<?php

declare(strict_types=1);

require __DIR__ . '/../src/bootstrap.php';
Auth::requireLogin();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: dashboard');
    exit;
}

$user = trim((string) ($_POST['user'] ?? ''));
$enable = ($_POST['enable'] ?? '') === '1';

if ($user === '') {
    header('Location: dashboard?erro=1&msg=' . urlencode('Usuário inválido.'));
    exit;
}

try {
    $ldap = new Ldap();
    $ldap->bindService();

    $entry = $ldap->findUserByCn($user);
    if ($entry === null) {
        throw new RuntimeException('Aluno não encontrado no AD.');
    }

    $dn = $ldap->dnOf($entry);
    $accountControl = (int) ($entry['useraccountcontrol'][0] ?? 0);
    $new = $enable ? ($accountControl & ~2) : ($accountControl | 2);

    $quemFez = Auth::currentLogin() ?? 'desconhecido';
    $ldap->modify($dn, [
        'useraccountcontrol' => $new,
        'description'        => $quemFez,
    ]);

    AuditLog::record($quemFez, $enable ? 'habilitou_aluno' : 'desabilitou_aluno', $user);

    header('Location: dashboard?ok=1');
    exit;
} catch (Throwable $e) {
    header('Location: dashboard?erro=1&msg=' . urlencode($e->getMessage()));
    exit;
}