<?php
require_once __DIR__ . '/../base_api.php';

class AuthAPI extends BaseAPI {
    public function __construct() {
        // 登录操作不需要检查用户是否登录，所以这里不调用父类的 __construct 方法
    }
    
    public function login($user, $pass, $code) {
        global $conf, $_SESSION, $DB;
        
        if ($conf['yzme'] === true && $code != $_SESSION['authcode']) {
            unset($_SESSION['authcode']);
            $this->error('验证码错误');
        }
        
        $user_escaped = $DB->escape($user);
        $zj = $DB->get_row("SELECT * FROM `zj` WHERE `user`='{$user_escaped}'");
        
        if (!$zj) {
            unset($_SESSION['authcode']);
            $this->error('用户不存在');
        }
        
        if ($pass != $zj['pass']) {
            unset($_SESSION['authcode']);
            $this->error('密码错误');
        }
        
        if ($conf['kzmbqk'] != 'true') {
            $this->error('控制面板已关闭');
        }
        
        if ($zj['zt'] == '已过期') {
            $this->error('主机已过期');
        }
        
        if ($zj['zt'] == '已禁用') {
            $this->error('主机已被禁用');
        }
        
        if ($zj['zt'] == '已暂停') {
            $this->error('主机已被暂停');
        }
        
        unset($_SESSION['authcode']);
        global $password_hash;
        $session = md5($user . $zj['pass'] . $password_hash);
        $token = authcode("{$user}\t{$session}", 'ENCODE', SYS_KEY);
        // 清理可能存在的历史路径cookie，避免读取到旧用户
        setcookie("user_token", "", time() - 3600, "/");
        setcookie("user_token", "", time() - 3600, "/user");
        setcookie("user_token", "", time() - 3600, "/user/");
        setcookie("user_token", $token, time() + 604800, "/");
        
        // 记录登录日志
        if (function_exists('logjl')) {
            logjl($user, '用户登录', '登录成功', true);
        }
        
        // 检查是否需要邮箱验证
        $need_email_verify = false;
        if (isset($conf['login_email_verify']) && $conf['login_email_verify'] == 'true') {
            // 如果用户邮箱为空，则需要验证
            if (empty($zj['email'])) {
                $need_email_verify = true;
            }
        }
        
        $this->success(array('code' => '登录成功', 'msg' => '登录成功', 'need_email_verify' => $need_email_verify));
    }
    
    public function logout() {
        setcookie("user_token", "", time() - 604800, "/");
        setcookie("user_token", "", time() - 604800, "/user");
        setcookie("user_token", "", time() - 604800, "/user/");
        if(isset($_SESSION['user_token'])) unset($_SESSION['user_token']);
        session_destroy();
        
        // 记录登出日志
        if (function_exists('logjl')) {
            logjl('', '用户登出', '退出登录', true);
        }
        
        header('Location: /user/login.php?logout=1');
        exit;
    }
    
    public function changePassword($oldpass, $newpass) {
        // 修改密码操作需要检查用户是否登录，所以这里调用父类的 __construct 方法
        parent::__construct();
        
        if ($oldpass != $this->user['pass']) {
            $this->error('原密码错误');
        }
        
        $GLOBALS['DB']->query("UPDATE `zj` SET `pass`='{$newpass}' WHERE `id`='{$this->user['id']}'");
        $this->log('修改密码', '修改密码');
        $this->success(array('msg' => '修改成功'));
    }
}
?>
