<?php
/**
 * AUTHENTICATION MIDDLEWARE
 * =========================
 * 
 * DESKRIPSI:
 * ==========
 * Middleware untuk validasi authentication pada API endpoints.
 * Mendukung dua metode authentication:
 * 1. Session-based (untuk web interface)
 * 2. Token-based (untuk API calls)
 * 
 * FLOW AUTHENTICATION:
 * ====================
 * 1. Cek session terlebih dahulu (jika ada)
 * 2. Jika tidak ada session, cek Authorization header
 * 3. Validate token dari database
 * 4. Return username jika valid, atau 401 jika tidak
 * 
 * AUTHOR: Rodhi
 * DATE: 2026-01-19
 */

require_once __DIR__.'/token.php';

/**
 * Fungsi untuk validasi authentication - UNIVERSAL LEGACY COMPATIBLE
 * 
 * Mendukung multiple authentication methods:
 * 1. Session-based (untuk web interface)
 * 2. Query parameter ?auth_token=xxx (UNIVERSAL - works on all servers)
 * 3. POST data auth_token (untuk form submissions)
 * 4. Authorization header (jika server support)
 * 5. Custom headers (backup)
 * 
 * RETURN:
 * =======
 * @return string Username jika authentication berhasil
 * 
 * EXIT:
 * =====
 * Function akan exit dengan 401 jika authentication gagal
 */
function authRequired() {
    // Start session jika belum dimulai
    if (session_status() == PHP_SESSION_NONE) {
        session_start();
    }

    // Debug: Log authentication attempt
    // error_log("Authentication check started - Universal Legacy Mode");

    // 1️⃣ SESSION AUTHENTICATION (highest priority)
    if (!empty($_SESSION['username'])) {
        // error_log("Authentication via session successful: " . $_SESSION['username']);
        return $_SESSION['username'];
    }

    // 2️⃣ QUERY PARAMETER AUTHENTICATION (most universal)
    $token = null;
    $authMethod = 'none';
    
    if (isset($_GET['auth_token']) && !empty($_GET['auth_token'])) {
        $token = $_GET['auth_token'];
        $authMethod = 'query_parameter';
    }
    
    // 3️⃣ POST DATA AUTHENTICATION (for form submissions)
    elseif (isset($_POST['auth_token']) && !empty($_POST['auth_token'])) {
        $token = $_POST['auth_token'];
        $authMethod = 'post_data';
    }
    
    // 4️⃣ REQUEST BODY AUTHENTICATION (for JSON APIs)
    elseif ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'PUT') {
        $rawInput = file_get_contents('php://input');
        if ($rawInput) {
            $data = json_decode($rawInput, true);
            if (isset($data['auth_token']) && !empty($data['auth_token'])) {
                $token = $data['auth_token'];
                $authMethod = 'request_body';
            }
        }
    }
    
    // 5️⃣ AUTHORIZATION HEADER (if server supports)
    if (!$token) {
        $headers = function_exists('getallheaders') ? getallheaders() : array();
        
        // Try Authorization header
        if (!empty($headers['Authorization'])) {
            if (preg_match('/Bearer\s(\S+)/', $headers['Authorization'], $m)) {
                $token = $m[1];
                $authMethod = 'authorization_header';
            }
        }
        // Try custom header
        elseif (!empty($headers['X-Auth-Token'])) {
            $token = $headers['X-Auth-Token'];
            $authMethod = 'custom_header';
        }
        // Try $_SERVER variables
        elseif (isset($_SERVER['HTTP_AUTHORIZATION'])) {
            if (preg_match('/Bearer\s(\S+)/', $_SERVER['HTTP_AUTHORIZATION'], $m)) {
                $token = $m[1];
                $authMethod = 'server_authorization';
            }
        }
        elseif (isset($_SERVER['HTTP_X_AUTH_TOKEN'])) {
            $token = $_SERVER['HTTP_X_AUTH_TOKEN'];
            $authMethod = 'server_custom_header';
        }
    }

    // Debug: Log token extraction
    // error_log("Token extraction - Method: $authMethod, Token: " . ($token ? substr($token, 0, 16) . "..." : "NOT_FOUND"));

    // 6️⃣ VALIDATE TOKEN
    if ($token) {
        $user = getUserByToken($token);
        if ($user) {
            // Debug: Log token authentication success
            // error_log("Authentication via $authMethod successful: " . $user['username']);
            
            // Set session untuk consistency
            $_SESSION['username'] = $user['username'];
            
            return $user['username'];
        } else {
            // Debug: Log token validation failure
            // error_log("Token validation failed - Method: $authMethod, Token: " . substr($token, 0, 16) . "...");
        }
    }

    // Authentication failed
    // error_log("Authentication failed - no valid session, token, or header found");
    
    http_response_code(401);
    echo json_encode([
        'error' => 'Unauthorized',
        'debug' => [
            'session_exists' => !empty($_SESSION['username']),
            'token_method_tried' => $authMethod,
            'token_found' => $token ? true : false
        ]
    ]);
    exit;
}