// --------- School Frontend Login (shortcode) ----------
function dc_school_login_form(){
    global $wpdb;
    // already logged in?
    if(!empty($_SESSION['dc_school_id'])){
        return '<div class="dc-success">You are already logged in. <a href="'.site_url('?dc_action=logout').'">Logout</a> | <a href="'.site_url('?dc_action=dashboard').'">Go to Dashboard</a></div>';
    }

    $output = '';
    if(isset($_POST['dc_school_login'])){
        $email = sanitize_email($_POST['email']);
        $password = $_POST['password'];

        $table = $wpdb->prefix.'dc_schools';
        $school = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $table WHERE email = %s AND password = %s", $email, wp_hash_password($password)) );

        if($school){
            // set session
            $_SESSION['dc_school_id'] = intval($school->id);
            $_SESSION['dc_school_name'] = $school->school_name;
            // redirect to dashboard page (current page)
            wp_safe_redirect( add_query_arg('dc_action','dashboard', $_SERVER['REQUEST_URI']) );
            exit;
        } else {
            $output .= '<div class="dc-error">Invalid email or password.</div>';
        }
    }

    $output .= '<form method="post" class="dc-school-login-form">';
    $output .= '<input type="email" name="email" placeholder="School Email" required />';
    $output .= '<input type="password" name="password" placeholder="Password" required />';
    $output .= '<button type="submit" name="dc_school_login">Login</button>';
    $output .= '</form>';

    return $output;
}
add_shortcode('dc_school_login','dc_school_login_form');


// --------- School Logout Handler (URL param) ----------
function dc_frontend_action_handler(){
    if(isset($_GET['dc_action']) && $_GET['dc_action'] == 'logout'){
        // clear session
        unset($_SESSION['dc_school_id']);
        unset($_SESSION['dc_school_name']);
        // redirect to current page without param
        $url = remove_query_arg('dc_action', $_SERVER['REQUEST_URI']);
        wp_safe_redirect( $url );
        exit;
    }
    if(isset($_GET['dc_action']) && $_GET['dc_action'] == 'dashboard'){
        // redirect to a page (if needed). noop here.
    }
}
add_action('init','dc_frontend_action_handler');


// --------- School Dashboard Shortcode ----------
function dc_school_dashboard_shortcode(){
    global $wpdb;

    // require login
    if(empty($_SESSION['dc_school_id'])){
        return '<div class="dc-error">Please login first. <a href="'.site_url().'">Go to Login</a></div>';
    }

    $school_id = intval($_SESSION['dc_school_id']);
    $output = '<h2>Welcome, '.esc_html($_SESSION['dc_school_name']).'</h2>';
    $output .= '<p><a href="'.add_query_arg('dc_action','logout', $_SERVER['REQUEST_URI']).'">Logout</a></p>';

    // Handle CSV export
    if(isset($_GET['dc_export']) && $_GET['dc_export'] == 'csv'){
        // which level?
        $level = isset($_GET['level']) ? sanitize_text_field($_GET['level']) : 'all';
        // fetch rows
        if($level == 'all'){
            $rows = $wpdb->get_results( $wpdb->prepare("SELECT * FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d ORDER BY id DESC", $school_id), ARRAY_A );
            $filename_level = 'all';
        } else {
            $rows = $wpdb->get_results( $wpdb->prepare("SELECT * FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d AND level = %s ORDER BY id DESC", $school_id, $level), ARRAY_A );
            // sanitize filename part
            $filename_level = preg_replace('/[^a-z0-9_\-]/i','_', $level);
        }

        // send CSV headers
        header('Content-Type: text/csv; charset=utf-8');
        header('Content-Disposition: attachment; filename=students_school_'.$school_id.'_'.$filename_level.'_'.date('Ymd_His').'.csv');

        $output_csv = fopen('php://output', 'w');
        // header row
        fputcsv($output_csv, array('ID','Student Name','Mother Name','Father Name','Mobile','District','DOB','Gender','Level','Created At'));
        foreach($rows as $r){
            fputcsv($output_csv, array(
                $r['id'],
                $r['student_name'],
                $r['mother_name'],
                $r['father_name'],
                $r['mobile'],
                $r['district'],
                $r['dob'],
                $r['gender'],
                $r['level'],
                $r['created_at']
            ));
        }
        fclose($output_csv);
        exit;
    }

