<?php
/**
 * api/admin/reservations.php
 * Rezervasyon CRUD AJAX endpoint
 */

declare(strict_types=1);

require_once __DIR__ . '/../../includes/db.php';
require_once __DIR__ . '/../../includes/auth.php';
require_once __DIR__ . '/../../includes/functions.php';
require_once __DIR__ . '/../../includes/csrf.php';

require_permission('reservations');
header('Content-Type: application/json');

$action = $_GET['action'] ?? post_str('action');

// GET istekleri
if ($_SERVER['REQUEST_METHOD'] === 'GET' && $action === 'get') {
    $id  = get_int('id');
    $row = db_row('SELECT * FROM reservations WHERE id = ?', [$id]);
    if (!$row) json_response(false, 'Rezervasyon bulunamadı.');
    json_response(true, '', ['reservation' => $row]);
}

// POST istekleri - CSRF kontrol
csrf_required();

set_exception_handler(function(Throwable $e) {
    http_response_code(500);
    header("Content-Type: application/json");
    echo json_encode(["success" => false, "message" => "Sunucu hatası: " . $e->getMessage()]);
    exit;
});

$id = post_int('id');

switch ($action) {

    case 'confirm':
        if (!$id) json_response(false, 'Geçersiz ID.');
        $table_no   = post_str('table_no');
        $admin_note = post_str('admin_note');
        db_run(
            "UPDATE reservations SET status='onaylandi', table_no=?, admin_note=? WHERE id=? AND status='bekliyor'",
            [$table_no, $admin_note, $id]
        );
        json_response(true, 'Rezervasyon onaylandı.');

    case 'reject':
        if (!$id) json_response(false, 'Geçersiz ID.');
        $reason = post_str('cancel_reason');
        db_run(
            "UPDATE reservations SET status='reddedildi', cancel_reason=? WHERE id=? AND status='bekliyor'",
            [$reason, $id]
        );
        json_response(true, 'Rezervasyon reddedildi.');

    case 'cancel':
        if (!$id) json_response(false, 'Geçersiz ID.');
        $reason = post_str('cancel_reason');
        db_run(
            "UPDATE reservations SET status='iptal', cancel_reason=? WHERE id=? AND status IN ('bekliyor','onaylandi')",
            [$reason, $id]
        );
        json_response(true, 'Rezervasyon iptal edildi.');

    case 'archive':
        if (!$id) json_response(false, 'Geçersiz ID.');
        db_run("UPDATE reservations SET status='arsiv' WHERE id=? AND status='onaylandi'", [$id]);
        json_response(true, 'Arşivlendi.');

    case 'visit':
        if (!$id) json_response(false, 'Geçersiz ID.');
        $visit_status = post_str('visit_status');
        $visit_note   = post_str('visit_note');
        $allowed      = ['', 'geldi', 'gelmedi'];
        if (!in_array($visit_status, $allowed)) json_response(false, 'Geçersiz durum.');
        db_run(
            "UPDATE reservations SET visit_status=?, visit_note=? WHERE id=? AND status IN ('onaylandi','arsiv')",
            [$visit_status ?: null, $visit_note, $id]
        );
        json_response(true, 'Ziyaret durumu güncellendi.');

    case 'update':
        if (!$id) json_response(false, 'Geçersiz ID.');
        $full_name       = post_str('full_name');
        $phone           = post_str('phone');
        $guest_count     = post_int('guest_count');
        $date            = post_str('date');
        $time            = post_str('time');
        $table_no        = post_str('table_no');
        $special_request = post_str('special_request');
        $admin_note      = post_str('admin_note');

        if (!$full_name || !$phone || !$date || !$time) {
            json_response(false, 'Zorunlu alanlar eksik.');
        }

        db_run(
            "UPDATE reservations SET full_name=?, phone=?, guest_count=?, date=?, time=?, table_no=?, special_request=?, admin_note=? WHERE id=?",
            [$full_name, $phone, $guest_count, $date, $time, $table_no, $special_request, $admin_note, $id]
        );
        json_response(true, 'Rezervasyon güncellendi.');

    case 'delete':
        if (!is_admin()) json_response(false, 'Yetkiniz yok.');
        if (!$id) json_response(false, 'Geçersiz ID.');
        db_run('DELETE FROM reservations WHERE id=?', [$id]);
        json_response(true, 'Silindi.');

    default:
        json_response(false, 'Geçersiz işlem.');
}