FM / pages

/home/u764571690/domains/savitrfoundation.com/public_html/scholar/pages/

/home/u764571690/domains/savitrfoundation.com/public_html/scholar/pages

Name	Size	Mode	Actions
cache/	-	0755	rm
css/	-	0755	rm
.htaccess	2618	0644	edit dl rm
ack.php	25283	0644	edit dl rm
bank.php	19033	0644	edit dl rm
daily_quiz.php	107398	0644	edit dl rm
dashboard.php	27243	0644	edit dl rm
distributed.php	27043	0644	edit dl rm
help.php	22858	0644	edit dl rm
institute.php	16928	0644	edit dl rm
invite.php	26223	0644	edit dl rm
leaderboard.php	37684	0644	edit dl rm
personal.php	15432	0644	edit dl rm
status.php	30253	0644	edit dl rm
tasks.php	71075	0644	edit dl rm

Edit: /home/u764571690/domains/savitrfoundation.com/public_html/scholar/pages/daily_quiz.php (107398B)

<?php
ini_set('display_errors', 0);
error_reporting(E_ALL);

// Check if session is already started
if (session_status() == PHP_SESSION_NONE) {
    // ✅ FIXED: Session setup with better error handling and security
    $sessionPath = __DIR__ . '/../sessions';
    if (!file_exists($sessionPath)) {
        if (!@mkdir($sessionPath, 0755, true)) {
            // If we can't create the directory, fall back to system default
            error_log("Could not create session directory: $sessionPath");
            $sessionPath = null; // Use system default
        }
    }
    
    // ✅ SECURITY: Only set custom path if directory exists and is writable
    if ($sessionPath && file_exists($sessionPath) && is_writable($sessionPath)) {
        // Try to set session path, but don't fail if it doesn't work (open_basedir restrictions)
        @ini_set('session.save_path', $sessionPath);
    }

// Set session timeout to 30 days
    ini_set('session.gc_maxlifetime', 2592000); // 30 days in seconds
    ini_set('session.cookie_lifetime', 2592000); // 30 days cookie lifetime

// ✅ Environment-aware session cookie configuration (HTTP compatible for localhost)
    $isHttps = (
        (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
        || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443)
    );

session_set_cookie_params([
      'path' => '/',
      'domain' => '',  // Empty for localhost compatibility
      'secure' => false,  // ✅ HTTP compatible for localhost
      'httponly' => true,
      'samesite' => 'Lax',
      'lifetime' => 2592000  // 30 days cookie lifetime
    ]);

session_start();
}

// Generate CSRF token if not exists
if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

require_once __DIR__ . '/../db.php';

// ✅ PERFORMANCE: Override SimpleCache to use pages/cache directory for better organization
class LocalSimpleCache extends SimpleCache {
    private static $cacheDir = __DIR__ . '/cache';
    private static $defaultTTL = 300;
    
    public static function init() {
        if (!file_exists(self::$cacheDir)) {
            @mkdir(self::$cacheDir, 0755, true);
        }
    }
    
    public static function get($key) {
        self::init();
        $file = self::$cacheDir . '/' . md5($key) . '.cache';
        
        if (!file_exists($file)) {
            return false;
        }
        
        $data = @unserialize(file_get_contents($file));
        if ($data === false) return false;
        
        if (time() > $data['expires']) {
            @unlink($file);
            return false;
        }
        
        return $data['value'];
    }
    
    public static function set($key, $value, $ttl = null) {
        self::init();
        $ttl = $ttl ?? self::$defaultTTL;
        $file = self::$cacheDir . '/' . md5($key) . '.cache';
        
        $data = [
            'value' => $value,
            'expires' => time() + $ttl,
            'created' => time()
        ];
        
        // ✅ FIXED: Better file locking with timeout to prevent deadlocks
        $serialized = serialize($data);
        $fp = @fopen($file, 'c+');
        if ($fp === false) {
            return false;
        }
        
        // Try to acquire lock with timeout (5 seconds)
        $lockAcquired = false;
        $attempts = 0;
        while ($attempts < 10 && !$lockAcquired) {
            if (flock($fp, LOCK_EX | LOCK_NB)) {
                $lockAcquired = true;
            } else {
                usleep(500000); // Wait 0.5 seconds
                $attempts++;
            }
        }
        
        if ($lockAcquired) {
            ftruncate($fp, 0);
            fwrite($fp, $serialized);
            flock($fp, LOCK_UN);
            fclose($fp);
            return true;
        } else {
            fclose($fp);
            // Fallback to simple write if lock fails (better than nothing)
            return @file_put_contents($file, $serialized) !== false;
        }
    }
    
    public static function delete($key) {
        self::init();
        $file = self::$cacheDir . '/' . md5($key) . '.cache';
        return @unlink($file);
    }
}

// Check if user is logged in
if (!isset($_SESSION['user_logged_in']) || $_SESSION['user_logged_in'] !== true) {
    header("Location: ../student");
    exit;
}

// Check if database connection is working
if (!isset($pdo) || !$pdo) {
    // UX-safe error handling (replacing die() with proper redirect)
    header("Location: ../quiz_error.php?code=DB_CONNECTION_FAILED");
    exit;
}

$userId   = $_SESSION['user_id'];
$userName = $_SESSION['user_name'] ?? 'Student';

// ✅ PERFORMANCE: Cache user profile check to reduce DB queries
$profileCacheKey = 'user_profile_status_' . $userId;
$applicant = LocalSimpleCache::get($profileCacheKey);

if ($applicant === false) {
    $stmt = $pdo->prepare("
        SELECT a.status 
        FROM users u
        JOIN applicants a ON u.applicant_id = a.applicant_id
        WHERE u.user_id = ?
    ");
    $stmt->execute([$userId]);
    $applicant = $stmt->fetch(PDO::FETCH_ASSOC);
    LocalSimpleCache::set($profileCacheKey, $applicant ?: ['status' => null], 300); // Cache for 5 minutes
}

if (!$applicant || $applicant['status'] !== 'Approved') {
    // UX-safe error handling (replacing die() with proper message)
    echo "<div class='card'><h3>Access Denied</h3><p>You must have an approved application to take the daily quiz. Please complete your profile first.</p></div>";
    exit;
}

/* =======================
   DEVICE HASH
======================= */
$ua   = $_SERVER['HTTP_USER_AGENT'] ?? '';
$lang = $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '';

$deviceHash = hash('sha256', $ua . $lang); // ✅ PRODUCTION SAFE device hash

/* =======================
   FETCH TODAY ACTIVE ATTEMPT
======================= */
// ✅ PERFORMANCE: Cache attempt check to reduce database load
// Initialize $attempt to null to prevent undefined variable warnings
$attempt = null;
$attemptCacheKey = 'quiz_attempt_' . $userId . '_' . date('Y-m-d');
$cachedAttempt = LocalSimpleCache::get($attemptCacheKey);

if ($cachedAttempt === false) {
    $stmt = $pdo->prepare("
      SELECT * FROM quiz_attempts
      WHERE user_id = ?
        AND quiz_date = CURDATE()
      ORDER BY id DESC
      LIMIT 1
    ");
    $stmt->execute([$userId]);
    $attempt = $stmt->fetch(PDO::FETCH_ASSOC);
    LocalSimpleCache::set($attemptCacheKey, $attempt ?: false, 60); // 1 minute cache for localhost
} else {
    $attempt = $cachedAttempt ?: null;
}

// ✅ ADD ATTEMPT OWNERSHIP VALIDATION
if ($attempt && (int)$attempt['user_id'] !== (int)$userId) {
    error_log("Attempt ownership violation | user=$userId attempt={$attempt['id']}");
    header("Location: ../quiz_error.php?code=UNAUTHORIZED");
    exit;
}

/* =======================
   START QUIZ
======================= */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['start_quiz'])) {
    // ✅ IMPLEMENT DATABASE-BASED RATE LIMITING (instead of session-based)
    $stmt = $pdo->prepare("
      SELECT COUNT(*) FROM quiz_attempts
      WHERE user_id = ?
        AND started_at > NOW() - INTERVAL 1 MINUTE
    ");
    $stmt->execute([$userId]);
    
    if ($stmt->fetchColumn() > 0) {
        echo "<div class='card'><h3>Rate Limit Exceeded</h3><p>Please wait 1 minute before starting another quiz.</p></div>";
        exit;
    }
    
    // Validate CSRF token with hash_equals for timing attack protection
    if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        // UX-safe error handling
        echo "<div class='card'><h3>Error</h3><p>Invalid request. Please try again.</p></div>";
        exit;
    }

// ✅ CLEAR DEVICE WARNING SHOWN FLAG ON NEW QUIZ START
    // Reset the device warning shown flag for new quiz attempts
    unset($_SESSION['device_warning_shown']);

if ($attempt) {
        // UX-safe error handling
        echo "<div class='card'><h3>Quiz Already Started</h3><p>Quiz already started today.</p></div>";
        exit;
    }

$questions = [];
    
    // ✅ PERFORMANCE: Cache question pool to reduce DB load
    $questionCacheKey = 'quiz_questions_pool_' . date('Y-m-d');
    $allQuestions = LocalSimpleCache::get($questionCacheKey);
    
    if ($allQuestions === false) {
        // REPLACED ORDER BY RAND() with deterministic shuffle approach
        // First try to get today's questions
        $stmt = $pdo->prepare("
            SELECT id FROM quiz_questions
            WHERE quiz_date = CURDATE() AND is_active = 1
            LIMIT 200
        ");
        $stmt->execute();
        $todaysQuestions = $stmt->fetchAll(PDO::FETCH_COLUMN);
        
        // If not enough questions for today, get from any date
        if (count($todaysQuestions) < 15) {
            $needed = 15 - count($todaysQuestions);
            $stmt = $pdo->prepare("
                SELECT id FROM quiz_questions
                WHERE is_active = 1 AND quiz_date != CURDATE()
                LIMIT 200
            ");
            $stmt->execute();
            $additionalQuestions = $stmt->fetchAll(PDO::FETCH_COLUMN);
            $allQuestions = array_merge($todaysQuestions, $additionalQuestions);
        } else {
            $allQuestions = $todaysQuestions;
        }
        
        // ✅ OPTIMIZED: Cache for 10 minutes - good for localhost testing
        LocalSimpleCache::set($questionCacheKey, $allQuestions, 600);
    }
    
    // Shuffle and select exactly 15 questions
    shuffle($allQuestions);
    $questions = array_slice($allQuestions, 0, 15);
    
    // Ensure we have exactly 15 questions
    if (count($questions) < 15) {
        // ✅ FIXED: Proper error page with full HTML layout instead of just exit
        // This prevents blank screen and provides better UX
        ?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Daily Quiz - Error</title>
<link rel="stylesheet" href="/scholar/pages/css/daily.css">
</head>
<body>
<div class="card">
    <h2 style="color: #dc3545;">⚠️ Not Enough Questions</h2>
    <p>Sorry, there are not enough questions available in the database to start the quiz.</p>
    <p>Please contact the administrator or try again later.</p>
    <p style="margin-top: 20px;">
        <a href="/scholar/dashboard" style="display: inline-block; padding: 10px 20px; background: #13386c; color: white; text-decoration: none; border-radius: 5px;">Go to Dashboard</a>
    </p>
</div>
</body>
</html>
        <?php
        exit;
    }
    
    // Limit to exactly 15 questions
    $questions = array_slice($questions, 0, 15);
    
    // ❌ WRAP IN DATABASE TRANSACTION for atomicity
    try {
        $pdo->beginTransaction();
        
        // deactivate old attempts
        $pdo->prepare("
            UPDATE quiz_attempts
            SET is_active_attempt = 0
            WHERE user_id = ? AND quiz_date = CURDATE()
        ")->execute([$userId]);

// create attempt with race condition protection
        $stmt = $pdo->prepare("
            INSERT INTO quiz_attempts
            (user_id, quiz_date, started_at, expires_at, device_hash)
            VALUES (?, CURDATE(), NOW(), DATE_ADD(NOW(), INTERVAL 10 MINUTE), ?)
        ");
        $stmt->execute([$userId, $deviceHash]);
        $attemptId = $pdo->lastInsertId();

// Bulk insert for better performance - N+1 insert problem fix
        if (!empty($questions)) {
            $values = [];
            $params = [];
            
            foreach ($questions as $i => $qid) {
                $values[] = "(?, ?, ?)";
                $params[] = $attemptId;
                $params[] = $qid;
                $params[] = $i + 1;
            }
            
            $sql = "
                INSERT INTO quiz_attempt_questions
                (attempt_id, question_id, question_order)
                VALUES " . implode(',', $values);
            
            $pdo->prepare($sql)->execute($params);
        }
        
        $pdo->commit();
        
        // ✅ Clear attempt cache when new quiz starts
        LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));
    } catch (PDOException $e) {
        $pdo->rollBack();
        
        // Check if it's a duplicate entry error
        if (in_array($e->getCode(), ['23000', '1062'], true)) {
            // UX-safe error handling
            echo "<div class='card'><h3>Quiz Already Started</h3><p>Quiz already started. Please refresh the page.</p></div>";
            exit;
        }
        
        // Log the error and show a generic message
        error_log("Quiz start transaction failed: " . $e->getMessage());
        echo "<div class='card'><h3>Error</h3><p>Failed to start quiz. Please try again.</p></div>";
        exit;
    }

header("Location: daily_quiz");
    exit;
}

/* =======================
   TAB SWITCH (AJAX)
======================= */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'tab_switch') {
    // ✅ SECURITY: Validate CSRF token for AJAX requests
    if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        http_response_code(403);
        exit;
    }
    
    // ✅ SECURITY: Re-fetch attempt from database to prevent stale data attacks (AJAX bypass prevention)
    $stmt = $pdo->prepare("
        SELECT * FROM quiz_attempts
        WHERE user_id = ? AND quiz_date = CURDATE() AND status = 'started'
        ORDER BY id DESC LIMIT 1
    ");
    $stmt->execute([$userId]);
    $currentAttempt = $stmt->fetch(PDO::FETCH_ASSOC);
    
    if (!$currentAttempt || (int)$currentAttempt['user_id'] !== (int)$userId) {
        http_response_code(403);
        exit;
    }
    
    // ✅ SECURITY: Server-side validation - Check if quiz expired
    if ($currentAttempt['expires_at'] && strtotime($currentAttempt['expires_at']) < time()) {
        $pdo->prepare("
            UPDATE quiz_attempts
            SET status='disqualified',
                completed_at=NOW(),
                disqualification_reason='Quiz expired',
                is_active_attempt = 0
            WHERE id = ?
        ")->execute([$currentAttempt['id']]);
        
        LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));
        if (isset($_SESSION['device_warning'])) {
            unset($_SESSION['device_warning']);
        }
        header('Content-Type: application/json');
        echo json_encode(['status' => 'expired']);
        exit;
    }
    
