<?php
/*
 * Client Portal
 * Process GET/POST requests
 */

require_once '../config.php';
require_once '../includes/load_global_settings.php';
require_once '../functions.php';
require_once 'includes/check_login.php';
require_once 'functions.php';

if (isset($_POST['add_ticket'])) {

    validateCSRFToken();

    $subject = escapeSql($_POST['subject']);
    $details = mysqli_real_escape_string($mysqli, ($_POST['details']));
    $category = intval($_POST['category']);
    $asset = intval($_POST['asset']);

    // Get settings from load_global_settings.php
    $config_ticket_prefix = escapeSql($config_ticket_prefix);
    $config_ticket_from_name = escapeSql($config_ticket_from_name);
    $config_ticket_from_email = escapeSql($config_ticket_from_email);
    $config_base_url = escapeSql($config_base_url);
    $config_ticket_new_ticket_notification_email = filter_var($config_ticket_new_ticket_notification_email, FILTER_VALIDATE_EMAIL);

    //Generate a unique URL key for clients to access
    $url_key = randomString(32);

    // Ensure priority is one of the four allowed values (as can be user defined)
    if ($_POST['priority'] !== "Low" && $_POST['priority'] !== "Medium" && $_POST['priority'] !== "High" && $_POST['priority'] !== "Urgent") {
        $priority = "Medium";
    } else {
        $priority = escapeSql($_POST['priority']);
    }

    // Atomically increment and get the new ticket number
    mysqli_query($mysqli, "
        UPDATE settings
        SET
            config_ticket_next_number = LAST_INSERT_ID(config_ticket_next_number),
            config_ticket_next_number = config_ticket_next_number + 1
        WHERE company_id = 1
    ");

    $ticket_number = mysqli_insert_id($mysqli);

    mysqli_query($mysqli, "INSERT INTO tickets SET ticket_prefix = '$config_ticket_prefix', ticket_number = $ticket_number, ticket_source = 'Portal', ticket_category = $category, ticket_subject = '$subject', ticket_details = '$details', ticket_priority = '$priority', ticket_status = 1, ticket_billable = $config_ticket_default_billable, ticket_created_by = $session_user_id, ticket_contact_id = $session_contact_id, ticket_asset_id = $asset, ticket_url_key = '$url_key', ticket_client_id = $session_client_id");
    $ticket_id = mysqli_insert_id($mysqli);
    applyTicketSla($ticket_id);

    // Notify agent DL of the new ticket, if populated with a valid email
    if ($config_ticket_new_ticket_notification_email) {

        $client_name = escapeSql($session_client_name);

        $email_subject = "ITFlow - New Ticket - $client_name: $subject";
        $email_body = "Hello, <br><br>This is a notification that a new ticket has been raised in ITFlow. <br>Client: $client_name<br>Priority: $priority<br>Link: https://$config_base_url/agent/ticket.php?ticket_id=$ticket_id&client_id=$session_client_id <br><br><b>$subject</b><br>$details";

        // Queue Mail
        $data = [
            [
                'from' => $config_ticket_from_email,
                'from_name' => $config_ticket_from_name,
                'recipient' => $config_ticket_new_ticket_notification_email,
                'recipient_name' => $config_ticket_from_name,
                'subject' => $email_subject,
                'body' => $email_body,
            ]
        ];
        addToMailQueue($data);
        }

    // Custom action/notif handler
    triggerCustomAction('ticket_create', $ticket_id);

    logAudit("Ticket", "Create", "$session_contact_name created ticket $config_ticket_prefix$ticket_number - $subject from the client portal", $session_client_id, $ticket_id);

    redirect("ticket.php?id=" . $ticket_id);

}

if (isset($_POST['add_ticket_comment'])) {

    validateCSRFToken();

    $ticket_id = intval($_POST['ticket_id']);
    $comment = mysqli_real_escape_string($mysqli, $_POST['comment']);

    // After stripping bad HTML, check the comment isn't just empty
    if (empty($comment)) {
        flashAlert("You must enter a comment", 'danger');
        redirect();
    }

    // Verify the contact has access to the provided ticket ID
    if (verifyContactTicketAccess($ticket_id, "Open")) {

        // Add the comment
        mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$comment', ticket_reply_type = 'Client', ticket_reply_by = $session_contact_id, ticket_reply_ticket_id = $ticket_id");

        $ticket_reply_id = mysqli_insert_id($mysqli);

        // Update Ticket Last Response Field & set ticket to open as client has replied
        $original_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_status FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
        $original_ticket_status = intval($original_row['ticket_status'] ?? 0);

        mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 2 WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id LIMIT 1");
        syncTicketSlaClock($ticket_id);

        // Only record the reopen when the ticket was not already open
        if ($original_ticket_status !== 2) {
            logTicketHistory($ticket_id, "$session_contact_name replied from the client portal, reopening the ticket");
        }


        // Get ticket details &  Notify the assigned tech (if any)
        $ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT client_name, ticket_assigned_to, ticket_number, ticket_subject FROM tickets LEFT JOIN clients ON ticket_client_id = client_id WHERE ticket_id = $ticket_id LIMIT 1"));

        $ticket_number = intval($ticket_details['ticket_number']);
        $ticket_assigned_to = intval($ticket_details['ticket_assigned_to']);
        $ticket_subject = escapeSql($ticket_details['ticket_subject']);
        $client_name = escapeSql($ticket_details['client_name']);

        if ($ticket_details && $ticket_assigned_to !== 0) {

            // Get tech details
            $tech_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_email, user_name FROM users WHERE user_id = $ticket_assigned_to LIMIT 1"));
            $tech_email = escapeSql($tech_details['user_email']);
            $tech_name = escapeSql($tech_details['user_name']);

            $subject = "$config_app_name Ticket updated - [$config_ticket_prefix$ticket_number] $ticket_subject";
            $body    = "Hello $tech_name,<br><br>A new reply has been added to the below ticket, check ITFlow for full details.<br><br>Client: $client_name<br>Ticket: $config_ticket_prefix$ticket_number<br>Subject: $ticket_subject<br><br>https://$config_base_url/agent/ticket.php?ticket_id=$ticket_id&client_id=$session_client_id";

            $data = [
                [
                    'from' => $config_ticket_from_email,
                    'from_name' => $config_ticket_from_name,
                    'recipient' => $tech_email,
                    'recipient_name' => $tech_name,
                    'subject' => $subject,
                    'body' => $body
                ]
            ];

            addToMailQueue($data);

        }

        // Store any attached files against this reply
        saveTicketAttachments($ticket_id, $ticket_reply_id, 'file');

        // Custom action/notif handler
        triggerCustomAction('ticket_reply_client', $ticket_id);

        // Redirect back to original page
        redirect();

    } else {
        // The client does not have access to this ticket
        redirect("post.php?logout");
    }
}

if (isset($_GET['approve_ticket_task'])) {

    validateCSRFToken();

    $task_id = intval($_GET['approve_ticket_task']);
    $approval_id = intval($_GET['approval_id']);
    $url_key = escapeSql($_GET['approval_url_key']);

    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name,
        task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'"));

