<?php
// HappyBums.php - V8 Owner Login & Multi-Wearer Dashboard
// SQLite storage - Owner login - Cookie session management
//
// ============================================================
// OVERVIEW
// ============================================================
// Web portal for the [Diaper] OpenSim incontinence/wearable system.
// Owners log in here to monitor and control their wearers remotely,
// even when not in-world.
//
// ============================================================
// ARCHITECTURE
// ============================================================
// Single-file PHP application. All pages, AJAX handlers, and API
// endpoints are served from this one script, distinguished by the
// 'action' GET/POST parameter.
//
// Storage: SQLite3 database (happybums.db) in the same directory.
// Sessions: PHP sessions + persistent cookies (30-day remember-me).
//
// ============================================================
// DATABASE TABLES
// ============================================================
// wearers        - One row per active HUD. Keyed by access_uuid (a
//                  per-HUD UUID generated on first contact). Stores
//                  diaper state, lock flags, auto-wet interval,
//                  simulator URL, announce settings, and owner title.
//
// owners         - One row per owner. Keyed by owner_uuid (their
//                  OpenSim avatar UUID). Stores bcrypt password hash
//                  and a flag indicating whether a forced password
//                  change is pending.
//
// owner_wearers  - Many-to-many join: links owner_uuid to access_uuid.
//                  An owner may have multiple wearers; a wearer may
//                  have multiple owners.
//
// nicknames      - Per-owner display name overrides for wearers/owners.
//                  Keyed by (owner_uuid, target_uuid).
//
// ============================================================
// ACTION ROUTING
// ============================================================
// GET  (no action)          - Login page or dashboard (if session active)
// POST action=login         - Authenticate owner, start session
// POST action=logout        - Destroy session and cookies
// POST action=change_password - Owner changes their own password
// POST action=set_nickname  - Owner sets a display nickname for a wearer
// POST action=remove_nickname - Removes a nickname
// POST action=hud_heartbeat - Called by WebRelay LSL script to register/
//                             update wearer state and simulator URL
// POST action=add_owner     - Called by Core LSL script to provision a
//                             new owner account (sets temp password,
//                             links wearer, IMs owner with credentials)
// POST action=reset_password - Called by Core LSL script to reset an
//                             owner's password and IM them the new one
// POST action=wet           - Owner triggers a wet event on the wearer
// POST action=change        - Owner triggers a diaper change on the wearer
// POST action=set_autowet   - Owner sets the auto-wet interval
// POST action=toggle_lock   - Owner toggles the change lock state
//
// ============================================================
// IN-WORLD COMMUNICATION
// ============================================================
// Commands sent from the web to the HUD are forwarded via the
// [Diaper] WebRelay LSL script. The wearer's simulator_url (an
// llRequestURL() result stored on heartbeat) is used as the
// HTTP endpoint. The WebRelay script receives the POST and
// forwards it to Core via llMessageLinked on channel 1001.
//
// ============================================================
// SECURITY NOTES
// ============================================================
// - Owner passwords are hashed with bcrypt (password_hash / password_verify).
// - All DB queries use PDO prepared statements (no SQL injection risk).
// - Simulator URL commands are only dispatched if the wearer has a
//   non-empty simulator_url and was seen recently (stale check).
// - No owner can affect a wearer they are not linked to in owner_wearers.
//

session_start();

$dbFile          = __DIR__ . '/happybums.db';
$cookieOwner     = 'inco_owner';
$cookieWearer    = 'inco_wearer';
$cookieDays      = 30;

// ============================================================
// Database initialisation
// ============================================================

function getDB($dbFile) {
    $db = new PDO('sqlite:' . $dbFile);
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
    $db->exec('PRAGMA journal_mode=WAL');

    $db->exec("
        CREATE TABLE IF NOT EXISTS wearers (
            access_uuid         TEXT PRIMARY KEY,
            wearer_name         TEXT    DEFAULT '',
            region_name         TEXT    DEFAULT '',
            region_rating       TEXT    DEFAULT 'Unknown',
            diaper_state        TEXT    DEFAULT 'dry',
            mess_state          TEXT    DEFAULT 'Clean',
            mess_capable        INTEGER DEFAULT 0,
            removal_locked      TEXT    DEFAULT '0',
            change_lock         TEXT    DEFAULT '0',
            auto_wet_interval   INTEGER DEFAULT 1800,
            auto_mess_interval  INTEGER DEFAULT 0,
            simulator_url       TEXT    DEFAULT '',
            last_seen           INTEGER DEFAULT 0,
            owner_list          TEXT    DEFAULT '',
            announce_full       TEXT    DEFAULT '0',
            announce_leak       TEXT    DEFAULT '1',
            announce_change     TEXT    DEFAULT '1',
            notify_wearer       TEXT    DEFAULT '1',
            owner_title         TEXT    DEFAULT 'Caregiver',
            state_names         TEXT    DEFAULT 'Dry,Damp,Wet,Soaking,Leaking',
            mess_names          TEXT    DEFAULT 'Clean,Soiled,Messy,Blowout'
        );

        CREATE TABLE IF NOT EXISTS owners (
            owner_uuid      TEXT PRIMARY KEY,
            password_hash   TEXT NOT NULL DEFAULT '',
            password_changed  INTEGER NOT NULL DEFAULT 0
        );

        CREATE TABLE IF NOT EXISTS owner_wearers (
            owner_uuid  TEXT,
            access_uuid TEXT,
            PRIMARY KEY (owner_uuid, access_uuid)
        );

        CREATE TABLE IF NOT EXISTS nicknames (
            owner_uuid  TEXT,
            target_uuid TEXT,
            nickname    TEXT DEFAULT '',
            PRIMARY KEY (owner_uuid, target_uuid)
        );
    ");

    return $db;
}

// ============================================================
// Wearer helpers
// ============================================================

function getWearer($db, $uuid) {
    $stmt = $db->prepare('SELECT * FROM wearers WHERE access_uuid = ?');
    $stmt->execute([$uuid]);
    return $stmt->fetch() ?: null;
}

function upsertWearer($db, $data) {
    $stmt = $db->prepare("
        INSERT INTO wearers
            (access_uuid, wearer_name, region_name, region_rating,
             diaper_state, mess_state, mess_capable,
             removal_locked, change_lock,
             auto_wet_interval, auto_mess_interval,
             simulator_url, last_seen, owner_list,
             announce_full, announce_leak, announce_change,
             notify_wearer, owner_title, state_names, mess_names)
        VALUES
            (:access_uuid, :wearer_name, :region_name, :region_rating,
             :diaper_state, :mess_state, :mess_capable,
             :removal_locked, :change_lock,
             :auto_wet_interval, :auto_mess_interval,
             :simulator_url, :last_seen, :owner_list,
             :announce_full, :announce_leak, :announce_change,
             :notify_wearer, :owner_title, :state_names, :mess_names)
        ON CONFLICT(access_uuid) DO UPDATE SET
            wearer_name        = excluded.wearer_name,
            region_name        = excluded.region_name,
            region_rating      = excluded.region_rating,
            diaper_state       = excluded.diaper_state,
            mess_state         = excluded.mess_state,
            mess_capable       = excluded.mess_capable,
            removal_locked     = excluded.removal_locked,
            change_lock        = excluded.change_lock,
            auto_wet_interval  = excluded.auto_wet_interval,
            auto_mess_interval = excluded.auto_mess_interval,
            simulator_url      = excluded.simulator_url,
            last_seen          = excluded.last_seen,
            owner_list         = excluded.owner_list,
            announce_full      = excluded.announce_full,
            announce_leak      = excluded.announce_leak,
            announce_change    = excluded.announce_change,
            notify_wearer      = excluded.notify_wearer,
            owner_title        = excluded.owner_title,
            state_names        = excluded.state_names,
            mess_names         = excluded.mess_names
    ");
    $stmt->execute([
        ':access_uuid'        => $data['access_uuid']        ?? '',
        ':wearer_name'        => $data['wearer_name']        ?? '',
        ':region_name'        => $data['region_name']        ?? '',
        ':region_rating'      => $data['region_rating']      ?? 'Unknown',
        ':diaper_state'       => $data['diaper_state']       ?? 'dry',
        ':mess_state'         => $data['mess_state']         ?? 'Clean',
        ':mess_capable'       => (int)($data['mess_capable'] ?? 0),
        ':removal_locked'     => $data['removal_locked']     ?? '0',
        ':change_lock'        => $data['change_lock']        ?? '0',
        ':auto_wet_interval'  => (int)($data['auto_wet_interval']  ?? 1800),
        ':auto_mess_interval' => (int)($data['auto_mess_interval'] ?? 0),
        ':simulator_url'      => $data['simulator_url']     ?? '',
        ':last_seen'          => (int)($data['last_seen']   ?? time()),
        ':owner_list'         => $data['owner_list']        ?? '',
        ':announce_full'      => $data['announce_full']     ?? '0',
        ':announce_leak'      => $data['announce_leak']     ?? '1',
        ':announce_change'    => $data['announce_change']   ?? '1',
        ':notify_wearer'      => $data['notify_wearer']     ?? '1',
        ':owner_title'        => $data['owner_title']       ?? 'Caregiver',
        ':state_names'        => $data['state_names']       ?? 'Dry,Damp,Wet,Soaking,Leaking',
        ':mess_names'         => $data['mess_names']        ?? 'Clean,Soiled,Messy,Blowout',
    ]);
}

