<?php
declare(strict_types=1);
require_once __DIR__ . '/../../includes/db.php';
require_once __DIR__ . '/../../includes/auth.php';
require_once __DIR__ . '/../../includes/functions.php';

header('Content-Type: application/json');

// Auth durumu
$logged = is_logged_in();
$user   = $logged ? current_user() : null;

// CSRF
$csrf_session = $_SESSION['csrf_token'] ?? 'YOK';
$csrf_header  = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? 'HEADER_YOK';
$csrf_post    = $_POST['csrf_token'] ?? 'POST_YOK';

// DB test
try {
    $staff_count = db_value("SELECT COUNT(*) FROM staff");
    $has_dept    = db_value("SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='staff' AND COLUMN_NAME='department'");
    $sample      = db_row("SELECT id, full_name FROM staff LIMIT 1");
} catch (Throwable $e) {
    $staff_count = 'HATA: ' . $e->getMessage();
    $has_dept    = 'HATA';
    $sample      = null;
}

echo json_encode([
    'logged_in'    => $logged,
    'user'         => $user ? $user['username'] : null,
    'csrf_match'   => ($csrf_session === $csrf_header || $csrf_session === $csrf_post),
    'csrf_header'  => substr($csrf_header, 0, 10) . '...',
    'csrf_session' => substr($csrf_session, 0, 10) . '...',
    'staff_count'  => $staff_count,
    'has_dept_col' => (bool)$has_dept,
    'sample_staff' => $sample,
    'post_data'    => $_POST,
    'all_headers'  => array_filter(
        $_SERVER,
        fn($k) => str_starts_with($k, 'HTTP_'),
        ARRAY_FILTER_USE_KEY
    ),
], JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);