<?php
function auth_user_record(): ?array
{
    $sessionUser = auth_user();
    if (!$sessionUser || empty($sessionUser['id'])) return null;

    $pdo = crm_pdo();
    $stmt = $pdo->prepare("
        SELECT id, username, email, role, employee_id, external_partner_id, customer_id, is_active
        FROM users
        WHERE id = :id
        LIMIT 1
    ");
    $stmt->execute([':id' => (int)$sessionUser['id']]);
    $user = $stmt->fetch();
    if (!$user || (int)($user['is_active'] ?? 0) !== 1) return null;
    return $user;
}

function auth_role_normalized(): string
{
    $u = auth_user_record();
    return $u ? strtolower(trim((string)($u['role'] ?? ''))) : '';
}

function auth_is_admin_like(): bool
{
    return in_array(auth_role_normalized(), ['admin', 'administrator', 'super_admin', 'owner', 'manager'], true);
}

function auth_is_secretary_like(): bool
{
    return in_array(auth_role_normalized(), ['secretary', 'secretariat', 'office'], true);
}

function auth_is_employee(): bool { return auth_role_normalized() === 'employee'; }
function auth_is_partner(): bool { return auth_role_normalized() === 'partner'; }
function auth_is_customer(): bool { return auth_role_normalized() === 'customer'; }

function auth_employee_id(): int
{
    $u = auth_user_record();
    if (!$u) return 0;

    if (auth_is_admin_like()) {
        $forced = (int)($_GET['employee_id'] ?? $_POST['employee_id'] ?? 0);
        return $forced > 0 ? $forced : 0;
    }

    return auth_is_employee() ? (int)($u['employee_id'] ?? 0) : 0;
}

function auth_partner_id(): int
{
    $u = auth_user_record();
    if (!$u) return 0;

    if (auth_is_admin_like()) {
        $forced = (int)($_GET['partner_id'] ?? $_POST['partner_id'] ?? 0);
        return $forced > 0 ? $forced : 0;
    }

    return auth_is_partner() ? (int)($u['external_partner_id'] ?? 0) : 0;
}

function auth_customer_id(): int
{
    $u = auth_user_record();
    if (!$u) return 0;

    if (auth_is_admin_like()) {
        $forced = (int)($_GET['customer_id'] ?? $_POST['customer_id'] ?? 0);
        return $forced > 0 ? $forced : 0;
    }

    return auth_is_customer() ? (int)($u['customer_id'] ?? 0) : 0;
}

function auth_require_employee_portal(): void
{
    if (auth_is_admin_like()) return;
    $u = auth_user_record();
    if (!$u || !auth_is_employee() || (int)($u['employee_id'] ?? 0) <= 0) {
        http_response_code(403);
        exit('Employee portal access denied.');
    }
}

function auth_require_partner_portal(): void
{
    if (auth_is_admin_like()) return;
    $u = auth_user_record();
    if (!$u || !auth_is_partner() || (int)($u['external_partner_id'] ?? 0) <= 0) {
        http_response_code(403);
        exit('Partner portal access denied.');
    }
}

function auth_require_customer_portal(): void
{
    if (auth_is_admin_like()) return;
    $u = auth_user_record();
    if (!$u || !auth_is_customer() || (int)($u['customer_id'] ?? 0) <= 0) {
        http_response_code(403);
        exit('Customer portal access denied.');
    }
}