    $task_name = escapeHtml($approval_row['task_name']);
    $scope = escapeHtml($approval_row['approval_scope']);
    $type = escapeHtml($approval_row['approval_type']);
    $required_user = intval($approval_row['approval_required_user_id']);
    $created_by = intval($approval_row['approval_created_by']);
    $ticket_id = intval($approval_row['task_ticket_id']);

    if (!$approval_row) {
        flashAlert("Cannot find/approve that task", 'warning');
        redirect();
        exit;
    }

    // Approve
    mysqli_query($mysqli, "UPDATE task_approvals SET approval_status = 'approved', approval_approved_by = $session_user_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'");


    // Notify tech
    mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Ticket', notification = '$session_contact_email approved ticket task $task_name', notification_action = 'ticket.php?ticket_id=$ticket_id&client_id=$session_client_id', notification_client_id = $session_client_id, notification_user_id = $created_by");
    // TODO: Email agent

    // Logging
    logAudit("Task", "Edit", "Contact $session_contact_email approved task $task_name (approval $approval_id)", $session_client_id, $task_id);

    flashAlert("Task Approved");
    redirect();

}

if (isset($_POST['add_ticket_feedback'])) {

    validateCSRFToken();

    $ticket_id = intval($_POST['ticket_id']);
    $feedback = escapeSql($_POST['add_ticket_feedback']);

    // Verify the contact has access to the provided ticket ID
    if (verifyContactTicketAccess($ticket_id, "Closed")) {

        // Add feedback
        mysqli_query($mysqli, "UPDATE tickets SET ticket_feedback = '$feedback' WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id LIMIT 1");

        // Notify on bad feedback
        if ($feedback == "Bad") {
            $ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
            $ticket_number = intval($ticket_details['ticket_number']);
            appNotify("Feedback", "$session_contact_name rated ticket $config_ticket_prefix$ticket_number as bad (ID: $ticket_id)", "/agent/ticket.php?ticket_id=$ticket_id&client_id=$session_client_id", $session_client_id, $ticket_id);
        }

        // Custom action/notif handler
        triggerCustomAction('ticket_feedback', $ticket_id);

        // Redirect
        redirect();
    } else {
        // The client does not have access to this ticket
        redirect("post.php?logout");
    }

}

if (isset($_GET['resolve_ticket'])) {

    validateCSRFToken();

    $ticket_id = intval($_GET['resolve_ticket']);

    // Get ticket details for logging
    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));

    $ticket_prefix = escapeSql($row['ticket_prefix']);
    $ticket_number = intval($row['ticket_number']);

    // Verify the contact has access to the provided ticket ID
    if (verifyContactTicketAccess($ticket_id, "Open")) {

        // Resolve the ticket
        mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 4, ticket_resolved_at = NOW() WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id");
        setTicketResolutionSlaMet($ticket_id);
        syncTicketSlaClock($ticket_id);
        logTicketHistory($ticket_id, "$session_contact_name resolved the ticket from the client portal");

        // Add reply
        mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket resolved by $session_contact_name.', ticket_reply_type = 'Client', ticket_reply_by = $session_contact_id, ticket_reply_ticket_id = $ticket_id");

        logAudit("Ticket", "Edit", "$session_contact_name marked ticket $ticket_prefix$ticket_number as resolved in the client portal", $session_client_id, $ticket_id);

        // Custom action/notif handler
        triggerCustomAction('ticket_resolve', $ticket_id);

        redirect("ticket.php?id=" . $ticket_id);

    } else {
        // The client does not have access to this ticket - send them home
        redirect("index.php");
    }

}

if (isset($_GET['reopen_ticket'])) {

    validateCSRFToken();

    $ticket_id = intval($_GET['reopen_ticket']);

    // Get ticket details for logging
    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));

    $ticket_prefix = escapeSql($row['ticket_prefix']);
    $ticket_number = intval($row['ticket_number']);

    // Verify the contact has access to the provided ticket ID
    if (verifyContactTicketAccess($ticket_id, "Open")) {

        // Re-open ticket
        mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 2, ticket_resolved_at = NULL WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id");
        resetTicketResolutionSla($ticket_id);
        syncTicketSlaClock($ticket_id);
        logTicketHistory($ticket_id, "$session_contact_name reopened the ticket from the client portal");

        // Add reply
        mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket reopened by $session_contact_name.', ticket_reply_type = 'Client', ticket_reply_by = $session_contact_id, ticket_reply_ticket_id = $ticket_id");

        logAudit("Ticket", "Edit", "$session_contact_name reopend ticket $ticket_prefix$ticket_number in the client portal", $session_client_id, $ticket_id);

        // Custom action/notif handler
        triggerCustomAction('ticket_update', $ticket_id);

        redirect("ticket.php?id=" . $ticket_id);

    } else {
        // The client does not have access to this ticket - send them home
        redirect("index.php");
    }

}

if (isset($_GET['close_ticket'])) {

    validateCSRFToken();

    $ticket_id = intval($_GET['close_ticket']);

    // Get ticket details for logging
    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));

    $ticket_prefix = escapeSql($row['ticket_prefix']);
    $ticket_number = intval($row['ticket_number']);

    // Verify the contact has access to the provided ticket ID
    if (verifyContactTicketAccess($ticket_id, "Open")) {

        // Fully close ticket
        mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 5, ticket_closed_at = NOW() WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id");
        syncTicketSlaClock($ticket_id);
        logTicketHistory($ticket_id, "$session_contact_name closed the ticket from the client portal");

        // Add reply
        mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket closed by $session_contact_name.', ticket_reply_type = 'Client', ticket_reply_by = $session_contact_id, ticket_reply_ticket_id = $ticket_id");

        logAudit("Ticket", "Edit", "$session_contact_name closed ticket $ticket_prefix$ticket_number in the client portal", $session_client_id, $ticket_id);

        // Custom action/notif handler
        triggerCustomAction('ticket_close', $ticket_id);

        redirect("ticket.php?id=" . $ticket_id);

    } else {
        // The client does not have access to this ticket - send them home
        redirect("index.php");
    }
}


if (isset($_GET['export_statement_pdf'])) {

    validateCSRFToken();

    enforceContactCan('accounting');

    /*
     * SCOPING: the client is taken from the session, never from the request.
     * There is no client_id parameter on this handler by design - a contact
     * cannot ask for another company's statement because there is nothing to
     * ask with. enforceContactCan('accounting') above limits it to primary and
     * billing contacts, matching client/statement.php and client/invoices.php.
     */
    $client_id = $session_client_id;

    $sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $client_id LIMIT 1");
    $row = mysqli_fetch_assoc($sql);
    $client_name = escapeHtml($row['client_name']);

    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_logo, company_name,
        company_phone, company_phone_country_code, company_state, company_website, company_zip
        FROM companies WHERE company_id = 1");
    $row = mysqli_fetch_assoc($sql);