// Returns all wearers linked to an owner UUID
function getWearersForOwner($db, $ownerUUID) {
    $stmt = $db->prepare("
        SELECT w.* FROM wearers w
        JOIN owner_wearers ow ON ow.access_uuid = w.access_uuid
        WHERE ow.owner_uuid = ?
        ORDER BY w.wearer_name ASC
    ");
    $stmt->execute([$ownerUUID]);
    return $stmt->fetchAll();
}

// ============================================================
// Owner helpers
// ============================================================

function getOwner($db, $ownerUUID) {
    $stmt = $db->prepare('SELECT * FROM owners WHERE owner_uuid = ?');
    $stmt->execute([$ownerUUID]);
    return $stmt->fetch() ?: null;
}

function ownerExists($db, $ownerUUID) {
    return getOwner($db, $ownerUUID) !== null;
}

function insertOwner($db, $ownerUUID, $passwordHash) {
    $stmt = $db->prepare(
        'INSERT OR IGNORE INTO owners (owner_uuid, password_hash) VALUES (?, ?)'
    );
    $stmt->execute([$ownerUUID, $passwordHash]);
}

function updateOwnerPassword($db, $ownerUUID, $passwordHash) {
    $stmt = $db->prepare(
        'UPDATE owners SET password_hash = ?, password_changed = 0 WHERE owner_uuid = ?'
    );
    $stmt->execute([$passwordHash, $ownerUUID]);
}

function linkOwnerWearer($db, $ownerUUID, $accessUUID) {
    $stmt = $db->prepare(
        'INSERT OR IGNORE INTO owner_wearers (owner_uuid, access_uuid) VALUES (?, ?)'
    );
    $stmt->execute([$ownerUUID, $accessUUID]);
}

// ============================================================
// Nickname helpers
// ============================================================

function getNickname($db, $ownerUUID, $targetUUID) {
    $stmt = $db->prepare(
        'SELECT nickname FROM nicknames WHERE owner_uuid = ? AND target_uuid = ?'
    );
    $stmt->execute([$ownerUUID, $targetUUID]);
    $row = $stmt->fetch();
    return $row ? $row['nickname'] : '';
}

function setNickname($db, $ownerUUID, $targetUUID, $nickname) {
    $stmt = $db->prepare("
        INSERT INTO nicknames (owner_uuid, target_uuid, nickname)
        VALUES (?, ?, ?)
        ON CONFLICT(owner_uuid, target_uuid) DO UPDATE SET nickname = excluded.nickname
    ");
    $stmt->execute([$ownerUUID, $targetUUID, $nickname]);
}

function getAllNicknames($db, $ownerUUID) {
    $stmt = $db->prepare(
        'SELECT target_uuid, nickname FROM nicknames WHERE owner_uuid = ?'
    );
    $stmt->execute([$ownerUUID]);
    $result = [];
    foreach ($stmt->fetchAll() as $row) {
        $result[$row['target_uuid']] = $row['nickname'];
    }
    return $result;
}

// ============================================================
// Cookie helpers
// ============================================================

function setSessionCookie($name, $value, $days) {
    $opts = [
        'path'     => '/',
        'secure'   => true,
        'httponly' => true,
        'samesite' => 'Strict',
    ];
    if ($days > 0) $opts['expires'] = time() + (86400 * $days);
    setcookie($name, $value, $opts);
}

function clearCookie($name) {
    setcookie($name, '', [
        'expires'  => time() - 3600,
        'path'     => '/',
        'secure'   => true,
        'httponly' => true,
        'samesite' => 'Strict',
    ]);
}

// ============================================================
// Display helpers
// ============================================================

function getAgeString($lastSeen) {
    $age = time() - (int)$lastSeen;
    if      ($age < 60)    return 'Just now';
    elseif  ($age < 3600)  return floor($age/60)   . ' minutes ago';
    elseif  ($age < 86400) return floor($age/3600)  . ' hours ago';
    else                   return floor($age/86400) . ' days ago';
}

function getChangeLockText($value) {
    switch ((string)$value) {
        case '0': return 'Open Access';
        case '1': return 'Owner + Wearer';
        case '2': return 'Owner Only';
        default:  return 'Unknown';
    }
}

function isValidUUID($uuid) {
    return (bool)preg_match(
        '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i',
        $uuid
    );
}

// ============================================================
// Open database
// ============================================================

$db = getDB($dbFile);

// ============================================================
// POST - Receive data from HUD (JSON heartbeat / status update)
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' &&
    strpos($_SERVER['CONTENT_TYPE'] ?? '', 'application/json') !== false)
{
    $input = file_get_contents('php://input');
    $data  = json_decode($input, true);

    if (!$data) {
        http_response_code(400);
        echo json_encode(['status' => 'error', 'message' => 'Invalid JSON']);
        exit;
    }

    $action = $data['action'] ?? '';

    // ---- proxy command to HUD ----
    if (isset($data['proxy_cmd'])) {
        $ownerUUID  = $_COOKIE[$cookieOwner]  ?? '';
        $wearerUUID = $_COOKIE[$cookieWearer] ?? '';

        if (!$ownerUUID || !$wearerUUID) {
            http_response_code(403);
            echo json_encode(['status' => 'error', 'message' => 'Not logged in']);
            exit;
        }

        $stmt = $db->prepare(
            'SELECT w.simulator_url FROM wearers w
             JOIN owner_wearers ow ON ow.access_uuid = w.access_uuid
             WHERE ow.owner_uuid = ? AND w.access_uuid = ?'
        );
        $stmt->execute([$ownerUUID, $wearerUUID]);
        $row = $stmt->fetch();

        if (!$row || empty($row['simulator_url'])) {
            http_response_code(503);
            echo json_encode(['status' => 'error', 'message' => 'HUD simulator URL not available. Is the wearer online?']);
            exit;
        }

        $forward = $data['proxy_cmd'];
        $forward['access_uuid'] = $wearerUUID;

        $ch = curl_init($row['simulator_url']);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($forward));
        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_TIMEOUT, 10);
        $result   = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($result === false) {
            http_response_code(503);
            echo json_encode(['status' => 'error', 'message' => 'Could not reach HUD. Wearer may have changed region or gone offline.']);
            exit;
        }

        http_response_code($httpCode);
        echo $result;
        exit;
    }


    // ---- add_owner ----
    if ($action === 'add_owner') {
        $ownerUUID   = trim($data['owner_uuid']   ?? '');
        $plainPwd    = trim($data['password']      ?? '');
        $accessUUID  = trim($data['access_uuid']   ?? '');

        if (!isValidUUID($ownerUUID) || !isValidUUID($accessUUID) || $plainPwd === '') {
            http_response_code(400);
            echo json_encode(['status' => 'error', 'message' => 'Missing or invalid fields']);
            exit;
        }

        $isNew = !ownerExists($db, $ownerUUID);
        if ($isNew) {
            insertOwner($db, $ownerUUID, password_hash($plainPwd, PASSWORD_DEFAULT));
        }
        linkOwnerWearer($db, $ownerUUID, $accessUUID);

        echo json_encode(['status' => $isNew ? 'new' : 'existing']);
        exit;
    }

    // ---- reset_password ----
    if ($action === 'reset_password') {
        $ownerUUID = trim($data['owner_uuid'] ?? '');
        $plainPwd  = trim($data['password']   ?? '');

        if (!isValidUUID($ownerUUID) || $plainPwd === '') {
            http_response_code(400);
            echo json_encode(['status' => 'error', 'message' => 'Missing or invalid fields']);
            exit;
        }

        updateOwnerPassword($db, $ownerUUID, password_hash($plainPwd, PASSWORD_DEFAULT));
        echo json_encode(['status' => 'ok']);
        exit;
    }

