// ---------------- Connector Documents ----------------

function fino_lm_user_has_lead_access($lead_id, $user_id){
    global $wpdb;
    $leads_table = $wpdb->prefix . 'fino_leads';
    $lead = $wpdb->get_row($wpdb->prepare("SELECT * FROM $leads_table WHERE id=%d", $lead_id));
    if(!$lead) return false;

    if(current_user_can('manager') || current_user_can('submanager') || current_user_can('administrator')){
        return true;
    }
    if(current_user_can('connector')){
        return intval($lead->created_by) === intval($user_id);
    }
    if(current_user_can('employee')){
        return intval($lead->assigned_employee_id) === intval($user_id);
    }
    if(current_user_can('banker')){
        return intval($lead->assigned_banker_id) === intval($user_id);
    }
    return false;
}

function fino_lm_handle_doc_upload(){
    if(!is_user_logged_in()) wp_die('Not logged in');
    if(!(current_user_can('connector') || current_user_can('employee') || current_user_can('banker'))) wp_die('Access denied');

    check_admin_referer('fino_doc_upload');

    $lead_id = isset($_POST['lead_id']) ? intval($_POST['lead_id']) : 0;
    $doc_type = isset($_POST['doc_type']) ? sanitize_text_field($_POST['doc_type']) : '';
    $notes = isset($_POST['notes']) ? sanitize_textarea_field($_POST['notes']) : '';

    if(!$lead_id || !$doc_type){
        wp_redirect(add_query_arg(['fino_msg'=>'missing'], wp_get_referer()));
        exit;
    }

    $user_id = get_current_user_id();
    if(!fino_lm_user_has_lead_access($lead_id, $user_id)){
        wp_redirect(add_query_arg(['fino_msg'=>'noaccess'], wp_get_referer()));
        exit;
    }

    if(empty($_FILES['lead_document']['name'])){
        wp_redirect(add_query_arg(['fino_msg'=>'nofile'], wp_get_referer()));
        exit;
    }

    require_once ABSPATH . 'wp-admin/includes/file.php';

    $allowed = ['application/pdf','image/jpeg','image/png'];
    $filetype = wp_check_filetype_and_ext($_FILES['lead_document']['tmp_name'], $_FILES['lead_document']['name']);
    if(!$filetype['type'] || !in_array($filetype['type'], $allowed)){
        wp_redirect(add_query_arg(['fino_msg'=>'badtype'], wp_get_referer()));
        exit;
    }

    $upload = wp_handle_upload($_FILES['lead_document'], ['test_form' => false]);
    if(isset($upload['error'])){
        wp_redirect(add_query_arg(['fino_msg'=>'uploaderr'], wp_get_referer()));
        exit;
    }

    global $wpdb;
    $docs_table = $wpdb->prefix . 'fino_lead_documents';
    $wpdb->insert($docs_table, [
        'lead_id' => $lead_id,
        'uploaded_by' => $user_id,
        'uploaded_role' => (current_user_can('employee') ? 'employee' : (current_user_can('banker') ? 'banker' : 'connector')),
        'doc_type' => $doc_type,
        'file_url' => $upload['url'],
        'file_name' => basename($upload['file']),
        'notes' => $notes,
        'status' => 'pending'
    ]);

    wp_redirect(add_query_arg(['fino_msg'=>'uploaded'], remove_query_arg('fino_msg', wp_get_referer())));
    exit;
}
add_action('admin_post_fino_doc_upload', 'fino_lm_handle_doc_upload');
add_action('admin_post_nopriv_fino_doc_upload', 'fino_lm_handle_doc_upload');

add_shortcode('fino_connector_upload_docs', function(){
    if(!is_user_logged_in()) return '<div class="mini"><strong>Please login.</strong></div>';
    if(!(current_user_can('connector') || current_user_can('employee') || current_user_can('banker'))) return '<div class="mini"><strong>Access denied.</strong></div>';

