<?php
session_start();
require_once 'idiomas.php';
if (!isset($_SESSION['user_id'])) { header("Location: index.php"); exit(); }

$msg = "";
require_once 'config.php';
$user_id = $_SESSION['user_id'];

// Gera um token CSRF único para a sessão
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['desafiar'])) {
    // Verificação de Segurança do CSRF
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("<div class='alert alert-danger'>Ataque CSRF detectado. Requisição bloqueada.</div>");
    }
    $meu_robo = $conn->real_escape_string($_POST['meu_robo']);
    $inimigo = $conn->real_escape_string($_POST['inimigo']);
    $seckey = md5(uniqid(rand(), true)); 
    
    $sql = "INSERT INTO BATTLEDATA (team1, team2, seckey, score1, score2, status, time, attempts) VALUES ('$meu_robo', '$inimigo', '$seckey', 0, 0, 0, 1, 0)";
    if ($conn->query($sql)) {
        $msg = "<div class='alert alert-success fw-bold'>".$t['msg_bat_ok']."</div>";
    } else {
        $msg = "<div class='alert alert-danger'>Erro: " . $conn->error . "</div>";
    }
}
$meus_robos = $conn->query("SELECT team_name, rating FROM robots WHERE user_id = $user_id ORDER BY rating DESC");
$outros_robos = $conn->query("SELECT team_name, rating FROM robots WHERE user_id != $user_id ORDER BY rating DESC");
?>
<!DOCTYPE html>
<html lang="<?php echo $_SESSION['lang']; ?>" data-bs-theme="dark">
<head>
    <meta charset="UTF-8">
    <title><?php echo $t['title_challenge']; ?></title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>body { background-color: #121212; } .vs-text { font-size: 2rem; font-weight: 900; color: #ff4757; text-shadow: 2px 2px 5px rgba(255,0,0,0.5); } .lang-btn { text-decoration: none; margin-left: 10px; font-size: 1.2rem; opacity: 0.5; } .lang-btn.active { opacity: 1; }</style>
</head>
<body>

    <nav class="navbar navbar-expand-lg navbar-dark bg-dark border-bottom border-secondary mb-4">
        <div class="container">
            <a class="navbar-brand fw-bold" href="index.php"><?php echo $t['nav_arena']; ?></a>
            <div class="collapse navbar-collapse">
                <ul class="navbar-nav ms-auto">
                    <li class="nav-item"><a class="nav-link" href="ranking.php"><?php echo $t['nav_ranking']; ?></a></li>
                    <li class="nav-item"><a class="nav-link" href="historico.php"><?php echo $t['nav_history']; ?></a></li>
                    <li class="nav-item"><a class="nav-link text-danger" href="index.php?logout=1"><?php echo $t['nav_logout']; ?></a></li>
                    <li class="nav-item d-flex align-items-center ms-3 border-start border-secondary ps-3">
                        <a href="?lang=pt" class="lang-btn <?php echo ($_SESSION['lang'] == 'pt') ? 'active' : ''; ?>">🇧🇷</a>
                        <a href="?lang=en" class="lang-btn <?php echo ($_SESSION['lang'] == 'en') ? 'active' : ''; ?>">🇺🇸</a>
                        <a href="?lang=de" class="lang-btn <?php echo ($_SESSION['lang'] == 'de') ? 'active' : ''; ?>">🇩🇪</a>
                    </li>
                </ul>
            </div>
        </div>
    </nav>

    <div class="container">
        <div class="row justify-content-center">
            <div class="col-md-8 text-center">
                <div class="text-start mb-3"><a href="index.php" class="text-info text-decoration-none fw-bold"><?php echo $t['back_hq']; ?></a></div>
                <h2 class="mb-4 text-uppercase fw-bold"><?php echo $t['title_challenge']; ?></h2>
                <?php echo $msg; ?>

                <?php if ($meus_robos->num_rows == 0): ?>
                    <div class="alert alert-warning border-warning">
                        <?php echo $t['no_troops']; ?> <a href="upload.php" class="alert-link"><?php echo $t['go_arsenal']; ?></a>.
                    </div>
                <?php elseif ($outros_robos->num_rows == 0): ?>
                    <div class="alert alert-info border-info"><?php echo $t['no_enemies']; ?></div>
                <?php else: ?>
                    <div class="card shadow-lg border-danger">
                        <div class="card-body p-5">
                            <form method="POST">
                                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">
                                <div class="mb-4">
                                    <label class="form-label fw-bold text-info"><?php echo $t['label_champ']; ?></label>
                                    <select name="meu_robo" class="form-select form-select-lg" required>
                                        <?php while($row = $meus_robos->fetch_assoc()): ?>
                                            <option value="<?php echo htmlspecialchars($row['team_name']); ?>"><?php echo htmlspecialchars($row['team_name']); ?> (Elo: <?php echo $row['rating']; ?>)</option>
                                        <?php endwhile; ?>
                                    </select>
                                </div>
                                <div class="vs-text mb-4">VS</div>
                                <div class="mb-5">
                                    <label class="form-label fw-bold text-warning"><?php echo $t['label_target']; ?></label>
                                    <select name="inimigo" class="form-select form-select-lg" required>
                                        <?php while($row = $outros_robos->fetch_assoc()): ?>
                                            <option value="<?php echo htmlspecialchars($row['team_name']); ?>"><?php echo htmlspecialchars($row['team_name']); ?> (Elo: <?php echo $row['rating']; ?>)</option>
                                        <?php endwhile; ?>
                                    </select>
                                </div>
                                <button type="submit" name="desafiar" class="btn btn-danger btn-lg w-100 fw-bold text-uppercase fs-4 shadow"><?php echo $t['btn_start']; ?></button>
                            </form>
                        </div>
                    </div>
                <?php endif; ?>
            </div>
        </div>
    </div>
</body>
</html>
<?php $conn->close(); ?>
