require_once __DIR__ . '/../store/lib/bootstrap.php';
require_once __DIR__ . '/lib/lang.php';
require_once __DIR__ . '/../config.php';

session_start_store();

header("Content-Type: text/html; charset=UTF-8");
$LANG = 'uz';
$pageTitle = 'Auksion — Aura Retail';

$user = null;
$userId = (int)($_SESSION['user_id'] ?? $_SESSION['auction_user_id'] ?? $_SESSION['member_user_id'] ?? 0);
if ($userId > 0) {
    try {
        $stmt = $pdo->prepare("SELECT * FROM users WHERE id = ? AND is_active = 1");
        $stmt->execute([$userId]);
        $user = $stmt->fetch();
        if ($user) {
            $_SESSION['user_id'] = $userId;
            $_SESSION['auction_user_id'] = $userId;
            $_SESSION['member_user_id'] = $userId;
            $_SESSION['user_name'] = (string)($user['name'] ?? 'Foydalanuvchi');
        } else {
            unset($_SESSION['user_id'], $_SESSION['auction_user_id'], $_SESSION['member_user_id'], $_SESSION['user_name']);
        }
    } catch (Throwable $e) {
        $user = null;
    }
}

$notice = '';
$noticeOk = false;

// Logout
if (isset($_GET['logout'])) {
    unset($_SESSION['user_id'], $_SESSION['auction_user_id'], $_SESSION['member_user_id'], $_SESSION['user_name'], $_SESSION['user']);
    header('Location: logout.php?return=web/auction.php');
    exit;
}

// Login form
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['login'])) {
    $phone = trim((string)($_POST['phone'] ?? ''));
    $password = (string)($_POST['password'] ?? '');
    if ($phone === '' || $password === '') {
        $notice = 'Telefon raqam va parolni kiriting';
    } else {
        try {
            $stmt = $pdo->prepare("SELECT * FROM users WHERE phone = ? AND is_active = 1 LIMIT 1");
            $stmt->execute([$phone]);
            $u = $stmt->fetch();
            if ($u && password_verify($password, (string)$u['password'])) {
                session_regenerate_id(true);
                $_SESSION['auction_user_id'] = (int)$u['id'];
                header('Location: auction.php');
                exit;
            } else {
                $notice = "Noto'g'ri telefon raqam yoki parol";
            }
        } catch (Throwable $e) {
            $notice = 'Xatolik yuz berdi. Iltimos, keyinroq qayta urinib ko\'ring.';
        }
    }
}

// Purchase
if ($user && $_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['purchase'])) {
    $username = trim((string)($_POST['username'] ?? ''));
    $storeId = (int)($_POST['store_id'] ?? 0);

    try {
        $data = ['owner_user_id' => $user['id'], 'store_id' => $storeId, 'username' => $username];
        $context = stream_context_create(['http' => [
            'method' => 'POST',
            'header' => "Content-Type: application/json\r\n",
            'content' => json_encode($data),
            'timeout' => 20,
        ]]);
        $base = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' ? 'https' : 'http') . '://' . ($_SERVER['HTTP_HOST'] ?? 'ar.hyperteo.uz');
        $resp = @file_get_contents($base . '/api/auction.php?action=purchase', false, $context);
        $res = $resp ? json_decode($resp, true) : null;
        if ($res && $res['success']) {
            $notice = $res['message'];
            $noticeOk = true;
            $newKey = $res['data']['key_code'] ?? '';
        } else {
            $notice = $res['message'] ?? 'Server javob bermadi';
        }
    } catch (Throwable $e) {
        $notice = 'Xatolik: ' . $e->getMessage();
    }
}

// Load rules (public — narxlar hammaga ko'rinadi) + stores
$rules = [];
$stores = [];
$myKeys = [];
$myUsernames = [];
try {
    $stmt = $pdo->prepare("SELECT name_length, price FROM nft_price_rules WHERE kind = 'auction' ORDER BY name_length DESC");
    $stmt->execute();
    $rules = $stmt->fetchAll();
} catch (Throwable $e) {
    $rules = [];
}
if ($user) {
    try {
        $stmt = $pdo->prepare("SELECT id, store_name FROM stores WHERE owner_id = ? ORDER BY store_name");
        $stmt->execute([$user['id']]);
        $stores = $stmt->fetchAll();

        $stmt = $pdo->prepare("SELECT k.key_code, k.price, k.status, n.username, s.store_name
            FROM nft_keys k
            JOIN nft_usernames n ON n.id = k.username_id
            LEFT JOIN stores s ON s.id = k.buyer_store_id
            WHERE k.buyer_user_id = ? ORDER BY k.created_at DESC");
        $stmt->execute([$user['id']]);
        $myKeys = $stmt->fetchAll();

        $stmt = $pdo->prepare("SELECT su.username, su.kind, s.store_name
            FROM store_usernames su JOIN stores s ON s.id = su.store_id
            WHERE s.owner_id = ? ORDER BY su.created_at DESC");
        $stmt->execute([$user['id']]);
        $myUsernames = $stmt->fetchAll();
    } catch (Throwable $e) {
        $notice = 'Ma\'lumotlarni yuklashda xatolik: ' . $e->getMessage();
    }
}
?>