    $company_name = escapeHtml($row['company_name']);
    $company_country = escapeHtml($row['company_country']);
    $company_address = escapeHtml($row['company_address']);
    $company_city = escapeHtml($row['company_city']);
    $company_state = escapeHtml($row['company_state']);
    $company_zip = escapeHtml($row['company_zip']);
    $company_phone = escapeHtml(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
    $company_website = escapeHtml($row['company_website']);
    $company_logo = escapeHtml($row['company_logo']);

    // Same statement query as client/statement.php - payments summed in a
    // derived table so a twice-paid invoice is not counted twice, and the
    // balance test drops anything fully paid
    $statement_sql = mysqli_query(
        $mysqli,
        "SELECT invoice_amount, invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix,
            invoice_scope, IFNULL(amount_paid, 0) AS amount_paid
        FROM invoices
        LEFT JOIN (
            SELECT payment_invoice_id, SUM(payment_amount) AS amount_paid FROM payments
            WHERE payment_archived_at IS NULL
            GROUP BY payment_invoice_id
        ) AS invoice_payments ON payment_invoice_id = invoice_id
        WHERE invoice_client_id = $client_id
        AND invoice_status NOT IN ('Draft', 'Cancelled', 'Non-Billable')
        AND invoice_amount - IFNULL(invoice_payments.amount_paid, 0) > 0
        ORDER BY invoice_date ASC, invoice_number ASC"
    );

    if (mysqli_num_rows($statement_sql) == 0) {
        flashAlert("There is nothing outstanding to put on a statement", 'error');
        redirect("statement.php");
    }

    require_once("../libs/TCPDF/tcpdf.php");

    // Start TCPDF
    $pdf = new TCPDF('P', 'mm', 'A4', true, 'UTF-8', false);
    $pdf->SetMargins(10, 10, 10);
    $pdf->setPrintHeader(false);
    $pdf->setPrintFooter(false);
    $pdf->AddPage();
    $pdf->SetFont('helvetica', '', 10);

    // Logo + title
    $html = '<table width="100%" cellspacing="0" cellpadding="3">
    <tr>
        <td width="40%">';
    if (!empty($company_logo) && file_exists("../uploads/settings/$company_logo")) {
        $html .= '<img src="/uploads/settings/' . $company_logo . '" width="120">';
    }
    $html .= '</td>
        <td width="60%" align="right">
            <span style="font-size:18pt; font-weight:bold;">Account Statement</span><br>
            <span style="font-size:11pt;">As of ' . date("Y-m-d") . '</span>
        </td>
    </tr>
    </table><br>';

    $html .= '<table width="100%" cellspacing="0" cellpadding="2">
    <tr>
        <td width="50%" style="font-size:14pt; font-weight:bold;">' . $company_name . '</td>
        <td width="50%" align="right" style="font-size:14pt; font-weight:bold;">' . $client_name . '</td>
    </tr>
    <tr>
        <td style="font-size:10pt; line-height:1.4;">' . nl2br(formatAddress($company_address, $company_city, $company_state, $company_zip, $company_country) . "\n$company_phone\n$company_website") . '</td>
        <td></td>
    </tr>
    </table><br>';

    // Statement lines
    $html .= '<table border="0" cellpadding="4" cellspacing="0" width="100%">
    <tr style="background-color:#343a40; color:#ffffff; font-weight:bold;">
        <td width="14%">Invoice</td>
        <td width="30%">Scope</td>
        <td width="13%">Date</td>
        <td width="13%">Due</td>
        <td width="10%" align="right">Amount</td>
        <td width="10%" align="right">Paid</td>
        <td width="10%" align="right">Balance</td>
    </tr>';

    $statement_total = 0;
    $statement_row_shade = false;

    while ($row = mysqli_fetch_assoc($statement_sql)) {
        $invoice_prefix = escapeHtml($row['invoice_prefix']);
        $invoice_number = intval($row['invoice_number']);
        $invoice_scope = escapeHtml($row['invoice_scope']);
        $invoice_date = escapeHtml($row['invoice_date']);
        $invoice_due = escapeHtml($row['invoice_due']);
        $invoice_amount = floatval($row['invoice_amount']);
        $amount_paid = floatval($row['amount_paid']);
        $invoice_balance = $invoice_amount - $amount_paid;

        $statement_total = $statement_total + $invoice_balance;

        // Same one-day grace as client/statement.php and client/invoices.php
        if (strtotime($invoice_due) + 86400 < time()) {
            $due_style = ' style="color:#dc3545;"';
        } else {
            $due_style = '';
        }

        $row_background = $statement_row_shade ? ' bgcolor="#f2f2f2"' : '';
        $statement_row_shade = !$statement_row_shade;

        $html .= '<tr' . $row_background . '>
        <td style="font-size:9pt;">' . $invoice_prefix . $invoice_number . '</td>
        <td style="font-size:9pt;">' . $invoice_scope . '</td>
        <td style="font-size:9pt;">' . $invoice_date . '</td>
        <td style="font-size:9pt;"' . $due_style . '>' . $invoice_due . '</td>
        <td style="font-size:9pt;" align="right">' . numfmt_format_currency($currency_format, $invoice_amount, $session_company_currency) . '</td>
        <td style="font-size:9pt;" align="right">' . numfmt_format_currency($currency_format, $amount_paid, $session_company_currency) . '</td>
        <td style="font-size:9pt;" align="right">' . numfmt_format_currency($currency_format, $invoice_balance, $session_company_currency) . '</td>
        </tr>';
    }

    $html .= '<tr>
        <td colspan="6" align="right" style="font-weight:bold;">Total Balance Due</td>
        <td align="right" style="font-weight:bold;">' . numfmt_format_currency($currency_format, $statement_total, $session_company_currency) . '</td>
    </tr>
    </table>';

    $pdf->writeHTML($html, true, false, true, false, '');

    $filename = toAlphanumeric($client_name) . "-Account_Statement-" . date("Y-m-d");

    $pdf->Output("$filename.pdf", 'D');

    exit();

}

if (isset($_GET['logout'])) {

    setcookie("PHPSESSID", '', time() - 3600, "/");
    unset($_COOKIE['PHPSESSID']);

    session_unset();
    session_destroy();

    redirect('/login.php');

}

if (isset($_POST['edit_profile'])) {

    validateCSRFToken();

    $new_password = $_POST['new_password'];

    if (!empty($new_password)) {
        $password_hash = password_hash($new_password, PASSWORD_DEFAULT);
        mysqli_query($mysqli, "UPDATE users SET user_password = '$password_hash' WHERE user_id = $session_user_id");

        // Logging
        logAudit("Contact", "Edit", "Client contact $session_contact_name edited their profile/password in the client portal", $session_client_id, $session_contact_id);
    }

    redirect('index.php');

}

if (isset($_POST['add_contact'])) {

    validateCSRFToken();

    enforceContactCan('contacts');

    $contact_name = escapeSql($_POST['contact_name']);
    $contact_email = escapeSql($_POST['contact_email']);
    $contact_technical = intval($_POST['contact_technical'] ?? 0);
    $contact_billing = intval($_POST['contact_billing'] ?? 0);
    $contact_auth_method = escapeSql($_POST['contact_auth_method']);