    $msg = isset($_GET['fino_msg']) ? sanitize_text_field($_GET['fino_msg']) : '';
    $notice = '';
    if($msg==='uploaded') $notice = '<div style="padding:10px;border:1px solid #bbf7d0;background:#dcfce7;border-radius:12px;margin-bottom:10px;font-weight:700">Document uploaded successfully.</div>';
    if($msg==='missing') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">Please fill Lead ID and Document Type.</div>';
    if($msg==='nofile') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">Please choose a file.</div>';
    if($msg==='badtype') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">Invalid file type. Allowed: PDF, JPG, PNG.</div>';
    if($msg==='noaccess') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">You can upload documents only for your own leads.</div>';

    $action = esc_url(admin_url('admin-post.php'));
    $nonce = wp_nonce_field('fino_doc_upload','_wpnonce', true, false);

    return $notice . '
    <form method="post" action="'.$action.'" enctype="multipart/form-data" style="display:grid;gap:10px">
      <input type="hidden" name="action" value="fino_doc_upload"/>
      '.$nonce.'
      <div style="display:grid;grid-template-columns:1fr 1fr;gap:10px">
        <div>
          <label style="font-size:12px;color:#64748b">Lead ID</label>
                    <input name="lead_id" class="input" required placeholder="Example: 9201" value="'.esc_attr($prefill_lead_id).'"/>
        </div>
        <div>
          <label style="font-size:12px;color:#64748b">Document Type</label>
          <select name="doc_type" class="select" required>
            <option value="">Select</option>
            <option>PAN</option>
            <option>Aadhaar</option>
            <option>Bank Statement</option>
            <option>Salary Slip</option>
            <option>ITR</option>
            <option>GST</option>
            <option>Photo</option>
            <option>Other</option>
          </select>
        </div>
      </div>

      <div>
        <label style="font-size:12px;color:#64748b">Upload File (PDF/JPG/PNG)</label>
        <input type="file" name="lead_document" required/>
      </div>

      <div>
        <label style="font-size:12px;color:#64748b">Notes (Optional)</label>
        <textarea name="notes" class="textarea" placeholder="Any notes..."></textarea>
      </div>

      <button class="btn btnP" type="submit">Upload Document</button>
    </form>';
});

add_shortcode('fino_connector_docs_history', function(){
    if(!is_user_logged_in()) return '<div class="mini"><strong>Please login.</strong></div>';
    if(!(current_user_can('connector') || current_user_can('employee') || current_user_can('banker'))) return '<div class="mini"><strong>Access denied.</strong></div>';

    global $wpdb;
    $docs_table = $wpdb->prefix . 'fino_lead_documents';
    $user_id = get_current_user_id();

    $rows = $wpdb->get_results($wpdb->prepare("SELECT * FROM $docs_table WHERE uploaded_by=%d ORDER BY id DESC LIMIT 50", $user_id));
    if(!$rows) return '<div class="mini"><strong>No documents uploaded yet.</strong></div>';

    $out = '<div style="overflow:auto"><table><thead><tr><th>Lead ID</th><th>Doc Type</th><th>File</th><th>Status</th><th>Date</th></tr></thead><tbody>';
    foreach($rows as $r){
        $file = esc_url($r->file_url);
        $out .= '<tr>
          <td><strong>#'.intval($r->lead_id).'</strong></td>
          <td>'.esc_html($r->doc_type).'</td>
          <td><a href="'.$file.'" target="_blank">View</a></td>
          <td>'.esc_html(strtoupper($r->status)).'</td>
          <td>'.esc_html($r->created_at).'</td>
        </tr>';
    }
    $out .= '</tbody></table></div>';
    return $out;
});

add_shortcode('fino_connector_my_leads', function(){
    if(!is_user_logged_in()) return '<div class="mini"><strong>Please login.</strong></div>';
    if(!(current_user_can('connector') || current_user_can('employee') || current_user_can('banker'))) return '<div class="mini"><strong>Access denied.</strong></div>';

    global $wpdb;
    $leads_table = $wpdb->prefix . 'fino_leads';
    $user_id = get_current_user_id();

    $rows = $wpdb->get_results($wpdb->prepare("SELECT * FROM $leads_table WHERE created_by=%d ORDER BY id DESC LIMIT 50", $user_id));
    if(!$rows) return '<div class="mini"><strong>No leads found.</strong></div>';