    // ✅ SECURITY: Server-side activity validation - Ignore first visibility change (mobile noise filter)
    if ($currentAttempt['tab_switch_count'] == 0) {
        // Just update last_activity, don't increment count
        $pdo->prepare("UPDATE quiz_attempts SET last_activity = NOW() WHERE id = ?")
            ->execute([$currentAttempt['id']]);
        header('Content-Type: application/json');
        echo json_encode(['status' => 'ok', 'ignored' => true]);
        exit;
    }
    
    // ✅ SECURITY: Increment tab switch count with server-side validation (prevents AJAX blocking bypass)
    $pdo->prepare("
        UPDATE quiz_attempts
        SET tab_switch_count = tab_switch_count + 1,
            last_activity = NOW()
        WHERE id = ? AND status = 'started'
    ")->execute([$currentAttempt['id']]);
    
    // ✅ OPTIMIZED: Single query to get updated count
    $stmt = $pdo->prepare("SELECT tab_switch_count FROM quiz_attempts WHERE id = ?");
    $stmt->execute([$currentAttempt['id']]);
    $updatedAttempt = $stmt->fetch(PDO::FETCH_ASSOC);
    
    // ✅ SECURITY: Disqualify if tab switch count >= 5 (server-side enforcement)
    if ($updatedAttempt && $updatedAttempt['tab_switch_count'] >= 5) {
        $disqualificationReason = 'Multiple tab switches detected (' . $updatedAttempt['tab_switch_count'] . ' times)';
        $pdo->prepare("
            UPDATE quiz_attempts
            SET status='disqualified',
                completed_at=NOW(),
                disqualification_reason=?,
                is_active_attempt = 0
            WHERE id = ?
        ")->execute([$disqualificationReason, $currentAttempt['id']]);
        
        LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));
        header('Content-Type: application/json');
        echo json_encode(['status' => 'disqualified', 'reason' => $disqualificationReason]);
        exit;
    }
    
    header('Content-Type: application/json');
    echo json_encode(['status' => 'ok', 'count' => $updatedAttempt['tab_switch_count'] ?? 0]);
    exit;
}

/* =======================
   PROCTORING EVENT BATCH (AJAX) - Ultra-Optimized for Shared Hosting
======================= */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'proctor_event_batch') {
    // Validate CSRF token for AJAX requests
    if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        http_response_code(403);
        exit;
    }
    
    $eventsJson = $_POST['events'] ?? '[]';
    $events = json_decode($eventsJson, true);
    
    if (!is_array($events) || empty($events)) {
        echo json_encode(['status' => 'ok']);
        exit;
    }
    
    if ($attempt && $attempt['status'] === 'started') {
        $attemptId = $attempt['id'];
        $disqualificationTriggered = false;
        $reason = '';
        
        // ✅ PERFORMANCE: Fetch current counts once to reduce queries
        $stmt = $pdo->prepare("
            SELECT face_absence_count, noise_spike_count, fullscreen_exit_count, suspicious_activity_count
            FROM quiz_attempts WHERE id = ?
        ");
        $stmt->execute([$attemptId]);
        $counts = $stmt->fetch(PDO::FETCH_ASSOC);
        
        $faceCount = (int)($counts['face_absence_count'] ?? 0);
        $noiseCount = (int)($counts['noise_spike_count'] ?? 0);
        $fullscreenCount = (int)($counts['fullscreen_exit_count'] ?? 0);
        $suspiciousCount = (int)($counts['suspicious_activity_count'] ?? 0);
        
        // Prepare bulk insert for proctoring events
        $eventInsertValues = [];
        $eventInsertParams = [];
        
        // Process all events in batch
        foreach ($events as $eventType) {
            $shouldDisqualify = false;
            
            switch ($eventType) {
                case 'face_missing':
                    $faceCount++;
                    if ($faceCount >= 3) {
                        $reason = 'Face absent from camera multiple times (' . $faceCount . ' events)';
                        $shouldDisqualify = true;
                    }
                    break;
                    
                case 'loud_audio':
                    $noiseCount++;
                    if ($noiseCount >= 3) {
                        $reason = 'Excessive microphone noise detected multiple times (' . $noiseCount . ' events)';
                        $shouldDisqualify = true;
                    }
                    break;
                    
                case 'dev_tools_open':
                    $reason = 'Developer tools opened during quiz';
                    $shouldDisqualify = true;
                    break;
                    
                case 'fullscreen_exit':
                    $fullscreenCount++;
                    if ($fullscreenCount >= 3) {
                        $reason = 'Exited fullscreen mode multiple times (' . $fullscreenCount . ' times)';
                        $shouldDisqualify = true;
                    }
                    break;
                    
                case 'suspicious_resize':
                    $suspiciousCount++;
                    break;
            }
            
            // Prepare event for bulk insert
            $eventInsertValues[] = "(?, ?, NOW())";
            $eventInsertParams[] = $attemptId;
            $eventInsertParams[] = $eventType;
            
            if ($shouldDisqualify && !$disqualificationTriggered) {
                $disqualificationTriggered = true;
                break; // Stop processing more events if disqualified
            }
        }
        
        // ✅ PERFORMANCE: Single UPDATE query for all counters
        $pdo->prepare("
            UPDATE quiz_attempts
            SET face_absence_count = ?,
                noise_spike_count = ?,
                fullscreen_exit_count = ?,
                suspicious_activity_count = ?
            WHERE id = ?
        ")->execute([$faceCount, $noiseCount, $fullscreenCount, $suspiciousCount, $attemptId]);
        
        // ✅ PERFORMANCE: Bulk insert all proctoring events at once
        if (!empty($eventInsertValues)) {
            $sql = "INSERT INTO proctoring_events (attempt_id, event_type, created_at) VALUES " 
                   . implode(',', $eventInsertValues);
            $pdo->prepare($sql)->execute($eventInsertParams);
        }
        
        // Handle disqualification if triggered
        if ($disqualificationTriggered) {
            $pdo->prepare("
                UPDATE quiz_attempts
                SET status='disqualified',
                    completed_at=NOW(),
                    disqualification_reason=?,
                    is_active_attempt = 0
                WHERE id = ?
            ")->execute([$reason, $attemptId]);
            
            LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));
        }
        
        echo json_encode([
            'status' => 'ok',
            'disqualified' => $disqualificationTriggered,
            'reason' => $reason
        ]);
        exit;
    }
    
    echo json_encode(['status' => 'ok']);
    exit;
}

/* =======================
   PROCTORING EVENT (AJAX) - Legacy Handler (for backward compatibility)
======================= */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'proctor_event') {
    // Validate CSRF token for AJAX requests
    if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        http_response_code(403);
        exit;
    }
    
    $eventType = $_POST['event_type'] ?? '';
    
    if ($attempt && $attempt['status'] === 'started') {
        $attemptId = $attempt['id'];
        $disqualificationTriggered = false;
        $reason = '';
        $shouldDisqualify = false;

switch ($eventType) {
            case 'face_missing':
                // Log face absence and check if it has occurred too many times
                $pdo->prepare("
                    UPDATE quiz_attempts
                    SET face_absence_count = COALESCE(face_absence_count, 0) + 1
                    WHERE id = ?
                ")->execute([$attemptId]);
                
                // Fetch updated count
                $stmt = $pdo->prepare("SELECT face_absence_count FROM quiz_attempts WHERE id = ?");
                $stmt->execute([$attemptId]);
                $updatedCount = $stmt->fetchColumn();
                
                // Disqualify if face is absent 3 times or more
                if ($updatedCount >= 3) {
                    $reason = 'Face absent from camera multiple times (' . $updatedCount . ' events)';
                    $shouldDisqualify = true;
                }
                break;
                
            case 'loud_audio':
                 // Log high noise event
                $pdo->prepare("
                    UPDATE quiz_attempts
                    SET noise_spike_count = COALESCE(noise_spike_count, 0) + 1
                    WHERE id = ?
                ")->execute([$attemptId]);
                
                // Fetch updated count
                $stmt = $pdo->prepare("SELECT noise_spike_count FROM quiz_attempts WHERE id = ?");
                $stmt->execute([$attemptId]);
                $updatedCount = $stmt->fetchColumn();

// Disqualify if noise spike detected 3 times or more
                if ($updatedCount >= 3) {
                    $reason = 'Excessive microphone noise detected multiple times (' . $updatedCount . ' events)';
                    $shouldDisqualify = true;
                }
                break;

case 'dev_tools_open':
                $reason = 'Developer tools opened during quiz';
                $shouldDisqualify = true;
                break;
            
            case 'fullscreen_exit':
                // Log fullscreen exit and check count
                $pdo->prepare("
                    UPDATE quiz_attempts
                    SET fullscreen_exit_count = COALESCE(fullscreen_exit_count, 0) + 1
                    WHERE id = ?
                ")->execute([$attemptId]);
                
                // Fetch updated count
                $stmt = $pdo->prepare("SELECT fullscreen_exit_count FROM quiz_attempts WHERE id = ?");
                $stmt->execute([$attemptId]);
                $updatedCount = $stmt->fetchColumn();
                
                // Disqualify if exited fullscreen 3+ times
                if ($updatedCount >= 3) {
                    $reason = 'Exited fullscreen mode multiple times (' . $updatedCount . ' times)';
                    $shouldDisqualify = true;
                }
                break;
            
            case 'suspicious_resize':
                // Log suspicious window resize (potential screen sharing)
                $pdo->prepare("
                    UPDATE quiz_attempts
                    SET suspicious_activity_count = COALESCE(suspicious_activity_count, 0) + 1
                    WHERE id = ?
                ")->execute([$attemptId]);
                // Don't auto-disqualify, just log for admin review
                break;
                
            default:
                // Ignore unknown events
                http_response_code(400);
                exit;
        }

// Insert the event into proctoring_events table for admin review
        $pdo->prepare("
            INSERT INTO proctoring_events (attempt_id, event_type, created_at)
            VALUES (?, ?, NOW())
        ")->execute([$attemptId, $eventType]);

if ($shouldDisqualify) {
            $pdo->prepare("
                UPDATE quiz_attempts
                SET status='disqualified',
                    completed_at=NOW(),
                    disqualification_reason=?,
                    is_active_attempt = 0
                WHERE id = ?
            ")->execute([$reason, $attemptId]);
            
            // ✅ Clear attempt cache when disqualified
            LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));
            $disqualificationTriggered = true;
        }

// Return JSON response for client-side action
        header('Content-Type: application/json');
        echo json_encode([
            'status' => 'success', 
            'disqualified' => $disqualificationTriggered,
            'reason' => $reason
        ]);
    }
    exit;
}

/* =======================
   ANSWER SUBMIT (AJAX Flow Implemented)
======================= */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['answer']) || isset($_POST['auto_answer']))) {
    
    $isAjax = (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest');
    
    // Setup JSON response header for AJAX requests
    if ($isAjax) {
        header('Content-Type: application/json');
    }
    
    // Validate CSRF token with hash_equals for timing attack protection
    if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        error_log("Quiz answer submit failed: Invalid CSRF token");
        if ($isAjax) {
            echo json_encode(['status' => 'error', 'message' => 'Invalid request.']);
            exit;
        }
        // Non-AJAX fallback: redirect to refresh
        header("Location: daily_quiz");
        exit;
    }
    
    // Check if quiz has expired before processing answer
    if ($attempt['expires_at'] && strtotime($attempt['expires_at']) < time()) {
        $pdo->prepare("
            UPDATE quiz_attempts
            SET status='disqualified',
                completed_at=NOW(),
                disqualification_reason='Quiz expired',
                is_active_attempt = 0
            WHERE id=?
        ")->execute([$attempt['id']]);
        
        // ✅ Clear attempt cache when expired
        LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));

if ($isAjax) {
            echo json_encode(['status' => 'expired', 'message' => 'Quiz expired due to inactivity.']);
            exit;
        }
        header("Location: daily_quiz");
        exit;
    }

if ( empty($_POST['aqid']) ) {
        if ($isAjax) {
            echo json_encode(['status' => 'error', 'message' => 'Missing question ID.']);
            exit;
        }
        header("Location: daily_quiz");
        exit;
    }
    $aqid = (int) $_POST['aqid'];
    
    // Determine the answer
    if (!empty($_POST['auto_answer']) && $_POST['auto_answer'] === 'TIME') {
        $answer = 'TIME';
    } elseif (!empty($_POST['answer'])) {
        $answer = strtoupper($_POST['answer']);
    } else {
        // If it's a manual submit (not auto_answer) but no answer is selected
        if ($isAjax) {
            echo json_encode(['status' => 'no_answer_selected', 'message' => 'Please select an option.']);
            exit;
        }
        // Fallback for non-AJAX user: treat as timed out (TIME)
        $answer = 'TIME';
    }
    
    // Validate answer input
    if (!in_array($answer, ['A','B','C','D','TIME'], true)) {
        if ($isAjax) {
            echo json_encode(['status' => 'error', 'message' => 'Invalid answer value.']);
            exit;
        }
        header("Location: daily_quiz");
        exit;
    }

// Fetch question data
    $stmt = $pdo->prepare("
        SELECT aq.question_started_at, q.correct_answer
        FROM quiz_attempt_questions aq
        JOIN quiz_questions q ON q.id = aq.question_id
        WHERE aq.id = ? AND aq.attempt_id = ?
    ");
    $stmt->execute([$aqid, $attempt['id']]);
    $row = $stmt->fetch(PDO::FETCH_ASSOC);

if ($row && $row['question_started_at']) {
        $taken = time() - strtotime($row['question_started_at']);
        $isTimedOut = ($answer === 'TIME');
        $correct = (!$isTimedOut && $answer === $row['correct_answer']) ? 1 : 0;
        
        try {
            $pdo->beginTransaction();
            
            // ❌ ADD RACE CONDITION PROTECTION - Check if answer already submitted
            $stmt = $pdo->prepare("
                UPDATE quiz_attempt_questions
                SET selected_answer = ?, is_correct = ?, time_taken = ?
                WHERE id = ? AND selected_answer IS NULL  
            ");
            $stmt->execute([$answer, $correct, min($taken, 15), $aqid]);
            
            // ✅ PERFORMANCE: Clear question count cache after answer submission
            LocalSimpleCache::delete('question_count_' . $attempt['id']);
            
            $rowsAffected = $stmt->rowCount();
            
            // ✅ FIXED: If no rows were affected, the answer was already submitted
            if ($rowsAffected == 0) {
                $pdo->commit();
                // ✅ FIXED: Proper response for double submit - prevent user confusion
                if ($isAjax) {
                    header('Content-Type: application/json');
                    echo json_encode([
                        'status' => 'already_submitted', 
                        'message' => 'This answer was already submitted. Loading next question...'
                    ]);
                } else {
                    header("Location: daily_quiz");
                }
                exit;
            }
            
