<?php

require_once __DIR__ . '/functions.php';
require_once __DIR__ . '/app/saas-mail.php';
require_once __DIR__ . '/app/rate-limit.php';
require_once __DIR__ . '/app/legal.php';
require_once __DIR__ . '/app/pushover.php';
require_once __DIR__ . '/app/spam-guard.php';

$pdo = app_db_pdo();
$errors = [];
$values = [
    'tenant_name' => trim((string)($_POST['tenant_name'] ?? '')),
    'tenant_slug' => trim((string)($_POST['tenant_slug'] ?? '')),
    'display_name' => trim((string)($_POST['display_name'] ?? '')),
    'email' => trim((string)($_POST['email'] ?? '')),
    'customer_type' => (string)($_POST['customer_type'] ?? ''),
];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    app_require_csrf();

    // Reihenfolge mit Absicht: erst die billigen Bot-Merkmale, dann die
    // Rate-Limits, erst danach die DNS-Abfrage. Alle Abweisungen bis
    // einschliesslich Rate-Limit nennen denselben generischen Text, damit die
    // Antwort nicht verraet, welche Huerde angeschlagen hat.
    $genericRejection = 'Zu viele Registrierungsversuche. Bitte versuche es später erneut.';

    if (app_spam_guard_honeypot_tripped()) {
        app_spam_guard_log('register', 'honeypot');
        $errors = [$genericRejection];
    } elseif (app_spam_guard_submitted_too_fast('register')) {
        app_spam_guard_log('register', 'zu schnell abgesendet');
        $errors = [$genericRejection];
    } elseif (!app_rate_limit_check($pdo, 'register_ip:' . app_client_ip(), 5, 3600)) {
        $errors = [$genericRejection];
    } elseif (!app_rate_limit_check($pdo, 'register_global', APP_SPAM_GUARD_GLOBAL_MAX, APP_SPAM_GUARD_GLOBAL_WINDOW)) {
        // Notbremse gegen verteilte Bots: die kommen je ueber eine eigene IP,
        // an der das IP-Limit nie anschlaegt.
        app_spam_guard_log('register', 'globales Limit');
        $errors = [$genericRejection];
    } elseif (filter_var($values['email'], FILTER_VALIDATE_EMAIL) !== false
        && !app_spam_guard_email_domain_resolves($values['email'])) {
        // Hier bewusst konkret: das ist typischerweise ein Tippfehler in der
        // Domain, und der Hinweis hilft einem echten Nutzer weiter.
        $errors = ['Zu dieser E-Mail-Adresse gibt es keine erreichbare Mail-Domain. Bitte prüfe die Schreibweise.'];
    } else {
        $result = saas_register_tenant_owner($pdo, [
            'tenant_name' => $values['tenant_name'],
            'tenant_slug' => $values['tenant_slug'],
            'display_name' => $values['display_name'],
            'email' => $values['email'],
            'password' => (string)($_POST['password'] ?? ''),
            'password_confirm' => (string)($_POST['password_confirm'] ?? ''),
            'customer_type' => $values['customer_type'],
            'accept_terms' => !empty($_POST['accept_terms']),
            'acknowledge_privacy' => !empty($_POST['acknowledge_privacy']),
            'accept_dpa' => !empty($_POST['accept_dpa']),
        ]);

        if ($result['ok']) {
            $contractMail = saas_send_registration_contract_mail(
                $values['email'],
                $values['tenant_name'],
                (string)$result['identity']['tenant_slug'],
                $values['customer_type']
            );
            $verificationMail = ['ok' => true];
            if (!empty($result['email_verification_token'])) {
                $verificationMail = saas_send_email_verification_mail($values['email'], (string)$result['email_verification_token']);
            }
            // Betreiber-Push ueber die Neuanmeldung. Bewusst hier statt in
            // saas_register_tenant_owner(), damit die check-*-Skripte in
            // scripts/ keine Pushes ausloesen. Das Ergebnis wird nicht
            // ausgewertet: ein fehlgeschlagener Push darf die Registrierung
            // nie stoppen, er landet nur im PHP-Error-Log.
            pushover_notify_new_tenant(
                $values['tenant_name'],
                (string)$result['identity']['tenant_slug'],
                $values['email'],
                $values['customer_type']
            );
            saas_session_login($result['identity']);
            if (empty($contractMail['ok'])) {
                $_SESSION['saas_contract_mail_failed'] = true;
            }
            if (empty($verificationMail['ok'])) {
                $_SESSION['saas_verification_mail_failed'] = true;
            }
            if (saas_should_show_auth_links() && !empty($result['email_verification_token'])) {
                $_SESSION['saas_dev_email_verification_token'] = (string)$result['email_verification_token'];
            }
            header('Location: konto.php?registered=1');
            exit;
        }

        $errors = $result['errors'];
    }
}

?>

<!DOCTYPE HTML>
<html lang="de">
    <head>
        <title>Kaffeeliste Registrierung</title>
        <meta charset="utf-8" />
        <meta name="viewport" content="width=device-width, initial-scale=1" />
        <link rel="stylesheet" href="assets/css/main.css" />
        <link rel="stylesheet" href="assets/css/public.css" />
        <?php echo app_analytics_head_html(); ?>
    </head>
    <body class="is-preload public-page">
        <div class="public-shell">
            <section class="public-auth">
                <nav class="public-nav" aria-label="Hauptnavigation">
                    <strong><a href="landing.php">Kaffeeliste</a></strong>
                    <ul class="actions">
                        <li><a href="login.php" class="button">Login</a></li>
                    </ul>
                </nav>

