<?php
/**
 * SUPER LOG - Token Generator
 * Location: relevantreflex.shop/superlog-generate.php
 * 
 * Generates a one-time, time-limited token and redirects to
 * relevantreflex.com/superlog/ for admin impersonation.
 * Only super_admin role can access this.
 */
require_once 'config.php';

// Must be logged in as admin
if (!isLoggedIn()) {
    header('Location: login.php');
    exit;
}

// Only super_admin can use superlog
if (!isAdmin()) {
    http_response_code(403);
    die('Access denied. Super Log is restricted to Super Admins only.');
}

try {
    $pdo = getDBConnection();
    
    // Create tokens table if it doesn't exist
    $pdo->exec("CREATE TABLE IF NOT EXISTS superlog_tokens (
        id INT AUTO_INCREMENT PRIMARY KEY,
        admin_id INT NOT NULL,
        admin_username VARCHAR(100) NOT NULL,
        admin_name VARCHAR(200) NOT NULL,
        token VARCHAR(128) NOT NULL,
        ip_address VARCHAR(45),
        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
        expires_at DATETIME NOT NULL,
        used TINYINT(1) DEFAULT 0,
        used_at DATETIME NULL,
        UNIQUE KEY idx_token (token),
        INDEX idx_expires (expires_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4");
    
    // Clean up expired / old used tokens
    $pdo->exec("DELETE FROM superlog_tokens WHERE expires_at < NOW() OR (used = 1 AND created_at < DATE_SUB(NOW(), INTERVAL 24 HOUR))");
    
    // Rate limit: max 10 tokens per admin per hour
    $stmt = $pdo->prepare("SELECT COUNT(*) FROM superlog_tokens WHERE admin_id = ? AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)");
    $stmt->execute([$_SESSION['admin_id']]);
    if ((int)$stmt->fetchColumn() >= 10) {
        die('Rate limit exceeded. Please wait before generating another Super Log token.');
    }
    
    // Generate cryptographically secure token
    $token = bin2hex(random_bytes(64)); // 128 chars
    
    // Store token with 5-minute expiry
    $stmt = $pdo->prepare("
        INSERT INTO superlog_tokens (admin_id, admin_username, admin_name, token, ip_address, expires_at) 
        VALUES (?, ?, ?, ?, ?, DATE_ADD(NOW(), INTERVAL 5 MINUTE))
    ");
    $stmt->execute([
        $_SESSION['admin_id'],
        $_SESSION['admin_username'],
        $_SESSION['admin_name'] ?? $_SESSION['admin_username'],
        $token,
        $_SERVER['REMOTE_ADDR'] ?? ''
    ]);
    
    // Log the superlog initiation in admin activity
    logActivity($_SESSION['admin_id'], 'superlog_init', 'Super Log session initiated from ' . ($_SERVER['REMOTE_ADDR'] ?? 'unknown'));
    
    // Redirect to superlog page on relevantreflex.com
    header('Location: https://relevantreflex.com/superlog/?token=' . urlencode($token));
    exit;
    
} catch (Exception $e) {
    error_log("Superlog token generation error: " . $e->getMessage());
    die('Error generating Super Log token. Please try again.');
}