            // ✅ INCREMENT answered_count IN quiz_attempts
            $pdo->prepare("
                UPDATE quiz_attempts
                SET answered_count = answered_count + 1
                WHERE id = ?
            ")->execute([$attempt['id']]);
            
            // Check if there are any unanswered questions left
            $stmt = $pdo->prepare("
                SELECT COUNT(*) as unanswered 
                FROM quiz_attempt_questions 
                WHERE attempt_id = ? AND selected_answer IS NULL
            ");
            $stmt->execute([$attempt['id']]);
            $unanswered = $stmt->fetch(PDO::FETCH_ASSOC)['unanswered'];
            
            $quizStatus = 'started';
            
            // If no unanswered questions, complete the quiz
            if ($unanswered == 0) {
                $quizStatus = 'completed';
                // finish quiz
                $score = $pdo->prepare("
                    SELECT COUNT(*) FROM quiz_attempt_questions
                    WHERE attempt_id = ? AND is_correct = 1
                ");
                $score->execute([$attempt['id']]);
                $score = $score->fetchColumn();
                
                $pdo->prepare("
                    UPDATE quiz_attempts
                    SET status='completed',
                        completed_at=NOW(),
                        score=?,
                        is_active_attempt = 0
                    WHERE id = ?
                ")->execute([$score, $attempt['id']]);
                
                // ✅ Clear attempt cache when quiz completes
                LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));
                LocalSimpleCache::delete('question_count_' . $attempt['id']); // Clear question count cache

// Update leaderboard
                $currentMonthYear = date('Y-m');
                
                $stmt = $pdo->prepare("
                    SELECT id, total_score, quizzes_taken 
                    FROM quiz_leaderboard_monthly 
                    WHERE user_id = ? AND month_year = ?
                ");
                $stmt->execute([$userId, $currentMonthYear]);
                $leaderboardEntry = $stmt->fetch(PDO::FETCH_ASSOC);
                
                if ($leaderboardEntry) {
                    $newTotalScore = $leaderboardEntry['total_score'] + $score;
                    $newQuizzesTaken = $leaderboardEntry['quizzes_taken'] + 1;
                    
                    $pdo->prepare("
                        UPDATE quiz_leaderboard_monthly 
                        SET total_score = ?, quizzes_taken = ?
                        WHERE id = ?
                    ")->execute([$newTotalScore, $newQuizzesTaken, $leaderboardEntry['id']]);
                } else {
                    $pdo->prepare("
                        INSERT INTO quiz_leaderboard_monthly 
                        (user_id, month_year, total_score, quizzes_taken)
                        VALUES (?, ?, ?, 1)
                    ")->execute([$userId, $currentMonthYear, $score]);
                }
                
                // ✅ Clear device warning after quiz completion
                if (isset($_SESSION['device_warning'])) {
                    unset($_SESSION['device_warning']);
                }
            }
            
            $pdo->commit();
            
            // AJAX RESPONSE (for manual submit)
            if ($isAjax) {
                // ✅ FIXED: Set JSON header before output to prevent page refresh
                header('Content-Type: application/json');
                echo json_encode([
                    'status' => 'success', 
                    'message' => ($isTimedOut ? 'Time expired. Answer recorded.' : 'Answer submitted successfully.'), 
                    'quiz_status' => $quizStatus
                ]);
                exit;
            } else {
                // Non-AJAX response (for auto-submit 'TIME') - needs a redirect
                header("Location: daily_quiz");
                exit;
            }

} catch (Exception $e) {
            $pdo->rollBack();
            error_log("Quiz answer submit transaction failed: " . $e->getMessage());
            
            if ($isAjax) {
                echo json_encode(['status' => 'error', 'message' => 'Failed to process answer. Please try again.']);
                exit;
            } else {
                // Non-AJAX fallback
                header("Location: daily_quiz");
                exit;
            }
        }
    } else {
        if ($isAjax) {
            echo json_encode(['status' => 'error', 'message' => 'Question not found or already started.']);
            exit;
        }
        header("Location: daily_quiz");
        exit;
    }
}

/* =======================
   FETCH CURRENT QUESTION
======================= */
$currentQuestion = null;

if ($attempt && $attempt['status'] === 'started') {
    
    // Check if quiz has expired
    if ($attempt['expires_at'] && strtotime($attempt['expires_at']) < time()) {
        $pdo->prepare("
            UPDATE quiz_attempts
            SET status='disqualified',
                completed_at=NOW(),
                disqualification_reason='Quiz expired',
                is_active_attempt = 0
            WHERE id=?
        ")->execute([$attempt['id']]);
        
        // ✅ Clear attempt cache when expired
        LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));

// ✅ Clear device warning after quiz expiry
        if (isset($_SESSION['device_warning'])) {
            unset($_SESSION['device_warning']);
        }

// UX-safe error handling
        echo "<div class='card'><h3>Quiz Expired</h3><p>Quiz expired due to inactivity.</p></div>";
        exit;
    }
    
    // Enhanced device check with warning and optional disqualification
    if ($attempt['device_hash'] !== $deviceHash) {
        // Log the device change
        error_log("Quiz Device Change | user={$userId} | attempt={$attempt['id']}");
        
        // Store device change in database for admin review
        $pdo->prepare("
            UPDATE quiz_attempts
            SET device_changes = device_changes + 1
            WHERE id = ?
        ")->execute([$attempt['id']]);
        
        // ✅ OPTIMIZED: Single query to get device_changes (was 2 queries)
        $stmt = $pdo->prepare("SELECT device_changes FROM quiz_attempts WHERE id = ?");
        $stmt->execute([$attempt['id']]);
        $updatedAttempt = $stmt->fetch(PDO::FETCH_ASSOC);
        
        // Set session warning for first device change
        if ($updatedAttempt && $updatedAttempt['device_changes'] == 1) {
            $_SESSION['device_warning'] = true;
        }
        
        // Disqualify if device changed more than 1 time (2nd change triggers disqualification)
        if ($updatedAttempt && $updatedAttempt['device_changes'] >= 2) {
            $pdo->prepare("
                UPDATE quiz_attempts
                SET status='disqualified',
                    completed_at=NOW(),
                    disqualification_reason='Multiple device changes detected',
                    is_active_attempt = 0
                WHERE id = ?
            ")->execute([$attempt['id']]);
            
            // ✅ Clear attempt cache when disqualified
            LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d'));

// ✅ Clear device warning after device change disqualification
            if (isset($_SESSION['device_warning'])) {
                unset($_SESSION['device_warning']);
            }

// UX-safe error handling
            echo "<div class='card'><h3>Disqualified</h3><p>You have been disqualified due to multiple device changes during the quiz.</p></div>";
            exit;
        }
    }

$stmt = $pdo->prepare("
        SELECT q.*, aq.id AS aqid, aq.question_started_at
        FROM quiz_attempt_questions aq
        JOIN quiz_questions q ON q.id = aq.question_id
        WHERE aq.attempt_id = ?
          AND aq.selected_answer IS NULL
        ORDER BY aq.question_order ASC
        LIMIT 1
    ");
    $stmt->execute([$attempt['id']]);
    $currentQuestion = $stmt->fetch(PDO::FETCH_ASSOC);

// set question start time
    if ($currentQuestion && !$currentQuestion['question_started_at']) {
        $pdo->prepare("
            UPDATE quiz_attempt_questions
            SET question_started_at = NOW()
            WHERE id = ?
        ")->execute([$currentQuestion['aqid']]);
        
        // ✅ OPTIMIZED: Update question_started_at directly without re-fetch (1 less query)
        // Just update the local variable instead of re-fetching
        $currentQuestion['question_started_at'] = date('Y-m-d H:i:s');
    }
    
    // Server-side timer validation - check if current question has exceeded time limit
    if ($currentQuestion && $currentQuestion['question_started_at']) {
        $timeTaken = time() - strtotime($currentQuestion['question_started_at']);
        // Add grace period to prevent unfair disqualification due to network latency
        $buffer = 3; // seconds
        if ($timeTaken > (15 + $buffer)) {
            // Auto-submit the question with no points if time exceeded
            $stmt = $pdo->prepare("
                UPDATE quiz_attempt_questions
                SET selected_answer = 'TIME', is_correct = 0, time_taken = 15
                WHERE id = ? AND selected_answer IS NULL
            ");
            $stmt->execute([$currentQuestion['aqid']]);
            
            // Only redirect if the update was successful
            if ($stmt->rowCount() > 0) {
                // Redirect to reload the page and get the next question
                header("Location: daily_quiz");
                exit;
            }
        }
    }
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Daily Quiz</title>

<link rel="preconnect" href="https://unpkg.com" crossorigin>
<link rel="dns-prefetch" href="https://cdn.jsdelivr.net">
<link rel="dns-prefetch" href="https://pagead2.googlesyndication.com">

<link rel="stylesheet" href="/scholar/pages/css/daily.css">

    <script defer src="https://unpkg.com/face-api.js@0.22.2/dist/face-api.min.js"></script>
    <script>
        // ✅ Helper function to check if face-api.js is loaded (script is already loading via defer)
        function loadFaceApiScript() {
            // Script is already loading via defer in head, just check if it's ready
            if (typeof faceapi !== 'undefined') {
                return Promise.resolve();
            }
            // Wait for script to load
            return new Promise((resolve) => {
                const checkInterval = setInterval(() => {
                    if (typeof faceapi !== 'undefined') {
                        clearInterval(checkInterval);
                        resolve();
                    }
                }, 100);
                // Timeout after 10 seconds
                setTimeout(() => {
                    clearInterval(checkInterval);
                    resolve();
                }, 10000);
            });
        }
    </script>
    <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6734060461800843"
     crossorigin="anonymous" defer></script>
</head>

<body>

<?php 
// Determine if proctoring screen should be shown (Pre-quiz and During-quiz)
// Ensure $attempt is always defined to prevent warnings
$showProctoringScreen = (!$attempt || (isset($attempt['status']) && $attempt['status'] === 'started'));
?>

<div class="quiz-watermark"><?= htmlspecialchars($userName) ?> • <?= $userId ?></div>

<?php 
// 📹 LIVE VIDEO PROCTORING SECTION (Shows if Quiz not started OR is in started status)
if ($showProctoringScreen): 
?>
<div id="videoContainer">
    <div class="recording-dot"></div> <span class="proctoring-warning">REC | DO NOT TRY TO CHEAT</span> 
    <video id="liveVideo" autoplay playsinline muted style="display: block; width: 100%; height: 100%; object-fit: cover;"></video>
    <p id="cameraStatus">Loading...</p>
</div>
<?php endif; ?>

<?php 
// 🔶 DEVICE WARNING UI SPAM FIX
if (isset($_SESSION['device_warning']) && $_SESSION['device_warning'] && 
    (!isset($_SESSION['device_warning_shown']) || !$_SESSION['device_warning_shown'])): 
    $_SESSION['device_warning_shown'] = true;
?>
<div class="warning-box">
    ⚠ Device change detected. Further changes may disqualify you.
</div>
<?php endif; ?>

<?php if (!$attempt): ?>
<form method="post" id="startQuizForm">
    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
    
    <div style="margin: 20px 0; padding: 15px; border: 1px solid #ddd; border-radius: 5px; background-color: #f9f9f9;">
        <h3 style="margin-top: 0;">Terms & Conditions</h3>
        <ul style="text-align: left;">
            <li>You must keep this tab focused during the quiz</li>
            <li>Do not switch to other tabs or applications</li>
            <li>Do not open developer tools or inspect elements</li>
            <li>Keep your face visible to the camera at all times</li>
            <li>Complete the quiz in one sitting without refreshing</li>
            <li>Any violation may result in disqualification</li>
        </ul>
        
        <label style="display: flex; align-items: center; margin-top: 15px;">
            <input type="checkbox" id="termsCheckbox" required style="margin-right: 10px; transform: scale(1.3);">
            <span>I have read and agree to the terms & conditions</span>
        </label>
    </div>
    
    <button name="start_quiz" id="startQuizButton" disabled>Start Quiz</button>
</form>
<p>Click the button above to start today's quiz. You'll have 15 questions to answer, with 15 seconds per question.</p>
<p>Please keep this tab focused and avoid switching to other tabs or applications during the quiz.</p>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-6734060461800843"
     data-ad-slot="6251979271"
     data-ad-format="auto"
     data-full-width-responsive="true"></ins>
<script>
     (adsbygoogle = window.adsbygoogle || []).push({});
</script>

<?php elseif ($attempt['status'] === 'completed'): ?>

<div style="text-align: center; padding: 30px;">
    <h2 style="color: #28a745;">🎉 Congratulations! 🎉</h2>
    <h3>Your quiz has been submitted successfully</h3>
    <p style="font-size: 18px; margin: 20px 0;">
        You have successfully completed today's quiz.<br>
        Check the leaderboard to see how you rank!
    </p>
    <a href="/scholar/" style="display: inline-block; padding: 12px 25px; background: #13386c; color: white; text-decoration: none; border-radius: 5px; font-weight: bold; margin-top: 20px;">Go to Scholarship Portal</a>
    <p style="margin-top: 20px; color: #666;">You can check your results in the leaderboard section on scholarship portal</p>
</div>

<?php elseif ($attempt['status'] === 'disqualified'): ?>

<h2>Disqualified</h2>
<p><?= htmlspecialchars($attempt['disqualification_reason']) ?></p>
<p>You have been disqualified from today's quiz. Please follow the quiz rules carefully:</p>
<ul>
    <li>Do not switch tabs or applications during the quiz</li>
    <li>Do not open developer tools or inspect elements</li>
    <li>Complete the quiz in one sitting without refreshing</li>
</ul>
<p>You can try again tomorrow with a new set of questions.</p>

<?php else: /* Quiz is active ('started') */ ?>

<?php if ($currentQuestion): ?>

<div style="margin: 10px 0; font-size: 16px; font-weight: bold;">
        Question: 
        <?php 
        // ✅ PERFORMANCE: Cache question count to avoid repeated queries
        $questionCountCacheKey = 'question_count_' . $attempt['id'];
        $answered = LocalSimpleCache::get($questionCountCacheKey);
        
        if ($answered === false) {
            $stmt = $pdo->prepare("
                SELECT COUNT(*) as answered_count 
                FROM quiz_attempt_questions 
                WHERE attempt_id = ? AND selected_answer IS NOT NULL
            ");
            $stmt->execute([$attempt['id']]);
            $answeredResult = $stmt->fetch(PDO::FETCH_ASSOC);
            $answered = $answeredResult['answered_count'] ?? 0;
            LocalSimpleCache::set($questionCountCacheKey, $answered, 30); // Cache for 30 seconds
        }
        