    // Filter form (select level)
    $output .= '<form method="get" class="dc-filter-form">';
    $output .= '<input type="hidden" name="page_id" value="'.(isset($_GET['page_id'])?esc_attr($_GET['page_id']):'').'" />'; // keep page id if used
    $output .= '<label>Filter by Level: </label>';
    $levels = array('all'=>'All','Elementary Grade Drawing Competition'=>'Elementary','Junior Grade Drawing Competition'=>'Junior','Senior Grade Drawing Competition'=>'Senior');
    $selected = isset($_GET['level']) ? sanitize_text_field($_GET['level']) : 'all';
    $output .= '<select name="level">';
    foreach($levels as $k=>$v){
        $sel = ($selected == $k) ? 'selected' : '';
        $output .= "<option value=\"".esc_attr($k)."\" $sel>".esc_html($v)."</option>";
    }
    $output .= '</select>';
    $output .= '<button type="submit">Apply</button>';
    $output .= '</form>';

    // Get students for this school (filtered)
    $level = isset($_GET['level']) ? sanitize_text_field($_GET['level']) : 'all';
    if($level == 'all'){
        $students = $wpdb->get_results( $wpdb->prepare("SELECT * FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d ORDER BY id DESC", $school_id) );
    } else {
        $students = $wpdb->get_results( $wpdb->prepare("SELECT * FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d AND level = %s ORDER BY id DESC", $school_id, $level) );
    }

    // Summary counts for school
    $total_all = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d", $school_id) );
    $total_elementary = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d AND level = %s", $school_id, 'Elementary Grade Drawing Competition') );
    $total_junior = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d AND level = %s", $school_id, 'Junior Grade Drawing Competition') );
    $total_senior = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}dc_candidates WHERE school_id = %d AND level = %s", $school_id, 'Senior Grade Drawing Competition') );

    $output .= '<div class="dc-stats">';
    $output .= '<b>Total Students:</b> '.intval($total_all).' &nbsp; ';
    $output .= '<b>Elementary:</b> '.intval($total_elementary).' &nbsp; ';
    $output .= '<b>Junior:</b> '.intval($total_junior).' &nbsp; ';
    $output .= '<b>Senior:</b> '.intval($total_senior);
    $output .= '</div>';

    // Export links
    // build base url keeping page params
    $base_url = remove_query_arg(array('dc_export','level'), $_SERVER['REQUEST_URI']);
    $export_all_url = add_query_arg(array('dc_export'=>'csv','level'=>'all'), $base_url);
    $export_elem_url = add_query_arg(array('dc_export'=>'csv','level'=>'Elementary Grade Drawing Competition'), $base_url);
    $export_jun_url = add_query_arg(array('dc_export'=>'csv','level'=>'Junior Grade Drawing Competition'), $base_url);
    $export_sen_url = add_query_arg(array('dc_export'=>'csv','level'=>'Senior Grade Drawing Competition'), $base_url);

    $output .= '<p>Export: <a href="'.esc_url($export_all_url).'">All</a> | <a href="'.esc_url($export_elem_url).'">Elementary</a> | <a href="'.esc_url($export_jun_url).'">Junior</a> | <a href="'.esc_url($export_sen_url).'">Senior</a></p>';

    // Students table
    if($students){
        $output .= '<table class="dc-table" cellpadding="5" cellspacing="0" border="1" style="border-collapse:collapse;width:100%">';
        $output .= '<tr><th>ID</th><th>Name</th><th>Mobile</th><th>District</th><th>Level</th><th>Registered On</th><th>Actions</th></tr>';
        foreach($students as $s){
            $output .= '<tr>';
            $output .= '<td>'.intval($s->id).'</td>';
            $output .= '<td>'.esc_html($s->student_name).'</td>';
            $output .= '<td>'.esc_html($s->mobile).'</td>';
            $output .= '<td>'.esc_html($s->district).'</td>';
            $output .= '<td>'.esc_html($s->level).'</td>';
            $output .= '<td>'.esc_html($s->created_at).'</td>';
            // actions: view preview (link to candidate preview page), edit (if allowed), hall ticket
            $view_url = add_query_arg(array('dc_view_candidate' => $s->id), $_SERVER['REQUEST_URI']);
            $edit_url = add_query_arg(array('dc_edit_candidate' => $s->id), $_SERVER['REQUEST_URI']);
            $hall_url = add_query_arg(array('dc_hall' => $s->id), $_SERVER['REQUEST_URI']);
            $output .= '<td><a href="'.esc_url($view_url).'">View</a> | <a href="'.esc_url($edit_url).'">Edit</a> | <a href="'.esc_url($hall_url).'" target="_blank">Hall Ticket</a></td>';
            $output .= '</tr>';
        }
        $output .= '</table>';
    } else {
        $output .= '<p>No students found for selected filter.</p>';
    }

