<?php
/**
 * api/admin/staff.php
 * Personel CRUD endpoint
 */

declare(strict_types=1);

require_once __DIR__ . '/../../includes/db.php';
require_once __DIR__ . '/../../includes/auth.php';
require_once __DIR__ . '/../../includes/csrf.php';
require_once __DIR__ . '/../../includes/functions.php';

// Tüm hataları JSON döndür
set_exception_handler(function(Throwable $e) {
    http_response_code(500);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode(['success' => false, 'message' => 'Sunucu hatası: ' . $e->getMessage()]);
    exit;
});

// Auth kontrolü
if (!is_logged_in()) {
    http_response_code(401);
    json_response(false, 'Oturum süresi doldu. Lütfen yeniden giriş yapın.');
}

require_permission('staff');

// Aksiyonu al (POST veya GET'ten)
$action = $_POST['action'] ?? $_GET['action'] ?? '';

// GET action için CSRF gerekmez
$write_actions = ['create', 'update', 'toggle_status', 'delete'];
if (in_array($action, $write_actions)) {
    csrf_required();
}

// department kolonu var mı?
function staff_has_dept_col(): bool
{
    static $result = null;
    if ($result === null) {
        try {
            $result = (bool)db_value(
                "SELECT COUNT(*) FROM information_schema.COLUMNS
                  WHERE TABLE_SCHEMA = DATABASE()
                    AND TABLE_NAME   = 'staff'
                    AND COLUMN_NAME  = 'department'"
            );
        } catch (Throwable $e) {
            $result = false;
        }
    }
    return $result;
}

// Router
match ($action) {
    'get'           => action_get(),
    'create'        => action_create(),
    'update'        => action_update(),
    'toggle_status' => action_toggle_status(),
    'delete'        => action_delete(),
    'update_sort'   => action_update_sort(),
    default         => json_response(false, 'Geçersiz işlem: ' . htmlspecialchars($action))
};

/* ------------------------------------------------------------------ */

function action_get(): void
{
    $id = (int)($_POST['id'] ?? $_GET['id'] ?? 0);
    if (!$id) json_response(false, 'ID gerekli.');

    $staff = db_row(
        "SELECT id, full_name, phone, email, position, is_active, notes FROM staff WHERE id = ?",
        [$id]
    );

    if (!$staff) json_response(false, "ID=$id olan personel bulunamadı.");

    // department kolonunu güvenle ekle
    $staff['department'] = 'salon'; // varsayılan
    if (staff_has_dept_col()) {
        $dept = db_value("SELECT department FROM staff WHERE id = ?", [$id]);
        if ($dept) $staff['department'] = $dept;
    }

    json_response(true, '', ['staff' => $staff]);
}

function action_create(): void
{
    $name = trim(post_str('full_name'));
    if (!$name) json_response(false, 'Ad Soyad zorunlu.');

    $dept = in_array(post_str('department'), ['salon','mutfak']) ? post_str('department') : 'salon';

    $has_sort = (bool)db_value("SELECT COUNT(*) FROM information_schema.COLUMNS
        WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='staff' AND COLUMN_NAME='sort_order'");
    $sort_val = max(0, post_int('sort_order'));

    if (staff_has_dept_col() && $has_sort) {
        $id = db_insert(
            "INSERT INTO staff (full_name, phone, email, position, department, is_active, notes, sort_order)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
            [$name, post_str('phone') ?: null, post_str('email') ?: null,
             post_str('position') ?: null, $dept,
             post_int('is_active') ?: 1, post_str('notes') ?: null, $sort_val]
        );
    } elseif (staff_has_dept_col()) {
        $id = db_insert(
            "INSERT INTO staff (full_name, phone, email, position, department, is_active, notes)
             VALUES (?, ?, ?, ?, ?, ?, ?)",
            [$name, post_str('phone') ?: null, post_str('email') ?: null,
             post_str('position') ?: null, $dept,
             post_int('is_active') ?: 1, post_str('notes') ?: null]
        );
    } else {
        $id = db_insert(
            "INSERT INTO staff (full_name, phone, email, position, is_active, notes)
             VALUES (?, ?, ?, ?, ?, ?)",
            [$name, post_str('phone') ?: null, post_str('email') ?: null,
             post_str('position') ?: null,
             post_int('is_active') ?: 1, post_str('notes') ?: null]
        );
    }
    json_response(true, 'Personel oluşturuldu.', ['id' => (int)$id]);
}

function action_update(): void
{
    $id   = post_int('id');
    $name = trim(post_str('full_name'));
    if (!$id)   json_response(false, 'ID gerekli.');
    if (!$name) json_response(false, 'Ad Soyad zorunlu.');

    if (!db_row("SELECT id FROM staff WHERE id = ?", [$id])) {
        json_response(false, 'Personel bulunamadı.');
    }

    $dept = in_array(post_str('department'), ['salon','mutfak']) ? post_str('department') : 'salon';

    if (staff_has_dept_col()) {
        db_run(
            "UPDATE staff SET full_name=?, phone=?, email=?, position=?, department=?, is_active=?, notes=? WHERE id=?",
            [$name, post_str('phone') ?: null, post_str('email') ?: null,
             post_str('position') ?: null, $dept,
             post_int('is_active') ?: 1, post_str('notes') ?: null, $id]
        );
    } else {
        db_run(
            "UPDATE staff SET full_name=?, phone=?, email=?, position=?, is_active=?, notes=? WHERE id=?",
            [$name, post_str('phone') ?: null, post_str('email') ?: null,
             post_str('position') ?: null,
             post_int('is_active') ?: 1, post_str('notes') ?: null, $id]
        );
    }
    json_response(true, 'Personel güncellendi.');
}

function action_toggle_status(): void
{
    $id        = post_int('id');
    $is_active = post_int('is_active');
    if (!$id) json_response(false, 'ID gerekli.');
    db_run("UPDATE staff SET is_active = ? WHERE id = ?", [$is_active, $id]);
    json_response(true, $is_active ? 'Personel aktifleştirildi.' : 'Personel pasifleştirildi.');
}

function action_delete(): void
{
    if (!is_admin()) json_response(false, 'Silme işlemi için admin yetkisi gerekli.');
    $id = post_int('id');
    if (!$id) json_response(false, 'ID gerekli.');
    if (!db_row("SELECT id FROM staff WHERE id = ?", [$id])) {
        json_response(false, 'Personel bulunamadı.');
    }
    $shift_count = (int)db_value("SELECT COUNT(*) FROM staff_shifts WHERE staff_id = ?", [$id]);
    if ($shift_count > 0) {
        json_response(false, 'Bu personelin vardiya kayıtları var. Silmek yerine pasifleştirin.');
    }
    db_run("DELETE FROM staff WHERE id = ?", [$id]);
    json_response(true, 'Personel silindi.');
}

function action_update_sort(): void
{
    $id  = post_int('id');
    $val = max(0, post_int('sort_order'));
    if (!$id) json_response(false, 'ID gerekli.');
    // sort_order kolonu var mı?
    $has = (bool)db_value("SELECT COUNT(*) FROM information_schema.COLUMNS
        WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='staff' AND COLUMN_NAME='sort_order'");
    if (!$has) json_response(false, 'sort_order kolonu yok. Migration çalıştırın.');
    db_run("UPDATE staff SET sort_order=? WHERE id=?", [$val, $id]);
    json_response(true, 'Sıra güncellendi.');
}