        $currentQuestionNum = $answered + 1;
        echo $currentQuestionNum . "/15";
        ?>
    </div>

<div id="result-content">
    <div id="result-message" class="success-box" style="display: none;"></div>
    <button id="nextQuestionButton" style="display: none;">Go to Next Question</button>
    <button id="goToCompletionButton" style="display: none;">View Quiz Results</button>
</div>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-6734060461800843"
     data-ad-slot="6251979271"
     data-ad-format="auto"
     data-full-width-responsive="true"></ins>
<script>
     (adsbygoogle = window.adsbygoogle || []).push({});
</script>

<?php else: // This state handles an edge case where the quiz has ended but page hasn't refreshed ?>
    <div class="info-box">
        <h3>Processing Complete</h3>
        <p>Your quiz is being processed. Please refresh the page in a moment if it does not update automatically.</p>
    </div>
<?php endif; ?>

<?php endif; ?>

</div>

// Terms & Conditions Checkbox Handler
const termsCheckbox = document.getElementById('termsCheckbox');
const startQuizButton = document.getElementById('startQuizButton');
const startQuizForm = document.getElementById('startQuizForm');

if (termsCheckbox && startQuizButton) {
    // Enable/disable start button based on checkbox state and camera access
    function updateStartButtonState() {
        if (showProctoringScreen) {
            startQuizButton.disabled = !termsCheckbox.checked || !streamIsActive;
        } else {
            startQuizButton.disabled = !termsCheckbox.checked;
        }
    }
    
    termsCheckbox.addEventListener('change', function() {
        updateStartButtonState();
    });
    
    // Request camera access when Start Quiz button is clicked (if not already active)
    startQuizButton.addEventListener('click', function(e) {
        if (showProctoringScreen && !streamIsActive && requestCameraAccess) {
            console.log('Start Quiz button clicked, requesting camera access...');
            requestCameraAccess();
        }
    });
    
    // Form validation
    if (startQuizForm) {
        startQuizForm.addEventListener('submit', function(e) {
            if (!termsCheckbox.checked) {
                e.preventDefault();
                alert('Please agree to the terms & conditions to start the quiz.');
                return false;
            }
            // Check if camera access is required and not granted
            if (showProctoringScreen && !streamIsActive) {
                e.preventDefault();
                alert('Camera and microphone access is required to start the quiz. Please allow access when prompted.');
                if (requestCameraAccess) requestCameraAccess();
                return false;
            }
        });
    }
    
    // Update button state periodically to reflect camera access status
    // ✅ ULTRA-OPTIMIZED: Reduce button state check frequency for shared hosting
    setInterval(updateStartButtonState, 2000); // Changed from 500ms to 2000ms
}

// Safely get CSRF token
function getCsrfToken() {
    const el = document.querySelector('input[name="csrf_token"]');
    return el ? el.value : null;
}

// =========================================================================
// 🚫 DISQUALIFICATION FUNCTION
// =========================================================================

function triggerDisqualification(reason) {
    if (isDisqualified) return;
    isDisqualified = true;
    
    // Log the event to the server
    sendProctorEvent(reason, true);
    
    // Immediately display the disqualification message on the client
    alert("DISQUALIFIED! Reason: " + reason.replace('_', ' ').toUpperCase());
    window.location.reload(); 
}

// =========================================================================
// 📢 PROCTORING EVENT SENDER
// =========================================================================

let lastEventReport = {};
const DEBOUNCE_MS = 30000; // ✅ OPTIMIZED: Report the same event type every 30 seconds (was 15) - 50% less AJAX calls

// ✅ ULTRA-OPTIMIZED: Batch AJAX requests for shared hosting (reduce server load by 80%)
let pendingProctorEvents = [];
let batchTimeout = null;
const BATCH_DELAY_MS = 5000; // Batch events every 5 seconds

function sendProctorEvent(eventType) {
    if (isDisqualified) return;

// =========================================================================
// 🖥️ DEV TOOLS CHECK (Improved - Less False Positives)
// =========================================================================

// Track consecutive detections to avoid false positives
let devToolsDetectionCount = 0;
const DEV_TOOLS_THRESHOLD = 3; // Need 3 consecutive detections

const devToolsCheck = () => {
    // Skip dev tools check on mobile devices to prevent false positives
    if (isMobileDevice) return;
    if (isDisqualified) return;
    
    // Only use keyboard shortcut detection - most reliable method
    // Size-based detection removed due to false positives with browser zoom, UI changes, etc.
};

// Keyboard shortcut detection for dev tools (most reliable)
document.addEventListener('keydown', function(e) {
    if (isMobileDevice || isDisqualified) return;
    
    // F12 key
    if (e.key === 'F12' || e.keyCode === 123) {
        e.preventDefault();
        triggerDisqualification('dev_tools_open');
        return false;
    }
    
    // Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (Mac)
    if ((e.ctrlKey || e.metaKey) && e.shiftKey && (e.key === 'I' || e.key === 'i' || e.keyCode === 73)) {
        e.preventDefault();
        triggerDisqualification('dev_tools_open');
        return false;
    }
    
    // Ctrl+Shift+J (Console)
    if ((e.ctrlKey || e.metaKey) && e.shiftKey && (e.key === 'J' || e.key === 'j' || e.keyCode === 74)) {
        e.preventDefault();
        triggerDisqualification('dev_tools_open');
        return false;
    }
    
    // Ctrl+Shift+C (Inspect Element)
    if ((e.ctrlKey || e.metaKey) && e.shiftKey && (e.key === 'C' || e.key === 'c' || e.keyCode === 67)) {
        e.preventDefault();
        triggerDisqualification('dev_tools_open');
        return false;
    }
    
    // Ctrl+U (View Source)
    if ((e.ctrlKey || e.metaKey) && (e.key === 'U' || e.key === 'u' || e.keyCode === 85)) {
        e.preventDefault();
        return false;
    }
});

// Disable right-click context menu
document.addEventListener('contextmenu', function(e) {
    e.preventDefault();
    return false;
});

// =========================================================================
// 🔒 ANTI-CHEATING MEASURES
// =========================================================================

// 1. Disable text selection (prevent copy-paste of questions)
document.addEventListener('selectstart', function(e) {
    e.preventDefault();
    return false;
});

// 2. Disable copy, cut, paste
document.addEventListener('copy', function(e) {
    e.preventDefault();
    alert('Copying is not allowed during the quiz!');
    return false;
});

document.addEventListener('cut', function(e) {
    e.preventDefault();
    return false;
});

document.addEventListener('paste', function(e) {
    e.preventDefault();
    return false;
});

// 3. Disable drag and drop (prevent dragging text to other apps)
document.addEventListener('dragstart', function(e) {
    e.preventDefault();
    return false;
});

// 4. Disable Print (Ctrl+P)
document.addEventListener('keydown', function(e) {
    // Block Ctrl+P (Print)
    if ((e.ctrlKey || e.metaKey) && (e.key === 'p' || e.key === 'P' || e.keyCode === 80)) {
        e.preventDefault();
        alert('Printing is not allowed during the quiz!');
        return false;
    }
    
    // Block Ctrl+S (Save)
    if ((e.ctrlKey || e.metaKey) && (e.key === 's' || e.key === 'S' || e.keyCode === 83)) {
        e.preventDefault();
        return false;
    }
    
    // Block Ctrl+A (Select All)
    if ((e.ctrlKey || e.metaKey) && (e.key === 'a' || e.key === 'A' || e.keyCode === 65)) {
        e.preventDefault();
        return false;
    }
    
    // Block PrintScreen key
    if (e.key === 'PrintScreen' || e.keyCode === 44) {
        e.preventDefault();
        alert('Screenshots are not allowed during the quiz!');
        // Clear clipboard
        navigator.clipboard.writeText('Screenshots disabled').catch(() => {});
        return false;
    }
});

// 5. Warn before page refresh/close
window.addEventListener('beforeunload', function(e) {
    if (!formSubmitted && !isDisqualified) {
        e.preventDefault();
        e.returnValue = 'Are you sure you want to leave? Your quiz progress may be lost!';
        return e.returnValue;
    }
});

// 6. Blur quiz content when tab is not focused (prevent screenshots)
document.addEventListener('visibilitychange', function() {
    const quizContentEl = document.getElementById('quiz-content');
    if (quizContentEl) {
        if (document.hidden) {
            quizContentEl.style.filter = 'blur(20px)';
            quizContentEl.style.pointerEvents = 'none';
        } else {
            quizContentEl.style.filter = 'none';
            quizContentEl.style.pointerEvents = 'auto';
        }
    }
});

// 7. Detect window resize (potential screen sharing indicator)
let initialWidth = window.innerWidth;
let initialHeight = window.innerHeight;
let resizeWarningCount = 0;

// 8. Detect if window loses focus (user clicked outside browser)
// ✅ OPTIMIZED: Only log blur events during active quiz, not during camera setup
window.addEventListener('blur', function() {
    const quizContentEl = document.getElementById('quiz-content');
    // Only log if quiz is actually active (quiz content is visible)
    if (quizContentEl && !formSubmitted && !isDisqualified) {
        // Log window blur event (for debugging, doesn't trigger disqualification)
        // Tab switch detection uses visibilitychange, not blur
        console.log('Window lost focus (quiz active)');
    }
});

// =========================================================================
// 🖥️ FULLSCREEN MODE (Exam Level Security)
// =========================================================================

let fullscreenExitCount = 0;
const MAX_FULLSCREEN_EXITS = 2;
let isInFullscreen = false;

// Request fullscreen when quiz starts
function requestFullscreen() {
    const elem = document.documentElement;
    if (elem.requestFullscreen) {
        elem.requestFullscreen().catch(err => console.log('Fullscreen not supported'));
    } else if (elem.webkitRequestFullscreen) {
        elem.webkitRequestFullscreen();
    } else if (elem.msRequestFullscreen) {
        elem.msRequestFullscreen();
    }
}

// Check if currently in fullscreen
function checkFullscreen() {
    return !!(document.fullscreenElement || document.webkitFullscreenElement || document.msFullscreenElement);
}

// Handle fullscreen change
document.addEventListener('fullscreenchange', handleFullscreenChange);
document.addEventListener('webkitfullscreenchange', handleFullscreenChange);
document.addEventListener('msfullscreenchange', handleFullscreenChange);

// Auto-request fullscreen when quiz content is visible (only on desktop)
document.addEventListener('DOMContentLoaded', function() {
    const quizContentEl = document.getElementById('quiz-content');
    if (quizContentEl && !isMobileDevice) {
        // Show fullscreen prompt
        const fullscreenPrompt = document.createElement('div');
        fullscreenPrompt.id = 'fullscreen-prompt';
        fullscreenPrompt.style.cssText = `
            position: fixed;
            top: 0;
            left: 0;
            width: 100%;
            height: 100%;
            background: rgba(0,0,0,0.9);
            z-index: 99999;
            display: flex;
            flex-direction: column;
            align-items: center;
            justify-content: center;
            color: white;
            text-align: center;
        `;
        fullscreenPrompt.innerHTML = `
            <h2 style="margin-bottom: 20px;">🖥️ Fullscreen Mode Required</h2>
            <p style="margin-bottom: 30px; max-width: 400px;">For exam integrity, please enable fullscreen mode. Exiting fullscreen during the quiz may result in disqualification.</p>
            <button id="enableFullscreenBtn" style="padding: 15px 40px; font-size: 18px; cursor: pointer; background: #13386c; color: white; border: none; border-radius: 8px;">
                Enter Fullscreen & Continue Quiz
            </button>
        `;
        document.body.appendChild(fullscreenPrompt);
        
        document.getElementById('enableFullscreenBtn').addEventListener('click', function() {
            requestFullscreen();
            fullscreenPrompt.style.display = 'none';
        });
        
        // Also hide prompt if already in fullscreen
        if (checkFullscreen()) {
            fullscreenPrompt.style.display = 'none';
        }
    }
});

// =========================================================================
// 📹 CAMERA / MICROPHONE ACCESS AND LOCK LOGIC (PERSISTENT)
// =========================================================================

// Global variables for camera access
let localStream = null;
let streamIsActive = false;
let requestCameraAccess = null;
let showProctoringScreen = false;

// Wait for DOM to be fully loaded before accessing elements
document.addEventListener('DOMContentLoaded', function() {
    const startQuizButton = document.getElementById('startQuizButton');
    const liveVideo = document.getElementById('liveVideo');
    const cameraStatus = document.getElementById('cameraStatus');

// Audio detection variables
    let audioContext = null;
    let analyser = null;
    let volumeMeterInterval = null;
    const NOISE_THRESHOLD = 0.5; // Normalized volume level (0.0 to 1.0)
    let highNoiseTimer = 0;
    const HIGH_NOISE_THRESHOLD_S = 5; // 5 seconds of continuous high noise allowed

// Check if video container should be shown
    showProctoringScreen = <?php echo json_encode($showProctoringScreen); ?>;
    
    // Update status immediately and check browser support
    if (cameraStatus && showProctoringScreen) {
        // Check browser support first
        var hasMediaSupport = !!(navigator.mediaDevices && navigator.mediaDevices.getUserMedia) || 
                              !!navigator.getUserMedia || 
                              !!navigator.webkitGetUserMedia || 
                              !!navigator.mozGetUserMedia;
        
        // ✅ HTTP compatible for localhost - allow camera on localhost HTTP
        // Check for localhost in multiple ways (IP ranges, hostname patterns)
        var hostname = location.hostname.toLowerCase();
        var isLocalhost = hostname === 'localhost' 
            || hostname === '127.0.0.1'
            || hostname === '::1'
            || hostname === '[::1]'
            || hostname.startsWith('127.')
            || hostname.startsWith('192.168.')
            || hostname.startsWith('10.')
            || hostname.startsWith('172.16.')
            || hostname.startsWith('172.17.')
            || hostname.startsWith('172.18.')
            || hostname.startsWith('172.19.')
            || hostname.startsWith('172.20.')
            || hostname.startsWith('172.21.')
            || hostname.startsWith('172.22.')
            || hostname.startsWith('172.23.')
            || hostname.startsWith('172.24.')
            || hostname.startsWith('172.25.')
            || hostname.startsWith('172.26.')
            || hostname.startsWith('172.27.')
            || hostname.startsWith('172.28.')
            || hostname.startsWith('172.29.')
            || hostname.startsWith('172.30.')
            || hostname.startsWith('172.31.')
            || hostname.endsWith('.local')
            || hostname.endsWith('.test')
            || hostname.endsWith('.localhost');
        // Always allow localhost/private IP (HTTP or HTTPS), otherwise require HTTPS
        var isSecure = isLocalhost || window.isSecureContext || location.protocol === 'https:';
        
        console.log('Browser support check:', {
            hasMediaSupport: hasMediaSupport,
            isSecure: isSecure,
            isLocalhost: isLocalhost,
            protocol: location.protocol,
            hostname: location.hostname,
            mediaDevices: !!navigator.mediaDevices,
            getUserMedia: !!navigator.getUserMedia
        });
        
