<?php
// Auth endpoint
if ($method === 'POST') {
    $username = trim($data['username'] ?? '');
    $password = $data['password'] ?? '';

    if (!$username || !$password) {
        http_response_code(400);
        echo json_encode(['error' => 'Credentials required']);
        exit;
    }

    $user = JarvisDB::single(
        'SELECT * FROM users WHERE username = ?', [$username]
    );

    if ($user && password_verify($password, $user['password_hash'])) {
        $token = bin2hex(random_bytes(32));
        $_SESSION['jarvis_token']   = $token;
        $_SESSION['jarvis_user_id'] = $user['id'];
        $_SESSION['jarvis_name']    = $user['display_name'];

        JarvisDB::execute(
            'UPDATE users SET last_seen = NOW() WHERE id = ?', [$user['id']]
        );

        // Use stored address preference for greeting
        $addrRow = JarvisDB::query(
            "SELECT pref_value FROM kb_preferences WHERE pref_key='user_title' LIMIT 1"
        );
        $userAddr = $addrRow[0]['pref_value'] ?? $user['display_name'];

        echo json_encode([
            'success'      => true,
            'token'        => $token,
            'display_name' => $userAddr,
            'greeting'     => "Welcome back, {$userAddr}. All systems are online and awaiting your command.",
        ]);
    } else {
        http_response_code(401);
        echo json_encode(['error' => 'Invalid credentials']);
    }
} elseif ($method === 'DELETE') {
    session_destroy();
    echo json_encode(['success' => true, 'message' => 'Session terminated.']);
} else {
    // Check session status
    $loggedIn = !empty($_SESSION['jarvis_token']);
    echo json_encode([
        'authenticated' => $loggedIn,
        'name' => $_SESSION['jarvis_name'] ?? null,
    ]);
}