    // Check the email isn't already in use
    $sql = mysqli_query($mysqli, "SELECT user_id FROM users WHERE user_email = '$contact_email'");
    if ($sql && mysqli_num_rows($sql) > 0) {
        flashAlert("Cannot add contact as that email address is already in use", 'danger');
        redirect('contact_add.php');
    }

    // Create user account with rand password for the contact
    $contact_user_id = 0;
    if ($contact_name && $contact_email && $contact_auth_method) {

        $password_hash = password_hash(randomString(), PASSWORD_DEFAULT);

        mysqli_query($mysqli, "INSERT INTO users SET user_name = '$contact_name', user_email = '$contact_email', user_password = '$password_hash', user_auth_method = '$contact_auth_method', user_type = 2");

        $contact_user_id = mysqli_insert_id($mysqli);

    }

    // Create contact record
    mysqli_query($mysqli, "INSERT INTO contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical, contact_client_id = $session_client_id, contact_user_id = $contact_user_id");

    $contact_id = mysqli_insert_id($mysqli);

    // Logging
    logAudit("Contact", "Create", "Client contact $session_contact_name created contact $contact_name in the client portal", $session_client_id, $contact_id);

    triggerCustomAction('contact_create', $contact_id);

    flashAlert("Contact $contact_name created");

    redirect('contacts.php');

}

if (isset($_POST['edit_contact'])) {

    validateCSRFToken();

    enforceContactCan('contacts');

    $contact_id = intval($_POST['contact_id']);
    // A contact cannot edit their own record - that would let them change their own roles
    if ($contact_id === $session_contact_id) {
        flashAlert("You cannot edit your own contact record", 'danger');
        redirect('contacts.php');
    }
    $contact_name = escapeSql($_POST['contact_name']);
    $contact_email = escapeSql($_POST['contact_email']);
    $contact_technical = intval($_POST['contact_technical'] ?? 0);
    $contact_billing = intval($_POST['contact_billing'] ?? 0);
    $contact_auth_method = escapeSql($_POST['contact_auth_method']);

    // Get the existing contact_user_id - we look it up ourselves so the user can't just overwrite random users
    $sql = mysqli_query($mysqli,"SELECT contact_user_id FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $session_client_id");
    $row = mysqli_fetch_assoc($sql);
    $contact_user_id = intval($row['contact_user_id']);

    // Check the email isn't already in use
    $sql = mysqli_query($mysqli, "SELECT user_id FROM users WHERE user_email = '$contact_email' AND user_id != $contact_user_id");
    if ($sql && mysqli_num_rows($sql) > 0) {
        flashAlert("Cannot update contact as that email address is already in use", 'danger');
        redirect('contact_edit.php?id=' . $contact_id);
    }

    // Update Existing User
    if ($contact_user_id > 0) {
        mysqli_query($mysqli, "UPDATE users SET user_name = '$contact_name', user_email = '$contact_email', user_auth_method = '$contact_auth_method' WHERE user_id = $contact_user_id");

    // Else, create New User
    } elseif ($contact_user_id == 0 && $contact_name && $contact_email && $contact_auth_method) {
        $password_hash = password_hash(randomString(), PASSWORD_DEFAULT);
        mysqli_query($mysqli, "INSERT INTO users SET user_name = '$contact_name', user_email = '$contact_email', user_password = '$password_hash', user_auth_method = '$contact_auth_method', user_type = 2");

        $contact_user_id = mysqli_insert_id($mysqli);
    }

    // Update contact
    mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical, contact_user_id = $contact_user_id WHERE contact_id = $contact_id AND contact_client_id = $session_client_id AND contact_archived_at IS NULL AND contact_primary = 0 AND contact_id != $session_contact_id");

    logAudit("Contact", "Edit", "Client contact $session_contact_name edited contact $contact_name in the client portal", $session_client_id, $contact_id);

    flashAlert("Contact $contact_name updated");

    triggerCustomAction('contact_update', $contact_id);

    redirect('contacts.php');

}

if (isset($_GET['add_payment_by_provider'])) {

    validateCSRFToken();

    $invoice_id = intval($_GET['invoice_id']);
    $saved_payment_id = intval($_GET['add_payment_by_provider']);

    // Get invoice details
    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_extension, contact_mobile,
        contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
        invoice_amount, invoice_currency_code, invoice_number, invoice_prefix, invoice_status,
        invoice_url_key FROM invoices
            LEFT JOIN clients ON invoice_client_id = client_id
            LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
            WHERE invoice_id = $invoice_id AND client_id = $session_client_id"
    );
    $row = mysqli_fetch_assoc($sql);
    $invoice_number = intval($row['invoice_number']);
    $invoice_status = escapeSql($row['invoice_status']);
    $invoice_amount = floatval($row['invoice_amount']);
    $invoice_prefix = escapeSql($row['invoice_prefix']);
    $invoice_number = intval($row['invoice_number']);
    $invoice_url_key = escapeSql($row['invoice_url_key']);
    $invoice_currency_code = escapeSql($row['invoice_currency_code']);
    $client_id = intval($row['client_id']);
    $client_name = escapeSql($row['client_name']);
    $contact_name = escapeSql($row['contact_name']);
    $contact_email = escapeSql($row['contact_email']);
    $contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
    $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
    $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));

    // Get ITFlow company details
    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_name, company_phone,
        company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
    $row = mysqli_fetch_assoc($sql);
    $company_name = escapeSql($row['company_name']);
    $company_country = escapeSql($row['company_country']);
    $company_address = escapeSql($row['company_address']);
    $company_city = escapeSql($row['company_city']);
    $company_state = escapeSql($row['company_state']);
    $company_zip = escapeSql($row['company_zip']);
    $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
    $company_email = escapeSql($row['company_email']);
    $company_website = escapeSql($row['company_website']);

    // Sanitize Config vars from get_settings.php
    $config_invoice_from_name = escapeSql($config_invoice_from_name);
    $config_invoice_from_email = escapeSql($config_invoice_from_email);

    // Get Client Payment Details
    $sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_client, payment_provider_private_key,
        payment_provider_public_key, saved_payment_client_id, saved_payment_description,
        saved_payment_provider_method FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id AND saved_payment_client_id = $session_client_id LIMIT 1");
    $row = mysqli_fetch_assoc($sql);

    $public_key = escapeSql($row['payment_provider_public_key']);
    $private_key = escapeSql($row['payment_provider_private_key']);
    $account_id = intval($row['payment_provider_account']);
    $payment_provider_client = escapeSql($row['payment_provider_client']);
    $saved_payment_method = escapeSql($row['saved_payment_provider_method']);
    $saved_payment_description = escapeSql($row['saved_payment_description']);
    $payment_client_id = intval($row['saved_payment_client_id']);

    // Sanity checks
    // Check to make invoice belongs to logged in client
    if ($client_id !== $session_client_id) {
        flashAlert("Invoice does not belong to you!", 'danger');
        redirect();
    } elseif ($payment_client_id !== $session_client_id) {
        flashAlert("Saved Payment method does not belong to you!", 'danger');
        redirect();
    } elseif (!$payment_provider_client || !$saved_payment_method) {
        flashAlert("Stripe not enabled or no client card saved", 'error');
        redirect();
    } elseif ($invoice_status !== 'Sent' && $invoice_status !== 'Viewed') {
        flashAlert("Invalid invoice state (draft/partial/paid/not billable)", 'error');
        redirect();
    } elseif ($invoice_amount == 0) {
        flashAlert("Invalid invoice amount", 'error');
        redirect();
    }