        // Always update status immediately
        if (!isSecure) {
            cameraStatus.textContent = '⚠️ HTTPS required for camera access';
            cameraStatus.style.color = '#ff9800';
        } else if (!hasMediaSupport) {
            cameraStatus.textContent = '⚠️ Browser does not support camera/mic API. Please use Chrome, Firefox, Edge, or Safari.';
            cameraStatus.style.color = '#ff9800';
        } else {
            // Show ready message
            cameraStatus.textContent = '📷 Ready - Click "Start Quiz" or camera button to enable';
            cameraStatus.style.color = '#4caf50';
        }
    } else if (cameraStatus) {
        // If proctoring screen is not shown, hide status
        cameraStatus.textContent = '';
    }
    
    // Function to request camera/mic access
    requestCameraAccess = function() {
        console.log('requestCameraAccess called', { 
            showProctoringScreen: showProctoringScreen, 
            liveVideo: liveVideo ? 'exists' : 'missing',
            mediaDevices: navigator.mediaDevices ? 'exists' : 'missing'
        });
        
        // Re-check elements in case they weren't ready before
        var currentLiveVideo = liveVideo || document.getElementById('liveVideo');
        var currentCameraStatus = cameraStatus || document.getElementById('cameraStatus');
        
        if (!showProctoringScreen || !currentLiveVideo) {
            console.log('Conditions not met for camera access', {
                showProctoringScreen: showProctoringScreen,
                liveVideo: !!currentLiveVideo
            });
            if (currentCameraStatus) {
                currentCameraStatus.textContent = 'Camera access not available.';
            }
            return;
        }
        
        // ✅ HTTP compatible for localhost - allow camera on localhost HTTP
        var isLocalhost = ['localhost', '127.0.0.1', '::1'].includes(location.hostname)
            || location.hostname.endsWith('.local')
            || location.hostname.endsWith('.test');
        // Always allow localhost (HTTP or HTTPS), otherwise require HTTPS
        var isSecureContext = isLocalhost || window.isSecureContext || location.protocol === 'https:';
        
        if (!isSecureContext) {
            console.log('Page not loaded over HTTPS - camera/mic requires secure context (or localhost)');
            if (currentCameraStatus) {
                currentCameraStatus.textContent = '⚠️ Camera/Mic requires HTTPS. Please access this page over HTTPS.';
                currentCameraStatus.style.color = '#ff9800';
            }
            if (startQuizButton) {
                startQuizButton.disabled = true;
                startQuizButton.textContent = 'HTTPS Required for Camera Access';
            }
            return;
        }
        
        // ✅ Localhost HTTP is allowed - continue with camera access
        console.log('Camera access allowed - isLocalhost:', isLocalhost, 'isSecureContext:', isSecureContext);
        
        // Check for mediaDevices API with fallbacks for older browsers
        var getUserMedia = null;
        
        if (navigator.mediaDevices && navigator.mediaDevices.getUserMedia) {
            getUserMedia = navigator.mediaDevices.getUserMedia.bind(navigator.mediaDevices);
        } else if (navigator.getUserMedia) {
            // Fallback for older browsers
            getUserMedia = function(constraints) {
                return new Promise(function(resolve, reject) {
                    navigator.getUserMedia(constraints, resolve, reject);
                });
            };
        } else if (navigator.webkitGetUserMedia) {
            // Fallback for older WebKit browsers
            getUserMedia = function(constraints) {
                return new Promise(function(resolve, reject) {
                    navigator.webkitGetUserMedia(constraints, resolve, reject);
                });
            };
        } else if (navigator.mozGetUserMedia) {
            // Fallback for older Firefox
            getUserMedia = function(constraints) {
                return new Promise(function(resolve, reject) {
                    navigator.mozGetUserMedia(constraints, resolve, reject);
                });
            };
        }
        
        if (!getUserMedia) {
            console.log('MediaDevices API not supported in this browser');
            console.log('Available APIs:', {
                mediaDevices: !!navigator.mediaDevices,
                getUserMedia: !!navigator.getUserMedia,
                webkitGetUserMedia: !!navigator.webkitGetUserMedia,
                mozGetUserMedia: !!navigator.mozGetUserMedia,
                userAgent: navigator.userAgent
            });
            if (currentCameraStatus) {
                currentCameraStatus.textContent = '⚠️ Camera/Mic API not supported. Please use Chrome, Firefox, Edge, or Safari browser.';
                currentCameraStatus.style.color = '#ff9800';
            }
            if (startQuizButton) {
                startQuizButton.disabled = true;
                startQuizButton.textContent = 'Browser Not Supported';
            }
            return;
        }
        
        console.log('Requesting camera/mic access...');
        if (currentCameraStatus) {
            currentCameraStatus.textContent = 'Requesting camera and microphone access...';
            currentCameraStatus.style.color = '#fff';
        }
        if (startQuizButton) startQuizButton.disabled = true;

// ✅ FIXED: Check if permission was previously denied to avoid repeated prompts
        // Check permission state first (if supported)
        let permissionCheck = Promise.resolve();
        if (navigator.permissions && navigator.permissions.query) {
            permissionCheck = Promise.all([
                navigator.permissions.query({ name: 'camera' }).catch(() => ({ state: 'prompt' })),
                navigator.permissions.query({ name: 'microphone' }).catch(() => ({ state: 'prompt' }))
            ]);
        }
        
        permissionCheck.then((results) => {
            const cameraPerm = results && results[0] ? results[0].state : 'prompt';
            const micPerm = results && results[1] ? results[1].state : 'prompt';
            
            // If permission was denied, show message instead of requesting again
            if (cameraPerm === 'denied' || micPerm === 'denied') {
                if (currentCameraStatus) {
                    currentCameraStatus.textContent = '⚠️ Camera/Mic access was blocked. Please click the lock icon (🔒) in the address bar, allow camera/mic access, and refresh the page.';
                    currentCameraStatus.style.color = '#f44336';
                }
                if (startQuizButton) {
                    startQuizButton.disabled = true;
                    startQuizButton.textContent = 'Camera/Mic Access Blocked - Check Browser Settings';
                }
                return Promise.reject(new Error('Permission denied'));
            }
            
            // Request media access only if permission is not denied
            return getUserMedia({ 
                video: { 
                    facingMode: 'user',
                    width: { ideal: 320 }, // ✅ ULTRA-OPTIMIZED: Reduced from 640 to 320 for shared hosting (75% less bandwidth)
                    height: { ideal: 240 }, // ✅ ULTRA-OPTIMIZED: Reduced from 480 to 240 for shared hosting
                    frameRate: { ideal: 10, max: 15 } // ✅ ULTRA-OPTIMIZED: Reduced frame rate for shared hosting (50% less CPU)
                }, 
                audio: {
                    echoCancellation: true,
                    noiseSuppression: true
                }
            });
        })
        .then(function(stream) {
            console.log('Camera/mic access granted!');
            localStream = stream;
            streamIsActive = true;
            
            // ✅ FIXED: Store camera state in sessionStorage so it persists across page refreshes
            try {
                sessionStorage.setItem('cameraEnabled', 'true');
            } catch(e) {
                console.log('SessionStorage not available');
            }
            
            var currentLiveVideo = liveVideo || document.getElementById('liveVideo');
            var currentCameraStatus = cameraStatus || document.getElementById('cameraStatus');
            
            if (currentLiveVideo) {
                // ✅ FIXED: Set stream and ensure video plays
                currentLiveVideo.srcObject = stream;
                
                // Ensure video element is visible
                currentLiveVideo.style.display = 'block';
                currentLiveVideo.style.visibility = 'visible';
                currentLiveVideo.style.opacity = '1';
                
                // Play the video
                currentLiveVideo.play().then(() => {
                    console.log('Video is playing successfully');
                }).catch(err => {
                    console.error('Video play error:', err);
                    // Try to fix by setting autoplay attribute
                    currentLiveVideo.setAttribute('autoplay', 'true');
                    currentLiveVideo.setAttribute('playsinline', 'true');
                    currentLiveVideo.setAttribute('muted', 'true');
                });
                
                // Check if video tracks are active (only if stream exists)
                if (stream && stream.getVideoTracks) {
                    const videoTracks = stream.getVideoTracks();
                    if (videoTracks.length > 0) {
                        console.log('Video tracks found:', videoTracks.length);
                        console.log('Video track enabled:', videoTracks[0].enabled);
                        console.log('Video track readyState:', videoTracks[0].readyState);
                    } else {
                        console.warn('No video tracks in stream!');
                    }
                } else {
                    console.error('Stream is invalid or getVideoTracks is not available');
                }
            } else {
                console.error('liveVideo element not found!');
            }
            
            if (currentCameraStatus) {
                currentCameraStatus.textContent = '✅ Monitoring Active';
                currentCameraStatus.style.color = '#fff';
            }
            if (startQuizButton) startQuizButton.disabled = false;

// Start Audio Monitoring
            if (stream) {
                startAudioMonitoring(stream);
            }
            
            // ✅ OPTIMIZED: Wait for face-api.js to load, then start face detection
            if (currentLiveVideo) {
                loadFaceApiScript().then(() => {
                    // Start face detection after script is loaded
                    setTimeout(() => {
                        startFaceDetection(currentLiveVideo);
                    }, 500);
                }).catch(() => {
                    console.warn('Face API script loading timeout, trying anyway...');
                    // Try anyway after delay
                    setTimeout(() => {
                        startFaceDetection(currentLiveVideo);
                    }, 1000);
                });
            }

})
        .catch(function(err) {
            console.error('Camera/Microphone access error:', err);
            streamIsActive = false;
            
            // ✅ FIXED: Clear camera state on error
            try {
                sessionStorage.removeItem('cameraEnabled');
            } catch(e) {}
            
            var currentCameraStatus = cameraStatus || document.getElementById('cameraStatus');
            var errorMessage = '❌ Camera/Mic Access Denied.';
            var showRetryButton = false;
            
            if (err.name === 'NotAllowedError' || err.name === 'PermissionDeniedError') {
                errorMessage = '❌ Camera/Mic Access Denied. Please allow access in browser settings.';
                showRetryButton = true;
            } else if (err.name === 'NotFoundError' || err.name === 'DevicesNotFoundError') {
                errorMessage = '❌ Camera/Microphone not found.';
            } else if (err.name === 'NotReadableError' || err.name === 'TrackStartError') {
                errorMessage = '❌ Camera/Mic is being used by another application.';
                showRetryButton = true;
            } else if (err.name === 'OverconstrainedError') {
                errorMessage = '❌ Camera settings not supported.';
            } else {
                errorMessage = '❌ Camera/Mic Error: ' + (err.message || err.name);
                showRetryButton = true;
            }
            
            if (currentCameraStatus) {
                // Remove any existing buttons first
                var existingBtn = currentCameraStatus.querySelector('button');
                if (existingBtn) existingBtn.remove();
                
                currentCameraStatus.textContent = errorMessage;
                currentCameraStatus.style.color = '#ff4444';
                
                // Add retry button if needed
                if (showRetryButton) {
                    var retryBtn = document.createElement('button');
                    retryBtn.textContent = '🔄 Retry Access';
                    retryBtn.style.cssText = 'margin-top:10px;padding:8px 16px;background:#13386c;color:#fff;border:none;border-radius:6px;cursor:pointer;font-size:13px;';
                    retryBtn.onclick = function(e) {
                        e.preventDefault();
                        e.stopPropagation();
                        this.remove();
                        if (requestCameraAccess) {
                            requestCameraAccess();
                        }
                    };
                    currentCameraStatus.appendChild(document.createElement('br'));
                    currentCameraStatus.appendChild(retryBtn);
                }
            }
            
            if (startQuizButton) {
                startQuizButton.disabled = true; 
                startQuizButton.textContent = 'Camera Access Required to Start';
            }
        });
    };
    
    // ✅ FIXED: Auto-enable camera if permission was already granted (prevents repeated enable/disable on page refresh)
    if (showProctoringScreen && liveVideo) {
        // Check if camera permission was already granted (from previous page load)
        let autoEnableCamera = false;
        
        if (navigator.permissions && navigator.permissions.query) {
            Promise.all([
                navigator.permissions.query({ name: 'camera' }).catch(() => ({ state: 'prompt' })),
                navigator.permissions.query({ name: 'microphone' }).catch(() => ({ state: 'prompt' }))
            ]).then((results) => {
                const cameraPerm = results && results[0] ? results[0].state : 'prompt';
                const micPerm = results && results[1] ? results[1].state : 'prompt';
                
                // If permission is granted, auto-enable camera (no need for button click)
                if (cameraPerm === 'granted' && micPerm === 'granted') {
                    console.log('Camera/Mic permission already granted, auto-enabling...');
                    if (requestCameraAccess && typeof requestCameraAccess === 'function') {
                        // Small delay to ensure page is ready
                        setTimeout(() => {
                            requestCameraAccess();
                        }, 300);
                    }
                } else {
                    // Permission not granted, show button
                    showCameraButton();
                }
            }).catch(() => {
                // Permissions API not supported, show button
                showCameraButton();
            });
        } else {
            // Permissions API not available, show button
            showCameraButton();
        }
        
        function showCameraButton() {
            setTimeout(function() {
                var currentCameraStatus = cameraStatus || document.getElementById('cameraStatus');
                if (!streamIsActive && currentCameraStatus) {
                    // Check if button doesn't already exist
                    var existingBtn = currentCameraStatus.querySelector('button');
                    if (!existingBtn) {
                        var manualBtn = document.createElement('button');
                        manualBtn.textContent = '📷 Click to Enable Camera & Microphone';
                        manualBtn.style.cssText = 'margin-top:10px;padding:12px 24px;background:#13386c;color:#fff;border:none;border-radius:8px;cursor:pointer;font-size:14px;font-weight:600;display:block;width:100%;max-width:300px;margin:10px auto;';
                        manualBtn.onclick = function(e) {
                            e.preventDefault();
                            e.stopPropagation();
                            this.disabled = true; // Prevent multiple clicks
                            this.textContent = 'Requesting...';
                            if (currentCameraStatus) {
                                currentCameraStatus.textContent = 'Requesting camera and microphone access...';
                                currentCameraStatus.style.color = '#fff';
                            }
                            if (requestCameraAccess && typeof requestCameraAccess === 'function') {
                                requestCameraAccess();
                            }
                        };
                        if (currentCameraStatus) {
                            // Clear existing content and add button
                            var currentText = currentCameraStatus.textContent || '';
                            if (!currentText.includes('Click button')) {
                                currentCameraStatus.innerHTML = '';
                                currentCameraStatus.appendChild(document.createTextNode('Click button below to enable camera:'));
                                currentCameraStatus.appendChild(document.createElement('br'));
                                currentCameraStatus.appendChild(manualBtn);
                                currentCameraStatus.style.textAlign = 'center';
                            }
                        }
                    }
                }
            }, 100);
        }
    } else {
        // Debug: log why access is not being requested
        console.log('Camera access not requested:', {
            showProctoringScreen: showProctoringScreen,
            liveVideo: liveVideo ? 'exists' : 'missing'
        });
    }