    // ---- change_password (owner-initiated, authenticated) ----
    if ($action === 'change_password') {
        $ownerUUID  = $_COOKIE[$cookieOwner] ?? '';
        $currentPwd = trim($data['current_password'] ?? '');
        $newPwd     = trim($data['new_password']     ?? '');

        if (!$ownerUUID || !isValidUUID($ownerUUID) || $currentPwd === '' || $newPwd === '') {
            http_response_code(400);
            echo json_encode(['status' => 'error', 'message' => 'Missing fields']);
            exit;
        }

        $owner = getOwner($db, $ownerUUID);
        if (!$owner || !password_verify($currentPwd, $owner['password_hash'])) {
            http_response_code(403);
            echo json_encode(['status' => 'error', 'message' => 'Current password incorrect']);
            exit;
        }

        $stmt = $db->prepare(
            'UPDATE owners SET password_hash = ?, password_changed = 1 WHERE owner_uuid = ?'
        );
        $stmt->execute([password_hash($newPwd, PASSWORD_DEFAULT), $ownerUUID]);
        echo json_encode(['status' => 'ok']);
        exit;
    }

    // ---- force_set_password (first-login forced change) ----
    if ($action === 'force_set_password') {
        $ownerUUID = $_COOKIE[$cookieOwner] ?? '';
        $newPwd    = trim($data['new_password'] ?? '');

        if (!$ownerUUID || !isValidUUID($ownerUUID) || $newPwd === '') {
            http_response_code(400);
            echo json_encode(['status' => 'error', 'message' => 'Missing fields or not logged in']);
            exit;
        }

        $owner = getOwner($db, $ownerUUID);
        if (!$owner) {
            http_response_code(403);
            echo json_encode(['status' => 'error', 'message' => 'Owner not found']);
            exit;
        }

        $stmt = $db->prepare(
            'UPDATE owners SET password_hash = ?, password_changed = 1 WHERE owner_uuid = ?'
        );
        $stmt->execute([password_hash($newPwd, PASSWORD_DEFAULT), $ownerUUID]);
        echo json_encode(['status' => 'ok']);
        exit;
    }

    // ---- heartbeat / status update (no action field) ----
    if (!isset($data['access_uuid'])) {
        http_response_code(400);
        echo json_encode(['status' => 'error', 'message' => 'No access_uuid']);
        exit;
    }

    upsertWearer($db, $data);
    echo json_encode(['status' => 'ok', 'message' => 'Data received']);
    exit;
}

// ============================================================
// POST - Owner login form
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['owner_uuid']))
{
    $ownerUUID = trim($_POST['owner_uuid']);
    $password  = $_POST['password'] ?? '';
    $remember  = isset($_POST['remember']);

    if (!isValidUUID($ownerUUID)) {
        $loginError = 'Please enter a valid UUID.';
    } else {
        $owner = getOwner($db, $ownerUUID);
        if (!$owner) {
            $loginError = 'Owner not found. Have you been added as an owner by a wearer?';
        } elseif (!password_verify($password, $owner['password_hash'])) {
            $loginError = 'Incorrect password.';
        } else {
            setSessionCookie($cookieOwner, $ownerUUID, $remember ? $cookieDays : 0);
            clearCookie($cookieWearer);
            // If password hasn't been changed yet, redirect to force-change page
            if (!$owner['password_changed']) {
                header('Location: ' . $_SERVER['PHP_SELF'] . '?mustchange=1');
            } else {
                header('Location: ' . $_SERVER['PHP_SELF']);
            }
            exit;
        }
        
    }
}

// ============================================================
// POST - Select active wearer from dashboard
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['connect_wearer']))
{
    $ownerUUID  = $_COOKIE[$cookieOwner] ?? '';
    $accessUUID = trim($_POST['connect_wearer']);

    // Verify this owner actually has access to this wearer
    if ($ownerUUID && isValidUUID($accessUUID)) {
        $stmt = $db->prepare(
            'SELECT 1 FROM owner_wearers WHERE owner_uuid = ? AND access_uuid = ?'
        );
        $stmt->execute([$ownerUUID, $accessUUID]);
        if ($stmt->fetch()) {
            setSessionCookie($cookieWearer, $accessUUID, 0);
        }
    }
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// ============================================================
// POST - Remove wearer from owner's list (website only)
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['remove_wearer']))
{
    $ownerUUID  = $_COOKIE[$cookieOwner] ?? '';
    $accessUUID = trim($_POST['remove_wearer']);

    if ($ownerUUID && isValidUUID($accessUUID)) {
        $stmt = $db->prepare(
            'DELETE FROM owner_wearers WHERE owner_uuid = ? AND access_uuid = ?'
        );
        $stmt->execute([$ownerUUID, $accessUUID]);
    }
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// ============================================================
// POST - Back to dashboard (deselect active wearer)
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['back_to_dashboard']))
{
    clearCookie($cookieWearer);
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// ============================================================
// POST - Save nickname
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' &&
    isset($_POST['action']) && $_POST['action'] === 'save_nickname')
{
    $ownerUUID  = $_COOKIE[$cookieOwner]  ?? '';
    $targetUUID = trim($_POST['owner_uuid'] ?? '');
    $nickname   = trim($_POST['nickname']   ?? '');

    if ($ownerUUID && $targetUUID) {
        setNickname($db, $ownerUUID, $targetUUID, $nickname);
    }
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// ============================================================
// POST - Logout
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['logout']))
{
    clearCookie($cookieOwner);
    clearCookie($cookieWearer);
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// ============================================================
// Resolve session state
//   $ownerUUID   — logged-in owner, or ''
//   $activeWearer — wearer row currently being viewed, or null
//   $wearers      — all wearers for this owner (for dashboard)
// ============================================================
$ownerUUID    = $_COOKIE[$cookieOwner]  ?? '';
$wearerUUID   = $_COOKIE[$cookieWearer] ?? '';
$activeWearer = null;
$wearers      = [];
$ownerRow     = null;

if ($ownerUUID) {
    $ownerRow = getOwner($db, $ownerUUID);
    if (!$ownerRow) {
        // Stale cookie — owner deleted
        clearCookie($cookieOwner);
        clearCookie($cookieWearer);
        $ownerUUID = '';
    } else {
        $wearers = getWearersForOwner($db, $ownerUUID);
        if ($wearerUUID) {
            // Verify this owner still has access
            $stmt = $db->prepare(
                'SELECT 1 FROM owner_wearers WHERE owner_uuid = ? AND access_uuid = ?'
            );
            $stmt->execute([$ownerUUID, $wearerUUID]);
            if ($stmt->fetch()) {
                $activeWearer = getWearer($db, $wearerUUID);
            } else {
                clearCookie($cookieWearer);
                $wearerUUID = '';
            }
        }
        // Load nicknames keyed by owner UUID (owner nicknames their wearers)
        $nicknames = getAllNicknames($db, $ownerUUID);
    }
}

// Determine which view to show
// 0 = login   1 = dashboard (wearer list)   2 = control panel    3 = password change
$view = 0;
if ($ownerUUID) {
    $view = 1;
    // Force password change if flagged
    if ($ownerRow && !$ownerRow['password_changed']) $view = 3;
}
if ($activeWearer && $view !== 3) $view = 2;

?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>HappyBums Remote Control Panel</title>
    <style>
        * { box-sizing: border-box; margin: 0; padding: 0; }

        body {
            font-family: Arial, sans-serif;
            background: #1a1a2e;
            color: #eee;
            display: flex;
            justify-content: center;
            padding: 40px 20px;
            min-height: 100vh;
        }

        .outer {
            width: 100%;
            max-width: 900px;
            height: fit-content;
        }

        /* Header */
        .header {
            background: #16213e;
            border-radius: 12px 12px 0 0;
            padding: 24px 30px 20px;
            text-align: center;
            border-bottom: 2px solid #2a2a4a;
        }

        h1 { color: #e94560; margin-bottom: 4px; }
        .subtitle { color: #888; font-size: 0.85em; }

