<?php
require 'config.php';
session_start();
require 'contadb.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    // CSRF Check
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF token validation failed");
    }

    // reCAPTCHA Check
    $recaptcha_secret = RECAPTCHA_SECRET_KEY;
    $recaptcha_response = $_POST['g-recaptcha-response'];

    $url = 'https://www.google.com/recaptcha/api/siteverify';
    $data = [
        'secret' => $recaptcha_secret,
        'response' => $recaptcha_response
    ];

    $options = [
        'http' => [
            'header'  => "Content-type: application/x-www-form-urlencoded\r\n",
            'method'  => 'POST',
            'content' => http_build_query($data)
        ]
    ];
    $context  = stream_context_create($options);
    $verify = file_get_contents($url, false, $context);
    $captcha_success = json_decode($verify);

    if ($verify === false || !$captcha_success->success) {
        die("reCAPTCHA validation failed. Please try again.");
    }

    $researcher_name = htmlspecialchars($_POST['researcher_name']);
    $research_name = htmlspecialchars($_POST['research_name']);
    $title = htmlspecialchars($_POST['title']);
    $degree = htmlspecialchars($_POST['degree']);
    $specialization = htmlspecialchars($_POST['specialization']);
    $institutional_email = filter_input(INPUT_POST, 'institutional_email', FILTER_VALIDATE_EMAIL);
    $mobile_number = htmlspecialchars($_POST['mobile_number']);
    $affiliation = htmlspecialchars($_POST['affiliation']);
    $area_of_interest = htmlspecialchars($_POST['area_of_interest']);
    $journal_selection = htmlspecialchars($_POST['journal_selection']);


    if (!empty($_FILES['search_file']) && $_FILES['search_file']['error'] === UPLOAD_ERR_OK) {
        $file = $_FILES['search_file'];

        // Limit size (e.g. 5MB)
        if ($file['size'] > 5 * 1024 * 1024) {
            die("File size exceeds 5MB limit.");
        }

        $allowed_mime_types = [
            'application/pdf',
            'application/msword',
            'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
        ];

        // Verify MIME type
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mime_type = finfo_file($finfo, $file['tmp_name']);
        finfo_close($finfo);

        if (!in_array($mime_type, $allowed_mime_types)) {
            die("Invalid file type. Only PDF and Word documents are allowed.");
        }

        // Verify Extension
        $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
        $allowed_exts = ['pdf', 'doc', 'docx'];
        if (!in_array($ext, $allowed_exts)) {
            die("Invalid file extension.");
        }

        $upload_dir = 'uploads/';
        // Generate secure random filename
        $file_name = uniqid('doc_', true) . '.' . $ext;
        $file_path = "{$upload_dir}{$file_name}";

        if (!move_uploaded_file($file['tmp_name'], $file_path)) {
            die("Failed to move uploaded file.");
        }
    } else {
        $file_path = null;
    }


    try {
        $stmt = $pdo->prepare("INSERT INTO researchers 
            (researcher_name,research_name, title, degree, specialization, institutional_email, mobile_number, affiliation, area_of_interest, journal_selection, file_path) 
            VALUES 
            (:researcher_name,:research_name, :title, :degree, :specialization, :institutional_email, :mobile_number, :affiliation, :area_of_interest, :journal_selection, :file_path)");

        $stmt->execute([
            ':researcher_name' => $researcher_name,
            ':research_name' => $research_name,
            ':title' => $title,
            ':degree' => $degree,
            ':specialization' => $specialization,
            ':institutional_email' => $institutional_email,
            ':mobile_number' => $mobile_number,
            ':affiliation' => $affiliation,
            ':area_of_interest' => $area_of_interest,
            ':journal_selection' => $journal_selection,
            ':file_path' => $file_path
        ]);

        $success_message = "Application submitted successfully!";
    } catch (PDOException $e) {
        die("Database error: " . $e->getMessage());
    }
}

require 'header.php';
?>

<div class="container mt-5 animate__animated animate__fadeIn">
    <div class="card shadow-lg">
        <div class="card-header bg-success text-white text-center py-4">
            <h2 class="animate__animated animate__bounceInDown">Successfully Submitted!</h2>
        </div>
        <div class="card-body p-5 text-center">
            <?php if (isset($success_message)): ?>
                <div class="alert alert-success animate__animated animate__fadeIn">
                    Your Information have been recorded

                </div>
            <?php endif; ?>
            <p>Please start your submission by click on the following link
            </p>
            <p><a href="https://iscmbt-kufa-atu.com/iscmbt/index.php/ojs/login">click Here</a></p>
            <a href="index.php" class="btn btn-primary btn-lg animate__animated animate__pulse">
                <i class="fas fa-home me-2"></i> Back to Home Page

            </a>
        </div>
    </div>
</div>

<?php require 'footer.php'; ?>