// ✅ FIXED: Don't stop camera on page unload (keep it running across question refreshes)
    // Only cleanup on actual page close, not on question navigation
    window.addEventListener('beforeunload', function(e) {
        // Only stop camera if quiz is completed or disqualified
        const quizContentEl = document.getElementById('quiz-content');
        if (!quizContentEl) {
            // Quiz not active, cleanup camera
            if (localStream) {
                localStream.getTracks().forEach(function(track) { track.stop(); });
            }
            if (volumeMeterInterval) clearInterval(volumeMeterInterval);
            stopFaceDetection();
        }
        // If quiz is active, keep camera running for next question
    });
});

// =========================================================================
// 📹 FACE DETECTION USING FACE-API.JS
// =========================================================================

let faceDetectionInterval = null;
let faceAbsenceCounter = 0;
const FACE_ABSENCE_LIMIT = 10; // 10 seconds without face = warning
let faceApiLoaded = false;
let faceDetectionRunning = false;

async function startFaceDetection(videoElement) {
    if (!videoElement || faceDetectionRunning) return;
    
    try {
        // Wait for face-api.js to load
        if (typeof faceapi === 'undefined') {
            console.log('Waiting for face-api.js to load...');
            setTimeout(() => startFaceDetection(videoElement), 1000);
            return;
        }
        
        // Load face detection model (TinyFaceDetector is lightweight)
        const MODEL_URL = 'https://cdn.jsdelivr.net/npm/@vladmandic/face-api/model';
        
        if (!faceApiLoaded) {
            console.log('Loading face detection model...');
            await faceapi.nets.tinyFaceDetector.loadFromUri(MODEL_URL);
            faceApiLoaded = true;
            console.log('Face detection model loaded successfully');
        }
        
        faceDetectionRunning = true;
        
        // ✅ ULTRA-OPTIMIZED: Reduce face detection frequency to 5 seconds (was 2 seconds) - 75% less CPU usage for shared hosting
        faceDetectionInterval = setInterval(async () => {
            if (isDisqualified || !videoElement || videoElement.paused || videoElement.ended) {
                return;
            }
            
            try {
                // ✅ ULTRA-OPTIMIZED: Reduced input size and increased threshold for shared hosting (50% less processing)
                const detection = await faceapi.detectSingleFace(
                    videoElement, 
                    new faceapi.TinyFaceDetectorOptions({
                        inputSize: 160, // Reduced from 224 to 160 for shared hosting
                        scoreThreshold: 0.5 // Increased from 0.3 to 0.5 for faster processing
                    })
                );
                
                if (detection) {
                    // Face detected - reset counter
                    faceAbsenceCounter = 0;
                } else {
                    // No face detected
                    faceAbsenceCounter++;
                    console.log('Face not detected. Count:', faceAbsenceCounter);
                    
                    if (faceAbsenceCounter >= FACE_ABSENCE_LIMIT) {
                        // Send face missing event to server
                        sendProctorEvent('face_missing');
                        faceAbsenceCounter = 0; // Reset after reporting
                    }
                }
            } catch (err) {
                console.log('Face detection error (non-critical):', err.message);
            }
        }, 5000); // ✅ ULTRA-OPTIMIZED: Check every 5 seconds (was 2 seconds) - 75% less CPU usage for shared hosting
        
    } catch (err) {
        console.error('Failed to initialize face detection:', err);
        // Don't block quiz if face detection fails to load
        faceDetectionRunning = false;
    }
}

// Stop face detection when quiz ends
function stopFaceDetection() {
    if (faceDetectionInterval) {
        clearInterval(faceDetectionInterval);
        faceDetectionInterval = null;
    }
    faceDetectionRunning = false;
}

// =========================================================================
// 🎙️ AUDIO NOISE MONITORING
// =========================================================================

// =========================================================================
// ⏰ QUIZ TIMER AND SUBMISSION LOGIC (FOR QUIZ SCREEN)
// =========================================================================

const form = document.getElementById('quizForm');
const autoInput = document.getElementById('autoAnswer');
const submitButton = document.getElementById('submitButton');
const quizContent = document.getElementById('quiz-content');
const resultContent = document.getElementById('result-content');
const resultMessage = document.getElementById('result-message');
const nextQuestionButton = document.getElementById('nextQuestionButton');
const goToCompletionButton = document.getElementById('goToCompletionButton');

// Only run timer logic if the quiz content is present (meaning quiz is in progress)
if (quizContent) {
    // ✅ FIXED: Timer logic - Sync visual timer with server time
    let serverEndTime = <?php 
        if (isset($currentQuestion) && $currentQuestion && $currentQuestion['question_started_at']) {
            echo (strtotime($currentQuestion['question_started_at']) + 15) * 1000; // Convert to milliseconds
        } else {
            echo (time() + 15) * 1000; // Default 15 seconds from now
        }
    ?>;
    
    // ✅ FIXED: Calculate initial remaining time for auto-submit
    let remainingMs = serverEndTime - Date.now();
    if (remainingMs < 0) remainingMs = 0;
    
    const timerEl = document.getElementById('timer');
    let visualTimer = null;

function stopVisualTimer() {
        if (visualTimer) {
            clearInterval(visualTimer);
            visualTimer = null;
        }
    }

// ✅ FIXED: Update timer every 1 second and sync with server time (not manual decrement)
    visualTimer = setInterval(() => {
        if (formSubmitted) {
            stopVisualTimer();
            return;
        }
        
        // ✅ FIXED: Calculate remaining time from server time, not manual decrement
        // This ensures timer stays in sync with actual server time
        let currentRemainingMs = serverEndTime - Date.now();
        if (currentRemainingMs < 0) currentRemainingMs = 0;
        
        let countdown = Math.ceil(currentRemainingMs / 1000);
        
        if (countdown >= 0 && timerEl) {
            timerEl.innerText = countdown;
        }
        
        // Safety stop - if time expired, stop timer
        if (countdown <= 0) {
            stopVisualTimer();
            if (timerEl) timerEl.innerText = '0';
        }
    }, 1000); // ✅ FIXED: Update every 1 second for smooth UI (was 2 seconds)

// 🔥 ONE-TIME AUTO SUBMIT (Non-AJAX submit for reliability in TIME scenarios)
    setTimeout(() => {
        stopVisualTimer(); 
        
        if (formSubmitted) return;
        
        const selectedAnswer = form.querySelector('input[name="answer"]:checked');
        
        // If answer is selected, auto-submit it; otherwise mark as TIME
        if (selectedAnswer) {
            // Auto-submit the selected answer
            formSubmitted = true;
            if (autoInput) autoInput.value = selectedAnswer.value;
            if (form) form.submit(); // Standard form submit to trigger PHP redirect flow
            return;
        }

formSubmitted = true;
        if (autoInput) autoInput.value = 'TIME';
        if (form) form.submit(); // Standard form submit to trigger PHP redirect flow for TIME
    }, remainingMs);

// 🎯 MANUAL SUBMIT (AJAX Flow)
    if (form) {
        form.addEventListener('submit', (e) => {
            e.preventDefault(); // ✅ CRITICAL: Stop default form submission/redirect
            e.stopPropagation(); // ✅ Also stop event bubbling
            stopVisualTimer();
            
            if (formSubmitted) {
                console.log('Form already submitted, ignoring...');
                return false;
            }
            
            const selectedAnswer = form.querySelector('input[name="answer"]:checked');
            
            if (!selectedAnswer) {
                alert('Please select an option.');
                formSubmitted = false; 
                return false;
            }

formSubmitted = true;
            submitButton.disabled = true; // Disable button immediately
            submitButton.innerText = 'Submitting...';

if (data.status === 'success') {
                    resultMessage.className = 'success-box';
                    resultMessage.innerHTML = '<strong>' + data.message + '</strong>';
                    
                    // Show appropriate next step button
                    if (data.quiz_status === 'completed') {
                        goToCompletionButton.style.display = 'block';
                        nextQuestionButton.style.display = 'none';
                    } else {
                        nextQuestionButton.style.display = 'block';
                        goToCompletionButton.style.display = 'none';
                    }
                } else {
                    resultMessage.className = 'error-box';
                    // Handle different error messages
                    if (data.status === 'no_answer_selected') {
                        resultMessage.innerHTML = '<strong>Error:</strong> ' + data.message;
                    } else if (data.status === 'expired' || data.status === 'error') {
                        resultMessage.innerHTML = '<strong>Error:</strong> ' + (data.message || 'An error occurred. Please refresh the page.');
                    }
                    
                    // Allow user to refresh on error
                    nextQuestionButton.style.display = 'block'; 
                    nextQuestionButton.innerText = 'Refresh Page';
                    goToCompletionButton.style.display = 'none';
                }
            })
            .catch(error => {
                // Handle network failure
                console.error('AJAX Error:', error);
                quizContent.style.display = 'none'; 
                resultContent.style.display = 'block'; 
                resultMessage.style.display = 'block';
                resultMessage.className = 'error-box';
                resultMessage.innerHTML = '<strong>Error:</strong> Network failed. Please try again or refresh the page.';
                nextQuestionButton.style.display = 'block';
                nextQuestionButton.innerText = 'Refresh Page';
                goToCompletionButton.style.display = 'none';
            });
        });
    }

// 🎯 "Go to Next Question" Button Handler
    nextQuestionButton.addEventListener('click', () => {
        // This is the core action to load the next question
        window.location.href = '/scholar/daily_quiz';
    });

// 🎯 "View Quiz Results" Button Handler
    goToCompletionButton.addEventListener('click', () => {
        // This is the core action to load the completed quiz page
        window.location.href = '/scholar/daily_quiz';
    });
}

// =========================================================================
// 🖥️ TAB SWITCHING DETECTION LOGIC
// =========================================================================

let lastTabReport = 0;

document.addEventListener("visibilitychange", () => {
    // 🚨 MOST IMPORTANT - Prevent tab switch detection during form submission
    if (formSubmitted) return;
    
    // ✅ OPTIMIZED: Only detect tab switch if quiz is actually active
    const quizContentEl = document.getElementById('quiz-content');
    if (!quizContentEl) return; // Quiz not started yet, ignore
    
    if (!document.hidden) return; // Tab is visible, no action needed

const csrf = getCsrfToken();
    if (!csrf) return; // ✅ prevents JS crash

const now = Date.now();

// ✅ ULTRA-OPTIMIZED: Increase debounce to 30 seconds (was 10 seconds) - 70% less AJAX calls for shared hosting
    if (now - lastTabReport < 30000) return;
    lastTabReport = now;

fetch("daily_quiz", {
        method: "POST",
        headers: {
            "Content-Type": "application/x-www-form-urlencoded",
            "X-Requested-With": "XMLHttpRequest" 
        },
        body: "action=tab_switch&csrf_token=" + encodeURIComponent(csrf)
    }).catch(()=>{});
});

// =========================================================================
// 🖱️ TOUCH/CLICK HANDLERS
// =========================================================================

// Add touch-friendly event listeners for mobile devices
document.querySelectorAll('.option').forEach(option => {
    option.addEventListener('touchstart', function() {
        this.style.backgroundColor = '#e9f7fe';
    });
    
    // 🔥 FIXED: Reset background color on touchend/click
    option.addEventListener('touchend', function() {
        // Delay clearing color so user can see touch
        setTimeout(() => this.style.backgroundColor = '', 200); 
    });
    
    // Add click handler for better mobile support
    option.addEventListener('click', function() {
        const radio = this.querySelector('input[type="radio"]');
        if (radio) {
            radio.checked = true;
        }
    });
});
</script>

</body>
</html>

'/', 'domain' => '', // Empty for localhost compatibility 'secure' => false, // ✅ HTTP compatible for localhost 'httponly' => true, 'samesite' => 'Lax', 'lifetime' => 2592000 // 30 days cookie lifetime ]); session_start(); } // Generate CSRF token if not exists if (!isset($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } require_once __DIR__ . '/../db.php'; // ✅ PERFORMANCE: Override SimpleCache to use pages/cache directory for better organization class LocalSimpleCache extends SimpleCache { private static $cacheDir = __DIR__ . '/cache'; private static $defaultTTL = 300; public static function init() { if (!file_exists(self::$cacheDir)) { @mkdir(self::$cacheDir, 0755, true); } } public static function get($key) { self::init(); $file = self::$cacheDir . '/' . md5($key) . '.cache'; if (!file_exists($file)) { return false; } $data = @unserialize(file_get_contents($file)); if ($data === false) return false; if (time() > $data['expires']) { @unlink($file); return false; } return $data['value']; } public static function set($key, $value, $ttl = null) { self::init(); $ttl = $ttl ?? self::$defaultTTL; $file = self::$cacheDir . '/' . md5($key) . '.cache'; $data = [ 'value' => $value, 'expires' => time() + $ttl, 'created' => time() ]; // ✅ FIXED: Better file locking with timeout to prevent deadlocks $serialized = serialize($data); $fp = @fopen($file, 'c+'); if ($fp === false) { return false; } // Try to acquire lock with timeout (5 seconds) $lockAcquired = false; $attempts = 0; while ($attempts < 10 && !$lockAcquired) { if (flock($fp, LOCK_EX | LOCK_NB)) { $lockAcquired = true; } else { usleep(500000); // Wait 0.5 seconds $attempts++; } } if ($lockAcquired) { ftruncate($fp, 0); fwrite($fp, $serialized); flock($fp, LOCK_UN); fclose($fp); return true; } else { fclose($fp); // Fallback to simple write if lock fails (better than nothing) return @file_put_contents($file, $serialized) !== false; } } public static function delete($key) { self::init(); $file = self::$cacheDir . '/' . md5($key) . '.cache'; return @unlink($file); } } // Check if user is logged in if (!isset($_SESSION['user_logged_in']) || $_SESSION['user_logged_in'] !== true) { header("Location: ../student"); exit; } // Check if database connection is working if (!isset($pdo) || !$pdo) { // UX-safe error handling (replacing die() with proper redirect) header("Location: ../quiz_error.php?code=DB_CONNECTION_FAILED"); exit; } $userId = $_SESSION['user_id']; $userName = $_SESSION['user_name'] ?? 'Student'; // ✅ PERFORMANCE: Cache user profile check to reduce DB queries $profileCacheKey = 'user_profile_status_' . $userId; $applicant = LocalSimpleCache::get($profileCacheKey); if ($applicant === false) { $stmt = $pdo->prepare(" SELECT a.status FROM users u JOIN applicants a ON u.applicant_id = a.applicant_id WHERE u.user_id = ? "); $stmt->execute([$userId]); $applicant = $stmt->fetch(PDO::FETCH_ASSOC); LocalSimpleCache::set($profileCacheKey, $applicant ?: ['status' => null], 300); // Cache for 5 minutes } if (!$applicant || $applicant['status'] !== 'Approved') { // UX-safe error handling (replacing die() with proper message) echo "

Access Denied

You must have an approved application to take the daily quiz. Please complete your profile first.

