<?php
class User
{
    private $conn;
    private $table_name = "users";

    public $id;
    public $name;
    public $phone;
    public $email;
    public $password;
    public $role;
    public $fcm_token;
    public $push_enabled;
    public $profile_photo;
    public $created_at;

    public function __construct($db)
    {
        $this->conn = $db;
    }

    public function create()
    {
        $query = "INSERT INTO " . $this->table_name . " SET name=:name, phone=:phone, email=:email, password=:password, role=:role, fcm_token=:fcm_token, push_enabled=:push_enabled, created_at=:created_at";
        $stmt = $this->conn->prepare($query);

        $this->name = htmlspecialchars(strip_tags($this->name));
        $this->phone = $this->phone ? htmlspecialchars(strip_tags($this->phone)) : null;
        $this->email = $this->email ? htmlspecialchars(strip_tags($this->email)) : null;
        $this->password = htmlspecialchars(strip_tags($this->password));
        $this->role = htmlspecialchars(strip_tags($this->role ?? 'guest'));
        $this->fcm_token = $this->fcm_token ? htmlspecialchars(strip_tags($this->fcm_token)) : null;
        $this->push_enabled = $this->push_enabled ?? 1;
        $this->created_at = date('Y-m-d H:i:s');

        $stmt->bindParam(":name", $this->name);
        $stmt->bindParam(":phone", $this->phone);
        $stmt->bindParam(":email", $this->email);
        $stmt->bindParam(":password", $this->password);
        $stmt->bindParam(":role", $this->role);
        $stmt->bindParam(":fcm_token", $this->fcm_token);
        $stmt->bindParam(":push_enabled", $this->push_enabled);
        $stmt->bindParam(":created_at", $this->created_at);

        if ($stmt->execute()) {
            $this->id = $this->conn->lastInsertId();
            return true;
        }
        return false;
    }

    public function emailExists()
    {
        if (!$this->email)
            return false;
        $query = "SELECT id, name, password, role, phone FROM " . $this->table_name . " WHERE email = ? LIMIT 0,1";
        $stmt = $this->conn->prepare($query);
        $this->email = htmlspecialchars(strip_tags($this->email));
        $stmt->bindParam(1, $this->email);
        $stmt->execute();
        $num = $stmt->rowCount();

        if ($num > 0) {
            $row = $stmt->fetch(PDO::FETCH_ASSOC);
            $this->id = $row['id'];
            $this->name = $row['name'];
            $this->password = $row['password'];
            $this->role = $row['role'];
            $this->phone = $row['phone'];
            return true;
        }
        return false;
    }

    public function phoneExists()
    {
        if (!$this->phone)
            return false;
        $query = "SELECT id, name, password, role, email FROM " . $this->table_name . " WHERE phone = ? LIMIT 0,1";
        $stmt = $this->conn->prepare($query);
        $this->phone = htmlspecialchars(strip_tags($this->phone));
        $stmt->bindParam(1, $this->phone);
        $stmt->execute();
        $num = $stmt->rowCount();

        if ($num > 0) {
            $row = $stmt->fetch(PDO::FETCH_ASSOC);
            $this->id = $row['id'];
            $this->name = $row['name'];
            $this->password = $row['password'];
            $this->role = $row['role'];
            $this->email = $row['email'];
            return true;
        }
        return false;
    }

    public function updateRole($user_id, $role)
    {
        $query = "UPDATE " . $this->table_name . " SET role = :role WHERE id = :id";
        $stmt = $this->conn->prepare($query);
        $stmt->bindParam(":role", $role);
        $stmt->bindParam(":id", $user_id);
        return $stmt->execute();
    }

    public function updateFcmToken($user_id, $token)
    {
        $query = "UPDATE " . $this->table_name . " SET fcm_token = :token WHERE id = :id";
        $stmt = $this->conn->prepare($query);
        $stmt->bindParam(":token", $token);
        $stmt->bindParam(":id", $user_id);
        return $stmt->execute();
    }

    public function updatePushEnabled($user_id, $enabled)
    {
        $query = "UPDATE " . $this->table_name . " SET push_enabled = :enabled WHERE id = :id";
        $stmt = $this->conn->prepare($query);
        $stmt->bindParam(":enabled", $enabled, PDO::PARAM_INT);
        $stmt->bindParam(":id", $user_id);
        return $stmt->execute();
    }

    public function updateProfile($user_id, $data)
    {
        $fields = [];
        $params = [':id' => $user_id];

        if (isset($data['name'])) {
            $fields[] = "name = :name";
            $params[':name'] = htmlspecialchars(strip_tags($data['name']));
        }
        if (isset($data['email'])) {
            $fields[] = "email = :email";
            $email = htmlspecialchars(strip_tags($data['email']));
            $params[':email'] = !empty($email) ? $email : null;
        }
        if (isset($data['phone'])) {
            $fields[] = "phone = :phone";
            $phone = htmlspecialchars(strip_tags($data['phone']));
            $params[':phone'] = !empty($phone) ? $phone : null;
        }
        if (isset($data['profile_photo'])) {
            $fields[] = "profile_photo = :profile_photo";
            $params[':profile_photo'] = htmlspecialchars(strip_tags($data['profile_photo']));
        }

        if (empty($fields))
            return true;

        $query = "UPDATE " . $this->table_name . " SET " . implode(", ", $fields) . " WHERE id = :id";
        $stmt = $this->conn->prepare($query);

        foreach ($params as $key => $val) {
            $stmt->bindValue($key, $val);
        }

        return $stmt->execute();
    }
}