    $base = get_permalink(); // current dashboard page
    $out = '<div style="overflow:auto"><table><thead><tr><th>Lead ID</th><th>Loan</th><th>Amount</th><th>City</th><th>Status</th><th>Documents</th></tr></thead><tbody>';
    foreach($rows as $r){
        $lead_id = intval($r->id);
        $url = add_query_arg(['lead_id'=>$lead_id], $base) . '#uploadDocs';
        $out .= '<tr>
          <td><strong>#'.$lead_id.'</strong></td>
          <td>'.esc_html($r->loan_type).'</td>
          <td>INR '.number_format_i18n(floatval($r->loan_amount)).'</td>
          <td>'.esc_html($r->city).'</td>
          <td>'.esc_html(strtoupper($r->status)).'</td>
          <td><a class="btn btnO" href="'.esc_url($url).'">Upload Documents</a></td>
        </tr>';
    }
    $out .= '</tbody></table></div>';
    return $out;
});

add_shortcode('fino_employee_assigned_leads', function(){
    if(!is_user_logged_in()) return '<div class="mini"><strong>Please login.</strong></div>';
    if(!current_user_can('employee')) return '<div class="mini"><strong>Access denied.</strong></div>';

    global $wpdb;
    $leads_table = $wpdb->prefix . 'fino_leads';
    $user_id = get_current_user_id();

    $rows = $wpdb->get_results($wpdb->prepare("SELECT * FROM $leads_table WHERE assigned_employee_id=%d ORDER BY id DESC LIMIT 50", $user_id));
    if(!$rows) return '<div class="mini"><strong>No assigned leads found.</strong></div>';

    $base = get_permalink();
    $out = '<div style="overflow:auto"><table><thead><tr><th>Lead ID</th><th>Name</th><th>Mobile</th><th>Loan</th><th>Amount</th><th>Status</th><th>Documents</th></tr></thead><tbody>';
    foreach($rows as $r){
        $lead_id = intval($r->id);
        $url = add_query_arg(['lead_id'=>$lead_id], $base) . '#uploadDocs';
        $out .= '<tr>
          <td><strong>#'.$lead_id.'</strong></td>
          <td>'.esc_html($r->name).'</td>
          <td>'.esc_html($r->mobile).'</td>
          <td>'.esc_html($r->loan_type).'</td>
          <td>INR '.number_format_i18n(floatval($r->loan_amount)).'</td>
          <td>'.esc_html(strtoupper($r->status)).'</td>
          <td><a class="btn btnO" href="'.esc_url($url).'">Upload Documents</a></td>
        </tr>';
    }
    $out .= '</tbody></table></div>';
    return $out;
});

add_shortcode('fino_banker_assigned_leads_v2', function(){
    if(!is_user_logged_in()) return '<div class="mini"><strong>Please login.</strong></div>';
    if(!current_user_can('banker')) return '<div class="mini"><strong>Access denied.</strong></div>';

    global $wpdb;
    $leads_table = $wpdb->prefix . 'fino_leads';
    $user_id = get_current_user_id();

    $rows = $wpdb->get_results($wpdb->prepare("SELECT * FROM $leads_table WHERE assigned_banker_id=%d ORDER BY id DESC LIMIT 50", $user_id));
    if(!$rows) return '<div class="mini"><strong>No assigned leads found.</strong></div>';

    $base = get_permalink();
    $out = '<div style="overflow:auto"><table><thead><tr><th>Lead ID</th><th>Name</th><th>Mobile</th><th>Loan</th><th>Amount</th><th>Status</th><th>Documents</th></tr></thead><tbody>';
    foreach($rows as $r){
        $lead_id = intval($r->id);
        $url = add_query_arg(['lead_id'=>$lead_id], $base) . '#uploadDocs';
        $out .= '<tr>
          <td><strong>#'.$lead_id.'</strong></td>
          <td>'.esc_html($r->name).'</td>
          <td>'.esc_html($r->mobile).'</td>
          <td>'.esc_html($r->loan_type).'</td>
          <td>INR '.number_format_i18n(floatval($r->loan_amount)).'</td>
          <td>'.esc_html(strtoupper($r->status)).'</td>
          <td><a class="btn btnO" href="'.esc_url($url).'">Upload Documents</a></td>
        </tr>';
    }
    $out .= '</tbody></table></div>';
    return $out;
});

function fino_lm_handle_doc_status_update(){
    if(!is_user_logged_in()) wp_die('Not logged in');
    if(!(current_user_can('manager') || current_user_can('submanager') || current_user_can('administrator'))) wp_die('Access denied');

    check_admin_referer('fino_doc_status');

