<?php
declare(strict_types=1);
require_once __DIR__ . '/../src/bootstrap.php';
require_once __DIR__ . '/../src/layout.php';
require_once __DIR__ . '/../src/account_security_audit.php';
require_once __DIR__ . '/../src/registration.php';

require_logged_out('You are already logged in.');

$err = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();

    $result = registration_create_account($_POST);

    if (!($result['ok'] ?? false)) {
        $err = (string)($result['message'] ?? 'Registration failed.');
    } else {
        $_SESSION['account_id_hex'] = (string)$result['account_id_hex'];
        $_SESSION['username'] = (string)$result['username'];
        ensure_default_system_admin_for_account((string)$result['account_id_hex'], (string)$result['username']);

        $ip = $_SERVER['HTTP_CF_CONNECTING_IP']
            ?? $_SERVER['HTTP_X_FORWARDED_FOR']
            ?? $_SERVER['REMOTE_ADDR']
            ?? null;

        $upd = system_pdo()->prepare("
            UPDATE accounts
            SET last_login_at=NOW(), last_login_ip=:ip, failed_login_count=0
            WHERE id=UNHEX(:hex)
        ");
        $upd->execute([':ip' => $ip, ':hex' => (string)$result['account_id_hex']]);

        account_security_audit_session_created((string)$result['account_id_hex'], null, ['reason' => 'registration']);
        flash_add('success', 'Account created and logged in.');
        flash_add('info', 'Verify your email address before using it for password reset links.');
        redirect('/');
    }
}

page_header('Register');
?>
<div class="card">
  <h2>Register</h2>
  <p class="muted">
    Create a master FRSuite account.
    <strong>At least one email is required</strong> (work or personal). Phone numbers are optional.
    You can log in immediately, but you must be added to an agency to access agency features.
  </p>

  <?php if ($err): ?><p class="err"><?= e($err) ?></p><?php endif; ?>

  <form method="post" autocomplete="off">
    <input type="hidden" name="csrf" value="<?= e(csrf_token()) ?>">

    <label>Username (required)</label>
    <input name="username" value="<?= e($_POST['username'] ?? '') ?>" required>

    <div class="row">
      <div>
        <label>Work Email (optional)</label>
        <input name="email_work" type="email" value="<?= e($_POST['email_work'] ?? '') ?>">
      </div>
      <div>
        <label>Personal Email (optional)</label>
        <input name="email_personal" type="email" value="<?= e($_POST['email_personal'] ?? '') ?>">
      </div>
    </div>

    <div class="row">
      <div>
        <label>Work Phone (optional)</label>
        <input name="phone_work" value="<?= e($_POST['phone_work'] ?? '') ?>">
      </div>
      <div>
        <label>Personal Phone (optional)</label>
        <input name="phone_personal" value="<?= e($_POST['phone_personal'] ?? '') ?>">
      </div>
    </div>

    <div class="row">
      <div>
        <label>Agency Name (optional)</label>
        <input name="agency_name" value="<?= e($_POST['agency_name'] ?? '') ?>" maxlength="150">
      </div>
      <div>
        <label>Agency State (optional)</label>
        <?php $selectedAgencyState = strtoupper(trim((string)($_POST['agency_state'] ?? ''))); ?>
        <select name="agency_state">
          <option value="">Select a state</option>
          <?php foreach (registration_agency_state_options() as $stateCode => $stateName): ?>
            <option value="<?= e($stateCode) ?>" <?= $selectedAgencyState === $stateCode ? 'selected' : '' ?>><?= e($stateName) ?></option>
          <?php endforeach; ?>
        </select>
      </div>
    </div>

    <label>Password (required)</label>
    <input name="password" type="password" required>

    <div style="margin-top:14px">
      <button type="submit">Create Account</button>
      <span class="muted">·</span>
      <a href="/login.php">Already have an account?</a>
    </div>
  </form>
</div>
<?php page_footer(); ?>
