<?php

if (session_status() === PHP_SESSION_NONE) {
    session_name('PIONEERS_PMS_SESSION');

    session_set_cookie_params([
        'lifetime' => 0,
        'path'     => '/rooms/',
        'secure'   => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
        'httponly' => true,
        'samesite' => 'Lax',
    ]);

    session_start();
}
require_once __DIR__ . '/database_connection.php';
require_once __DIR__ . '/functions.php';
require_once __DIR__ . '/auth.php';

$appName = app_setting($pdo, 'name', 'Pioneers PMS');
$currentUserName = isset($_SESSION['ss_username']) ? $_SESSION['ss_username'] : 'User';
$currentPath = basename($_SERVER['PHP_SELF']);
/*
 * Guest-change audit request context.
 *
 * Database triggers use these MySQL connection variables to record which
 * logged-in user, PHP page, browser session and request caused a guest-name
 * change. This runs once for every request that loads bootstrap.php.
 */
if (!function_exists('set_guest_audit_request_context')) {
    function set_guest_audit_request_context(PDO $pdo): void
    {
        try {
            $userId = 0;
            foreach (['ss_user_id', 'user_id', 'id', 'uid', 'staffid'] as $key) {
                if (!empty($_SESSION[$key]) && (int)$_SESSION[$key] > 0) {
                    $userId = (int)$_SESSION[$key];
                    break;
                }
            }

            $username = trim((string)($_SESSION['ss_username'] ?? $_SESSION['username'] ?? ''));
            $requestUri = (string)($_SERVER['REQUEST_URI'] ?? '');
            $scriptName = (string)($_SERVER['SCRIPT_NAME'] ?? $_SERVER['PHP_SELF'] ?? '');
            $sessionId = session_status() === PHP_SESSION_ACTIVE ? session_id() : '';
            $ipAddress = (string)($_SERVER['REMOTE_ADDR'] ?? '');
            $userAgent = (string)($_SERVER['HTTP_USER_AGENT'] ?? '');
            $requestMethod = (string)($_SERVER['REQUEST_METHOD'] ?? '');
            $requestId = bin2hex(random_bytes(12));

            $context = [
                '@guest_audit_user_id'        => $userId,
                '@guest_audit_username'       => mb_substr($username, 0, 190),
                '@guest_audit_request_uri'    => mb_substr($requestUri, 0, 1000),
                '@guest_audit_script_name'    => mb_substr($scriptName, 0, 255),
                '@guest_audit_session_id'     => mb_substr($sessionId, 0, 190),
                '@guest_audit_ip_address'     => mb_substr($ipAddress, 0, 64),
                '@guest_audit_user_agent'     => mb_substr($userAgent, 0, 1000),
                '@guest_audit_request_method' => mb_substr($requestMethod, 0, 16),
                '@guest_audit_request_id'     => $requestId,
            ];

            foreach ($context as $variable => $value) {
                $stmt = $pdo->prepare("SET {$variable} = :value");
                $stmt->execute([':value' => $value]);
            }
        } catch (Throwable $e) {
            // Auditing must never interrupt normal PMS operation.
        }
    }
}

set_guest_audit_request_context($pdo);