    $doc_id = isset($_POST['doc_id']) ? intval($_POST['doc_id']) : 0;
    $new_status = isset($_POST['new_status']) ? sanitize_text_field($_POST['new_status']) : '';

    if(!$doc_id || !in_array($new_status, ['verified','rejected'], true)){
        wp_redirect(add_query_arg(['fino_doc_msg'=>'invalid'], wp_get_referer()));
        exit;
    }

    global $wpdb;
    $docs_table = $wpdb->prefix . 'fino_lead_documents';
    $wpdb->update($docs_table, ['status'=>$new_status], ['id'=>$doc_id]);

    $doc = $wpdb->get_row($wpdb->prepare("SELECT * FROM $docs_table WHERE id=%d", $doc_id));
    if($doc){
        $title = ($new_status==='verified') ? 'Document Approved' : 'Document Rejected';
        $msg = 'Lead #'.intval($doc->lead_id).' • '.sanitize_text_field($doc->doc_type);
        fino_lm_add_notification(intval($doc->uploaded_by), $title, $msg, '');
    }

    wp_redirect(add_query_arg(['fino_doc_msg'=>'updated'], remove_query_arg('fino_doc_msg', wp_get_referer())));
    exit;
}
add_action('admin_post_fino_doc_status_update', 'fino_lm_handle_doc_status_update');


add_shortcode('fino_manager_documents_review', function(){
    if(!is_user_logged_in()) return '<div class="mini"><strong>Please login.</strong></div>';
    if(!(current_user_can('manager') || current_user_can('submanager') || current_user_can('administrator'))) return '<div class="mini"><strong>Access denied.</strong></div>';

    $msg = isset($_GET['fino_doc_msg']) ? sanitize_text_field($_GET['fino_doc_msg']) : '';
    $notice = '';
    if($msg==='updated') $notice = '<div style="padding:10px;border:1px solid #bbf7d0;background:#dcfce7;border-radius:12px;margin-bottom:10px;font-weight:700">Document status updated.</div>';
    if($msg==='invalid') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">Invalid request.</div>';

    $filter_lead = isset($_GET['fino_lead_id']) ? intval($_GET['fino_lead_id']) : 0;
    $filter_status = isset($_GET['fino_status']) ? sanitize_text_field($_GET['fino_status']) : '';
    $filter_role = isset($_GET['fino_role']) ? sanitize_text_field($_GET['fino_role']) : '';

    $allowed_status = ['pending','verified','rejected'];
    $allowed_roles = ['connector','employee','banker'];

    global $wpdb;
    $docs_table = $wpdb->prefix . 'fino_lead_documents';

    $where = "1=1";
    $params = [];

    if($filter_lead > 0){
        $where .= " AND lead_id=%d";
        $params[] = $filter_lead;
    }
    if($filter_status && in_array($filter_status, $allowed_status, true)){
        $where .= " AND status=%s";
        $params[] = $filter_status;
    }
    if($filter_role && in_array($filter_role, $allowed_roles, true)){
        $where .= " AND uploaded_role=%s";
        $params[] = $filter_role;
    }

    $sql = "SELECT * FROM $docs_table WHERE $where ORDER BY id DESC LIMIT 120";
    $rows = $params ? $wpdb->get_results($wpdb->prepare($sql, $params)) : $wpdb->get_results($sql);

