<?php 
	// EditUserPhoto.php - FINAL WORKING VERSION
	include "../../conn.php";
	include "../../functions2.php";
	
	header('Content-Type: application/json; charset=utf-8');
	header('Access-Control-Allow-Origin: *');
	header('Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization');
	
	date_default_timezone_set("Asia/Kolkata");
	
	$res = [
		'code' => 11,
		'msg' => 'Method not allowed',
		'msgCode' => 12
	];
	
	$shonubody = file_get_contents("php://input");
	$shonupost = json_decode($shonubody, true);
	
	// Allow POST and GET
	if ($_SERVER['REQUEST_METHOD'] == 'POST' || $_SERVER['REQUEST_METHOD'] == 'GET') {
		
		// Check parameters
		if (isset($shonupost['language']) && isset($shonupost['random']) && isset($shonupost['signature']) && isset($shonupost['userPhoto'])) {
			
			$language = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['language']));
			$random = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['random']));
			$signature = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['signature']));
			$userPhoto = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['userPhoto']));
			
			// 1. Signature Verify
			// Frontend se ye string banti hai: {"language":0,"random":"...","userPhoto":"5"}
			$shonustr = '{"language":'.$language.',"random":"'.$random.'","userPhoto":"'.$userPhoto.'"}';
			$shonusign = strtoupper(md5($shonustr));
			
			// Agar signature match kare (Security Check)
			if($shonusign == $signature){
				
				// 2. Token Check
				$headers = getallheaders();
				$authHeader = isset($headers['Authorization']) ? $headers['Authorization'] : (isset($headers['authorization']) ? $headers['authorization'] : '');
				
				if(!empty($authHeader)){
					$bearer = explode(" ", $authHeader);
					$author = $bearer[1];				
					$is_jwt_valid = is_jwt_valid($author);
					$data_auth = json_decode($is_jwt_valid, 1);
					
					if(isset($data_auth['status']) && $data_auth['status'] === 'Success') {
						$userId = $data_auth['payload']['id'];
						
						// =================================================
						// 🔥 MAIN UPDATE QUERY (Ye 'avatar' column me save karega)
						// =================================================
						$updateQ = "UPDATE shonu_subjects SET avatar = '$userPhoto' WHERE id = '$userId'";
						
						if ($conn->query($updateQ) === TRUE) {
							$res['code'] = 0;
							$res['msg'] = 'Succeed';
							$res['msgCode'] = 0;
							http_response_code(200);
						} else {
							$res['code'] = 1;
							$res['msg'] = 'Database Update Failed';
							$res['msgCode'] = 1;
						}
						echo json_encode($res);	
					}
					else{
						$res['code'] = 4;
						$res['msg'] = 'Invalid Token';
						$res['msgCode'] = 2;
						http_response_code(401);
						echo json_encode($res);					
					}
				} else {
					$res['code'] = 4;
					$res['msg'] = 'Token Missing';
					$res['msgCode'] = 2;
					echo json_encode($res);
				}
			}
			else{
				$res['code'] = 5;
				$res['msg'] = 'Wrong signature';
				$res['msgCode'] = 3;
				echo json_encode($res);				
			}
		}
		else{
			$res['code'] = 7;
			$res['msg'] = 'Param is Invalid';
			$res['msgCode'] = 6;
			echo json_encode($res);			
		}		
	} else {		
		http_response_code(405);
		echo json_encode($res);
	}
?>