<?php
/**
 * 福彩3D 报告页(fc3d.html) 登录/账号管理 API
 * 2026-09-09 屠哥需求: 额外新增带登录的报告页; 管理员账号可增删游客账号。
 * 账号数据持久化: fc3d_accounts.json (服务器本地文件)
 */
session_start();
header('Content-Type: application/json; charset=utf-8');

$DATA = __DIR__ . '/fc3d_accounts.json';

function load_acc($f) {
    if (!file_exists($f)) {
        $init = array(
            'admin' => array('pwd' => 'admin888', 'role' => 'admin'),
            'guest' => array('pwd' => 'guest888', 'role' => 'guest'),
        );
        @file_put_contents($f, json_encode($init, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT));
        @chmod($f, 0600);
        return $init;
    }
    $j = @json_decode(@file_get_contents($f), true);
    return is_array($j) ? $j : array();
}
function save_acc($f, $a) {
    $r = @file_put_contents($f, json_encode($a, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT));
    return $r !== false;
}
function out($arr) { echo json_encode($arr, JSON_UNESCAPED_UNICODE); exit; }
function is_admin() { return (($_SESSION['fc3d_role'] ?? '') === 'admin'); }

$act = $_POST['act'] ?? $_GET['act'] ?? '';

/* ---------- 验证码(图片) ---------- */
if ($act === 'captcha') {
    if (!function_exists('imagecreatetruecolor')) {
        // 无GD扩展: 降级为文本验证码(明文返回, 仅保证流程可用)
        $code = (string)random_int(1000, 9999);
        $_SESSION['fc3d_captcha'] = $code;
        header('Content-Type: text/plain; charset=utf-8');
        echo $code; exit;
    }
    $code = (string)random_int(1000, 9999);
    $_SESSION['fc3d_captcha'] = $code;
    header('Content-Type: image/png');
    header('Cache-Control: no-store, no-cache, must-revalidate');
    $im = imagecreatetruecolor(90, 34);
    $bg = imagecolorallocate($im, 246, 248, 250);
    imagefilledrectangle($im, 0, 0, 90, 34, $bg);
    for ($i = 0; $i < 60; $i++) {
        imagesetpixel($im, random_int(0, 90), random_int(0, 34),
            imagecolorallocate($im, random_int(120, 210), random_int(120, 210), random_int(120, 210)));
    }
    for ($i = 0; $i < 3; $i++) {
        imageline($im, random_int(0, 90), random_int(0, 34), random_int(0, 90), random_int(0, 34),
            imagecolorallocate($im, random_int(150, 220), random_int(150, 220), random_int(150, 220)));
    }
    $tc = imagecolorallocate($im, 25, 60, 120);
    imagestring($im, 5, 18, 9, $code, $tc);
    imagepng($im);
    imagedestroy($im);
    exit;
}

/* ---------- 登录 ---------- */
if ($act === 'login') {
    $u = trim($_POST['user'] ?? '');
    $p = trim($_POST['pwd'] ?? '');
    $c = trim($_POST['captcha'] ?? '');
    if ($u === '' || $p === '') out(array('ok' => false, 'msg' => '请输入用户名与密码'));
    $sess = $_SESSION['fc3d_captcha'] ?? '';
    if ($sess === '' || strcasecmp($c, $sess) !== 0) {
        out(array('ok' => false, 'msg' => '验证码错误或已过期'));
    }
    $acc = load_acc($DATA);
    if (!isset($acc[$u]) || $acc[$u]['pwd'] !== $p) {
        out(array('ok' => false, 'msg' => '用户名或密码错误'));
    }
    $_SESSION['fc3d_user'] = $u;
    $_SESSION['fc3d_role'] = $acc[$u]['role'];
    unset($_SESSION['fc3d_captcha']);
    out(array('ok' => true, 'user' => $u, 'role' => $acc[$u]['role']));
}

/* ---------- 退出 ---------- */
if ($act === 'logout') {
    $_SESSION = array();
    if (ini_get('session.use_cookies')) {
        $p = session_get_cookie_params();
        setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
    }
    session_destroy();
    out(array('ok' => true));
}

