-ports"          => 80,
                    "comment"           => $Secret
                ]);
                $mikrotik->disconnect();

                $jenis = "public";
            }

            // 🔥 Simpan log_remote
            $stmt = $this->pdo->prepare("INSERT INTO log_remote 
                (id_setting_mikrotik, nama_user, remote_port, aktif_time, jenis) 
                VALUES (:id_setting_mikrotik, :nama_user, :remote_port, :aktif_time, :jenis)");
            $stmt->execute([
                ':id_setting_mikrotik' => $id_mikrotik,
                ':nama_user'             => $nama_user,
                ':remote_port'         => $freePort,
                ':aktif_time'          => date('Y-m-d H:i:s'),
                ':jenis'               => $jenis
            ]);

            return json_encode([
                "status"       => "success",
                "message"      => "Remote berhasil ditambahkan.",
                "remote_port"  => $freePort,
                "link_remote"  => $mikrotikUser['ip_address'] . ":" . $freePort,
                "jenis"        => $jenis
            ]);

        } catch (Exception $e) {
            return json_encode([
                "status"  => "error",
                "message" => $e->getMessage()
            ]);
        }
    }

    public function remote_close($id_mikrotik, $port)
    {
        $mikrotik = new RouterosAPI();
        $mikrotik->debug = false;

        try {
            // 🔥 Ambil data Mikrotik
            $stmt = $this->pdo->prepare("SELECT ip_address, username, password, port_api, radius_nas_data 
                                         FROM setting_mikrotik 
                                         WHERE id = :id");
            $stmt->execute([':id' => $id_mikrotik]);
            $mikrotikUser = $stmt->fetch(PDO::FETCH_ASSOC);

            if (!$mikrotikUser) {
                return json_encode([
                    "status" => "error",
                    "message" => "Mikrotik dengan ID $id_mikrotik tidak ditemukan."
                ]);
            }

            $dataIP = json_decode($mikrotikUser['radius_nas_data']);
            $iptunnel = $dataIP->data->{'remote-address'} ?? null;

            if ($mikrotikUser['ip_address'] === "tunnel.manjapro.net" && !empty($iptunnel)) {
                // 🔥 Hapus di Mikrotik pusat
                if ($mikrotik->connect2('manjapro.net', 'apiapkmanjapro', 'apiapkmanjapro123321', 2887)) {
                    $this->removeNatRule($mikrotik, $port);
                    $mikrotik->disconnect();
                }

                // 🔥 Hapus di Mikrotik remote
                if ($mikrotik->connect2($mikrotikUser['ip_address'], $mikrotikUser['username'], $mikrotikUser['password'], $mikrotikUser['port_api'])) {
                    $this->removeNatRule($mikrotik, $port);
                    $mikrotik->disconnect();
                }
            } else {
                // 🔥 Hapus di Mikrotik langsung
                if ($mikrotik->connect2($mikrotikUser['ip_address'], $mikrotikUser['username'], $mikrotikUser['password'], $mikrotikUser['port_api'])) {
                    $this->removeNatRule($mikrotik, $port);
                    $mikrotik->disconnect();
                }
            }

            // 🔥 Hapus log_remote
            $stmt = $this->pdo->prepare("DELETE FROM log_remote 
                                         WHERE id_setting_mikrotik = :id AND remote_port = :port");
            $stmt->execute([
                ':id'   => $id_mikrotik,
                ':port' => $port
            ]);

            return json_encode([
                "status"  => "success",
                "message" => "Remote pada port $port berhasil ditutup."
            ]);

        } catch (Exception $e) {
            return json_encode([
                "status"  => "error",
                "message" => $e->getMessage()
            ]);
        }
    }

    private function removeNatRule($mikrotik, $port)
    {
        // 🔥 Cari dan hapus NAT rule berdasarkan dst-port
        $natRules = $mikrotik->comm('/ip/firewall/nat/print');
        foreach ($natRules as $rule) {
            if (isset($rule['dst-port']) && $rule['dst-port'] == $port) {
                $mikrotik->comm('/ip/firewall/nat/remove', ['.id' => $rule['.id']]);
            }
        }
    }
}