        /* Two column layout (control panel) */
        .columns {
            display: grid;
            grid-template-columns: 1fr 1fr;
            gap: 0;
        }

        @media (max-width: 650px) {
            .columns { grid-template-columns: 1fr; }
        }

        .col { background: #16213e; padding: 24px; }
        .col-left { border-right: 1px solid #2a2a4a; }

        .col-title {
            font-size: 0.75em;
            text-transform: uppercase;
            letter-spacing: 0.08em;
            color: #e94560;
            margin-bottom: 16px;
            padding-bottom: 8px;
            border-bottom: 1px solid #2a2a4a;
        }

        /* Fields */
        .field      { margin-bottom: 16px; }
        .label      { color: #aaa; font-size: 0.75em;
                      text-transform: uppercase;
                      letter-spacing: 0.05em; margin-bottom: 3px; }
        .value      { font-size: 1.05em; font-weight: bold; }

        /* Diaper states */
        .state-dry     { color: #4caf50; }
        .state-damp    { color: #8bc34a; }
        .state-wet     { color: #ffeb3b; }
        .state-soaking { color: #ff9800; }
        .state-leaking { color: #f44336; }

        .locked   { color: #f44336; }
        .unlocked { color: #4caf50; }

        .stale { color: #ff9800; }
        .stale-warning {
            background: #2a1a00;
            border: 1px solid #ff9800;
            border-radius: 6px;
            padding: 8px;
            font-size: 0.8em;
            color: #ff9800;
            margin-top: 6px;
        }

        hr { border-color: #2a2a4a; margin: 16px 0; }

        /* Owner list (control panel) */
        .owner-row {
            display: flex;
            align-items: center;
            justify-content: space-between;
            gap: 8px;
            padding: 10px 0;
            border-bottom: 1px solid #2a2a4a;
        }

        .owner-row:last-of-type { border-bottom: none; }

        .owner-name {
            flex: 1;
            font-size: 0.85em;
            color: #eee;
            word-break: break-all;
            cursor: default;
        }

        .owner-actions { display: flex; gap: 6px; flex-shrink: 0; }

        .btn-nickname { background: #1a3a5a; color: #6ab0f5; }
        .btn-nickname:hover { background: #2a4a6a; color: #8ac0ff; }
        .btn-remove { background: #5a1a1a; color: #f44336; }
        .btn-remove:hover { background: #7a2a2a; }

        /* Dashboard wearer cards */
        .dashboard {
            background: #16213e;
            padding: 24px;
        }

        .dashboard-title {
            font-size: 0.75em;
            text-transform: uppercase;
            letter-spacing: 0.08em;
            color: #e94560;
            margin-bottom: 20px;
            padding-bottom: 8px;
            border-bottom: 1px solid #2a2a4a;
        }

        .wearer-cards {
            display: flex;
            flex-direction: column;
            gap: 12px;
        }

        .wearer-card {
            background: #0f1f3a;
            border: 1px solid #2a2a4a;
            border-radius: 8px;
            padding: 16px 20px;
            display: flex;
            align-items: center;
            justify-content: space-between;
            gap: 16px;
        }

        .wearer-card:hover { border-color: #3a3a6a; }

        .wearer-card-info { flex: 1; min-width: 0; }

        .wearer-card-name {
            font-size: 1.1em;
            font-weight: bold;
            color: #eee;
            white-space: nowrap;
            overflow: hidden;
            text-overflow: ellipsis;
        }

        .wearer-card-uuid {
            font-size: 0.72em;
            color: #555;
            margin-top: 3px;
            word-break: break-all;
        }

        .wearer-card-status {
            font-size: 0.8em;
            color: #888;
            margin-top: 4px;
        }

        .no-wearers {
            color: #666;
            font-size: 0.9em;
            font-style: italic;
            padding: 12px 0;
        }

        /* Modal */
        .modal-overlay {
            display: none;
            position: fixed;
            top: 0; left: 0;
            width: 100%; height: 100%;
            background: rgba(0,0,0,0.7);
            z-index: 1000;
            justify-content: center;
            align-items: center;
        }

        .modal-overlay.active { display: flex; }

        .modal {
            background: #16213e;
            border: 1px solid #2a2a4a;
            border-radius: 12px;
            padding: 24px;
            width: 90%;
            max-width: 420px;
        }

        .modal h3 { color: #e94560; margin-bottom: 16px; font-size: 1em; }

        .modal-uuid {
            font-size: 0.75em;
            color: #888;
            word-break: break-all;
            margin-bottom: 12px;
            padding: 8px;
            background: #0f1f3a;
            border-radius: 6px;
        }

        .modal input[type=text] {
            width: 100%;
            padding: 10px;
            border-radius: 6px;
            border: 1px solid #444;
            background: #0f3460;
            color: #eee;
            font-size: 1em;
            margin-bottom: 16px;
        }

        .modal-buttons { display: flex; gap: 8px; }
        .modal-buttons .btn { flex: 1; }

        .btn-tiny {
            padding: 4px 8px;
            border: none;
            border-radius: 4px;
            background: #2a2a4a;
            color: #aaa;
            font-size: 0.8em;
            cursor: pointer;
            white-space: nowrap;
        }

        .btn-tiny:hover { background: #3a3a6a; color: #eee; }

        .no-owners { color: #666; font-size: 0.9em; font-style: italic; }

        .send-message-section {
            margin-top: 20px;
            padding-top: 16px;
            border-top: 1px solid #2a2a4a;
        }

        .send-message-section .col-title {
            margin-bottom: 10px;
        }

        .send-message-row {
            display: flex;
            gap: 8px;
            align-items: flex-end;
        }

        .send-message-row textarea {
            flex: 1;
            padding: 8px 10px;
            border-radius: 6px;
            border: 1px solid #444;
            background: #0f3460;
            color: #eee;
            font-size: 0.85em;
            resize: vertical;
            min-height: 70px;
            font-family: Arial, sans-serif;
        }

        .send-message-row textarea::placeholder { color: #555; }

        input[type=text],
        input[type=password] {
            width: 100%;
            padding: 10px;
            border-radius: 6px;
            border: 1px solid #444;
            background: #0f3460;
            color: #eee;
            font-size: 0.9em;
            margin-top: 4px;
        }

        .uuid-hint { font-size: 0.75em; color: #666; margin-top: 4px; }

        .btn {
            flex: 1;
            padding: 10px;
            border: none;
            border-radius: 6px;
            font-size: 0.9em;
            cursor: pointer;
            font-weight: bold;
        }

        .btn-primary       { background: #e94560; color: white; }
        .btn-primary:hover { background: #c73652; }

        .btn-secondary       { background: #2a2a4a; color: #aaa; }
        .btn-secondary:hover { background: #3a3a5a; color: #eee; }

        .btn-danger       { background: #5a1a1a; color: #f44336; }
        .btn-danger:hover { background: #7a2a2a; }

        .btn-full { width: 100%; margin-top: 10px; }

        /* Settings Row */
        .settings-row {
            background: #16213e;
            padding: 16px 24px;
            display: flex;
            gap: 8px;
            border-top: 1px solid #2a2a4a;
            justify-content: center;
            border-bottom: 1px solid #2a2a4a;
        }

        /* Footer */
        .footer {
            background: #16213e;
            border-radius: 0 0 12px 12px;
            padding: 16px 24px;
            border-top: 2px solid #2a2a4a;
            display: flex;
            justify-content: space-between;
            align-items: center;
            gap: 12px;
        }

        .footer a { color: #888; text-decoration: none; font-size: 0.85em; }
        .footer a:hover { color: #eee; }

        /* Login panel */
        .login-panel {
            background: #16213e;
            border-radius: 0 0 12px 12px;
            padding: 30px;
            max-width: 420px;
            margin: 0 auto;
        }

        .login-panel .field { margin-bottom: 16px; }

        .checkbox-row {
            display: flex;
            align-items: center;
            gap: 8px;
            margin-top: 12px;
            font-size: 0.9em;
            color: #aaa;
        }

        .error {
            background: #3a1a1a;
            border: 1px solid #f44336;
            border-radius: 6px;
            padding: 10px;
            color: #f44336;
            font-size: 0.9em;
            margin-top: 10px;
        }