    $base = esc_url(remove_query_arg(['fino_lead_id','fino_status','fino_role'], get_permalink()));
    $form = '<form method="get" style="display:flex;gap:10px;flex-wrap:wrap;align-items:end;margin-bottom:12px">
        <div>
          <label style="font-size:12px;color:#64748b;display:block;margin-bottom:6px">Lead ID</label>
          <input class="input" name="fino_lead_id" placeholder="Example: 9201" value="'.esc_attr($filter_lead ?: '').'" style="min-width:180px"/>
        </div>
        <div>
          <label style="font-size:12px;color:#64748b;display:block;margin-bottom:6px">Status</label>
          <select class="select" name="fino_status" style="min-width:180px">
            <option value="">All</option>
            <option value="pending" '.selected($filter_status,'pending',false).'>Pending</option>
            <option value="verified" '.selected($filter_status,'verified',false).'>Verified</option>
            <option value="rejected" '.selected($filter_status,'rejected',false).'>Rejected</option>
          </select>
        </div>
        <div>
          <label style="font-size:12px;color:#64748b;display:block;margin-bottom:6px">Uploaded Role</label>
          <select class="select" name="fino_role" style="min-width:180px">
            <option value="">All</option>
            <option value="connector" '.selected($filter_role,'connector',false).'>Connector</option>
            <option value="employee" '.selected($filter_role,'employee',false).'>Employee</option>
            <option value="banker" '.selected($filter_role,'banker',false).'>Banker</option>
          </select>
        </div>
        <div style="display:flex;gap:8px">
          <button class="btn btnP" type="submit">Filter</button>
          <a class="btn btnO" href="'.$base.'#docReview" style="text-decoration:none;display:inline-flex;align-items:center">Reset</a>
        </div>
      </form>';

    if(!$rows) return $notice . $form . '<div class="mini"><strong>No documents found for selected filters.</strong></div>';

    $action = esc_url(admin_url('admin-post.php'));
    $out = $notice . $form . '<div style="overflow:auto"><table><thead><tr><th>Doc ID</th><th>Lead ID</th><th>Type</th><th>File</th><th>Uploaded By</th><th>Status</th><th>Action</th><th>Date</th></tr></thead><tbody>';

    foreach($rows as $r){
        $doc_id = intval($r->id);
        $file = esc_url($r->file_url);
        $status = esc_html(strtoupper($r->status));
        $badge = $r->status==='verified' ? 'appv' : ($r->status==='rejected' ? 'rej' : 'proc');

        $approve = wp_nonce_field('fino_doc_status','_wpnonce', true, false);
        $reject = $approve;

        $approveBtn = '<form method="post" action="'.$action.'" style="display:inline-block;margin-right:6px">
            <input type="hidden" name="action" value="fino_doc_status_update"/>
            <input type="hidden" name="doc_id" value="'.$doc_id.'"/>
            <input type="hidden" name="new_status" value="verified"/>
            '.$approve.'
            <button class="btn btnP" type="submit" style="padding:7px 10px">Approve</button>
        </form>';

        $rejectBtn = '<form method="post" action="'.$action.'" style="display:inline-block">
            <input type="hidden" name="action" value="fino_doc_status_update"/>
            <input type="hidden" name="doc_id" value="'.$doc_id.'"/>
            <input type="hidden" name="new_status" value="rejected"/>
            '.$reject.'
            <button class="btn btnO" type="submit" style="padding:7px 10px;border-color:#fecaca;color:#991b1b">Reject</button>
        </form>';

        $out .= '<tr>
          <td><strong>#'.$doc_id.'</strong></td>
          <td><strong>#'.intval($r->lead_id).'</strong></td>
          <td>'.esc_html($r->doc_type).'</td>
          <td><a href="'.$file.'" target="_blank">View</a></td>
          <td>'.esc_html($r->uploaded_role).' • #'.intval($r->uploaded_by).'</td>
          <td><span class="badge '.$badge.'">'.$status.'</span></td>
          <td>'.$approveBtn.$rejectBtn.'</td>
          <td>'.esc_html($r->created_at).'</td>
        </tr>';
    }

    $out .= '</tbody></table></div>';
    return $out;
});


// ---------------- Profile Photo Upload (All Roles) ----------------
function fino_lm_handle_profile_photo_upload(){
    if(!is_user_logged_in()) wp_die('Not logged in');
    check_admin_referer('fino_profile_photo');

    if(empty($_FILES['profile_photo']['name'])){
        wp_redirect(add_query_arg(['fino_pmsg'=>'nofile'], wp_get_referer()));
        exit;
    }

