<?php

$session_ip = escapeSql(getIP());
$session_user_agent = escapeSql($_SERVER['HTTP_USER_AGENT'] ?? '');
$session_user_id = intval($_SESSION['user_id']);

$sql = mysqli_query(
    $mysqli,
    "SELECT role_is_admin, role_name, user_archived_at, user_avatar, user_config_force_mfa,
        user_config_records_per_page, user_config_theme_dark, user_email, user_name, user_role_id,
        user_password, user_status, user_token, user_type FROM users
     LEFT JOIN user_settings ON users.user_id = user_settings.user_id
     LEFT JOIN user_roles ON user_role_id = role_id
     WHERE users.user_id = $session_user_id"
);

$row = mysqli_fetch_assoc($sql);

$session_stamp_current = userSessionStamp($row['user_password'] ?? '');
if ($row) {
    unset($row['user_password']);
}

$session_name = escapeSql($row['user_name']);
$session_email = $row['user_email'];
$session_avatar = $row['user_avatar'];
$session_token = $row['user_token'];
$session_user_type = intval($row['user_type']);
$session_user_archived_at = $row['user_archived_at'];
$session_user_status = intval($row['user_status']);
$session_user_role = intval($row['user_role_id']);
$session_user_role_display = escapeSql($row['role_name']);
$session_is_admin = isset($row['role_is_admin']) && $row['role_is_admin'] == 1;
$session_user_config_force_mfa = intval($row['user_config_force_mfa']);
$user_config_records_per_page = max(1, intval($row['user_config_records_per_page']));
$user_config_theme_dark = intval($row['user_config_theme_dark']);

// Check user type is agent aka 1
if ($session_user_type !== 1) {
    session_unset();
    session_destroy();
    redirect("/login.php");
}

// Check User is active
if ($session_user_status !== 1) {
    session_unset();
    session_destroy();
    redirect("/login.php");
}

// Check User is archived
if ($session_user_archived_at !== null) {
    session_unset();
    session_destroy();
    redirect("/login.php");
}

// Check the password hasn't changed since this session signed in - by them elsewhere,
// an admin, or the incident-response reset (userSessionStamp())
if (!hash_equals($session_stamp_current, (string) ($_SESSION['user_session_stamp'] ?? ''))) {
    session_unset();
    session_destroy();
    redirect("/login.php");
}

// MFA required on this account and not set up yet: setting it up, or signing out, is all
// this session may do - every other page, modal, AJAX call and POST goes back to the set
// up page. Signing in only sends them there; this is what keeps them there, including when
// an admin requires MFA, or resets it, on an agent who is already signed in.
if ($session_user_config_force_mfa === 1 && trim((string) $session_token) === '' && !requestIsMfaSetup([
    'agent/user/mfa_enforcement.php' => [[[], []]],
    'agent/user/post.php' => [[[], ['csrf_token', 'enable_mfa', 'verify_code']], [['logout'], []]],
])) {
    redirect("/agent/user/mfa_enforcement.php");
}

// Load user client permissions (allow + deny lists)
$user_client_access_sql = "SELECT client_id, permission_type FROM user_client_permissions WHERE user_id = $session_user_id";
$user_client_access_result = mysqli_query($mysqli, $user_client_access_sql);

$client_access_array = []; // allow
$client_deny_array = [];   // deny
while ($row = mysqli_fetch_assoc($user_client_access_result)) {
    if ($row['permission_type'] === 'deny') {
        $client_deny_array[] = (int) $row['client_id'];
    } else {
        $client_access_array[] = (int) $row['client_id'];
    }
}