<?php
function gp_auth_user_full(PDO $pdo): ?array
{
    $sessionUser = auth_user();
    if (!$sessionUser || empty($sessionUser['id'])) return null;

    $stmt = $pdo->prepare("SELECT id, username, email, role, is_active FROM users WHERE id = :id LIMIT 1");
    $stmt->execute([':id' => (int)$sessionUser['id']]);
    $u = $stmt->fetch();
    if (!$u || (int)($u['is_active'] ?? 0) !== 1) return null;
    return $u;
}

function gp_user_role(PDO $pdo): string
{
    $u = gp_auth_user_full($pdo);
    return $u ? strtolower(trim((string)($u['role'] ?? ''))) : '';
}

function gp_current_user_id(): int
{
    $sessionUser = auth_user();
    return (int)($sessionUser['id'] ?? 0);
}

function gp_is_full_project_access_role(string $role): bool
{
    return in_array($role, ['admin', 'administrator', 'super_admin', 'owner', 'manager'], true);
}

function gp_is_secretary_like_role(string $role): bool
{
    return in_array($role, ['secretary', 'secretariat', 'office'], true);
}

function gp_can_create_project(PDO $pdo): bool
{
    $role = gp_user_role($pdo);
    return gp_is_full_project_access_role($role) || gp_is_secretary_like_role($role);
}

function gp_can_manage_project_access(PDO $pdo): bool
{
    return gp_is_full_project_access_role(gp_user_role($pdo));
}

function gp_can_edit_project(PDO $pdo, int $projectId): bool
{
    $u = gp_auth_user_full($pdo);
    if (!$u || $projectId <= 0) return false;

    $role = strtolower(trim((string)($u['role'] ?? '')));

    if (gp_is_full_project_access_role($role)) {
        return true;
    }

    if (gp_is_secretary_like_role($role)) {
        $stmt = $pdo->prepare("SELECT can_edit FROM project_edit_permissions WHERE user_id = :uid AND project_id = :pid LIMIT 1");
        $stmt->execute([
            ':uid' => (int)$u['id'],
            ':pid' => $projectId,
        ]);
        return (int)($stmt->fetchColumn() ?: 0) === 1;
    }

    return false;
}

function gp_require_project_edit(PDO $pdo, int $projectId): void
{
    if (!gp_can_edit_project($pdo, $projectId)) {
        http_response_code(403);
        exit('Project edit access denied.');
    }
}

function gp_require_project_create(PDO $pdo): void
{
    if (!gp_can_create_project($pdo)) {
        http_response_code(403);
        exit('Project create access denied.');
    }
}