        .login-hint {
            font-size: 0.78em;
            color: #555;
            margin-top: 6px;
            line-height: 1.4;
        }

        .action-buttons { display: flex; gap: 8px; margin-top: 8px; }

        .btn-wet     { background: #1a3a5a; color: #6ab0f5; }
        .btn-change  { background: #1a4a2a; color: #4caf50; }
        .btn-autowet { background: #3a2a1a; color: #ff9800; }
        .btn-mess    { background: #3a1a3a; color: #cf8fff; }
        .btn-automess { background: #2a1a3a; color: #b07fe8; }

    </style>
</head>
<body>
<div class="outer">

    <!-- Header -->
    <div class="header">
        <h1>HappyBums</h1>
        <div class="subtitle">Remote Control Panel</div>
    </div>

<?php if ($view === 0): ?>

    <!-- ======================================
         VIEW 0: LOGIN
    ======================================= -->
    <div class="login-panel">
        <form method="POST" action="<?= $_SERVER['PHP_SELF'] ?>">
            <div class="field">
                <div class="label">Your OpenSim UUID</div>
                <input type="text"
                       name="owner_uuid"
                       placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
                       autocomplete="off"
                       required />
                <div class="login-hint">Enter the UUID of your OpenSim avatar.</div>
            </div>

            <div class="field">
                <div class="label">Password</div>
                <input type="password"
                       name="password"
                       placeholder="Your password"
                       required />
                <div class="login-hint">Set when you were added as an owner by a wearer.</div>
            </div>

            <div class="checkbox-row">
                <input type="checkbox" name="remember" id="remember" checked />
                <label for="remember">Remember me for <?= $cookieDays ?> days</label>
            </div>

            <?php if (isset($loginError)): ?>
                <div class="error">&#9888; <?= htmlspecialchars($loginError) ?></div>
            <?php endif; ?>

            <button type="submit" class="btn btn-primary btn-full">Sign In</button>
        </form>
    </div>

<?php elseif ($view === 1): ?>

    <!-- ======================================
         VIEW 1: DASHBOARD (wearer list)
    ======================================= -->
    <div class="dashboard">
        <div class="dashboard-title">Your Wearers</div>

        <?php if (empty($wearers)): ?>
            <div class="no-wearers">
                You have no wearers linked to your account yet.<br>
                Ask your wearer to add you as an owner from their HUD.
            </div>
        <?php else: ?>
            <div class="wearer-cards">
            <?php foreach ($wearers as $w):
                $wName    = $w['wearer_name']   ?: $w['access_uuid'];
                $wNick    = $nicknames[$w['access_uuid']] ?? '';
                $wDisplay = $wNick ?: $wName;
                $wState   = strtolower($w['diaper_state'] ?? 'unknown');
                $wAge     = getAgeString($w['last_seen'] ?? 0);
                $wStale   = (time() - (int)($w['last_seen'] ?? 0)) > 600;
            ?>
            <div class="wearer-card">
                <div class="wearer-card-info">
                    <div class="wearer-card-name"><?= htmlspecialchars($wDisplay) ?></div>
                    <div class="wearer-card-uuid"><?= htmlspecialchars($w['access_uuid']) ?></div>
                    <div class="wearer-card-status">
                        <span class="state-<?= $wState ?>"><?= ucfirst($wState) ?></span>
                        <?php if (!empty($w['mess_capable'])): ?>
                            &nbsp;&middot;&nbsp;
                            <span style="color:#cf8fff;"><?= htmlspecialchars($w['mess_state'] ?? 'Clean') ?></span>
                        <?php endif; ?>
                        &nbsp;&middot;&nbsp;
                        <span class="<?= $wStale ? 'stale' : '' ?>"><?= $wAge ?></span>
                    </div>
                </div>

                <div style="display:flex; gap:8px; flex-shrink:0;">
                    <form method="POST" action="<?= $_SERVER['PHP_SELF'] ?>">
                        <input type="hidden" name="connect_wearer"
                               value="<?= htmlspecialchars($w['access_uuid']) ?>" />
                        <button type="submit" class="btn btn-primary"
                                style="padding: 8px 18px; font-size:0.85em;">
                            Connect
                        </button>
                    </form>
                    <form method="POST" action="<?= $_SERVER['PHP_SELF'] ?>"
                          onsubmit="return confirm('Remove <?= htmlspecialchars(addslashes($wDisplay)) ?> from your wearers list?\n\nThis only removes the website link — it does not affect the HUD.');">
                        <input type="hidden" name="remove_wearer"
                               value="<?= htmlspecialchars($w['access_uuid']) ?>" />
                        <button type="submit" class="btn btn-danger"
                                style="padding: 8px 18px; font-size:0.85em;">
                            Remove
                        </button>
                    </form>
                </div>

            </div>
            <?php endforeach; ?>
            </div>
        <?php endif; ?>
    </div>

    <!-- Footer -->
    <div class="footer">
        <span style="color:#555; font-size:0.8em;">
            Signed in as: <?= htmlspecialchars($ownerUUID) ?>
        </span>
        <form method="POST" action="<?= $_SERVER['PHP_SELF'] ?>" style="margin:0;">
            <button type="submit" name="logout" class="btn btn-danger"
                    style="padding: 8px 16px; font-size:0.85em;">
                &#128682; Sign Out
            </button>
        </form>
        <button class="btn btn-secondary" onclick="openModal('changePwdModal')">Change Password</button>
    </div>

<?php elseif ($view === 2): 

    // ======================================
    // VIEW 2: CONTROL PANEL
    // ======================================
    $lastSeen    = (int)($activeWearer['last_seen']         ?? 0);
    $age         = time() - $lastSeen;
    $stale       = $age > 600;
    $ageStr      = getAgeString($lastSeen);
    $state       = strtolower($activeWearer['diaper_state'] ?? 'unknown');
    $messState   = $activeWearer['mess_state']              ?? 'Clean';
    $messCapable = (int)($activeWearer['mess_capable']      ?? 0);
    $hudLocked   = ($activeWearer['removal_locked']         ?? '0') == '1';
    $changeLock  = $activeWearer['change_lock']             ?? '0';
    $ratingRaw    = $activeWearer['region_rating']          ?? 0;
    $ratingLabels = ['General', 'Moderate', 'Adult'];
    $rating       = $ratingLabels[(int)$ratingRaw]          ?? 'Unknown';
    $regionName  = $activeWearer['region_name']             ?? 'Unknown';
    $autoWet     = (int)($activeWearer['auto_wet_interval']  ?? 1800);
    $autoWetMins = $autoWet > 0 ? (int)($autoWet / 60) : 0;
    $autoMess    = (int)($activeWearer['auto_mess_interval'] ?? 0);
    $autoMessMins = $autoMess > 0 ? (int)($autoMess / 60) : 0;

    $ownerListRaw = $activeWearer['owner_list'] ?? '';
    $owners       = $ownerListRaw !== '' ? explode(',', $ownerListRaw) : [];

    // Nicknames for this owner (used in right column for listing owners)
    $nicknames = getAllNicknames($db, $ownerUUID);

    // Display name for the wearer (owner may have set a nickname)
    $wearerDisplayName = $nicknames[$wearerUUID] ?? $activeWearer['wearer_name'];
    
    $simUrl = $activeWearer['simulator_url'] ?? '';

?>
<script>
const HUD_URL    = <?= json_encode($simUrl) ?>;
const ACCESS_UUID = <?= json_encode($wearerUUID) ?>;
const WEARER_SETTINGS = {
    announce_full:      <?= json_encode($activeWearer['announce_full']      ?? '0') ?>,
    announce_leak:      <?= json_encode($activeWearer['announce_leak']      ?? '1') ?>,
    announce_change:    <?= json_encode($activeWearer['announce_change']    ?? '1') ?>,
    notify_wearer:      <?= json_encode($activeWearer['notify_wearer']      ?? '1') ?>,
    owner_title:        <?= json_encode($activeWearer['owner_title']        ?? 'Caregiver') ?>,
    state_names:        <?= json_encode($activeWearer['state_names']        ?? 'Dry,Damp,Wet,Soaking,Leaking') ?>,
    mess_names:         <?= json_encode($activeWearer['mess_names']         ?? 'Clean,Soiled,Messy,Blowout') ?>,
    mess_capable:       <?= json_encode($messCapable) ?>,
    auto_mess_interval: <?= json_encode($autoMessMins) ?>
};
</script>

