<?php
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');
require_once __DIR__ . '/../includes/auth.php';
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { exit(0); }
$request = explode('/', trim($_SERVER['PATH_INFO'] ?? '', '/')); $endpoint = $request[0] ?? '';
switch ($endpoint) {
case 'login': handleLogin(); break;
case 'register': handleRegister(); break;
case 'logout': handleLogout(); break;
case 'profile': handleProfile(); break;
default: http_response_code(404); echo json_encode(['error' => 'Endpoint not found']); break; }
function handleLogin(){ if($_SERVER['REQUEST_METHOD']!=='POST'){ http_response_code(405); echo json_encode(['error'=>'Method not allowed']); return; } $input=json_decode(file_get_contents('php://input'), true); if(!$input || !isset($input['email']) || !isset($input['password'])){ http_response_code(400); echo json_encode(['error'=>'Email and password are required']); return; } $conn=getDBConnection(); $stmt=$conn->prepare('SELECT id,name,email,password,user_type,account_status FROM users WHERE email = ?'); $stmt->bind_param('s', $input['email']); $stmt->execute(); $result=$stmt->get_result(); if($result->num_rows===1){ $user=$result->fetch_assoc(); if(($user['account_status'] ?? 'active') !== 'active'){ http_response_code(403); echo json_encode(['error'=>'This account is inactive']); } elseif(password_verify($input['password'], $user['password'])){ $_SESSION['user_id']=$user['id']; $_SESSION['user_name']=$user['name']; $_SESSION['user_type']=$user['user_type']; $_SESSION['account_status']=$user['account_status']; echo json_encode(['success'=>true,'message'=>'Login successful','user'=>['id'=>$user['id'],'name'=>$user['name'],'email'=>$user['email'],'user_type'=>$user['user_type'],'account_status'=>$user['account_status']]]); } else { http_response_code(401); echo json_encode(['error'=>'Invalid password']); } } else { http_response_code(401); echo json_encode(['error'=>'User not found']); } $stmt->close(); $conn->close(); }
function handleRegister(){ if($_SERVER['REQUEST_METHOD']!=='POST'){ http_response_code(405); echo json_encode(['error'=>'Method not allowed']); return; } $input=json_decode(file_get_contents('php://input'), true); if(!$input || !isset($input['name']) || !isset($input['email']) || !isset($input['password'])){ http_response_code(400); echo json_encode(['error'=>'Name, email, and password are required']); return; } $name=trim($input['name']); $email=trim($input['email']); $phone=trim($input['phone'] ?? ''); $password=$input['password']; $user_type=$input['user_type'] ?? 'family'; if(!in_array($user_type, ['resident','family','staff'], true)) $user_type='family'; if(strlen($password)<6){ http_response_code(400); echo json_encode(['error'=>'Password must be at least 6 characters long']); return; } $conn=getDBConnection(); $stmt=$conn->prepare('SELECT id FROM users WHERE email = ?'); $stmt->bind_param('s', $email); $stmt->execute(); if($stmt->get_result()->num_rows>0){ http_response_code(409); echo json_encode(['error'=>'Email already registered']); $stmt->close(); $conn->close(); return; } $stmt->close(); $hashed=password_hash($password, PASSWORD_DEFAULT); $status='active'; $stmt=$conn->prepare('INSERT INTO users (name,email,phone,password,user_type,account_status) VALUES (?,?,?,?,?,?)'); $stmt->bind_param('ssssss', $name, $email, $phone, $hashed, $user_type, $status); if($stmt->execute()){ $_SESSION['user_id']=$conn->insert_id; $_SESSION['user_name']=$name; $_SESSION['user_type']=$user_type; $_SESSION['account_status']=$status; echo json_encode(['success'=>true,'message'=>'Registration successful','user'=>['id'=>$conn->insert_id,'name'=>$name,'email'=>$email,'user_type'=>$user_type,'account_status'=>$status]]); } else { http_response_code(500); echo json_encode(['error'=>'Registration failed']); } $stmt->close(); $conn->close(); }
function handleLogout(){ if($_SERVER['REQUEST_METHOD']!=='POST'){ http_response_code(405); echo json_encode(['error'=>'Method not allowed']); return; } $_SESSION=[]; session_destroy(); echo json_encode(['success'=>true,'message'=>'Logout successful']); }
function handleProfile(){ if(!isLoggedIn()){ http_response_code(401); echo json_encode(['error'=>'Not authenticated']); return; } $user=getCurrentUser(); echo json_encode(['success'=>true,'user'=>['id'=>$user['id'],'name'=>$user['name'],'email'=>$user['email'],'phone'=>$user['phone'],'user_type'=>$user['user_type'],'account_status'=>$user['account_status'] ?? 'active']]); }
?>

