<?php

require_once APP_ROOT . '/config/database.php';

class UserController
{
    private \PDO $db;

    public function __construct()
    {
        if (!Session::isLoggedIn()) {
            header('Content-Type: application/json');
            echo json_encode(['error' => 'Unauthorized']);
            exit;
        }
        $this->db = Database::getInstance();
    }

    public function searchUsers(): void
    {
        header('Content-Type: application/json');
        
        // Debug session status
        error_log("Session isLoggedIn: " . (Session::isLoggedIn() ? 'true' : 'false'));
        error_log("Session user_id: " . Session::get('user_id'));
        
        if (!Session::isLoggedIn()) {
            http_response_code(401);
            echo json_encode(['error' => 'Unauthorized', 'debug' => 'Not logged in']);
            return;
        }
        
        try {
            $this->db = Database::getInstance();
        } catch (Exception $e) {
            error_log("Database connection error: " . $e->getMessage());
            http_response_code(500);
            echo json_encode(['error' => 'Database connection failed', 'debug' => $e->getMessage()]);
            return;
        }
        
        $query = $_GET['q'] ?? '';
        $currentUserId = Session::get('user_id');
        
        error_log("Query: " . $query . ", User ID: " . var_export($currentUserId, true));
        
        if (strlen($query) < 2) {
            echo json_encode([]);
            return;
        }
        
        if (!$currentUserId) {
            echo json_encode(['error' => 'No user session', 'debug' => 'user_id is null']);
            return;
        }
        
        try {
            $searchTerm = '%' . strtolower($query) . '%';
            $currentUserId = (int)$currentUserId;
            
            // Use query with escaped parameters
            $escapedSearchTerm = $this->db->quote($searchTerm);
            
            $stmt = $this->db->query("
                SELECT id, username, display_name 
                FROM users 
                WHERE id != {$currentUserId}
                AND (LOWER(username) LIKE {$escapedSearchTerm} OR LOWER(display_name) LIKE {$escapedSearchTerm})
                AND status = 'approved'
                ORDER BY username ASC
                LIMIT 10
            ");
            
            $users = $stmt->fetchAll(PDO::FETCH_ASSOC);
            
            error_log("Found " . count($users) . " users");
            
            // Format response
            $formattedUsers = array_map(function($user) {
                return [
                    'id' => (int)$user['id'],
                    'username' => htmlspecialchars($user['username']),
                    'display_name' => htmlspecialchars($user['display_name'] ?? $user['username'])
                ];
            }, $users);
            
            echo json_encode($formattedUsers);
            
        } catch (Exception $e) {
            error_log("User search error: " . $e->getMessage());
            http_response_code(500);
            echo json_encode(['error' => 'Internal server error', 'debug' => $e->getMessage()]);
        }
    }
}