    // handle view/edit/hall request (simple)
    if(isset($_GET['dc_view_candidate'])){
        $cid = intval($_GET['dc_view_candidate']);
        $c = $wpdb->get_row( $wpdb->prepare("SELECT * FROM {$wpdb->prefix}dc_candidates WHERE id = %d AND school_id = %d", $cid, $school_id) );
        if($c){
            $output .= '<h3>Candidate Preview</h3>';
            $output .= '<p><b>Name:</b> '.esc_html($c->student_name).'</p>';
            $output .= '<p><b>Father:</b> '.esc_html($c->father_name).'</p>';
            $output .= '<p><b>Mother:</b> '.esc_html($c->mother_name).'</p>';
            $output .= '<p><b>Mobile:</b> '.esc_html($c->mobile).'</p>';
            $output .= '<p><b>Level:</b> '.esc_html($c->level).'</p>';
            if(!empty($c->photo)){
                $photo_url = plugins_url('uploads/'.$c->photo, DC_PLUGIN_DIR.'../');
                // better to serve uploads via plugin uploads or server uploads — adjust path if needed
                $output .= '<p><img src="'.esc_url($photo_url).'" style="max-width:120px" /></p>';
            }
            $output .= '<p><button onclick="window.print()">Print</button></p>';
        } else {
            $output .= '<div class="dc-error">Candidate not found or you do not have permission.</div>';
        }
    }

    // Edit handling: redirect to edit form page or display inline form
    if(isset($_GET['dc_edit_candidate'])){
        $cid = intval($_GET['dc_edit_candidate']);
        $c = $wpdb->get_row( $wpdb->prepare("SELECT * FROM {$wpdb->prefix}dc_candidates WHERE id = %d AND school_id = %d", $cid, $school_id) );
        if($c){
            // if POST update
            if(isset($_POST['dc_update_candidate']) && intval($_POST['candidate_id']) == $cid){
                $wpdb->update(
                    $wpdb->prefix.'dc_candidates',
                    array(
                        'student_name' => sanitize_text_field($_POST['student_name']),
                        'father_name' => sanitize_text_field($_POST['father_name']),
                        'mother_name' => sanitize_text_field($_POST['mother_name']),
                        'mobile' => sanitize_text_field($_POST['mobile']),
                        'district' => sanitize_text_field($_POST['district']),
                        'dob' => sanitize_text_field($_POST['dob']),
                        'gender' => sanitize_text_field($_POST['gender']),
                        'level' => sanitize_text_field($_POST['level'])
                    ),
                    array('id' => $cid)
                );
                $output .= '<div class="dc-success">Candidate updated successfully.</div>';
                // refresh candidate data
                $c = $wpdb->get_row( $wpdb->prepare("SELECT * FROM {$wpdb->prefix}dc_candidates WHERE id = %d", $cid) );
            }

            // edit form
            $output .= '<h3>Edit Candidate</h3>';
            $output .= '<form method="post">';
            $output .= '<input type="hidden" name="candidate_id" value="'.intval($c->id).'" />';
            $output .= '<input type="text" name="student_name" value="'.esc_attr($c->student_name).'" required />';
            $output .= '<input type="text" name="father_name" value="'.esc_attr($c->father_name).'" />';
            $output .= '<input type="text" name="mother_name" value="'.esc_attr($c->mother_name).'" />';
            $output .= '<input type="text" name="mobile" value="'.esc_attr($c->mobile).'" />';
            $output .= '<input type="text" name="district" value="'.esc_attr($c->district).'" />';
            $output .= '<input type="date" name="dob" value="'.esc_attr($c->dob).'" />';
            $output .= '<select name="gender">';
            $g = $c->gender;
            $output .= '<option '.($g=='Male'?'selected':'').' value="Male">Male</option>';
            $output .= '<option '.($g=='Female'?'selected':'').' value="Female">Female</option>';
            $output .= '<option '.($g=='Other'?'selected':'').' value="Other">Other</option>';
            $output .= '</select>';
            $output .= '<select name="level">';
            $levels_full = array('Elementary Grade Drawing Competition','Junior Grade Drawing Competition','Senior Grade Drawing Competition');
            foreach($levels_full as $lv){
                $sel = ($c->level == $lv) ? 'selected' : '';
                $output .= '<option '.$sel.' value="'.esc_attr($lv).'">'.esc_html($lv).'</option>';
            }
            $output .= '</select>';
            $output .= '<button type="submit" name="dc_update_candidate">Update Candidate</button>';
            $output .= '</form>';
        } else {
            $output .= '<div class="dc-error">Candidate not found or you do not have permission.</div>';
        }
    }

    return $output;
}
add_shortcode('dc_school_dashboard','dc_school_dashboard_shortcode');