                <div class="public-auth-grid">
                    <div class="public-auth-copy">
                        <h1>Registrierung</h1>
                        <p>Lege kostenlos einen neuen Kundenbereich an. Das Angebot kann privat oder geschäftlich genutzt werden.</p>
                    </div>

                    <div class="public-panel">
                        <h2>Kundenkonto anlegen</h2>

                        <?php if ($errors !== []): ?>
                            <div class="hint-box error">
                                <?php foreach ($errors as $error): ?>
                                    <p><?php echo saas_html($error); ?></p>
                                <?php endforeach; ?>
                            </div>
                        <?php endif; ?>

                        <?php app_spam_guard_mark_form_rendered('register'); ?>
                        <form method="post" action="register.php">
                            <?php echo app_csrf_field(); ?>
                            <?php echo app_spam_guard_honeypot_field(); ?>
                            <div class="row">
                                <div class="col-12">
                                    <fieldset>
                                        <legend>Du registrierst dich als</legend>
                                        <input type="radio" name="customer_type" id="customer_type_business" value="business"<?php echo $values['customer_type'] === 'business' ? ' checked' : ''; ?> required>
                                        <label for="customer_type_business">Unternehmen / selbstständige Tätigkeit</label>
                                        <input type="radio" name="customer_type" id="customer_type_consumer" value="consumer"<?php echo $values['customer_type'] === 'consumer' ? ' checked' : ''; ?> required>
                                        <label for="customer_type_consumer">Verbraucher / private Nutzung</label>
                                    </fieldset>
                                </div>
                                <div class="col-6 col-12-small">
                                    <label for="tenant_name">Kundenname</label>
                                    <input type="text" name="tenant_name" id="tenant_name" value="<?php echo saas_html($values['tenant_name']); ?>" required>
                                </div>
                                <div class="col-6 col-12-small">
                                    <label for="tenant_slug">Kundenkürzel</label>
                                    <input type="text" name="tenant_slug" id="tenant_slug" value="<?php echo saas_html($values['tenant_slug']); ?>" placeholder="kaffeeliste-team" required>
                                </div>
                                <div class="col-6 col-12-small">
                                    <label for="display_name">Dein Name</label>
                                    <input type="text" name="display_name" id="display_name" value="<?php echo saas_html($values['display_name']); ?>" required>
                                </div>
                                <div class="col-6 col-12-small">
                                    <label for="email">E-Mail</label>
                                    <input type="email" name="email" id="email" value="<?php echo saas_html($values['email']); ?>" required>
                                </div>
                                <div class="col-6 col-12-small">
                                    <label for="password">Passwort</label>
                                    <input type="password" name="password" id="password" minlength="8" required>
                                </div>
                                <div class="col-6 col-12-small">
                                    <label for="password_confirm">Passwort wiederholen</label>
                                    <input type="password" name="password_confirm" id="password_confirm" minlength="8" required>
                                </div>
                                <div class="col-12">
                                    <input type="checkbox" name="accept_terms" id="accept_terms" value="1" required>
                                    <label for="accept_terms">Ich akzeptiere die <a href="agb.php" target="_blank" rel="noopener">AGB</a>.</label>
                                </div>
                                <div class="col-12">
                                    <input type="checkbox" name="acknowledge_privacy" id="acknowledge_privacy" value="1" required>
                                    <label for="acknowledge_privacy">Ich habe die <a href="datenschutz.php" target="_blank" rel="noopener">Datenschutzerklärung</a> gelesen. Dies ist keine Einwilligung in optionale Werbung oder Tracking.</label>
                                </div>
                                <div class="col-12">
                                    <input type="checkbox" name="accept_dpa" id="accept_dpa" value="1" required>
                                    <label for="accept_dpa">Ich vereinbare den <a href="avv.php" target="_blank" rel="noopener">Auftragsverarbeitungsvertrag</a>, soweit ich Daten anderer Personen in der Kaffeeliste verwalte.</label>
                                </div>
                            </div>
                            <p><small>Das Kundenkonto ist kostenlos. Verbraucher haben ein 14-tägiges <a href="widerruf.php">Widerrufsrecht</a>.</small></p>
                            <ul class="actions">
                                <li><button type="submit" class="primary">Kostenloses Kundenkonto anlegen</button></li>
                                <li><a href="login.php" class="button">Zum Login</a></li>
                            </ul>
                        </form>
                    </div>
                </div>
            </section>
        </div>

        <footer class="public-footer-links">
            <a href="impressum.php">Impressum</a>
            <a href="agb.php">AGB</a>
            <a href="datenschutz.php">Datenschutz</a>
            <a href="avv.php">AVV</a>
            <a href="widerruf.php">Widerrufsbelehrung</a>
            <a class="legal-action-link" href="widerrufen.php">Vertrag widerrufen</a>
            <a href="preise.php">Preise</a>
            <a class="legal-action-link" href="kuendigen.php">Verträge hier kündigen</a>
        </footer>

        <?php echo app_analytics_body_html(); ?>
        <script src="assets/js/jquery.min.js"></script>
        <script src="assets/js/browser.min.js"></script>
        <script src="assets/js/breakpoints.min.js"></script>
        <script src="assets/js/util.js"></script>
        <script src="assets/js/main.js"></script>
    </body>
</html>