    <!-- ======================================
         TWO COLUMN PANEL
    ======================================= -->
    <div class="columns">

        <!-- LEFT: Status -->
        <div class="col col-left">
            <div class="col-title">Current Status</div>

            <div class="field">
                <div class="label">Wearer</div>
                <div class="value"><?= htmlspecialchars($wearerDisplayName) ?></div>
            </div>

            <div class="field">
                <div class="label">Last Seen</div>
                <div class="value <?= $stale ? 'stale' : '' ?>"><?= $ageStr ?></div>
                <?php if ($stale): ?>
                    <div class="stale-warning">
                        &#9888; HUD not responding &mdash; wearer may be offline or visiting another grid
                    </div>
                <?php endif; ?>
            </div>

            <div class="field">
                <div class="label">Region</div>
                <div class="value">
                    <?= htmlspecialchars($regionName) ?>
                    <span style="color:#888; font-size:0.85em;">
                        (<?= htmlspecialchars($rating) ?>)
                    </span>
                </div>
            </div>

            <hr>

            <div class="field">
                <div class="label">Diaper Status</div>
                <div class="value state-<?= $state ?>"><?= ucfirst($state) ?></div>
                <div class="action-buttons">
                    <button class="btn-tiny btn-wet"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="sendCommand('wet')">&#128167; Wet</button>
                    <button class="btn-tiny btn-change"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="sendCommand('change')">&#128260; Change</button>
                    <button class="btn-tiny btn-autowet"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="openAutoWet(<?= $autoWetMins ?>)">&#9201; Auto-wet</button>
                </div>
            </div>

            <?php if ($messCapable): ?>
            <div class="field">
                <div class="label">Mess Status</div>
                <div class="value" style="color:#cf8fff;"><?= htmlspecialchars($messState) ?></div>
                <div class="action-buttons">
                    <button class="btn-tiny btn-mess"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="sendCommand('mess')">&#128169; Mess</button>
                    <button class="btn-tiny btn-automess"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="openAutoMess(<?= $autoMessMins ?>)">&#9201; Auto-mess</button>
                </div>
            </div>
            <?php endif; ?>

            <div class="field">
                <div class="label">HUD Lock</div>
                <div class="value <?= $hudLocked ? 'locked' : 'unlocked' ?>">
                    <?= $hudLocked ? '&#128274; Locked' : '&#128275; Unlocked' ?>
                </div>
                <div class="action-buttons">
                    <button class="btn-tiny <?= $hudLocked ? 'btn-remove' : 'btn-nickname' ?>"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="sendCommand('<?= $hudLocked ? 'hud_unlock' : 'hud_lock' ?>')">
                        <?= $hudLocked ? '&#128275; Unlock HUD' : '&#128274; Lock HUD' ?>
                    </button>
                </div>
            </div>

            <div class="field">
                <div class="label">Change Lock</div>
                <div class="value"><?= getChangeLockText($changeLock) ?></div>
                <div class="action-buttons">
                    <?php if ($changeLock != '0'): ?>
                    <button class="btn-tiny btn-nickname"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="sendCommand('change_lock:0')">
                        &#128275; Unlock
                    </button>
                    <?php endif; ?>
                    <?php if ($changeLock != '1'): ?>
                    <button class="btn-tiny btn-autowet"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="sendCommand('change_lock:1')">
                        &#128274; Wearer Lock
                    </button>
                    <?php endif; ?>
                    <?php if ($changeLock != '2'): ?>
                    <button class="btn-tiny btn-remove"
                            <?= $stale ? 'disabled' : '' ?>
                            onclick="sendCommand('change_lock:2')">
                        &#128274; Owner Lock
                    </button>
                    <?php endif; ?>
                </div>
            </div>

        </div>

        <!-- RIGHT: Owner Management -->
        <div class="col col-right">
            <div class="col-title">Owner Management</div>

            <?php if (empty($owners)): ?>
                <div class="no-owners">No owners currently assigned.</div>
            <?php else: ?>
                <?php foreach ($owners as $oUUID):
                    $oUUID       = trim($oUUID);
                    $displayName = !empty($nicknames[$oUUID])
                                   ? $nicknames[$oUUID]
                                   : $oUUID; ?>
                <div class="owner-row">
                    <div class="owner-name" title="<?= htmlspecialchars($oUUID) ?>">
                        <?= htmlspecialchars($displayName) ?>
                    </div>
                    <div class="owner-actions">
                        <button class="btn-tiny btn-nickname"
                                onclick="openNickname(
                                    '<?= htmlspecialchars($oUUID) ?>',
                                    '<?= htmlspecialchars($nicknames[$oUUID] ?? '') ?>'
                                )">
                            &#9999; Nickname
                        </button>
                    </div>
                </div>
                <?php endforeach; ?>
            <?php endif; ?>

            <!-- Hidden form for nickname saves -->
            <form method="POST" action="<?= $_SERVER['PHP_SELF'] ?>" id="nicknameForm">
                <input type="hidden" name="action"     value="save_nickname" />
                <input type="hidden" name="owner_uuid" id="nicknameUUID" />
                <input type="hidden" name="nickname"   id="nicknameValue" />
            </form>

            <!-- Send Message -->
            <div class="send-message-section">
                <div class="col-title">Send Message</div>
                <div class="send-message-row">
                    <textarea id="sendMessageText"
                        placeholder="Type a message to send to <?= htmlspecialchars($activeWearer['wearer_name']) ?>..."></textarea>
                    <button class="btn-tiny btn-nickname"
                        onclick="sendMessage()">
                        &#9993; Send
                     </button>
                </div>
            </div>

        </div>

    </div>

    <!-- Settings Row -->
    <div class="settings-row">
        <button class="btn-tiny btn-nickname" onclick="openModal('announceModal')">&#128226; Announce</button>
        <button class="btn-tiny btn-nickname" onclick="openModal('identityModal')">&#127991; Identity</button>
    </div>

    <!-- Footer -->
    <div class="footer">
        <form method="POST" action="<?= $_SERVER['PHP_SELF'] ?>" style="margin:0;">
            <button type="submit" name="back_to_dashboard" class="btn btn-secondary"
                    style="padding: 8px 16px; font-size:0.85em;">
                &#8592; My Wearers
            </button>
        </form>
        <a href="<?= $_SERVER['PHP_SELF'] ?>">&#8635; Refresh</a>
        <form method="POST" action="<?= $_SERVER['PHP_SELF'] ?>" style="margin:0;">
            <button type="submit" name="logout" class="btn btn-danger"
                    style="padding: 8px 16px; font-size:0.85em;">
                &#128682; Sign Out
            </button>
        </form>
    </div>

<?php elseif ($view === 3): ?>
<!-- VIEW 4: Forced password change -->
<div class="panel" style="max-width:460px; margin:0 auto; padding:30px;">
    <h2 style="color:#e94560; margin-bottom:8px;">Password Change Required</h2>
    <p style="color:#aaa; margin-bottom:20px; font-size:0.9em;">
        Your password was set by the in-world system. Please choose a new password before continuing.
    </p>
    <div id="forceChangeFeedback" style="margin-bottom:12px;"></div>
    <div class="field">
        <div class="label">New Password</div>
        <input type="password" id="fcNewPwd" style="margin-top:6px;" />
    </div>
    <div class="field" style="margin-top:12px;">
        <div class="label">Confirm New Password</div>
        <input type="password" id="fcConfirmPwd" style="margin-top:6px;" />
    </div>
    <div style="margin-top:18px; display:flex; gap:10px;">
        <button class="btn btn-primary" onclick="forceChangeSubmit()">Set Password</button>
        <form method="post" style="margin:0;">
            <button name="logout" class="btn btn-secondary">Cancel &amp; Logout</button>
        </form>
    </div>
</div>
<?php endif; ?>

</div>

<!-- Nickname Modal -->
<div class="modal-overlay" id="nicknameModal">
    <div class="modal">
        <h3>Set Nickname</h3>
        <div class="modal-uuid" id="modalUUID"></div>
        <input type="text"
               id="modalNicknameInput"
               placeholder="Enter nickname..."
               maxlength="40" />
        <div class="modal-buttons">
            <button class="btn btn-primary"   onclick="saveNickname()">Save</button>
            <button class="btn btn-secondary" onclick="closeModal('nicknameModal')">Cancel</button>
        </div>
    </div>
</div>

