<?php
// /messages/_bootstrap.php
declare(strict_types=1);

/**
 * Bootstrap commun de la messagerie.
 * - Mode CLI (cron/outils) : bypass login/CSRF, mais DB chargée.
 * - Mode Web : session requise (role=praticien|client + reference_id), CSRF.
 * - Charge DB (../includes/db.php ou ../public/includes/db.php) + i18n.
 * - Expose helpers h(), json_response(), assert_conversation_access().
 * - Expose $GLOBALS['MESSAGES_CTX'] = [role, me_id, csrf_token].
 */

if (session_status() !== PHP_SESSION_ACTIVE) {
    session_start();
}
// Charge le bootstrap global du site (env + session + DB + lang + helpers)
require_once realpath(__DIR__ . '/../public/includes/init_pr_cl.php');
if (!isset($pdo) || !($pdo instanceof PDO)) {
json_response(['ok'=>false,'error'=>'pdo_not_in_scope']);
}

// ===== Helpers communs =====
if (!function_exists('h')) {
    function h($v): string {
        return htmlspecialchars((string)$v, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
    }
}
if (!function_exists('json_response')) {
    function json_response(array $data, int $code = 200): void {
        http_response_code($code);
        header('Content-Type: application/json; charset=utf-8');
        echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
        exit;
    }
}
if (!function_exists('assert_conversation_access')) {
    /**
     * Vérifie l'accès du user courant à la conversation.
     * @return array Conversation row (id, praticien_id, client_id, status)
     */
    function assert_conversation_access(PDO $pdo, int $conversation_id, string $role, int $me_id): array {
        $stmt = $pdo->prepare("SELECT id, praticien_id, client_id, status FROM conversations WHERE id = ? LIMIT 1");
        $stmt->execute([$conversation_id]);
        $c = $stmt->fetch(PDO::FETCH_ASSOC);
        if (!$c) json_response(['error' => 'conversation_not_found'], 404);

        $ok = ($role === 'praticien' && (int)$c['praticien_id'] === $me_id)
           || ($role === 'client'    && (int)$c['client_id']    === $me_id);

        // En CLI (outils), on ne bloque pas; en Web on bloque
        if (!$ok && PHP_SAPI !== 'cli') {
            json_response(['error' => 'forbidden'], 403);
        }
        return $c;
    }
}

// ===== Contexte selon SAPI =====
if (PHP_SAPI === 'cli') {
    // --- MODE CLI (ex: /messages/tools/gc.php) ---
    // Pas d'exigence de session/login/CSRF ici.
    $GLOBALS['MESSAGES_CTX'] = [
        'role'       => 'praticien', // valeur neutre; non utilisée par gc.php
        'me_id'      => 0,
        'csrf_token' => ''
    ];
} else {
    // --- MODE WEB ---
    // Sécurité (require_login) depuis /public/includes/securite.php si présent.
    $sec = APP_HTDOCS . '/public/includes/securite.php';
    if (is_file($sec)) {
        require_once $sec;
        if (function_exists('require_login_or_redirect')) {
            require_login_or_redirect(['praticien', 'client','admin']);
        }
    }

    // Variables de session attendues
    $role  = $_SESSION['role']         ?? null; // 'praticien' | 'client'
    $me_id = $_SESSION['reference_id'] ?? null; // id de la personne (table praticien|client)

    if (!in_array($role, ['praticien', 'client','admin'], true) || empty($me_id)) {
        http_response_code(403);
        echo "Accès refusé (session invalide).";
        exit;
    }

    // CSRF token
    if (empty($_SESSION['_csrf'])) {
        $_SESSION['_csrf'] = bin2hex(random_bytes(16));
    }
    $csrf_token = $_SESSION['_csrf'];

    $GLOBALS['MESSAGES_CTX'] = [
        'role'       => $role,
        'me_id'      => (int)$me_id,
        'csrf_token' => $csrf_token
    ];
}