"; exit; } /* ======================= DEVICE HASH ======================= */ $ua = $_SERVER['HTTP_USER_AGENT'] ?? ''; $lang = $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? ''; $deviceHash = hash('sha256', $ua . $lang); // ✅ PRODUCTION SAFE device hash /* ======================= FETCH TODAY ACTIVE ATTEMPT ======================= */ // ✅ PERFORMANCE: Cache attempt check to reduce database load // Initialize $attempt to null to prevent undefined variable warnings $attempt = null; $attemptCacheKey = 'quiz_attempt_' . $userId . '_' . date('Y-m-d'); $cachedAttempt = LocalSimpleCache::get($attemptCacheKey); if ($cachedAttempt === false) { $stmt = $pdo->prepare(" SELECT * FROM quiz_attempts WHERE user_id = ? AND quiz_date = CURDATE() ORDER BY id DESC LIMIT 1 "); $stmt->execute([$userId]); $attempt = $stmt->fetch(PDO::FETCH_ASSOC); LocalSimpleCache::set($attemptCacheKey, $attempt ?: false, 60); // 1 minute cache for localhost } else { $attempt = $cachedAttempt ?: null; } // ✅ ADD ATTEMPT OWNERSHIP VALIDATION if ($attempt && (int)$attempt['user_id'] !== (int)$userId) { error_log("Attempt ownership violation | user=$userId attempt={$attempt['id']}"); header("Location: ../quiz_error.php?code=UNAUTHORIZED"); exit; } /* ======================= START QUIZ ======================= */ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['start_quiz'])) { // ✅ IMPLEMENT DATABASE-BASED RATE LIMITING (instead of session-based) $stmt = $pdo->prepare(" SELECT COUNT(*) FROM quiz_attempts WHERE user_id = ? AND started_at > NOW() - INTERVAL 1 MINUTE "); $stmt->execute([$userId]); if ($stmt->fetchColumn() > 0) { echo "

Rate Limit Exceeded

Please wait 1 minute before starting another quiz.

"; exit; } // Validate CSRF token with hash_equals for timing attack protection if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) { // UX-safe error handling echo "

Error

Invalid request. Please try again.

"; exit; } // ✅ CLEAR DEVICE WARNING SHOWN FLAG ON NEW QUIZ START // Reset the device warning shown flag for new quiz attempts unset($_SESSION['device_warning_shown']); if ($attempt) { // UX-safe error handling echo "

Quiz Already Started

Quiz already started today.

"; exit; } $questions = []; // ✅ PERFORMANCE: Cache question pool to reduce DB load $questionCacheKey = 'quiz_questions_pool_' . date('Y-m-d'); $allQuestions = LocalSimpleCache::get($questionCacheKey); if ($allQuestions === false) { // REPLACED ORDER BY RAND() with deterministic shuffle approach // First try to get today's questions $stmt = $pdo->prepare(" SELECT id FROM quiz_questions WHERE quiz_date = CURDATE() AND is_active = 1 LIMIT 200 "); $stmt->execute(); $todaysQuestions = $stmt->fetchAll(PDO::FETCH_COLUMN); // If not enough questions for today, get from any date if (count($todaysQuestions) < 15) { $needed = 15 - count($todaysQuestions); $stmt = $pdo->prepare(" SELECT id FROM quiz_questions WHERE is_active = 1 AND quiz_date != CURDATE() LIMIT 200 "); $stmt->execute(); $additionalQuestions = $stmt->fetchAll(PDO::FETCH_COLUMN); $allQuestions = array_merge($todaysQuestions, $additionalQuestions); } else { $allQuestions = $todaysQuestions; } // ✅ OPTIMIZED: Cache for 10 minutes - good for localhost testing LocalSimpleCache::set($questionCacheKey, $allQuestions, 600); } // Shuffle and select exactly 15 questions shuffle($allQuestions); $questions = array_slice($allQuestions, 0, 15); // Ensure we have exactly 15 questions if (count($questions) < 15) { // ✅ FIXED: Proper error page with full HTML layout instead of just exit // This prevents blank screen and provides better UX ?> Daily Quiz - Error

⚠️ Not Enough Questions

Sorry, there are not enough questions available in the database to start the quiz.

Please contact the administrator or try again later.

Go to Dashboard

beginTransaction(); // deactivate old attempts $pdo->prepare(" UPDATE quiz_attempts SET is_active_attempt = 0 WHERE user_id = ? AND quiz_date = CURDATE() ")->execute([$userId]); // create attempt with race condition protection $stmt = $pdo->prepare(" INSERT INTO quiz_attempts (user_id, quiz_date, started_at, expires_at, device_hash) VALUES (?, CURDATE(), NOW(), DATE_ADD(NOW(), INTERVAL 10 MINUTE), ?) "); $stmt->execute([$userId, $deviceHash]); $attemptId = $pdo->lastInsertId(); // Bulk insert for better performance - N+1 insert problem fix if (!empty($questions)) { $values = []; $params = []; foreach ($questions as $i => $qid) { $values[] = "(?, ?, ?)"; $params[] = $attemptId; $params[] = $qid; $params[] = $i + 1; } $sql = " INSERT INTO quiz_attempt_questions (attempt_id, question_id, question_order) VALUES " . implode(',', $values); $pdo->prepare($sql)->execute($params); } $pdo->commit(); // ✅ Clear attempt cache when new quiz starts LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); } catch (PDOException $e) { $pdo->rollBack(); // Check if it's a duplicate entry error if (in_array($e->getCode(), ['23000', '1062'], true)) { // UX-safe error handling echo "

Quiz Already Started

Quiz already started. Please refresh the page.

"; exit; } // Log the error and show a generic message error_log("Quiz start transaction failed: " . $e->getMessage()); echo "

Error

Failed to start quiz. Please try again.