    // Initialize Stripe
    require_once __DIR__ . '/../includes/stripe_init.php';
    $stripe = new \Stripe\StripeClient($private_key);

    $balance_to_pay = round($invoice_amount, 2);
    $pi_description = "ITFlow: $client_name payment of $invoice_currency_code $balance_to_pay for $invoice_prefix$invoice_number";

    // Create a payment intent
    try {
        $payment_intent = $stripe->paymentIntents->create([
            'amount' => intval($balance_to_pay * 100), // Times by 100 as Stripe expects values in cents
            'currency' => $invoice_currency_code,
            'customer' => $payment_provider_client,
            'payment_method' => $saved_payment_method,
            'off_session' => true,
            'confirm' => true,
            'description' => $pi_description,
            'metadata' => [
                'itflow_client_id' => $client_id,
                'itflow_client_name' => $client_name,
                'itflow_invoice_number' => $invoice_prefix . $invoice_number,
                'itflow_invoice_id' => $invoice_id,
            ]
        ]);

        // Get details from PI
        $pi_id = escapeSql($payment_intent->id);
        $pi_date = date('Y-m-d', $payment_intent->created);
        $pi_amount_paid = floatval(($payment_intent->amount_received / 100));
        $pi_currency = strtoupper(escapeSql($payment_intent->currency));
        $pi_livemode = $payment_intent->livemode;

    } catch (Exception $e) {
        $error = $e->getMessage();
        error_log("Stripe payment error - encountered exception during payment intent for invoice ID $invoice_id / $invoice_prefix$invoice_number: $error");
        logApp("Stripe", "error", "Exception during PI for invoice ID $invoice_id: $error");
    }

    if ($payment_intent->status == "succeeded" && intval($balance_to_pay) == intval($pi_amount_paid)) {

        // Update Invoice Status
        mysqli_query($mysqli, "UPDATE invoices SET invoice_status = 'Paid' WHERE invoice_id = $invoice_id");

        // Add Payment to History
        mysqli_query($mysqli, "INSERT INTO payments SET payment_date = '$pi_date', payment_amount = $pi_amount_paid, payment_currency_code = '$pi_currency', payment_account_id = $account_id, payment_method = 'Stripe', payment_reference = 'Stripe - $pi_id', payment_invoice_id = $invoice_id");
        mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Paid', history_description = 'Online Payment added (agent)', history_invoice_id = $invoice_id");

        // Email receipt
        if (!empty($config_smtp_host)) {
            $subject = "Payment Received - Invoice $invoice_prefix$invoice_number";
            $body = "Hello $contact_name,<br><br>We have received online payment for the amount of " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . " for invoice <a href=\'https://$config_base_url/guest/guest_view_invoice.php?invoice_id=$invoice_id&url_key=$invoice_url_key\'>$invoice_prefix$invoice_number</a>. Please keep this email as a receipt for your records.<br><br>Amount Paid: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "<br><br>Thank you for your business!<br><br><br>--<br>$company_name - Billing Department<br>$config_invoice_from_email<br>$company_phone";

            // Queue Mail
            $data = [
                [
                    'from' => $config_invoice_from_email,
                    'from_name' => $config_invoice_from_name,
                    'recipient' => $contact_email,
                    'recipient_name' => $contact_name,
                    'subject' => $subject,
                    'body' => $body,
                ]
            ];

            // Email the internal notification address too
            if (!empty($config_invoice_paid_notification_email)) {
                $subject = "Payment Received - $client_name - Invoice $invoice_prefix$invoice_number";
                $body = "Hello, <br><br>This is a notification that an invoice has been paid in ITFlow. Below is a copy of the receipt sent to the client:-<br><br>--------<br><br>Hello $contact_name,<br><br>We have received online payment for the amount of " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . " for invoice <a href=\'https://$config_base_url/guest/guest_view_invoice.php?invoice_id=$invoice_id&url_key=$invoice_url_key\'>$invoice_prefix$invoice_number</a>. Please keep this email as a receipt for your records.<br><br>Amount Paid: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "<br><br>Thank you for your business!<br><br><br>--<br>$company_name - Billing Department<br>$config_invoice_from_email<br>$company_phone";

                $data[] = [
                    'from' => $config_invoice_from_email,
                    'from_name' => $config_invoice_from_name,
                    'recipient' => $config_invoice_paid_notification_email,
                    'recipient_name' => $contact_name,
                    'subject' => $subject,
                    'body' => $body,
                ];
            }

            $mail = addToMailQueue($data);

            // Email Logging
            $email_id = mysqli_insert_id($mysqli);
            mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Payment Receipt sent to mail queue ID: $email_id!', history_invoice_id = $invoice_id");
            logAudit("Invoice", "Payment", "Payment receipt for invoice $invoice_prefix$invoice_number queued to $contact_email Email ID: $email_id", $client_id, $invoice_id);
        }

        // Log info
        $extended_log_desc = '';
        if (!$pi_livemode) {
            $extended_log_desc = '(DEV MODE)';
        }

        // Notify/log
        appNotify("Invoice Paid", "Invoice $invoice_prefix$invoice_number automatically paid", "/agent/invoice.php?invoice_id=$invoice_id", $client_id);
        logAudit("Invoice", "Payment", "$session_name initiated Stripe payment amount of " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . " added to invoice $invoice_prefix$invoice_number - $pi_id $extended_log_desc", $client_id, $invoice_id);
        triggerCustomAction('invoice_pay', $invoice_id);

        flashAlert("The amount " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . " paid Invoice $invoice_prefix$invoice_number");

        redirect();

    } else {
        mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Payment failed', history_description = 'Stripe pay failed due to payment error', history_invoice_id = $invoice_id");

        logAudit("Invoice", "Payment", "Failed online payment amount of invoice $invoice_prefix$invoice_number due to Stripe payment error", $client_id, $invoice_id);
        flashAlert("Payment failed", 'error');

        redirect();
    }

}

if (isset($_POST['create_stripe_customer'])) {

    validateCSRFToken();

    enforceContactCan('accounting');

    // Get Stripe provider
    $stripe_provider_result = mysqli_query($mysqli, "
        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
        WHERE payment_provider_name = 'Stripe'
        AND payment_provider_active = 1
        LIMIT 1
    ");

    $stripe_provider = mysqli_fetch_assoc($stripe_provider_result);
    if (!$stripe_provider) {
        flashAlert("Stripe provider is not configured in the system.", 'danger');
        redirect("saved_payment_methods.php");
    }

    $stripe_provider_id = intval($stripe_provider['payment_provider_id']);
    $stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);

    if (empty($stripe_secret_key)) {
        flashAlert("Stripe credentials missing. Please contact support.", 'danger');
        redirect("saved_payment_methods.php");
    }

