<?php
/**
 * Application Settings & Security Configuration
 * Kayal Kalmeen Kadai - Fish Stall Management System
 */

// Prevent direct access
if (!defined('APP_NAME')) {
    define('APP_NAME', 'Kayal Kalmeen Kadai');
}

// Site Configuration
define('SITE_URL', 'https://yourdomain.com');  // UPDATE with your actual domain
define('SITE_NAME', 'Kayal Kalmeen Kadai');
define('SITE_NAME_TAMIL', 'கயல் கல்மீன் கடை');

// Session Configuration
ini_set('session.cookie_httponly', 1);
ini_set('session.use_only_cookies', 1);
ini_set('session.cookie_secure', 1);  // Set to 1 if using HTTPS
ini_set('session.cookie_samesite', 'Strict');

// Session timeout (30 minutes)
define('SESSION_TIMEOUT', 1800);

// Security settings
define('CSRF_TOKEN_NAME', '_csrf_token');
define('CSRF_TOKEN_EXPIRY', 3600); // 1 hour

// Error reporting (disable in production)
error_reporting(E_ALL);
ini_set('display_errors', 0);  // Set to 0 in production
ini_set('log_errors', 1);
ini_set('error_log', __DIR__ . '/../error.log');

// Date and timezone
date_default_timezone_set('Asia/Kolkata');
define('DATE_FORMAT', 'd-m-Y');
define('DATETIME_FORMAT', 'd-m-Y H:i:s');

// Pagination
define('RECORDS_PER_PAGE', 20);

// File upload settings (for future use)
define('MAX_FILE_SIZE', 5242880); // 5MB
define('ALLOWED_FILE_TYPES', ['jpg', 'jpeg', 'png', 'pdf']);

// Start session securely
function startSession() {
    if (session_status() === PHP_SESSION_NONE) {
        session_name('kayal_session');
        session_start();
        
        // Regenerate session ID periodically
        if (!isset($_SESSION['created'])) {
            $_SESSION['created'] = time();
        } else if (time() - $_SESSION['created'] > 1800) {
            session_regenerate_id(true);
            $_SESSION['created'] = time();
        }
        
        // Check session timeout
        if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > SESSION_TIMEOUT)) {
            session_unset();
            session_destroy();
            header('Location: /index.php?timeout=1');
            exit();
        }
        
        $_SESSION['last_activity'] = time();
    }
}

// Generate CSRF token
function generateCSRFToken() {
    if (!isset($_SESSION[CSRF_TOKEN_NAME])) {
        $_SESSION[CSRF_TOKEN_NAME] = bin2hex(random_bytes(32));
        $_SESSION[CSRF_TOKEN_NAME . '_time'] = time();
    }
    return $_SESSION[CSRF_TOKEN_NAME];
}

// Verify CSRF token
function verifyCSRFToken($token) {
    if (!isset($_SESSION[CSRF_TOKEN_NAME]) || !isset($_SESSION[CSRF_TOKEN_NAME . '_time'])) {
        return false;
    }
    
    // Check if token expired
    if (time() - $_SESSION[CSRF_TOKEN_NAME . '_time'] > CSRF_TOKEN_EXPIRY) {
        unset($_SESSION[CSRF_TOKEN_NAME]);
        unset($_SESSION[CSRF_TOKEN_NAME . '_time']);
        return false;
    }
    
    return hash_equals($_SESSION[CSRF_TOKEN_NAME], $token);
}

// Check if user is logged in
function isLoggedIn() {
    return isset($_SESSION['user_id']) && isset($_SESSION['role']);
}

// Check if user has required role
function hasRole($required_role) {
    if (!isLoggedIn()) {
        return false;
    }
    
    $user_role = $_SESSION['role'];
    
    // Admin has access to everything
    if ($user_role === 'admin') {
        return true;
    }
    
    // Check specific role
    if (is_array($required_role)) {
        return in_array($user_role, $required_role);
    }
    
    return $user_role === $required_role;
}

// Require login
function requireLogin() {
    if (!isLoggedIn()) {
        header('Location: /index.php');
        exit();
    }
}

// Require specific role
function requireRole($required_role) {
    requireLogin();
    
    if (!hasRole($required_role)) {
        $_SESSION['error'] = "You don't have permission to access this page.";
        header('Location: /dashboard.php');
        exit();
    }
}

// Sanitize input
function sanitizeInput($data) {
    if (is_array($data)) {
        return array_map('sanitizeInput', $data);
    }
    
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
    return $data;
}

// Validate email
function validateEmail($email) {
    return filter_var($email, FILTER_VALIDATE_EMAIL);
}

// Validate phone number (Indian format)
function validatePhone($phone) {
    $phone = preg_replace('/[^0-9]/', '', $phone);
    return (strlen($phone) === 10) ? $phone : false;
}

// Get user IP address
function getUserIP() {
    $ip = '';
    if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
    } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
    } else {
        $ip = $_SERVER['REMOTE_ADDR'];
    }
    return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : '0.0.0.0';
}

// Get user agent
function getUserAgent() {
    return isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
}

// Format currency
function formatCurrency($amount) {
    return '₹' . number_format($amount, 2);
}

// Format weight
function formatWeight($weight) {
    return number_format($weight, 2) . ' kg';
}

// Format date
function formatDate($date, $format = DATE_FORMAT) {
    return date($format, strtotime($date));
}

// Set flash message
function setFlashMessage($type, $message) {
    $_SESSION['flash_type'] = $type;
    $_SESSION['flash_message'] = $message;
}

// Get and clear flash message
function getFlashMessage() {
    if (isset($_SESSION['flash_message'])) {
        $type = $_SESSION['flash_type'] ?? 'info';
        $message = $_SESSION['flash_message'];
        unset($_SESSION['flash_type']);
        unset($_SESSION['flash_message']);
        return ['type' => $type, 'message' => $message];
    }
    return null;
}

// Rate limiting for login attempts
function checkLoginAttempts($username) {
    $key = 'login_attempts_' . md5($username . getUserIP());
    
    if (!isset($_SESSION[$key])) {
        $_SESSION[$key] = ['count' => 0, 'time' => time()];
    }
    
    $attempts = $_SESSION[$key];
    
    // Reset after 15 minutes
    if (time() - $attempts['time'] > 900) {
        $_SESSION[$key] = ['count' => 0, 'time' => time()];
        return true;
    }
    
    // Block after 5 failed attempts
    if ($attempts['count'] >= 5) {
        return false;
    }
    
    return true;
}

// Increment login attempts
function incrementLoginAttempts($username) {
    $key = 'login_attempts_' . md5($username . getUserIP());
    
    if (!isset($_SESSION[$key])) {
        $_SESSION[$key] = ['count' => 0, 'time' => time()];
    }
    
    $_SESSION[$key]['count']++;
}

// Reset login attempts
function resetLoginAttempts($username) {
    $key = 'login_attempts_' . md5($username . getUserIP());
    unset($_SESSION[$key]);
}

// Prevent clickjacking
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
header('X-XSS-Protection: 1; mode=block');
header('Referrer-Policy: strict-origin-when-cross-origin');

?>