config.php

<?php
/**
 * Database Configuration
 */
if (PHP_SAPI === 'cli') {
    define('BASE_URL', '/expenses/');
} else {
    $scriptName = $_SERVER['SCRIPT_NAME'] ?? '';
    define('BASE_URL', (strpos($scriptName, '/expenses/') === 0) ? '/expenses/' : '/');
}


// Load .env variables
$envFile = __DIR__ . '/.env';
if (file_exists($envFile)) {
    $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    foreach ($lines as $line) {
        $line = trim($line);
        if ($line === '' || $line[0] === '#') {
            continue;
        }
        $parts = explode('=', $line, 2);
        if (count($parts) !== 2) {
            continue; // skip malformed
        }
        $name = trim($parts[0]);
        $value = trim($parts[1]);
        if ($value !== '' && ($value[0] === '"' || $value[0] === "'")) {
            $value = trim($value, "\"'");
        } else {
            // Unquoted values may carry an inline comment: KEY=value   # comment
            $value = trim(preg_replace('/\s+#.*$/', '', $value));
        }
        if ($name === '') {
            continue;
        }
        putenv(sprintf('%s=%s', $name, $value));
        $_ENV[$name] = $value;
    }
}

// Force HTTPS in production
if (($_ENV['APP_ENV'] ?? 'production') === 'production'
    && PHP_SAPI !== 'cli'
    && empty($_SERVER['HTTPS'])
    && ($_SERVER['SERVER_PORT'] ?? 80) != 443) {
    $host = $_SERVER['HTTP_HOST'] ?? '';
    $uri  = $_SERVER['REQUEST_URI'] ?? '/';
    header('Location: https://' . $host . $uri, true, 301);
    exit();
}

// Set Timezone
date_default_timezone_set($_ENV['APP_TIMEZONE'] ?? 'Asia/Dubai');

// Database Host (e.g., localhost or IP address)
define('DB_HOST', $_ENV['DB_HOST'] ?? 'localhost');

// Database Name
define('DB_NAME', $_ENV['DB_NAME'] ?? '');

// Database Username
define('DB_USER', $_ENV['DB_USER'] ?? '');

// Database Password
define('DB_PASS', $_ENV['DB_PASS'] ?? '');

// Charset
define('DB_CHARSET', 'utf8mb4');

try {
    $dsn = "mysql:host=" . DB_HOST . ";dbname=" . DB_NAME . ";charset=" . DB_CHARSET;
    $options = [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES => false,
    ];

    $pdo = new PDO($dsn, DB_USER, DB_PASS, $options);

    // Sync DB timezone with PHP timezone
    $now = new DateTime();
    $mins = $now->getOffset() / 60;
    $sgn = ($mins < 0 ? -1 : 1);
    $mins = abs($mins);
    $hrs = floor($mins / 60);
    $mins -= $hrs * 60;
    $offset = sprintf('%+d:%02d', $hrs * $sgn, $mins);
    $pdo->prepare("SET time_zone = ?")->execute([$offset]);

} catch (\PDOException $e) {
    // Production Error Handling
    error_log("Database Connection Error: " . $e->getMessage()); // Log to server error log
    die("Global Finance Error: Service temporarily unavailable. Please try again later.");
}

// Production Settings
ini_set('display_errors', 0);
ini_set('display_startup_errors', 0);
error_reporting(E_ALL);
// Secure Error Logging
// The parent folder is NOT safe: on this host it is the main site's public_html, where the
// log was publicly downloadable. Log into logs/, which is denied by logs/.htaccess and the
// app's root .htaccess.
$logDir = __DIR__ . '/logs';
if (!is_dir($logDir)) {
    @mkdir($logDir, 0750, true);
}
$logFile = $logDir . '/php_errors.log';
if (!is_writable($logDir) && !is_writable($logFile)) {
    $logFile = __DIR__ . '/.error.log'; // *.log is denied by the root .htaccess
}

ini_set('log_errors', 1);
ini_set('error_log', $logFile);