    // Check if client already has a Stripe customer
    $existing_customer = mysqli_fetch_assoc(mysqli_query($mysqli, "
        SELECT payment_provider_client
        FROM client_payment_provider
        WHERE client_id = $session_client_id
        AND payment_provider_id = $stripe_provider_id
        LIMIT 1
    "));

    if (!$existing_customer) {
        try {
            // Initialize Stripe
            require_once '../includes/stripe_init.php';
            $stripe = new \Stripe\StripeClient($stripe_secret_key);

            // Create new customer in Stripe
            $customer = $stripe->customers->create([
                'name' => $session_client_name,
                'email' => $session_contact_email,
                'metadata' => [
                    'itflow_client_id' => $session_client_id,
                    'consent_by' => $session_contact_name
                ]
            ]);

            $stripe_customer_id = escapeSql($customer->id);

            // Insert customer into client_payment_provider
            mysqli_query($mysqli, "
                INSERT INTO client_payment_provider
                SET client_id = $session_client_id,
                    payment_provider_id = $stripe_provider_id,
                    payment_provider_client = '$stripe_customer_id',
                    client_payment_provider_created_at = NOW()
            ");

            logAudit("Stripe", "Create", "$session_contact_name created Stripe customer for $session_client_name as $stripe_customer_id and authorized future automatic payments", $session_client_id, $session_client_id);

            flashAlert("Stripe customer created. Thank you for your consent.");

        } catch (Exception $e) {
            $error = $e->getMessage();

            error_log("Stripe error while creating customer for $session_client_name: $error");

            logApp("Stripe", "error", "Failed to create Stripe customer for $session_client_name: $error");

            flashAlert("An error occurred while creating your Stripe customer. Please try again.", 'danger');

        }

    } else {
        flashAlert("Stripe customer already exists for your account.", 'danger');
    }

    redirect('saved_payment_methods.php');
}

if (isset($_GET['create_stripe_checkout'])) {

    //validateCSRFToken();

    // This page is called by autopay_setup_stripe.js, returns a Checkout Session client_secret

    enforceContactCan('accounting');

    // Fetch Stripe provider info
    $stripe_provider_result = mysqli_query($mysqli, "
        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
        WHERE payment_provider_name = 'Stripe'
        AND payment_provider_active = 1
        LIMIT 1
    ");

    $stripe_provider = mysqli_fetch_assoc($stripe_provider_result);
    if (!$stripe_provider) {
        http_response_code(400);
        echo json_encode(['error' => 'Stripe provider not configured']);
        exit();
    }

    $stripe_provider_id = intval($stripe_provider['payment_provider_id']);
    $stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);

    if (empty($stripe_secret_key)) {
        http_response_code(400);
        echo json_encode(['error' => 'Stripe secret key missing']);
        exit();
    }

    // Get client currency
    $client_currency_result = mysqli_query($mysqli, "
        SELECT client_currency_code
        FROM clients
        WHERE client_id = $session_client_id
        LIMIT 1
    ");
    $client_currency_row = mysqli_fetch_assoc($client_currency_result);
    $client_currency = $client_currency_row['client_currency_code'] ?? 'usd';

    // Client's existing Stripe customer (so the setup attaches to it and
    // Checkout uses the customer's email instead of prompting for one)
    $client_provider = mysqli_fetch_assoc(mysqli_query($mysqli, "
        SELECT payment_provider_client
        FROM client_payment_provider
        WHERE client_id = $session_client_id
        AND payment_provider_id = $stripe_provider_id
        LIMIT 1
    "));
    $stripe_customer_id = $client_provider ? escapeSql($client_provider['payment_provider_client']) : null;

    // Return URL when checkout finishes
    $return_url = "https://$config_base_url/client/post.php?stripe_save_card&session_id={CHECKOUT_SESSION_ID}";

    try {
        require_once '../includes/stripe_init.php';
        $stripe = new \Stripe\StripeClient($stripe_secret_key);

        // Create checkout session
        $session_params = [
            'currency'   => $client_currency,
            'mode'       => 'setup',
            'ui_mode'    => 'embedded_page',
            'return_url' => $return_url,
        ];
        if ($stripe_customer_id) {
            $session_params['customer'] = $stripe_customer_id;
        }
        $checkout_session = $stripe->checkout->sessions->create($session_params);

        echo json_encode(['clientSecret' => $checkout_session->client_secret]);

    } catch (Exception $e) {
        $error = $e->getMessage();
        error_log("Stripe error creating checkout session: $error");
        logApp("Stripe", "error", "Exception creating checkout session: $error");
        http_response_code(500);
        echo json_encode(['error' => 'Stripe Checkout session failed']);
    }

    exit;
}

if (isset($_GET['stripe_save_card'])) {

    // validateCSRFToken(); Broken with Stripe Save Card JQ 2026-5-4

    enforceContactCan('accounting');

    // Get Stripe provider
    $stripe_provider_result = mysqli_query($mysqli, "
        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
        WHERE payment_provider_name = 'Stripe'
        AND payment_provider_active = 1
        LIMIT 1
    ");

    $stripe_provider = mysqli_fetch_assoc($stripe_provider_result);
    if (!$stripe_provider) {
        flashAlert("Stripe provider not configured.", 'danger');
        redirect("saved_payment_methods.php");
    }

    $stripe_provider_id = intval($stripe_provider['payment_provider_id']);
    $stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);

    if (empty($stripe_secret_key)) {
        flashAlert("Stripe credentials missing.", 'danger');
        redirect("saved_payment_methods.php");
    }

    // Get client's Stripe customer ID
    $client_provider_query = mysqli_query($mysqli, "
        SELECT payment_provider_client
        FROM client_payment_provider
        WHERE client_id = $session_client_id
        AND payment_provider_id = $stripe_provider_id
        LIMIT 1
    ");
    $client_provider = mysqli_fetch_assoc($client_provider_query);
    $stripe_customer_id = escapeSql($client_provider['payment_provider_client'] ?? '');

    if (empty($stripe_customer_id)) {
        flashAlert("Stripe customer ID not found for client.", 'danger');
        redirect("saved_payment_methods.php");
    }

    // Get session ID from URL
    $checkout_session_id = escapeSql($_GET['session_id']);

    try {
        require_once '../includes/stripe_init.php';
        $stripe = new \Stripe\StripeClient($stripe_secret_key);

        // Retrieve checkout session & setup intent
        $checkout_session = $stripe->checkout->sessions->retrieve($checkout_session_id, []);
        $setup_intent_id = $checkout_session->setup_intent;
        $setup_intent = $stripe->setupIntents->retrieve($setup_intent_id, []);
        $payment_method_id = escapeSql($setup_intent->payment_method);

        // Attach the payment method to the Stripe customer
        $stripe->paymentMethods->attach($payment_method_id, ['customer' => $stripe_customer_id]);

        // Retrieve PM details for logging and UI
        $payment_method_details = $stripe->paymentMethods->retrieve($payment_method_id, []);
        $card_brand = escapeSql($payment_method_details->card->brand);
        $last4 = escapeSql($payment_method_details->card->last4);
        $exp_month = escapeSql($payment_method_details->card->exp_month);
        $exp_year = escapeSql($payment_method_details->card->exp_year);