    // Validate type + size (2MB)
    $allowed = ['image/jpeg','image/png'];
    $max_bytes = 2 * 1024 * 1024;

    if($_FILES['profile_photo']['size'] > $max_bytes){
        wp_redirect(add_query_arg(['fino_pmsg'=>'toolarge'], wp_get_referer()));
        exit;
    }

    $filetype = wp_check_filetype_and_ext($_FILES['profile_photo']['tmp_name'], $_FILES['profile_photo']['name']);
    if(!$filetype['type'] || !in_array($filetype['type'], $allowed, true)){
        wp_redirect(add_query_arg(['fino_pmsg'=>'badtype'], wp_get_referer()));
        exit;
    }

    require_once ABSPATH . 'wp-admin/includes/file.php';
    require_once ABSPATH . 'wp-admin/includes/image.php';

    $upload = wp_handle_upload($_FILES['profile_photo'], ['test_form' => false]);
    if(isset($upload['error'])){
        wp_redirect(add_query_arg(['fino_pmsg'=>'uploaderr'], wp_get_referer()));
        exit;
    }

    $attachment = [
        'post_mime_type' => $upload['type'],
        'post_title'     => sanitize_file_name(basename($upload['file'])),
        'post_content'   => '',
        'post_status'    => 'inherit'
    ];
    $attach_id = wp_insert_attachment($attachment, $upload['file']);
    $attach_data = wp_generate_attachment_metadata($attach_id, $upload['file']);
    wp_update_attachment_metadata($attach_id, $attach_data);

    $user_id = get_current_user_id();
    update_user_meta($user_id, 'fino_profile_photo_id', $attach_id);

    wp_redirect(add_query_arg(['fino_pmsg'=>'updated'], remove_query_arg('fino_pmsg', wp_get_referer())));
    exit;
}
add_action('admin_post_fino_profile_photo_upload', 'fino_lm_handle_profile_photo_upload');

function fino_lm_get_profile_photo_url($user_id){
    $id = intval(get_user_meta($user_id, 'fino_profile_photo_id', true));
    if($id){
        $url = wp_get_attachment_image_url($id, 'thumbnail');
        if($url) return $url;
    }
    return '';
}

add_shortcode('fino_profile_photo_uploader', function(){
    if(!is_user_logged_in()) return '';
    $user_id = get_current_user_id();
    $user = wp_get_current_user();

    $msg = isset($_GET['fino_pmsg']) ? sanitize_text_field($_GET['fino_pmsg']) : '';
    $notice = '';
    if($msg==='updated') $notice = '<div style="padding:10px;border:1px solid #bbf7d0;background:#dcfce7;border-radius:12px;margin-bottom:10px;font-weight:700">Profile photo updated.</div>';
    if($msg==='nofile') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">Please choose a photo.</div>';
    if($msg==='toolarge') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">File too large. Max 2MB.</div>';
    if($msg==='badtype') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">Invalid type. Only JPG/PNG allowed.</div>';
    if($msg==='uploaderr') $notice = '<div style="padding:10px;border:1px solid #fecaca;background:#fee2e2;border-radius:12px;margin-bottom:10px;font-weight:700">Upload failed. Try again.</div>';

    $photo = fino_lm_get_profile_photo_url($user_id);
    $photo_html = $photo ? '<img src="'.esc_url($photo).'" style="width:56px;height:56px;border-radius:16px;object-fit:cover;border:1px solid #e5eaf3"/>' :
        '<div style="width:56px;height:56px;border-radius:16px;background:#eff6ff;border:1px solid #bfdbfe;display:flex;align-items:center;justify-content:center;font-weight:900;color:#1d4ed8">U</div>';

    $action = esc_url(admin_url('admin-post.php'));
    $nonce = wp_nonce_field('fino_profile_photo','_wpnonce', true, false);

    return $notice . '
    <div style="display:flex;gap:12px;align-items:center;margin-bottom:10px">
      '.$photo_html.'
      <div>
        <div style="font-weight:800">'.esc_html($user->display_name).'</div>
        <div style="font-size:12px;color:#64748b">'.esc_html($user->user_email).'</div>
      </div>
    </div>

