<?php
    ini_set('display_errors', 0);
    ini_set('display_startup_errors', 0);
    // error_reporting(E_ALL);
    
    require_once("db_konnect.php");
    include("functions.php");
    

    $api_key_internal = md5("sms#briatek#security_###");// this is the key to compare with the incoming API key
    $api_key_external = $_POST['api_key'];
    
   
    //AUTHENTICATE USER FOR LOGIN
    if ($_POST['api_key'] !="" and $_POST['action']=="auth" ){

        $staffUsername = $_POST['username'];
        $staffPassword = $_POST['password'];
        $api_key_external = $_POST['api_key'];

    
        $staffStatus = "1";
    
        if ($api_key_external == $api_key_internal) {

    
            if (!empty($staffUsername) and !empty($staffPassword)) {
    
                $checkLogin = $conn->prepare("SELECT * FROM staff_tbl WHERE staff_tbl.staff_no=? AND staff_tbl.staff_pass=? AND  staff_status=? ");
    
                $checkLogin->bindParam(1, $staffUsername);
                $checkLogin->bindParam(2, $staffPassword);
                $checkLogin->bindParam(3, $staffStatus);
    
                $checkLogin->execute();

                if ($checkLogin->rowCount() == 1) {
    
                    echo json_encode(array("status" => "ok", "validity" => true));
                } else {
                    echo json_encode(array("status" => "ok", "validity" => false));
                }
            } 
            else {
                echo json_encode(array("status" => "empty", "validity" => "empty"));
            }
        } 
        else {
            echo json_encode(array("status" => "invalid_key","validity" => false));
        }
    } 
    else{
        header("Location:/gsu.edu.ng");
    }
    
    //SAVE STAFF RECORD TO DB
    if ( $_POST['action']=="save" and $_POST['api_key'] !=""  ){
        // echo json_encode(array("status".$_POST['action'] => "no_key"));
        $api_key_external = $_POST['api_key'];

        $staffid = $_POST['staffid'];
        $staffname = $_POST['staffname'];
        $gender = $_POST['gender'];
        $phone = $_POST['phone'];
        $email = $_POST['email'];
        $deptCode = $_POST['deptCode'];
        $api_key = $_POST['api_key'];
        $createdBy = $_POST['adminId'];
        if ($api_key_external == $api_key_internal) {

            $addToLogin = $conn->prepare("INSERT IGNORE INTO staff_tbl (staff_no,staff_surname,staff_otherNames, staff_sex, staff_phone,staff_email,staff_dept_code, staff_pass,created_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?,?)");
            $checkSave = $addToLogin->execute(array($staffid,"",$staffname,$gender,$phone,$email,$deptCode,"@0@01@f",$createdBy));
            if ($checkSave) {
        
                $response = sendEmail($email, "GOMBE STATE UNIVERSITY", "GSU", "gsu");
                echo json_encode(array("status" => "ok", "msg" => "User Added successfully"));
            } 
            else {
                echo json_encode(array("status" => "fail", "msg" => "An error occured while saving the staff record unto the portal"));
            } 
        }
        else {
            echo json_encode(array("status" => "fail","msg" => "Invalid key"));
        }
    } 
    else{
        header("Location:/gsu.edu.ng");
    }

?>