        $saved_payment_description = "$card_brand - $last4 | Exp $exp_month/$exp_year";

        // Insert into client_saved_payment_methods
        mysqli_query($mysqli, "
            INSERT INTO client_saved_payment_methods
            SET
                saved_payment_provider_method = '$payment_method_id',
                saved_payment_description = '$saved_payment_description',
                saved_payment_client_id = $session_client_id,
                saved_payment_provider_id = $stripe_provider_id,
                saved_payment_created_at = NOW()
        ");

    } catch (Exception $e) {
        $error = $e->getMessage();
        error_log("Stripe error while saving payment method: $error");
        logApp("Stripe", "error", "Exception saving payment method: $error");

        flashAlert("An error occurred while saving your payment method.", 'danger');
        redirect("saved_payment_methods.php");
    }

    // Email Confirmation
    $sql_settings = mysqli_query($mysqli, "
        SELECT company_name, company_phone, company_phone_country_code, config_invoice_from_email,
            config_invoice_from_name, config_smtp_host FROM companies, settings
        WHERE companies.company_id = settings.company_id
        AND companies.company_id = 1
    ");
    $row = mysqli_fetch_assoc($sql_settings);

    $company_name = escapeSql($row['company_name']);
    $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
    $config_invoice_from_email = escapeSql($row['config_invoice_from_email']);
    $config_invoice_from_name = escapeSql($row['config_invoice_from_name']);

    if (!empty($row['config_smtp_host'])) {
        $subject = "Payment method saved";
        $body = "Hello $session_contact_name<br><br>
        Were writing to confirm that your payment details have been securely stored with Stripe our trusted payment processor.<br><br>
        You authorized us to automatically bill your card ($saved_payment_description) for future invoices.<br><br>
        You may update or remove your payment method at any time via the client portal.<br><br>
        Thank you for your business!<br><br>
        --<br>$company_name - Billing Department<br>$config_invoice_from_email<br>$company_phone";

        $data = [[
            'from' => $config_invoice_from_email,
            'from_name' => $config_invoice_from_name,
            'recipient' => $session_contact_email,
            'recipient_name' => $session_contact_name,
            'subject' => $subject,
            'body' => $body
        ]];

        $mail = addToMailQueue($data);
    }

    logAudit("Stripe", "Update", "$session_contact_name saved payment method ($saved_payment_description) (PM: $payment_method_id)", $session_client_id);

    flashAlert("Payment method saved – thank you.");
    redirect("saved_payment_methods.php");
}

if (isset($_GET['delete_saved_payment'])) {

    validateCSRFToken();

    enforceContactCan('accounting');

    $saved_payment_id = intval($_GET['delete_saved_payment']);

    // Get Stripe provider info
    $stripe_provider_result = mysqli_query($mysqli, "
        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
        WHERE payment_provider_name = 'Stripe'
        AND payment_provider_active = 1
        LIMIT 1
    ");
    $stripe_provider = mysqli_fetch_assoc($stripe_provider_result);

    if (!$stripe_provider) {
        flashAlert("Stripe provider is not configured.", 'danger');
        redirect("saved_payment_methods.php");
    }

    $stripe_provider_id = intval($stripe_provider['payment_provider_id']);
    $stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);

    if (empty($stripe_secret_key)) {
        flashAlert("Stripe credentials are missing.", 'danger');
        redirect("saved_payment_methods.php");
    }

    $saved_payment_result = mysqli_query($mysqli, "
        SELECT saved_payment_id, saved_payment_description, saved_payment_provider_method
        FROM client_saved_payment_methods
        WHERE saved_payment_id = $saved_payment_id
        AND saved_payment_client_id = $session_client_id
        AND saved_payment_provider_id = $stripe_provider_id
        LIMIT 1
    ");

    $saved_payment = mysqli_fetch_assoc($saved_payment_result);

    if (!$saved_payment) {
        flashAlert("Payment method not found or does not belong to you.", 'danger');
        redirect("saved_payment_methods.php");
    }

    $payment_method_id = escapeSql($saved_payment['saved_payment_provider_method']);

    $saved_payment_id = intval($saved_payment['saved_payment_id']);
    $saved_payment_description = escapeHtml($saved_payment['saved_payment_description']);

    try {
        // Initialize Stripe
        require_once '../includes/stripe_init.php';
        $stripe = new \Stripe\StripeClient($stripe_secret_key);

        // Detach the payment method from Stripe
        $stripe->paymentMethods->detach($payment_method_id, []);

    } catch (Exception $e) {
        $error = $e->getMessage();

        error_log("Stripe error while removing payment method $payment_method_id: $error");

        logApp("Stripe", "error", "Exception removing payment method $payment_method_id: $error");

        flashAlert("An error occurred while removing your payment method.", 'danger');

        redirect("saved_payment_methods.php");

    }

    // Remove saved payment method from local DB
    mysqli_query($mysqli, "
        DELETE FROM client_saved_payment_methods
        WHERE saved_payment_id = $saved_payment_id
    ");

    // Remove any auto-pay records using this payment method
    $recurring_invoices = mysqli_query($mysqli, "
        SELECT recurring_invoice_id
        FROM recurring_invoices
        WHERE recurring_invoice_client_id = $session_client_id
    ");

    while ($row = mysqli_fetch_assoc($recurring_invoices)) {
        $recurring_invoice_id = intval($row['recurring_invoice_id']);

        mysqli_query($mysqli, "
            DELETE FROM recurring_payments
            WHERE recurring_payment_recurring_invoice_id = $recurring_invoice_id
            AND recurring_payment_saved_payment_id = $saved_payment_id
        ");
    }

    logAudit("Stripe", "Update", "$session_contact_name deleted Stripe payment method $saved_payment_description (PM: $payment_method_id)", $session_client_id);

    flashAlert("Payment method $saved_payment_description removed.");

    redirect("saved_payment_methods.php");
}

if (isset($_POST['set_recurring_payment'])) {

    validateCSRFToken();

    $recurring_invoice_id = intval($_POST['recurring_invoice_id']);
    $saved_payment_id = intval($_POST['saved_payment_id']);

    // Get Recurring Invoice Info for logging and alerting
    $sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_currency_code, recurring_invoice_number,
        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $session_client_id");
    $row = mysqli_fetch_assoc($sql);
    $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
    $recurring_invoice_number = intval($row['recurring_invoice_number']);
    $recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']);
    $recurring_invoice_amount = floatval($row['recurring_invoice_amount']);

    if ($saved_payment_id) {

        // Get Payment provider and method
        $sql = mysqli_query($mysqli, "
            SELECT payment_provider_account, payment_provider_id, payment_provider_name,
                saved_payment_description FROM payment_providers
            LEFT JOIN client_saved_payment_methods ON saved_payment_provider_id = payment_provider_id
            WHERE saved_payment_id = $saved_payment_id
            AND saved_payment_client_id = $session_client_id
            AND payment_provider_active = 1
        ");

