<?php
require_once __DIR__ . "/config.inc.php";

$errors = [];
$full_name = $phone = $email = $address = "";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    try {
        user_check_csrf();
    } catch (Throwable $e) {
        $errors[] = "Invalid CSRF token. Refresh and try again.";
    }

    $full_name = trim($_POST['full_name'] ?? '');
    $phone     = trim($_POST['phone'] ?? '');
    $email     = trim($_POST['email'] ?? '');
    $address   = trim($_POST['address'] ?? '');
    $password  = $_POST['password'] ?? '';
    $password2 = $_POST['password2'] ?? '';

    if ($full_name === '') $errors[] = "Name is required.";
    if ($phone === '') $errors[] = "Phone is required.";
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = "Valid email is required.";
    if ($address === '') $errors[] = "Address is required.";
    if (strlen($password) < 6) $errors[] = "Password must be at least 6 characters.";
    if ($password !== $password2) $errors[] = "Passwords do not match.";

    if (!$errors) {
        $stmt = db()->prepare("SELECT id FROM users WHERE email = ?");
        $stmt->bind_param("s", $email);
        $stmt->execute();
        $stmt->store_result();
        if ($stmt->num_rows > 0) {
            $errors[] = "Email already registered. Please login.";
        }
        $stmt->close();
    }

    if (!$errors) {
        $hash = password_hash($password, PASSWORD_BCRYPT);

        $stmt = db()->prepare("INSERT INTO users(full_name, phone, email, address, password_hash) VALUES (?,?,?,?,?)");
        $stmt->bind_param("sssss", $full_name, $phone, $email, $address, $hash);
        $stmt->execute();

        $_SESSION['user_id'] = $stmt->insert_id;
        $_SESSION['user_name'] = $full_name;

        $stmt->close();
        redirect('index.php');
    }
}

require_once __DIR__ . "/partials/header.php";
?>
<div class="row justify-content-center">
  <div class="col-md-7 col-lg-6">
    <div class="card shadow-sm">
      <div class="card-body">
        <h4 class="mb-3">Create Account</h4>

        <?php if ($errors): ?>
          <div class="alert alert-danger">
            <ul class="mb-0">
              <?php foreach ($errors as $er): ?>
                <li><?= e($er) ?></li>
              <?php endforeach; ?>
            </ul>
          </div>
        <?php endif; ?>

        <form method="post" class="row g-3">
          <input type="hidden" name="csrf_token" value="<?= e(user_csrf()) ?>">

          <div class="col-12">
            <label class="form-label">Full Name</label>
            <input class="form-control" name="full_name" value="<?= e($full_name) ?>" required>
          </div>

          <div class="col-12">
            <label class="form-label">Phone</label>
            <input class="form-control" name="phone" value="<?= e($phone) ?>" required>
          </div>

          <div class="col-12">
            <label class="form-label">Email</label>
            <input class="form-control" type="email" name="email" value="<?= e($email) ?>" required>
          </div>

          <div class="col-12">
            <label class="form-label">Address</label>
            <textarea class="form-control" name="address" rows="3" required><?= e($address) ?></textarea>
          </div>

          <div class="col-md-6">
            <label class="form-label">Password</label>
            <input class="form-control" type="password" name="password" required>
          </div>

          <div class="col-md-6">
            <label class="form-label">Confirm Password</label>
            <input class="form-control" type="password" name="password2" required>
          </div>

          <div class="col-12 d-grid">
            <button class="btn btn-success">Sign Up</button>
          </div>

          <div class="col-12 text-center">
            Already have an account? <a href="login.php">Login</a>
          </div>
        </form>

      </div>
    </div>
  </div>
</div>
<?php require_once __DIR__ . "/partials/footer.php"; ?>