<?php
// ============================================================
//  admin/email-signature.php — Edit my email signature
// ============================================================
//
//  Per-user. Each admin manages only their own signature.
//  The signature is HTML — rendered via TinyMCE — and auto-
//  appended to every new email, reply, and forward they send.
//
//  The signature is sanitised on save (same allowlist as
//  incoming email body sanitisation) so users can't smuggle
//  scripts into their own signatures, even by accident from
//  pasting Word content.
// ============================================================

require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_once __DIR__ . '/../includes/config.php';
require_once __DIR__ . '/../includes/email_sanitize.php';
auth_require_admin();

$me = auth_admin_user();

$flash = '';
$flash_error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    $raw = (string)($_POST['signature'] ?? '');

    if (mb_strlen($raw) > 50000) {
        $flash_error = 'Signature is too long (max 50,000 characters).';
    } else {
        // Sanitise — same allowlist as incoming email bodies
        $sanitised = email_sanitize_html($raw, true)['html'];

        db_exec(
            "UPDATE admin_users
                SET email_signature = :sig,
                    signature_updated_at = NOW()
              WHERE id = :id",
            ['sig' => $sanitised, 'id' => $me['id']]
        );

        // Refresh
        $me = db_row('SELECT * FROM admin_users WHERE id = :id', ['id' => $me['id']]);
        $flash = 'Signature saved.';
    }
}

// Reload fresh after save
$signature_html = (string)($me['email_signature'] ?? '');
$updated_at = $me['signature_updated_at'] ?? null;

$page_title = 'My email signature';
require __DIR__ . '/_guard.php';
?>

<style>
.sig-wrap{max-width:840px;margin:0 auto;}
.sig-card{background:#fff;border:1px solid var(--line);border-radius:8px;padding:1.5rem;}
.sig-card h1{margin:0 0 .25rem;}
.sig-card .lead{color:var(--ink-muted);font-size:.88rem;margin:0 0 1.25rem;}
.sig-card .updated{font-size:.78rem;color:var(--ink-muted);margin-top:.4rem;}

.sig-flash{padding:.7rem 1rem;border-radius:6px;margin-bottom:1rem;font-size:.88rem;}
.sig-flash.ok{background:#ecfdf5;color:#065f46;border:1px solid #6ee7b7;}
.sig-flash.bad{background:#fef2f2;color:#991b1b;border:1px solid #fca5a5;}

.sig-actions{display:flex;gap:.5rem;margin-top:1rem;align-items:center;}
</style>

<section class="section"><div class="container sig-wrap">

<p style="margin:0 0 .75rem;">
    <a href="email.php" style="color:var(--ink-muted);text-decoration:none;font-size:.86rem;">← Back to email</a>
</p>

<div class="sig-card">
    <h1>My email signature</h1>
    <p class="lead">
        Automatically added to the bottom of every new email, reply, and forward you send.
        You can edit it in the compose window before sending if you want a custom signature for a particular message.
    </p>

    <?php if ($flash): ?>
        <div class="sig-flash ok"><?= htmlspecialchars($flash) ?></div>
    <?php endif; ?>
    <?php if ($flash_error): ?>
        <div class="sig-flash bad"><?= htmlspecialchars($flash_error) ?></div>
    <?php endif; ?>

    <form method="post" id="sig-form">
        <?= csrf_field() ?>
        <input type="hidden" name="signature" id="sig-hidden">
        <div id="sig-editor"><?= $signature_html ?: '' ?></div>

        <div class="sig-actions">
            <button type="submit" class="btn">Save signature</button>
            <a href="email.php" class="btn btn-outline">Cancel</a>
            <?php if ($updated_at): ?>
                <span class="updated">Last saved <?= htmlspecialchars(date('j M Y · H:i', strtotime($updated_at))) ?></span>
            <?php endif; ?>
        </div>
    </form>
</div>

</div></section>

<!-- Quill -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/quill@2.0.2/dist/quill.snow.css">
<script src="https://cdn.jsdelivr.net/npm/quill@2.0.2/dist/quill.min.js"></script>
<style>
#sig-editor{background:#fff;}
.ql-toolbar{border:1px solid var(--line) !important;border-radius:6px 6px 0 0;background:var(--surface-alt);}
.ql-container{border:1px solid var(--line) !important;border-top:none !important;border-radius:0 0 6px 6px;font-family:inherit;font-size:.92rem;min-height:240px;}
.ql-editor{min-height:200px;padding:1rem 1.25rem;}
</style>
<script>
function sigImageHandler() {
    const input = document.createElement('input');
    input.type = 'file';
    input.accept = 'image/jpeg,image/png,image/gif,image/webp';
    input.onchange = async () => {
        const file = input.files && input.files[0];
        if (!file) return;
        if (file.size > 5 * 1024 * 1024) {
            alert('Signature images should be under 5 MB.');
            return;
        }
        const fd = new FormData();
        fd.append('file', file);
        try {
            const resp = await fetch('email-upload-image.php', { method:'POST', body:fd, credentials:'same-origin' });
            const data = await resp.json();
            if (!resp.ok || !data.location) {
                alert((data.error && data.error.message) || 'Image upload failed.');
                return;
            }
            const range = window.sigQuill.getSelection(true);
            window.sigQuill.insertEmbed(range.index, 'image', data.location, 'user');
        } catch (err) { alert('Image upload error: ' + err.message); }
    };
    input.click();
}

window.sigQuill = new Quill('#sig-editor', {
    theme: 'snow',
    placeholder: 'Your name, title, contact details…',
    modules: {
        toolbar: {
            container: [
                ['bold', 'italic', 'underline'],
                [{ color: [] }, { background: [] }],
                [{ list: 'ordered' }, { list: 'bullet' }],
                ['link', 'image'],
                ['clean']
            ],
            handlers: { image: sigImageHandler }
        }
    }
});

document.getElementById('sig-form').addEventListener('submit', () => {
    document.getElementById('sig-hidden').value = window.sigQuill.root.innerHTML;
});
</script>

<?php require __DIR__ . '/_footer.php'; ?>