<!-- Autowet Modal -->
<div class="modal-overlay" id="autoWetModal">
    <div class="modal">
        <h3>&#9201; Auto-wet Interval</h3>
        <p style="color:#aaa; font-size:0.85em; margin-bottom:16px;">
            Set how often the diaper auto-wets (in minutes). Enter 0 to disable.
        </p>
        <input type="number" id="autoWetInput" min="0" max="999"
               placeholder="Minutes (0 = disabled)" />
        <div style="color:#666; font-size:0.75em; margin-top:4px;">
            Current: <span id="autoWetCurrent"></span>
        </div>
        <div class="modal-buttons" style="margin-top:16px;">
            <button class="btn btn-primary"   onclick="saveAutoWet()">Set</button>
            <button class="btn btn-secondary" onclick="closeAutoWetModal()">Cancel</button>
        </div>
    </div>
</div>

<!-- Automess Modal -->
<div class="modal-overlay" id="autoMessModal">
    <div class="modal">
        <h3>&#9201; Auto-mess Interval</h3>
        <p style="color:#aaa; font-size:0.85em; margin-bottom:16px;">
            Set how often the diaper auto-messes (in minutes). Enter 0 to disable.
        </p>
        <input type="number" id="autoMessInput" min="0" max="999"
               placeholder="Minutes (0 = disabled)" />
        <div style="color:#666; font-size:0.75em; margin-top:4px;">
            Current: <span id="autoMessCurrent"></span>
        </div>
        <div class="modal-buttons" style="margin-top:16px;">
            <button class="btn btn-primary"   onclick="saveAutoMess()">Set</button>
            <button class="btn btn-secondary" onclick="closeAutoMessModal()">Cancel</button>
        </div>
    </div>
</div>

<!-- Announce Modal -->
<div class="modal-overlay" id="announceModal">
    <div class="modal">
        <h3>&#128226; Announce Settings</h3>

        <div class="field">
            <div class="label">Full Announce (Soaking / Leaking)</div>
            <div style="display:flex; gap:6px; margin-top:6px;">
                <button class="btn-tiny" id="ann_full_0" onclick="setAnnounce('announce_full','0')">Private IM</button>
                <button class="btn-tiny" id="ann_full_1" onclick="setAnnounce('announce_full','1')">Local Chat</button>
                <button class="btn-tiny" id="ann_full_2" onclick="setAnnounce('announce_full','2')">Everyone</button>
            </div>
        </div>

        <div class="field" style="margin-top:12px;">
            <div class="label">Leak Announce</div>
            <div style="display:flex; gap:6px; margin-top:6px;">
                <button class="btn-tiny" id="ann_leak_0" onclick="setAnnounce('announce_leak','0')">Private IM</button>
                <button class="btn-tiny" id="ann_leak_1" onclick="setAnnounce('announce_leak','1')">Local Chat</button>
                <button class="btn-tiny" id="ann_leak_2" onclick="setAnnounce('announce_leak','2')">Everyone</button>
            </div>
        </div>

        <div class="field" style="margin-top:12px;">
            <div class="label">Change Announce</div>
            <div style="display:flex; gap:6px; margin-top:6px;">
                <button class="btn-tiny" id="ann_chg_0" onclick="setAnnounce('announce_change','0')">Private IM</button>
                <button class="btn-tiny" id="ann_chg_1" onclick="setAnnounce('announce_change','1')">Local Chat</button>
                <button class="btn-tiny" id="ann_chg_2" onclick="setAnnounce('announce_change','2')">Everyone</button>
            </div>
        </div>

        <div class="field" style="margin-top:12px;">
            <div class="label">Notify Wearer</div>
            <div style="display:flex; gap:6px; margin-top:6px;">
                <button class="btn-tiny" id="ann_nw_1" onclick="setAnnounce('notify_wearer','1')">On</button>
                <button class="btn-tiny" id="ann_nw_0" onclick="setAnnounce('notify_wearer','0')">Off</button>
            </div>
        </div>

        <div class="modal-buttons" style="margin-top:16px;">
            <button class="btn btn-secondary" onclick="closeModal('announceModal')">Close</button>
        </div>
    </div>
</div>

<!-- Identity Modal -->
<div class="modal-overlay" id="identityModal">
    <div class="modal">
        <h3>&#127991; Identity Settings</h3>
        <p style="color:#888; font-size:0.78em; margin-bottom:14px; line-height:1.5;">
            &#9888; These settings apply to the wearer's attachment and affect what
            all owners and the wearer see. If multiple owners are set, any of them
            can change these values.
        </p>

        <div class="field">
            <div class="label">Owner Title</div>
            <input type="text" id="ownerTitleInput" maxlength="30"
                   placeholder="e.g. Caregiver" style="margin-top:6px;" />
        </div>

        <div class="field" style="margin-top:12px;">
            <div class="label">State Names (5 comma-separated)</div>
            <input type="text" id="stateNamesInput" maxlength="80"
                   placeholder="Dry,Damp,Wet,Soaking,Leaking" style="margin-top:6px;" />
        </div>

        <?php if ($messCapable): ?>
        <div class="field" style="margin-top:12px;">
            <div class="label">Mess Names (4 comma-separated)</div>
            <input type="text" id="messNamesInput" maxlength="80"
                   placeholder="Clean,Soiled,Messy,Blowout" style="margin-top:6px;" />
        </div>
        <?php endif; ?>

        <div class="modal-buttons" style="margin-top:16px;">
            <button class="btn btn-primary"   onclick="saveIdentity()">Save</button>
            <button class="btn btn-secondary" onclick="closeModal('identityModal')">Cancel</button>
        </div>
    </div>
</div>

<script>
function openNickname(uuid, existing) {
    document.getElementById('modalUUID').textContent     = uuid;
    document.getElementById('modalNicknameInput').value  = existing;
    document.getElementById('nicknameUUID').value        = uuid;
    document.getElementById('nicknameModal').classList.add('active');
    document.getElementById('modalNicknameInput').focus();
}

function saveNickname() {
    const nickname = document.getElementById('modalNicknameInput').value.trim();
    document.getElementById('nicknameValue').value = nickname;
    document.getElementById('nicknameForm').submit();
}

function openModal(id) {
    document.getElementById(id).classList.add('active');
}

function closeModal(id) {
    document.getElementById(id).classList.remove('active');
}

['announceModal', 'identityModal'].forEach(id => {
    document.getElementById(id).addEventListener('click', function(e) {
        if (e.target === this) closeModal(id);
    });
});

document.getElementById('nicknameModal').addEventListener('click', function(e) {
    if (e.target === this) closeModal('nicknameModal');
});

document.addEventListener('keydown', function(e) {
    if (e.key === 'Escape') {
        ['nicknameModal','autoWetModal','autoMessModal','announceModal',
         'identityModal','changePwdModel'].forEach(closeModal);
    }
});
  
    
function sendCommand(cmd) {
    let body = { access_uuid: ACCESS_UUID };

    if (cmd === 'wet')            { body.cmd = 'wet'; }
    else if (cmd === 'mess')      { body.cmd = 'mess'; }
    else if (cmd === 'change')    { body.cmd = 'change'; }
    else if (cmd === 'hud_lock')  { body.cmd = 'hud_lock';    body.value = '1'; }
    else if (cmd === 'hud_unlock'){ body.cmd = 'hud_lock';    body.value = '0'; }
    else if (cmd.startsWith('change_lock:')) {
        body.cmd   = 'change_lock';
        body.value = cmd.split(':')[1];
    }
    else if (cmd.startsWith('autowet:')) {
        body.cmd   = 'autowet';
        body.value = cmd.split(':')[1];
    }
    else if (cmd.startsWith('automess:')) {
        body.cmd   = 'automess';
        body.value = cmd.split(':')[1];
    }
    else { alert('Unknown command: ' + cmd); return; }

    fetch('<?= $_SERVER['PHP_SELF'] ?>', {
        method:  'POST',
        headers: { 'Content-Type': 'application/json' },
        body:    JSON.stringify({ proxy_cmd: body })
    })
    
