<?php
$ValidAccess = 2010;

require_once("../include/globals.php");
if(session_status() !== PHP_SESSION_ACTIVE) session_start();

if (SessionActive() != 1 || ! UserLoggedIn()) {
   header("Location: {$FormTarget}");
   exit();
}


$AllowedUserTypes = array('SuperUser','System Administrator');
if (checkPermission($AllowedUserTypes) != 1) {
   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
   $naction = '';
   header("Location: {$FormTarget}?action=$action&naction=$naction$headerArgs&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
   exit();
}


/**
 * Helpers to look up a school's Square connection (merchant id + tokens).
 *
 * The PayPal helper only returned a merchant_id because PayPal acts via the
 * partner credentials. Square requires the SELLER's access token to charge on
 * their behalf, so getValidAccessToken() returns a decrypted, auto-refreshed
 * bearer token. All persistence/encryption/refresh lives in MerchantStore so
 * the web flow, the CLI cron, and the webhook share one implementation.
 */

require_once __DIR__ . '/lib/SquareClient.php';
require_once __DIR__ . '/lib/MerchantStore.php';

function squareConfig(): array {
    return require __DIR__ . '/config.php';
}

function squareStore(): MerchantStore {
    static $store = null;
    if ($store === null) $store = new MerchantStore(squareConfig());
    return $store;
}

function getMerchantId(string $schoolName): ?string
{
    $conn = squareStore()->get($schoolName);
    return $conn['merchant_id'] ?? null;
}

/**
 * Return a usable (decrypted, non-expired) access token for a school, refreshing
 * it lazily via the refresh token if it is near expiry. Returns null if the
 * school is not connected. This is what the Phase 4 payments code calls.
 */
function getValidAccessToken(string $schoolName): ?string
{
    $client = new SquareClient(squareConfig());
    $result = squareStore()->ensureFreshToken($schoolName, $client);
    return $result['access_token'] ?? null;
}

function getAllMerchants(): array
{
    $store = squareStore();
    $merchants = [];
    foreach ($store->connectedSchools() as $school) {
        $rec = $store->get($school);
        if (!$rec) continue;
        $merchants[$school] = [
            'merchant_id' => $rec['merchant_id'],
            'expires_at'  => $rec['expires_at'],
        ];
    }
    return $merchants;
}

// Return JSON when accessed directly (never expose tokens here).
if (basename(__FILE__) === basename($_SERVER['SCRIPT_FILENAME'])) {
    header('Content-Type: application/json');
    $school = $_GET['school'] ?? '';
    if ($school) {
        echo json_encode([
            'school'      => $school,
            'merchant_id' => getMerchantId($school),
            'connected'   => getMerchantId($school) !== null,
        ]);
    } else {
        echo json_encode(['merchants' => getAllMerchants()]);
    }
}