<?php
// Connexion au jeu "Presse-Citron" (easter egg). Comptes totalement séparés
// des comptes admin du portfolio (table lemon_players).

require_once(__DIR__ . '/../functions/security.php');
require_once('../functions/databaseConnection.php');

header('Content-Type: application/json; charset=utf-8');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Méthode non autorisée.']);
    exit;
}

requireCsrfToken();

$username = trim($_POST['username'] ?? '');
$password = $_POST['password'] ?? '';

try {
    $stmt = $dbh->prepare('
        SELECT id, username, password, score, lifetime_score, prestige_level, prestige_bonus, game_state
        FROM lemon_players WHERE username = :username LIMIT 1
    ');
    $stmt->execute([':username' => $username]);
    $player = $stmt->fetch(PDO::FETCH_ASSOC);
} catch (PDOException $e) {
    http_response_code(500);
    echo json_encode(['error' => 'Erreur serveur.']);
    exit;
}

if (!$player || !password_verify($password, $player['password'])) {
    http_response_code(401);
    echo json_encode(['error' => 'Nom de pressier ou mot de passe incorrect.']);
    exit;
}

// Régénère l'ID de session à la connexion : évite la fixation de session
session_regenerate_id(true);
$_SESSION['lemon_player_id'] = (int) $player['id'];
$_SESSION['lemon_username'] = $player['username'];

try {
    $stmt = $dbh->prepare('UPDATE lemon_players SET last_played = NOW() WHERE id = :id');
    $stmt->execute([':id' => $player['id']]);
} catch (PDOException $e) {
    // Pas bloquant : la connexion reste valable même si cette mise à jour échoue
}

echo json_encode([
    'ok' => true,
    'id' => (int) $player['id'],
    'username' => $player['username'],
    'score' => (float) $player['score'],
    'lifetime_score' => (float) $player['lifetime_score'],
    'prestige_level' => (int) $player['prestige_level'],
    'prestige_bonus' => (float) $player['prestige_bonus'],
    'game_state' => $player['game_state'],
]);