<?php
if(isset($_POST)) {
    include("scripts/functions.php");
    $accountID = filterString($_POST["id"]);
    $password = filterString($_POST["pass"]);
    $errorMsg = 0;

    if (empty($accountID) || empty($password)) {
        echo "<script>
         toastr.error('All fields are required', 'Empty field(s)', {'progressBar': true});
         document.getElementById('pass').style.borderColor='red';
         document.getElementById('id').style.borderColor='red';
         document.getElementById('pass').style.color='red';
         document.getElementById('id').style.color='red';
         </script>";
         $errorMsg = 1;
    } else {
         include("connect.php");
         $stmt = $conn->prepare("SELECT * FROM users WHERE accountnumber = ? AND id != 1 LIMIT 1");
         $stmt->bind_param("s", $accountID);
         $stmt->execute();
         $result = $stmt->get_result();

         if ($result && $result->num_rows > 0) {
             $fetch = $result->fetch_assoc();

             $stored = $fetch["password"];
             $verified = password_verify($password, $stored);

             if (!$verified && md5($password) === $stored) {
                 $newHash = password_hash($password, PASSWORD_DEFAULT);
                 $upd = $conn->prepare("UPDATE users SET password = ? WHERE id = ?");
                 $upd->bind_param("si", $newHash, $fetch["id"]);
                 $upd->execute();
                 $verified = true;
             }

             if ($verified) {
                 if($fetch["approve"] == 0){
                    $errorMsg = 1;
                    echo '
                     <div class="example-alert">
                     <div class="alert alert-pro alert-danger alert-dismissible">
                       <div class="alert-text">
                         <h6>Pending Approval!</h6>
                          <p>Sorry, your account have not been approved. Please try again later.</p>
                              </div>
                              <button class="close" data-dismiss="alert"></button>
                               </div>
                               </div>
                              <br>
                    ';
                 } elseif($fetch["status"] == "blocked"){
                    $errorMsg = 1;
                    echo '
                    <div class="example-alert">
                     <div class="alert alert-pro alert-danger alert-dismissible">
                       <div class="alert-text">
                         <h6>Account Suspended!</h6>
                          <p>Dear Customer,
                             we have discovered suspicious activities on your account; because an unauthorized IP address carried out a transaction on your account, consequently, your account has been flagged by our risk assessment department. kindly visit our nearest branch with your identification card and utility bill to confirm your identity before it can be reactivated.</p>
                              </div>
                              <button class="close" data-dismiss="alert">ok</button>
                            </div>
                        </div>
                     <br>
                    ';  
                 } elseif ($errorMsg == 0) {
                    echo '
                    <div class="example-alert">
                     <div class="alert alert-pro alert-success alert-dismissible">
                       <div class="alert-text">
                          <h6>Successful</h6>
                             <p>Your credentials matched our records</p>
                              </div>
                              <button class="close" data-dismiss="alert"></button>
                               </div>
                          </div>
                          <br>
                         ';

                    $_SESSION["loggedUser"] = $accountID;
                    $loggedtoken = loggedToken();
                    $_SESSION["loggedToken"] = $loggedtoken;
                    $userid = $fetch["id"];
                    $ip = $_SERVER["REMOTE_ADDR"];
                    $dated = date("d M y, H:i a");
                    $browser = $_SERVER["HTTP_USER_AGENT"];
                    $queryyy = $conn->prepare("INSERT INTO login(ip, browser, dated, token, userid) VALUES (?, ?, ?, ?, ?)");
                    $queryyy->bind_param("ssssi", $ip, $browser, $dated, $loggedtoken, $userid);
                    $queryyy->execute();
                    ?>
                    <meta http-equiv="refresh" content="2; url=../personal-banking/twa.php?accessToken=<?php echo$loggedtoken?>">
                    <?php
                 }
             } else {
                 echo '
                 <div class="example-alert">
                  <div class="alert alert-pro alert-danger alert-dismissible">
                    <div class="alert-text">
                      <h6>Invalid credentials</h6>
                       <p>Your account ID or passcode is incorrect</p>
                           </div>
                           <button class="close" data-dismiss="alert"></button>
                            </div>
                       </div>
                       <br>
                 ';
             }
         } else {
             echo '
             <div class="example-alert">
              <div class="alert alert-pro alert-danger alert-dismissible">
                <div class="alert-text">
                  <h6>Invalid credentials</h6>
                   <p>Your account ID or passcode is incorrect</p>
                       </div>
                       <button class="close" data-dismiss="alert"></button>
                        </div>
                   </div>
                   <br>
             ';
         }
    }
}
?>