/* ---------- 当前登录态 ---------- */
if ($act === 'me') {
    out(array(
        'ok' => isset($_SESSION['fc3d_user']),
        'user' => $_SESSION['fc3d_user'] ?? null,
        'role' => $_SESSION['fc3d_role'] ?? null,
    ));
}

/* ---------- 管理员: 账号列表 ---------- */
if ($act === 'list') {
    if (!is_admin()) out(array('ok' => false, 'msg' => '需要管理员权限'));
    $acc = load_acc($DATA);
    $list = array();
    foreach ($acc as $k => $v) $list[] = array('user' => $k, 'role' => $v['role']);
    out(array('ok' => true, 'list' => $list));
}

/* ---------- 管理员: 新增游客 ---------- */
if ($act === 'add') {
    if (!is_admin()) out(array('ok' => false, 'msg' => '需要管理员权限'));
    $u = trim($_POST['user'] ?? '');
    $p = trim($_POST['pwd'] ?? '');
    if ($u === '' || $p === '') out(array('ok' => false, 'msg' => '账号与密码不能为空'));
    if (strlen($u) > 32) out(array('ok' => false, 'msg' => '账号过长(最多32字符)'));
    $acc = load_acc($DATA);
    if (isset($acc[$u])) out(array('ok' => false, 'msg' => '该账号已存在'));
    $acc[$u] = array('pwd' => $p, 'role' => 'guest');
    if (!save_acc($DATA, $acc)) out(array('ok' => false, 'msg' => '写入失败: 服务器账号文件不可写'));
    out(array('ok' => true, 'msg' => '已新增游客账号 ' . $u));
}

/* ---------- 管理员: 删除游客 ---------- */
if ($act === 'del') {
    if (!is_admin()) out(array('ok' => false, 'msg' => '需要管理员权限'));
    $u = trim($_POST['user'] ?? '');
    if ($u === 'admin') out(array('ok' => false, 'msg' => '管理员账号不可删除'));
    $acc = load_acc($DATA);
    if (!isset($acc[$u])) out(array('ok' => false, 'msg' => '账号不存在'));
    unset($acc[$u]);
    if (!save_acc($DATA, $acc)) out(array('ok' => false, 'msg' => '写入失败: 服务器账号文件不可写'));
    out(array('ok' => true, 'msg' => '已删除账号 ' . $u));
}

/* ---------- 自助改密(任意已登录用户改自己的密码, 需验证旧密码) ---------- */
if ($act === 'selfchpwd') {
    $u = $_SESSION['fc3d_user'] ?? '';
    if ($u === '') out(array('ok' => false, 'msg' => '未登录'));
    $old = trim($_POST['old'] ?? '');
    $p = trim($_POST['pwd'] ?? '');
    if ($p === '') out(array('ok' => false, 'msg' => '新密码不能为空'));
    $acc = load_acc($DATA);
    if (!isset($acc[$u]) || $acc[$u]['pwd'] !== $old) {
        out(array('ok' => false, 'msg' => '原密码不正确'));
    }
    $acc[$u]['pwd'] = $p;
    if (!save_acc($DATA, $acc)) out(array('ok' => false, 'msg' => '写入失败: 服务器账号文件不可写'));
    out(array('ok' => true, 'msg' => '密码已修改, 下次登录生效'));
}

/* ---------- 管理员: 改密码 ---------- */
if ($act === 'chpwd') {
    if (!is_admin()) out(array('ok' => false, 'msg' => '需要管理员权限'));
    $u = trim($_POST['user'] ?? '');
    $p = trim($_POST['pwd'] ?? '');
    if ($p === '') out(array('ok' => false, 'msg' => '新密码不能为空'));
    $acc = load_acc($DATA);
    if (!isset($acc[$u])) out(array('ok' => false, 'msg' => '账号不存在'));
    $acc[$u]['pwd'] = $p;
    save_acc($DATA, $acc);
    out(array('ok' => true, 'msg' => '已修改 ' . $u . ' 的密码'));
}

out(array('ok' => false, 'msg' => '未知操作'));