<?php
define('DS_APP', true);
require_once dirname(__DIR__) . '/includes/init.php';

if (auth_check()) redirect('app/dashboard.php');

$errors = [];
$name = $email = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();

    $name     = sanitize_string(post('name'), 100);
    $email    = sanitize_email(post('email')) ?: '';
    $password = post('password');
    $confirm  = post('password_confirm');
    $terms    = !empty($_POST['terms']);

    $v = new Validator($_POST);
    $v->required('name', 'Prénom et nom')
      ->min('name', 2, 'Le nom')
      ->required('email', 'Email')
      ->email('email')
      ->required('password', 'Mot de passe')
      ->min('password', 8, 'Le mot de passe')
      ->matches('password', 'password_confirm', 'Les mots de passe');

    if (!$terms) {
        $errors['terms'] = 'Vous devez accepter les conditions d\'utilisation.';
    }

    if ($v->fails()) {
        $errors = array_merge($errors, $v->errors());
    } elseif (empty($errors)) {
        try {
            $userId = auth_register($name, $email, $password, current_lang());
            flash('success', __('auth.verify_email_sent', ['email' => $email]));
            redirect('auth/login.php');
        } catch (RuntimeException $e) {
            $errors['global'] = $e->getMessage();
        }
    }
}

// Google OAuth
$googleUrl = '';
if (GOOGLE_CLIENT_ID) {
    $state = generate_token(16);
    $_SESSION['oauth_state'] = $state;
    $params = http_build_query([
        'client_id'     => GOOGLE_CLIENT_ID,
        'redirect_uri'  => GOOGLE_REDIRECT_URI,
        'response_type' => 'code',
        'scope'         => 'openid email profile',
        'state'         => $state,
        'access_type'   => 'online',
        'prompt'        => 'select_account',
    ]);
    $googleUrl = 'https://accounts.google.com/o/oauth2/v2/auth?' . $params;
}

$pageTitle = __('auth.register_title');
ob_start();
?>

<div class="auth-header">
  <div class="auth-icon">✨</div>
  <h1 class="auth-title">Créer mon compte</h1>
  <p class="auth-subtitle">Gratuit, sans carte bancaire. Commencez à identifier vos déclencheurs.</p>
</div>

<?php if (!empty($errors['global'])): ?>
  <div class="flash flash-error"><?= e($errors['global']) ?></div>
<?php endif; ?>

<?php if ($googleUrl): ?>
<a href="<?= e($googleUrl) ?>" class="btn-google">
  <svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
    <path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4"/>
    <path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853"/>
    <path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05"/>
    <path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335"/>
  </svg>
  Continuer avec Google
</a>
<div class="auth-divider">ou</div>
<?php endif; ?>

<form method="POST" action="" novalidate>
  <?= csrf_field() ?>

  <div class="form-group">
    <label class="form-label" for="name"><?= _e('auth.name') ?></label>
    <input type="text" id="name" name="name"
      class="form-input <?= isset($errors['name']) ? 'error' : '' ?>"
      value="<?= e($name) ?>"
      placeholder="Marie Dupont"
      autocomplete="name" required>
    <?php if (isset($errors['name'])): ?>
      <div class="form-error"><?= e($errors['name']) ?></div>
    <?php endif; ?>
  </div>

  <div class="form-group">
    <label class="form-label" for="email"><?= _e('auth.email') ?></label>
    <input type="email" id="email" name="email"
      class="form-input <?= isset($errors['email']) ? 'error' : '' ?>"
      value="<?= e($email) ?>"
      placeholder="vous@exemple.fr"
      autocomplete="email" required>
    <?php if (isset($errors['email'])): ?>
      <div class="form-error"><?= e($errors['email']) ?></div>
    <?php endif; ?>
  </div>

  <div class="form-group">
    <label class="form-label" for="password"><?= _e('auth.password') ?></label>
    <div class="input-wrapper">
      <input type="password" id="password" name="password"
        class="form-input <?= isset($errors['password']) ? 'error' : '' ?>"
        placeholder="8 caractères minimum"
        autocomplete="new-password" required>
      <button type="button" class="password-toggle" aria-label="Afficher">👁</button>
    </div>
    <div class="password-strength">
      <div class="strength-bar"><div class="strength-fill"></div></div>
      <div class="strength-text"></div>
    </div>
    <?php if (isset($errors['password'])): ?>
      <div class="form-error"><?= e($errors['password']) ?></div>
    <?php endif; ?>
  </div>

  <div class="form-group">
    <label class="form-label" for="password_confirm"><?= _e('auth.password_confirm') ?></label>
    <div class="input-wrapper">
      <input type="password" id="password_confirm" name="password_confirm"
        class="form-input <?= isset($errors['password']) ? 'error' : '' ?>"
        placeholder="Répétez le mot de passe"
        autocomplete="new-password" required>
      <button type="button" class="password-toggle" aria-label="Afficher">👁</button>
    </div>
  </div>

  <div class="form-group">
    <label class="form-check">
      <input type="checkbox" name="terms" <?= !empty($_POST['terms']) ? 'checked' : '' ?>>
      En créant un compte, j'accepte les
      <a href="<?= url('legal/terms.php') ?>" target="_blank">CGU</a>
      et la
      <a href="<?= url('legal/privacy.php') ?>" target="_blank">Politique de confidentialité</a>
    </label>
    <?php if (isset($errors['terms'])): ?>
      <div class="form-error"><?= e($errors['terms']) ?></div>
    <?php endif; ?>
  </div>

  <button type="submit" class="btn-primary">
    <span>Créer mon compte gratuit</span>
    <div class="spinner"></div>
  </button>
</form>

<div class="auth-footer" style="margin-top:20px;">
  <?= _e('auth.have_account') ?>
  <a href="<?= url('auth/login.php') ?>"><?= _e('auth.login_btn') ?></a>
</div>

<?php
$content = ob_get_clean();
require DS_VIEWS . 'layouts/auth.php';