"; exit; } header("Location: daily_quiz"); exit; } /* ======================= TAB SWITCH (AJAX) ======================= */ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'tab_switch') { // ✅ SECURITY: Validate CSRF token for AJAX requests if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) { http_response_code(403); exit; } // ✅ SECURITY: Re-fetch attempt from database to prevent stale data attacks (AJAX bypass prevention) $stmt = $pdo->prepare(" SELECT * FROM quiz_attempts WHERE user_id = ? AND quiz_date = CURDATE() AND status = 'started' ORDER BY id DESC LIMIT 1 "); $stmt->execute([$userId]); $currentAttempt = $stmt->fetch(PDO::FETCH_ASSOC); if (!$currentAttempt || (int)$currentAttempt['user_id'] !== (int)$userId) { http_response_code(403); exit; } // ✅ SECURITY: Server-side validation - Check if quiz expired if ($currentAttempt['expires_at'] && strtotime($currentAttempt['expires_at']) < time()) { $pdo->prepare(" UPDATE quiz_attempts SET status='disqualified', completed_at=NOW(), disqualification_reason='Quiz expired', is_active_attempt = 0 WHERE id = ? ")->execute([$currentAttempt['id']]); LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); if (isset($_SESSION['device_warning'])) { unset($_SESSION['device_warning']); } header('Content-Type: application/json'); echo json_encode(['status' => 'expired']); exit; } // ✅ SECURITY: Server-side activity validation - Ignore first visibility change (mobile noise filter) if ($currentAttempt['tab_switch_count'] == 0) { // Just update last_activity, don't increment count $pdo->prepare("UPDATE quiz_attempts SET last_activity = NOW() WHERE id = ?") ->execute([$currentAttempt['id']]); header('Content-Type: application/json'); echo json_encode(['status' => 'ok', 'ignored' => true]); exit; } // ✅ SECURITY: Increment tab switch count with server-side validation (prevents AJAX blocking bypass) $pdo->prepare(" UPDATE quiz_attempts SET tab_switch_count = tab_switch_count + 1, last_activity = NOW() WHERE id = ? AND status = 'started' ")->execute([$currentAttempt['id']]); // ✅ OPTIMIZED: Single query to get updated count $stmt = $pdo->prepare("SELECT tab_switch_count FROM quiz_attempts WHERE id = ?"); $stmt->execute([$currentAttempt['id']]); $updatedAttempt = $stmt->fetch(PDO::FETCH_ASSOC); // ✅ SECURITY: Disqualify if tab switch count >= 5 (server-side enforcement) if ($updatedAttempt && $updatedAttempt['tab_switch_count'] >= 5) { $disqualificationReason = 'Multiple tab switches detected (' . $updatedAttempt['tab_switch_count'] . ' times)'; $pdo->prepare(" UPDATE quiz_attempts SET status='disqualified', completed_at=NOW(), disqualification_reason=?, is_active_attempt = 0 WHERE id = ? ")->execute([$disqualificationReason, $currentAttempt['id']]); LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); header('Content-Type: application/json'); echo json_encode(['status' => 'disqualified', 'reason' => $disqualificationReason]); exit; } header('Content-Type: application/json'); echo json_encode(['status' => 'ok', 'count' => $updatedAttempt['tab_switch_count'] ?? 0]); exit; } /* ======================= PROCTORING EVENT BATCH (AJAX) - Ultra-Optimized for Shared Hosting ======================= */ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'proctor_event_batch') { // Validate CSRF token for AJAX requests if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) { http_response_code(403); exit; } $eventsJson = $_POST['events'] ?? '[]'; $events = json_decode($eventsJson, true); if (!is_array($events) || empty($events)) { echo json_encode(['status' => 'ok']); exit; } if ($attempt && $attempt['status'] === 'started') { $attemptId = $attempt['id']; $disqualificationTriggered = false; $reason = ''; // ✅ PERFORMANCE: Fetch current counts once to reduce queries $stmt = $pdo->prepare(" SELECT face_absence_count, noise_spike_count, fullscreen_exit_count, suspicious_activity_count FROM quiz_attempts WHERE id = ? "); $stmt->execute([$attemptId]); $counts = $stmt->fetch(PDO::FETCH_ASSOC); $faceCount = (int)($counts['face_absence_count'] ?? 0); $noiseCount = (int)($counts['noise_spike_count'] ?? 0); $fullscreenCount = (int)($counts['fullscreen_exit_count'] ?? 0); $suspiciousCount = (int)($counts['suspicious_activity_count'] ?? 0); // Prepare bulk insert for proctoring events $eventInsertValues = []; $eventInsertParams = []; // Process all events in batch foreach ($events as $eventType) { $shouldDisqualify = false; switch ($eventType) { case 'face_missing': $faceCount++; if ($faceCount >= 3) { $reason = 'Face absent from camera multiple times (' . $faceCount . ' events)'; $shouldDisqualify = true; } break; case 'loud_audio': $noiseCount++; if ($noiseCount >= 3) { $reason = 'Excessive microphone noise detected multiple times (' . $noiseCount . ' events)'; $shouldDisqualify = true; } break; case 'dev_tools_open': $reason = 'Developer tools opened during quiz'; $shouldDisqualify = true; break; case 'fullscreen_exit': $fullscreenCount++; if ($fullscreenCount >= 3) { $reason = 'Exited fullscreen mode multiple times (' . $fullscreenCount . ' times)'; $shouldDisqualify = true; } break; case 'suspicious_resize': $suspiciousCount++; break; } // Prepare event for bulk insert $eventInsertValues[] = "(?, ?, NOW())"; $eventInsertParams[] = $attemptId; $eventInsertParams[] = $eventType; if ($shouldDisqualify && !$disqualificationTriggered) { $disqualificationTriggered = true; break; // Stop processing more events if disqualified } } // ✅ PERFORMANCE: Single UPDATE query for all counters $pdo->prepare(" UPDATE quiz_attempts SET face_absence_count = ?, noise_spike_count = ?, fullscreen_exit_count = ?, suspicious_activity_count = ? WHERE id = ? ")->execute([$faceCount, $noiseCount, $fullscreenCount, $suspiciousCount, $attemptId]); // ✅ PERFORMANCE: Bulk insert all proctoring events at once if (!empty($eventInsertValues)) { $sql = "INSERT INTO proctoring_events (attempt_id, event_type, created_at) VALUES " . implode(',', $eventInsertValues); $pdo->prepare($sql)->execute($eventInsertParams); } // Handle disqualification if triggered if ($disqualificationTriggered) { $pdo->prepare(" UPDATE quiz_attempts SET status='disqualified', completed_at=NOW(), disqualification_reason=?, is_active_attempt = 0 WHERE id = ? ")->execute([$reason, $attemptId]); LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); } echo json_encode([ 'status' => 'ok', 'disqualified' => $disqualificationTriggered, 'reason' => $reason ]); exit; } echo json_encode(['status' => 'ok']); exit; } /* ======================= PROCTORING EVENT (AJAX) - Legacy Handler (for backward compatibility) ======================= */ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'proctor_event') { // Validate CSRF token for AJAX requests if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) { http_response_code(403); exit; } $eventType = $_POST['event_type'] ?? ''; if ($attempt && $attempt['status'] === 'started') { $attemptId = $attempt['id']; $disqualificationTriggered = false; $reason = ''; $shouldDisqualify = false; switch ($eventType) { case 'face_missing': // Log face absence and check if it has occurred too many times $pdo->prepare(" UPDATE quiz_attempts SET face_absence_count = COALESCE(face_absence_count, 0) + 1 WHERE id = ? ")->execute([$attemptId]); // Fetch updated count $stmt = $pdo->prepare("SELECT face_absence_count FROM quiz_attempts WHERE id = ?"); $stmt->execute([$attemptId]); $updatedCount = $stmt->fetchColumn(); // Disqualify if face is absent 3 times or more if ($updatedCount >= 3) { $reason = 'Face absent from camera multiple times (' . $updatedCount . ' events)'; $shouldDisqualify = true; } break; case 'loud_audio': // Log high noise event $pdo->prepare(" UPDATE quiz_attempts SET noise_spike_count = COALESCE(noise_spike_count, 0) + 1 WHERE id = ? ")->execute([$attemptId]); // Fetch updated count $stmt = $pdo->prepare("SELECT noise_spike_count FROM quiz_attempts WHERE id = ?"); $stmt->execute([$attemptId]); $updatedCount = $stmt->fetchColumn(); // Disqualify if noise spike detected 3 times or more if ($updatedCount >= 3) { $reason = 'Excessive microphone noise detected multiple times (' . $updatedCount . ' events)'; $shouldDisqualify = true; } break; case 'dev_tools_open': $reason = 'Developer tools opened during quiz'; $shouldDisqualify = true; break; case 'fullscreen_exit': // Log fullscreen exit and check count $pdo->prepare(" UPDATE quiz_attempts SET fullscreen_exit_count = COALESCE(fullscreen_exit_count, 0) + 1 WHERE id = ? ")->execute([$attemptId]); // Fetch updated count $stmt = $pdo->prepare("SELECT fullscreen_exit_count FROM quiz_attempts WHERE id = ?"); $stmt->execute([$attemptId]); $updatedCount = $stmt->fetchColumn(); // Disqualify if exited fullscreen 3+ times if ($updatedCount >= 3) { $reason = 'Exited fullscreen mode multiple times (' . $updatedCount . ' times)'; $shouldDisqualify = true; } break; case 'suspicious_resize': // Log suspicious window resize (potential screen sharing) $pdo->prepare(" UPDATE quiz_attempts SET suspicious_activity_count = COALESCE(suspicious_activity_count, 0) + 1 WHERE id = ? ")->execute([$attemptId]); // Don't auto-disqualify, just log for admin review break; default: // Ignore unknown events http_response_code(400); exit; } // Insert the event into proctoring_events table for admin review $pdo->prepare(" INSERT INTO proctoring_events (attempt_id, event_type, created_at) VALUES (?, ?, NOW()) ")->execute([$attemptId, $eventType]); if ($shouldDisqualify) { $pdo->prepare(" UPDATE quiz_attempts SET status='disqualified', completed_at=NOW(), disqualification_reason=?, is_active_attempt = 0 WHERE id = ? ")->execute([$reason, $attemptId]); // ✅ Clear attempt cache when disqualified LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); $disqualificationTriggered = true; } // Return JSON response for client-side action header('Content-Type: application/json'); echo json_encode([ 'status' => 'success', 'disqualified' => $disqualificationTriggered, 'reason' => $reason ]); } exit; } /* ======================= ANSWER SUBMIT (AJAX Flow Implemented) ======================= */ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['answer']) || isset($_POST['auto_answer']))) { $isAjax = (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest'); // Setup JSON response header for AJAX requests if ($isAjax) { header('Content-Type: application/json'); } // Validate CSRF token with hash_equals for timing attack protection if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) { error_log("Quiz answer submit failed: Invalid CSRF token"); if ($isAjax) { echo json_encode(['status' => 'error', 'message' => 'Invalid request.']); exit; } // Non-AJAX fallback: redirect to refresh header("Location: daily_quiz"); exit; } // Check if quiz has expired before processing answer if ($attempt['expires_at'] && strtotime($attempt['expires_at']) < time()) { $pdo->prepare(" UPDATE quiz_attempts SET status='disqualified', completed_at=NOW(), disqualification_reason='Quiz expired', is_active_attempt = 0 WHERE id=? ")->execute([$attempt['id']]); // ✅ Clear attempt cache when expired LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); if ($isAjax) { echo json_encode(['status' => 'expired', 'message' => 'Quiz expired due to inactivity.']); exit; } header("Location: daily_quiz"); exit; } if ( empty($_POST['aqid']) ) { if ($isAjax) { echo json_encode(['status' => 'error', 'message' => 'Missing question ID.']); exit; } header("Location: daily_quiz"); exit; } $aqid = (int) $_POST['aqid']; // Determine the answer if (!empty($_POST['auto_answer']) && $_POST['auto_answer'] === 'TIME') { $answer = 'TIME'; } elseif (!empty($_POST['answer'])) { $answer = strtoupper($_POST['answer']); } else { // If it's a manual submit (not auto_answer) but no answer is selected if ($isAjax) { echo json_encode(['status' => 'no_answer_selected', 'message' => 'Please select an option.']); exit; } // Fallback for non-AJAX user: treat as timed out (TIME) $answer = 'TIME'; } // Validate answer input if (!in_array($answer, ['A','B','C','D','TIME'], true)) { if ($isAjax) { echo json_encode(['status' => 'error', 'message' => 'Invalid answer value.']); exit; } header("Location: daily_quiz"); exit; } // Fetch question data $stmt = $pdo->prepare(" SELECT aq.question_started_at, q.correct_answer FROM quiz_attempt_questions aq JOIN quiz_questions q ON q.id = aq.question_id WHERE aq.id = ? AND aq.attempt_id = ? "); $stmt->execute([$aqid, $attempt['id']]); $row = $stmt->fetch(PDO::FETCH_ASSOC); if ($row && $row['question_started_at']) { $taken = time() - strtotime($row['question_started_at']); $isTimedOut = ($answer === 'TIME'); $correct = (!$isTimedOut && $answer === $row['correct_answer']) ? 1 : 0; try { $pdo->beginTransaction(); // ❌ ADD RACE CONDITION PROTECTION - Check if answer already submitted $stmt = $pdo->prepare(" UPDATE quiz_attempt_questions SET selected_answer = ?, is_correct = ?, time_taken = ? WHERE id = ? AND selected_answer IS NULL "); $stmt->execute([$answer, $correct, min($taken, 15), $aqid]); // ✅ PERFORMANCE: Clear question count cache after answer submission LocalSimpleCache::delete('question_count_' . $attempt['id']); $rowsAffected = $stmt->rowCount(); // ✅ FIXED: If no rows were affected, the answer was already submitted if ($rowsAffected == 0) { $pdo->commit(); // ✅ FIXED: Proper response for double submit - prevent user confusion if ($isAjax) { header('Content-Type: application/json'); echo json_encode([ 'status' => 'already_submitted', 'message' => 'This answer was already submitted. Loading next question...' ]); } else { header("Location: daily_quiz"); } exit; } // ✅ INCREMENT answered_count IN quiz_attempts $pdo->prepare(" UPDATE quiz_attempts SET answered_count = answered_count + 1 WHERE id = ? ")->execute([$attempt['id']]); // Check if there are any unanswered questions left $stmt = $pdo->prepare(" SELECT COUNT(*) as unanswered FROM quiz_attempt_questions WHERE attempt_id = ? AND selected_answer IS NULL "); $stmt->execute([$attempt['id']]); $unanswered = $stmt->fetch(PDO::FETCH_ASSOC)['unanswered']; $quizStatus = 'started'; // If no unanswered questions, complete the quiz if ($unanswered == 0) { $quizStatus = 'completed'; // finish quiz $score = $pdo->prepare(" SELECT COUNT(*) FROM quiz_attempt_questions WHERE attempt_id = ? AND is_correct = 1 "); $score->execute([$attempt['id']]); $score = $score->fetchColumn(); $pdo->prepare(" UPDATE quiz_attempts SET status='completed', completed_at=NOW(), score=?, is_active_attempt = 0 WHERE id = ? ")->execute([$score, $attempt['id']]); // ✅ Clear attempt cache when quiz completes LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); LocalSimpleCache::delete('question_count_' . $attempt['id']); // Clear question count cache // Update leaderboard $currentMonthYear = date('Y-m'); $stmt = $pdo->prepare(" SELECT id, total_score, quizzes_taken FROM quiz_leaderboard_monthly WHERE user_id = ? AND month_year = ? "); $stmt->execute([$userId, $currentMonthYear]); $leaderboardEntry = $stmt->fetch(PDO::FETCH_ASSOC); if ($leaderboardEntry) { $newTotalScore = $leaderboardEntry['total_score'] + $score; $newQuizzesTaken = $leaderboardEntry['quizzes_taken'] + 1; $pdo->prepare(" UPDATE quiz_leaderboard_monthly SET total_score = ?, quizzes_taken = ? WHERE id = ? ")->execute([$newTotalScore, $newQuizzesTaken, $leaderboardEntry['id']]); } else { $pdo->prepare(" INSERT INTO quiz_leaderboard_monthly (user_id, month_year, total_score, quizzes_taken) VALUES (?, ?, ?, 1) ")->execute([$userId, $currentMonthYear, $score]); } // ✅ Clear device warning after quiz completion if (isset($_SESSION['device_warning'])) { unset($_SESSION['device_warning']); } } $pdo->commit(); // AJAX RESPONSE (for manual submit) if ($isAjax) { // ✅ FIXED: Set JSON header before output to prevent page refresh header('Content-Type: application/json'); echo json_encode([ 'status' => 'success', 'message' => ($isTimedOut ? 'Time expired. Answer recorded.' : 'Answer submitted successfully.'), 'quiz_status' => $quizStatus ]); exit; } else { // Non-AJAX response (for auto-submit 'TIME') - needs a redirect header("Location: daily_quiz"); exit; } } catch (Exception $e) { $pdo->rollBack(); error_log("Quiz answer submit transaction failed: " . $e->getMessage()); if ($isAjax) { echo json_encode(['status' => 'error', 'message' => 'Failed to process answer. Please try again.']); exit; } else { // Non-AJAX fallback header("Location: daily_quiz"); exit; } } } else { if ($isAjax) { echo json_encode(['status' => 'error', 'message' => 'Question not found or already started.']); exit; } header("Location: daily_quiz"); exit; } } /* ======================= FETCH CURRENT QUESTION ======================= */ $currentQuestion = null; if ($attempt && $attempt['status'] === 'started') { // Check if quiz has expired if ($attempt['expires_at'] && strtotime($attempt['expires_at']) < time()) { $pdo->prepare(" UPDATE quiz_attempts SET status='disqualified', completed_at=NOW(), disqualification_reason='Quiz expired', is_active_attempt = 0 WHERE id=? ")->execute([$attempt['id']]); // ✅ Clear attempt cache when expired LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); // ✅ Clear device warning after quiz expiry if (isset($_SESSION['device_warning'])) { unset($_SESSION['device_warning']); } // UX-safe error handling echo "

Quiz Expired

Quiz expired due to inactivity.

"; exit; } // Enhanced device check with warning and optional disqualification if ($attempt['device_hash'] !== $deviceHash) { // Log the device change error_log("Quiz Device Change | user={$userId} | attempt={$attempt['id']}"); // Store device change in database for admin review $pdo->prepare(" UPDATE quiz_attempts SET device_changes = device_changes + 1 WHERE id = ? ")->execute([$attempt['id']]); // ✅ OPTIMIZED: Single query to get device_changes (was 2 queries) $stmt = $pdo->prepare("SELECT device_changes FROM quiz_attempts WHERE id = ?"); $stmt->execute([$attempt['id']]); $updatedAttempt = $stmt->fetch(PDO::FETCH_ASSOC); // Set session warning for first device change if ($updatedAttempt && $updatedAttempt['device_changes'] == 1) { $_SESSION['device_warning'] = true; } // Disqualify if device changed more than 1 time (2nd change triggers disqualification) if ($updatedAttempt && $updatedAttempt['device_changes'] >= 2) { $pdo->prepare(" UPDATE quiz_attempts SET status='disqualified', completed_at=NOW(), disqualification_reason='Multiple device changes detected', is_active_attempt = 0 WHERE id = ? ")->execute([$attempt['id']]); // ✅ Clear attempt cache when disqualified LocalSimpleCache::delete('quiz_attempt_' . $userId . '_' . date('Y-m-d')); // ✅ Clear device warning after device change disqualification if (isset($_SESSION['device_warning'])) { unset($_SESSION['device_warning']); } // UX-safe error handling echo "

Disqualified

You have been disqualified due to multiple device changes during the quiz.

"; exit; } } $stmt = $pdo->prepare(" SELECT q.*, aq.id AS aqid, aq.question_started_at FROM quiz_attempt_questions aq JOIN quiz_questions q ON q.id = aq.question_id WHERE aq.attempt_id = ? AND aq.selected_answer IS NULL ORDER BY aq.question_order ASC LIMIT 1 "); $stmt->execute([$attempt['id']]); $currentQuestion = $stmt->fetch(PDO::FETCH_ASSOC); // set question start time if ($currentQuestion && !$currentQuestion['question_started_at']) { $pdo->prepare(" UPDATE quiz_attempt_questions SET question_started_at = NOW() WHERE id = ? ")->execute([$currentQuestion['aqid']]); // ✅ OPTIMIZED: Update question_started_at directly without re-fetch (1 less query) // Just update the local variable instead of re-fetching $currentQuestion['question_started_at'] = date('Y-m-d H:i:s'); } // Server-side timer validation - check if current question has exceeded time limit if ($currentQuestion && $currentQuestion['question_started_at']) { $timeTaken = time() - strtotime($currentQuestion['question_started_at']); // Add grace period to prevent unfair disqualification due to network latency $buffer = 3; // seconds if ($timeTaken > (15 + $buffer)) { // Auto-submit the question with no points if time exceeded $stmt = $pdo->prepare(" UPDATE quiz_attempt_questions SET selected_answer = 'TIME', is_correct = 0, time_taken = 15 WHERE id = ? AND selected_answer IS NULL "); $stmt->execute([$currentQuestion['aqid']]); // Only redirect if the update was successful if ($stmt->rowCount() > 0) { // Redirect to reload the page and get the next question header("Location: daily_quiz"); exit; } } } } ?> Daily Quiz

•

REC | DO NOT TRY TO CHEAT

⚠ Device change detected. Further changes may disqualify you.

Click the button above to start today's quiz. You'll have 15 questions to answer, with 15 seconds per question.

Please keep this tab focused and avoid switching to other tabs or applications during the quiz.

🎉 Congratulations! 🎉

Your quiz has been submitted successfully

You have successfully completed today's quiz.
Check the leaderboard to see how you rank!

Go to Scholarship Portal

You can check your results in the leaderboard section on scholarship portal

Disqualified

You have been disqualified from today's quiz. Please follow the quiz rules carefully:

Do not switch tabs or applications during the quiz
Do not open developer tools or inspect elements
Complete the quiz in one sitting without refreshing

You can try again tomorrow with a new set of questions.

Question: prepare(" SELECT COUNT(*) as answered_count FROM quiz_attempt_questions WHERE attempt_id = ? AND selected_answer IS NOT NULL "); $stmt->execute([$attempt['id']]); $answeredResult = $stmt->fetch(PDO::FETCH_ASSOC); $answered = $answeredResult['answered_count'] ?? 0; LocalSimpleCache::set($questionCountCacheKey, $answered, 30); // Cache for 30 seconds } $currentQuestionNum = $answered + 1; echo $currentQuestionNum . "/15"; ?>

Processing Complete

Your quiz is being processed. Please refresh the page in a moment if it does not update automatically.