// Global exception handler — logs the error, shows a generic message to the user
set_exception_handler(function (Throwable $e): void {
    error_log('[Uncaught] ' . get_class($e) . ': ' . $e->getMessage() . ' in ' . $e->getFile() . ':' . $e->getLine());
    if (PHP_SAPI !== 'cli' && !headers_sent()) {
        http_response_code(500);
    }
    echo 'An unexpected error occurred. Please try again later.';
    exit(1);
});

// CSRF Protection & Session Hardening
if (session_status() === PHP_SESSION_NONE) {
    // secure session cookie params
    $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] == 443;
    session_set_cookie_params([
        'lifetime' => 0,
        'path' => '/',
        'domain' => '',
        'secure' => $secure,
        'httponly' => true,
        'samesite' => 'Strict'
    ]);
    session_start();
}

// Server-side session idle timeout (1 hour)
if (isset($_SESSION['user_id'])) {
    if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity']) > 3600) {
        $_SESSION = [];
        if (PHP_SAPI !== 'cli' && !headers_sent()) {
            session_regenerate_id(true);
            $_SESSION['_flash'][] = ['type' => 'warning', 'message' => 'Your session expired. Please sign in again.'];
            header('Location: ' . BASE_URL . 'index.php');
            exit();
        }
    } else {
        $_SESSION['last_activity'] = time();
    }
}


// Keep the session in sync with the account: role/permission changes made by an admin
// apply immediately, and a password change, reset or revoke elsewhere signs this session out.
if (isset($_SESSION['user_id'])) {
    try {
        $acctStmt = $pdo->prepare("SELECT name, role, permission, tenant_id, password FROM users WHERE id = ?");
        $acctStmt->execute([$_SESSION['user_id']]);
        $acct = $acctStmt->fetch();
        $pwFingerprint = $acct ? hash('sha256', $acct['password']) : '';

        if (!$acct || (isset($_SESSION['pw_fp']) && !hash_equals($_SESSION['pw_fp'], $pwFingerprint))) {
            $_SESSION = [];
            if (PHP_SAPI !== 'cli' && !headers_sent()) {
                session_regenerate_id(true);
                $_SESSION['_flash'][] = ['type' => 'warning', 'message' => 'Your password was changed. Please sign in again.'];
                header('Location: ' . BASE_URL . 'index.php');
                exit();
            }
        } else {
            $_SESSION['pw_fp']      = $pwFingerprint;
            $_SESSION['user_name']  = $acct['name'];
            $_SESSION['role']       = $acct['role'];
            $_SESSION['permission'] = $acct['permission'];
            $_SESSION['tenant_id']  = $acct['tenant_id'];
        }
        unset($acctStmt, $acct, $pwFingerprint);
    } catch (\PDOException $e) {
        error_log("Session account check failed: " . $e->getMessage());
    }
}

// Load Composer Autoloader
require_once __DIR__ . '/autoload.php';

// procedural version removed in favor of App\Helpers\AuditHelper

// Load User Preferences into Session
if (isset($_SESSION['user_id']) && !isset($_SESSION['preferences'])) {
    try {
        $prefStmt = $pdo->prepare("SELECT * FROM user_preferences WHERE user_id = ?");
        $prefStmt->execute([$_SESSION['user_id']]);
        $prefs = $prefStmt->fetch();

        if (!$prefs) {
            // Create default
            $pdo->prepare("INSERT INTO user_preferences (user_id) VALUES (?)")->execute([$_SESSION['user_id']]);
            $prefs = ['base_currency' => 'AED', 'theme_preference' => 'dark', 'notifications_enabled' => 1];
        }
        $_SESSION['preferences'] = $prefs;
    } catch (Exception $e) {
        $_SESSION['preferences'] = ['base_currency' => 'AED', 'theme_preference' => 'dark'];
    }
}