<?php

/**
 * GET /api/session — verify Bearer token is still active (website session check).
 */

if ($method !== 'GET') {
    json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
}

$token = get_bearer_token();
if (!$token) {
    json_error('UNAUTHORIZED', 'Missing Bearer token', 401);
}

$rec = token_get_record($token);
if (!$rec) {
    json_error('UNAUTHORIZED', 'Invalid or expired token', 401);
}

$role = (string)($rec['role'] ?? '');
if ($role === 'coach') {
    json_error('FORBIDDEN', 'Coach accounts can only sign in through the mobile app.', 403);
}

$username = '';
if (($rec['userID'] ?? '') !== '') {
    try {
        [$pdo, $tmpDb, $lockFp] = qdb_open(false);
        $stmt = $pdo->prepare('SELECT username FROM users WHERE userID = :uid');
        $stmt->execute([':uid' => $rec['userID']]);
        $row = $stmt->fetchColumn();
        $username = $row !== false ? (string)$row : '';
        qdb_discard($tmpDb, $lockFp);
    } catch (Throwable $e) {
        error_log('session username lookup: ' . $e->getMessage());
    }
}

json_success([
    'valid'              => true,
    'user'               => $username,
    'role'               => $role,
    'userID'             => $rec['userID'] ?? '',
    'mustChangePassword' => !empty($rec['temp']),
]);