<?php
session_start();

header('Content-Type: application/json; charset=utf-8');

$user = $_SESSION['user'] ?? null;
if (!is_array($user) || empty($user['id'])) {
    echo json_encode(['error' => 'No autorizado.']);
    exit;
}

$token = $_SESSION['node_token'] ?? '';
if (!is_string($token) || trim($token) === '') {
    echo json_encode(['error' => 'Token de sesión no disponible. Vuelva a iniciar sesión.']);
    exit;
}

$nodeApiBase = getenv('COMPRANET_NODE_API_BASE');
if (!$nodeApiBase) {
    $nodeApiBase = 'https://app.compranet.com.co';
}

function cpn_node_request(string $method, string $url, string $token, ?array $payload = null): array
{
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
    $headers = [
        'Content-Type: application/json',
        'Authorization: Bearer ' . $token,
    ];
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
    curl_setopt($ch, CURLOPT_TIMEOUT, 20);

    if ($payload !== null) {
        $json = json_encode($payload);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $json);
    }

    $resp = curl_exec($ch);
    $err = curl_error($ch);
    $http = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($resp === false) {
        return ['ok' => false, 'error' => ['message' => 'Error conectando a Node: ' . ($err ?: 'desconocido')], '_http' => $http];
    }

    $data = json_decode($resp, true);
    if (!is_array($data)) {
        $snippet = substr((string)$resp, 0, 500);
        return ['ok' => false, 'error' => ['message' => 'Respuesta inválida de Node', 'raw' => $snippet], '_http' => $http];
    }
    $data['_http'] = $http;
    return $data;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(['error' => 'Método no permitido.']);
    exit;
}

$payload = [
    'nombre' => trim($_POST['nombre'] ?? ''),
    'apellido' => trim($_POST['apellido'] ?? ''),
];

$currentPassword = (string)($_POST['currentPassword'] ?? '');
$newPassword = (string)($_POST['newPassword'] ?? '');

if ($currentPassword !== '' || $newPassword !== '') {
    $payload['currentPassword'] = $currentPassword;
    $payload['newPassword'] = $newPassword;
}

$url = rtrim($nodeApiBase, '/') . '/api/auth/me';
$r = cpn_node_request('PATCH', $url, $token, $payload);

if (!isset($r['ok']) || $r['ok'] !== true) {
    $msg = $r['error']['message'] ?? 'Error actualizando perfil.';
    $details = $r['error']['details'] ?? ($r['error']['raw'] ?? null);
    echo json_encode(['error' => $msg, 'details' => $details, 'http' => $r['_http'] ?? null]);
    exit;
}

$data = $r['data'] ?? null;
if (is_array($data)) {
    // Mantener token/rol/isSuper desde sesión; actualizar nombre/apellido
    $_SESSION['user']['nombre'] = $data['nombre'] ?? ($_SESSION['user']['nombre'] ?? '');
    $_SESSION['user']['apellido'] = $data['apellido'] ?? ($_SESSION['user']['apellido'] ?? '');
}

echo json_encode(['data' => $data]);