    .then(r => r.json())
    .then(data => {
        if (data.status !== 'ok') alert('HUD error: ' + (data.message || 'unknown'));
        else setTimeout(() => location.reload(), 1500);
    })
    .catch(() => alert('Could not reach HUD. Wearer may have changed region or gone offline.'));
}    

function sendMessage() {
    const text = document.getElementById('sendMessageText').value.trim();
    if (!text) { alert('Please type a message first.'); return; }

    fetch('<?= $_SERVER['PHP_SELF'] ?>', {
        method:  'POST',
        headers: { 'Content-Type': 'application/json' },
        body:    JSON.stringify({ proxy_cmd: { cmd: 'msg', value: text } })
    })

    .then(r => r.json())
    .then(data => {
        if (data.status !== 'ok') alert('HUD error: ' + (data.message || 'unknown'));
        else document.getElementById('sendMessageText').value = '';
    })
    .catch(() => alert('Could not reach HUD. Wearer may have changed region or gone offline.'));
}


function openAutoWet(currentMins) {
    document.getElementById('autoWetInput').value = currentMins;
    document.getElementById('autoWetCurrent').textContent =
        currentMins > 0 ? currentMins + ' min' : 'Disabled';
    document.getElementById('autoWetModal').classList.add('active');
    document.getElementById('autoWetInput').focus();
}

function saveAutoWet() {
    const mins = parseInt(document.getElementById('autoWetInput').value);
    if (isNaN(mins) || mins < 0) {
        alert('Please enter a valid number of minutes.');
        return;
    }
    sendCommand('autowet:' + mins);
    closeAutoWetModal();
}

function closeAutoWetModal() {
    document.getElementById('autoWetModal').classList.remove('active');
}

document.getElementById('autoWetModal').addEventListener('click', function(e) {
    if (e.target === this) closeAutoWetModal();
});

function openAutoMess(currentMins) {
    document.getElementById('autoMessInput').value = currentMins;
    document.getElementById('autoMessCurrent').textContent =
        currentMins > 0 ? currentMins + ' min' : 'Disabled';
    document.getElementById('autoMessModal').classList.add('active');
    document.getElementById('autoMessInput').focus();
}

function saveAutoMess() {
    const mins = parseInt(document.getElementById('autoMessInput').value);
    if (isNaN(mins) || mins < 0) {
        alert('Please enter a valid number of minutes.');
        return;
    }
    sendCommand('automess:' + mins);
    closeAutoMessModal();
}

function closeAutoMessModal() {
    document.getElementById('autoMessModal').classList.remove('active');
}

document.getElementById('autoMessModal').addEventListener('click', function(e) {
    if (e.target === this) closeAutoMessModal();
});

function highlightGroup(prefix, activeVal) {
    ['0','1','2'].forEach(function(v) {
        var el = document.getElementById(prefix + '_' + v);
        if (!el) return;
        el.style.background = (v === String(activeVal)) ? '#1a4a1a' : '';
        el.style.color      = (v === String(activeVal)) ? '#8fff8f' : '';
    });
}

function openAnnounceModal() {
    highlightGroup('ann_full',  WEARER_SETTINGS.announce_full);
    highlightGroup('ann_leak',  WEARER_SETTINGS.announce_leak);
    highlightGroup('ann_chg',   WEARER_SETTINGS.announce_change);
    highlightGroup('ann_nw',    WEARER_SETTINGS.notify_wearer);
    openModal('announceModal');
}

function setAnnounce(cmd, value) {
    sendSettingCommand(cmd, value, function() {
        WEARER_SETTINGS[cmd] = value;
        if (cmd === 'announce_full')   highlightGroup('ann_full', value);
        if (cmd === 'announce_leak')   highlightGroup('ann_leak', value);
        if (cmd === 'announce_change') highlightGroup('ann_chg',  value);
        if (cmd === 'notify_wearer')   highlightGroup('ann_nw',   value);
    });
}

function openIdentityModal() {
    document.getElementById('ownerTitleInput').value = WEARER_SETTINGS.owner_title  || '';
    document.getElementById('stateNamesInput').value = WEARER_SETTINGS.state_names  || '';
    if (WEARER_SETTINGS.mess_capable) {
        var mni = document.getElementById('messNamesInput');
        if (mni) mni.value = WEARER_SETTINGS.mess_names || '';
    }
    openModal('identityModal');
}

function saveIdentity() {
    var title      = document.getElementById('ownerTitleInput').value.trim();
    var states     = document.getElementById('stateNamesInput').value.trim();
    var messNamesEl = document.getElementById('messNamesInput');
    var messes     = messNamesEl ? messNamesEl.value.trim() : '';
    var ok = true;

    if (states && states.split(',').length !== 5) {
        alert('State names must be exactly 5 comma-separated values.');
        ok = false;
    }

    if (messes && messes.split(',').length !== 4) {
        alert('Mess names must be exactly 4 comma-separated values.');
        ok = false;
    }

    if (!ok) return;

    if (title) {
        sendSettingCommand('owner_title', title, function() {
            WEARER_SETTINGS.owner_title = title;
        });
    }
    if (states) {
        sendSettingCommand('state_names', states, function() {
            WEARER_SETTINGS.state_names = states;
        });
    }
    if (messes) {
        sendSettingCommand('mess_names', messes, function() {
            WEARER_SETTINGS.mess_names = messes;
        });
    }
    closeModal('identityModal');
}

function sendSettingCommand(cmd, value, onSuccess) {
    fetch('<?= $_SERVER['PHP_SELF'] ?>', {
        method:  'POST',
        headers: { 'Content-Type': 'application/json' },
        body:    JSON.stringify({ proxy_cmd: { cmd: cmd, value: value } })
    })
    .then(function(r) { return r.json(); })
    .then(function(data) {
        if (data.status !== 'ok') alert('Error: ' + (data.message || 'unknown'));
        else if (onSuccess) onSuccess();
    })
    .catch(function() { alert('Could not reach HUD.'); });
}

function forceChangeSubmit() {
    var p1 = document.getElementById('fcNewPwd').value;
    var p2 = document.getElementById('fcConfirmPwd').value;
    var fb = document.getElementById('forceChangeFeedback');
    if (!p1 || p1 !== p2) {
        fb.innerHTML = '<span style="color:#e94560;">Passwords do not match.</span>';
        return;
    }
    fetch('<?= $_SERVER['PHP_SELF'] ?>', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ action: 'force_set_password', new_password: p1 })
    })
    .then(r => r.json())
    .then(data => {
        if (data.status === 'ok') location.reload();
        else fb.innerHTML = '<span style="color:#e94560;">' + (data.message || 'Error') + '</span>';
    });
}

function submitChangePassword() {
    var cur = document.getElementById('cpCurrentPwd').value;
    var p1  = document.getElementById('cpNewPwd').value;
    var p2  = document.getElementById('cpConfirmPwd').value;
    var fb  = document.getElementById('changePwdFeedback');
    if (!cur || !p1 || p1 !== p2) {
        fb.innerHTML = '<span style="color:#e94560;">Please fill all fields and ensure new passwords match.</span>';
        return;
    }
    fetch('<?= $_SERVER['PHP_SELF'] ?>', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ action: 'change_password', current_password: cur, new_password: p1 })
    })
    .then(r => r.json())
    .then(data => {
        if (data.status === 'ok') {
            closeModal('changePwdModal');
            fb.innerHTML = '';
        } else {
            fb.innerHTML = '<span style="color:#e94560;">' + (data.message || 'Error') + '</span>';
        }
    })
    .catch(function() {
        fb.innerHTML = '<span style="color:#e94560;">Network error.</span>';
    });
}

</script>

<div class="modal-overlay" id="changePwdModal">
    <div class="modal">
        <h3 style="margin-bottom:16px;">Change Password</h3>
        <div id="changePwdFeedback" style="margin-bottom:10px;"></div>
        <div class="field">
            <div class="label">Current Password</div>
            <input type="password" id="cpCurrentPwd" style="margin-top:6px;" />
        </div>
        <div class="field" style="margin-top:12px;">
            <div class="label">New Password</div>
            <input type="password" id="cpNewPwd" style="margin-top:6px;" />
        </div>
        <div class="field" style="margin-top:12px;">
            <div class="label">Confirm New Password</div>
            <input type="password" id="cpConfirmPwd" style="margin-top:6px;" />
        </div>
        <div class="modal-buttons" style="margin-top:16px;">
            <button class="btn btn-primary" onclick="submitChangePassword()">Save</button>
            <button class="btn btn-secondary" onclick="closeModal('changePwdModal')">Cancel</button>
        </div>
    </div>
</div>

</body>
</html>