        $row = mysqli_fetch_assoc($sql);

        $provider_id = intval($row['payment_provider_id']);
        $provider_name = escapeSql($row['payment_provider_name']);
        $account_id = intval($row['payment_provider_account']);
        $saved_payment_description = escapeSql($row['saved_payment_description']);

        mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_recurring_invoice_id = $recurring_invoice_id");
        mysqli_query($mysqli,"INSERT INTO recurring_payments SET recurring_payment_currency_code = '$recurring_invoice_currency_code', recurring_payment_account_id = $account_id, recurring_payment_method = 'Credit Card', recurring_payment_recurring_invoice_id = $recurring_invoice_id, recurring_payment_saved_payment_id = $saved_payment_id");
        // Get Payment ID for reference
        $recurring_payment_id = mysqli_insert_id($mysqli);

        logAudit("Recurring Invoice", "Auto Payment", "$session_name created Auto Pay for Recurring Invoice $recurring_invoice_prefix$recurring_invoice_number in the amount of " . numfmt_format_currency($currency_format, $recurring_invoice_amount, $recurring_invoice_currency_code), $session_client_id, $recurring_invoice_id);

        flashAlert("Automatic Payment $saved_payment_description enabled for Recurring Invoice $recurring_invoice_prefix$recurring_invoice_number");
    } else {
        // Delete
        mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_recurring_invoice_id = $recurring_invoice_id");

        logAudit("Recurring Invoice", "Auto Payment", "$session_name removed Auto Pay for Recurring Invoice $recurring_invoice_prefix$recurring_invoice_number in the amount of " . numfmt_format_currency($currency_format, $recurring_invoice_amount, $recurring_invoice_currency_code), $session_client_id, $recurring_invoice_id);

        flashAlert("Automatic Payment Disabled for Recurring Invoice $recurring_invoice_prefix$recurring_invoice_number");
    }

    redirect();

}

if (isset($_POST['client_add_document'])) {

    validateCSRFToken();

    // Permission check - only primary or technical contacts can create documents
    enforceContactCan('itdoc');

    $document_name = escapeSql($_POST['document_name']);
    $document_description = escapeSql($_POST['document_description']);
    $document_content_raw = escapeSql($document_name . " " . strip_tags($_POST['document_content']));

    // Create document
    mysqli_query($mysqli, "INSERT INTO documents SET
        document_name = '$document_name',
        document_description = '$document_description',
        document_content = '',
        document_content_raw = '$document_content_raw',
        document_client_visible = 1,
        document_client_id = $session_client_id,
        document_created_by = $session_contact_id");

    $document_id = mysqli_insert_id($mysqli);

    $processed_content = mysqli_escape_string(
        $mysqli,
        saveBase64Images(
            $_POST['document_content'],
            $_SERVER['DOCUMENT_ROOT'] . "/uploads/documents/",
            "uploads/documents/",
            $document_id
        )
    );

    // Document update content
    mysqli_query($mysqli,"UPDATE documents SET document_content = '$processed_content' WHERE document_id = $document_id");

    logAudit("Document", "Create", "Client contact $session_contact_name created document $document_name", $session_client_id, $document_id);

    flashAlert("Document <strong>$document_name</strong> created successfully");

    redirect('documents.php');

}

if (isset($_POST['client_upload_document'])) {

    validateCSRFToken();

    // Permission check - only primary or technical contacts can upload documents
    enforceContactCan('itdoc');

    $document_name = escapeSql($_POST['document_name']);
    $document_description = escapeSql($_POST['document_description']);
    $client_dir = "../uploads/clients/$session_client_id";

    // Create client directory if it doesn't exist
    if (!is_dir($client_dir)) {
        mkdir($client_dir, 0755, true);
    }

    // Allowed file extensions for documents
    $allowedExtensions = ['pdf', 'doc', 'docx', 'txt', 'md', 'odt', 'rtf'];

    // Check if file was uploaded
    if (isset($_FILES['document_file']) && $_FILES['document_file']['error'] == 0) {

        // Validate and get a safe file reference name
        if ($file_reference_name = checkFileUpload($_FILES['document_file'], $allowedExtensions)) {

            $file_tmp_path = $_FILES['document_file']['tmp_name'];
            $file_name = escapeSql($_FILES['document_file']['name']);
            $extParts = explode('.', $file_name);
            $file_extension = strtolower(end($extParts));
            $file_mime_type = escapeSql($_FILES['document_file']['type']);
            $file_size = intval($_FILES['document_file']['size']);

            // Define destination path and move the uploaded file
            $dest_path = $client_dir . "/" . $file_reference_name;

            if (move_uploaded_file($file_tmp_path, $dest_path)) {

                // Create document entry
                $document_content = "<p>Uploaded file: <strong>$file_name</strong></p><p>$document_description</p>";
                $document_content_raw = "$document_name $file_name $document_description";

                mysqli_query($mysqli, "INSERT INTO documents SET
                    document_name = '$document_name',
                    document_description = '$document_description',
                    document_content = '$document_content',
                    document_content_raw = '$document_content_raw',
                    document_client_visible = 1,
                    document_client_id = $session_client_id,
                    document_created_by = $session_contact_id");

                $document_id = mysqli_insert_id($mysqli);

                // Create file entry
                mysqli_query($mysqli, "INSERT INTO files SET
                    file_reference_name = '$file_reference_name',
                    file_name = '$file_name',
                    file_description = 'Attached to document: $document_name',
                    file_ext = '$file_extension',
                    file_mime_type = '$file_mime_type',
                    file_size = $file_size,
                    file_created_by = $session_contact_id,
                    file_client_id = $session_client_id");

                $file_id = mysqli_insert_id($mysqli);

                // Link file to document
                mysqli_query($mysqli, "INSERT INTO document_files SET document_id = $document_id, file_id = $file_id");

                logAudit("Document", "Upload", "Client contact $session_contact_name uploaded document $document_name with file $file_name", $session_client_id, $document_id);

                flashAlert("Document <strong>$document_name</strong> uploaded successfully");

            } else {
                flashAlert('Error uploading file. Please try again.', 'error');
            }

        } else {
            flashAlert('Invalid file type. Please upload PDF, Word documents, or text files only.', 'error');
        }

    } else {
        flashAlert('Please select a file to upload.', 'error');
    }

    redirect('documents.php');
}
' . $company_name . '	' . $client_name . '
' . nl2br(formatAddress($company_address, $company_city, $company_state, $company_zip, $company_country) . "\n$company_phone\n$company_website") . '
Invoice	Scope	Date	Due	Amount	Paid	Balance
' . $invoice_prefix . $invoice_number . '	' . $invoice_scope . '	' . $invoice_date . '	' . $invoice_due . '	' . numfmt_format_currency($currency_format, $invoice_amount, $session_company_currency) . '	' . numfmt_format_currency($currency_format, $amount_paid, $session_company_currency) . '	' . numfmt_format_currency($currency_format, $invoice_balance, $session_company_currency) . '
Total Balance Due						' . numfmt_format_currency($currency_format, $statement_total, $session_company_currency) . '