    <form method="post" action="'.$action.'" enctype="multipart/form-data" style="display:grid;gap:10px">
      <input type="hidden" name="action" value="fino_profile_photo_upload"/>
      '.$nonce.'
      <div>
        <label style="font-size:12px;color:#64748b">Upload Profile Photo (JPG/PNG, Max 2MB)</label>
        <input type="file" name="profile_photo" accept="image/jpeg,image/png" required/>
      </div>
      <button class="btn btnP" type="submit">Update Photo</button>
    </form>';
});

// ---------------- Notifications ----------------
function fino_lm_add_notification($user_id, $title, $message='', $link=''){
    global $wpdb;
    $table = $wpdb->prefix . 'fino_notifications';
    $wpdb->insert($table, [
        'user_id' => intval($user_id),
        'title' => sanitize_text_field($title),
        'message' => sanitize_textarea_field($message),
        'link' => esc_url_raw($link),
        'is_read' => 0
    ]);
}

function fino_lm_get_unread_count($user_id){
    global $wpdb;
    $table = $wpdb->prefix . 'fino_notifications';
    return intval($wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM $table WHERE user_id=%d AND is_read=0", $user_id)));
}

function fino_lm_mark_all_read(){
    if(!is_user_logged_in()) wp_die('Not logged in');
    check_admin_referer('fino_mark_read');
    global $wpdb;
    $table = $wpdb->prefix . 'fino_notifications';
    $wpdb->update($table, ['is_read'=>1], ['user_id'=>get_current_user_id()]);
    wp_redirect(remove_query_arg(['fino_nmsg'], wp_get_referer()));
    exit;
}
add_action('admin_post_fino_mark_all_read', 'fino_lm_mark_all_read');

add_shortcode('fino_notifications_count', function(){
    if(!is_user_logged_in()) return '0';
    return strval(fino_lm_get_unread_count(get_current_user_id()));
});

add_shortcode('fino_notifications_list', function(){
    if(!is_user_logged_in()) return '';
    global $wpdb;
    $table = $wpdb->prefix . 'fino_notifications';
    $user_id = get_current_user_id();
    $rows = $wpdb->get_results($wpdb->prepare("SELECT * FROM $table WHERE user_id=%d ORDER BY id DESC LIMIT 10", $user_id));

    $action = esc_url(admin_url('admin-post.php'));
    $nonce = wp_nonce_field('fino_mark_read','_wpnonce', true, false);

    $out = '<div style="padding:8px 10px;display:flex;align-items:center;justify-content:space-between">
        <strong style="font-size:13px">Notifications</strong>
        <form method="post" action="'.$action.'">
          <input type="hidden" name="action" value="fino_mark_all_read"/>
          '.$nonce.'
          <button class="btn btnO" type="submit" style="padding:6px 10px">Mark all read</button>
        </form>
      </div>
      <div style="height:1px;background:#e5eaf3"></div>';

    if(!$rows){
        return $out . '<div style="padding:12px;color:#64748b;font-size:13px">No notifications</div>';
    }

    foreach($rows as $r){
        $dot = intval($r->is_read)===0 ? '<span style="width:8px;height:8px;border-radius:999px;background:#dc2626;display:inline-block"></span>' : '<span style="width:8px;height:8px;border-radius:999px;background:#e5eaf3;display:inline-block"></span>';
        $link = $r->link ? esc_url($r->link) : '#';
        $out .= '<a href="'.$link.'" style="display:flex;gap:10px;align-items:flex-start;padding:10px 12px;text-decoration:none;color:#0f172a">
            '.$dot.'
            <div style="flex:1">
              <div style="font-weight:800;font-size:13px">'.esc_html($r->title).'</div>
              <div style="font-size:12px;color:#64748b">'.esc_html($r->message).'</div>
              <div style="font-size:11px;color:#94a3b8;margin-top:2px">'.esc_html($r->created_at).'</div>
            </div>
          </a>';
        $out .= '<div style="height:1px;background:#f1f5f9;margin:0 12px"></div>';
    }
    return $out;
});

function fino_lm_notify_lead_assigned($lead_id, $assignee_user_id, $assignee_role){
    $title = 'New Lead Assigned';
    $message = 'Lead #'.intval($lead_id).' assigned to you ('.sanitize_text_field($assignee_role).')';
    fino_lm_add_notification(intval($assignee_user_id), $title, $message, '');
}