<?php
/**
 * api/admin/users.php
 */

declare(strict_types=1);

require_once __DIR__ . '/../../includes/db.php';
require_once __DIR__ . '/../../includes/auth.php';
require_once __DIR__ . '/../../includes/csrf.php';
require_once __DIR__ . '/../../includes/functions.php';

require_permission('users');
csrf_required();

set_exception_handler(function(Throwable $e) {
    http_response_code(500);
    header("Content-Type: application/json");
    echo json_encode(["success" => false, "message" => "Sunucu hatası: " . $e->getMessage()]);
    exit;
});

// Tüm modüller - GLOBALS üzerinden fonksiyon scope sorununu aş
$GLOBALS['_modules'] = [
    'dashboard', 'reservations', 'customers', 'customer_tags',
    'suppliers', 'daily_orders', 'staff', 'settings', 'users'
];

$action = post_str('action');

if ($action === 'get')    { action_get();    exit; }
if ($action === 'create') { action_create(); exit; }
if ($action === 'update') { action_update(); exit; }
if ($action === 'delete') { action_delete(); exit; }

json_response(false, 'Geçersiz işlem.');

function action_get(): void
{
    $id = post_int('id');
    if (!$id) json_response(false, 'ID gerekli.');

    $user = db_row("SELECT id, full_name, username, role, is_active FROM users WHERE id = ?", [$id]);
    if (!$user) json_response(false, 'Kullanıcı bulunamadı.');

    $perms     = db_rows("SELECT module_key FROM user_permissions WHERE user_id = ? AND is_active = 1", [$id]);
    $perm_keys = array_column($perms, 'module_key');

    json_response(true, '', ['user' => $user, 'permissions' => $perm_keys]);
}

function action_create(): void
{
    $full_name = trim(post_str('full_name'));
    $username  = trim(post_str('username'));
    $password  = post_str('password');
    $role      = post_str('role') === 'admin' ? 'admin' : 'staff';
    $is_active = post_int('is_active');

    if (!$full_name) json_response(false, 'Ad Soyad zorunlu.');
    if (!$username)  json_response(false, 'Kullanıcı adı zorunlu.');
    if (!$password)  json_response(false, 'Şifre zorunlu.');
    if (strlen($password) < 8) json_response(false, 'Şifre en az 8 karakter olmalı.');

    $exists = db_value("SELECT COUNT(*) FROM users WHERE username = ?", [$username]);
    if ($exists) json_response(false, 'Bu kullanıcı adı zaten kullanılıyor.');

    $hash = password_hash($password, PASSWORD_DEFAULT);
    $id   = (int)db_insert(
        "INSERT INTO users (full_name, username, password_hash, role, is_active) VALUES (?, ?, ?, ?, ?)",
        [$full_name, $username, $hash, $role, $is_active]
    );

    if ($role === 'staff') {
        do_save_permissions($id);
    }

    json_response(true, 'Kullanıcı oluşturuldu.', ['id' => $id]);
}

function action_update(): void
{
    $id        = post_int('id');
    $full_name = trim(post_str('full_name'));
    $username  = trim(post_str('username'));
    $password  = post_str('password');
    $role      = post_str('role') === 'admin' ? 'admin' : 'staff';
    $is_active = post_int('is_active');

    if (!$id)        json_response(false, 'ID gerekli.');
    if (!$full_name) json_response(false, 'Ad Soyad zorunlu.');
    if (!$username)  json_response(false, 'Kullanıcı adı zorunlu.');
    if ($password && strlen($password) < 8) json_response(false, 'Şifre en az 8 karakter olmalı.');

    $user = db_row("SELECT * FROM users WHERE id = ?", [$id]);
    if (!$user) json_response(false, 'Kullanıcı bulunamadı.');

    $me = current_user();
    if ($id === $me['id'] && !$is_active) json_response(false, 'Kendinizi pasifleştiremezsiniz.');
    if ($id === $me['id'] && $role !== 'admin') json_response(false, 'Kendi admin rolünüzü kaldıramazsınız.');

    $dup = db_value("SELECT COUNT(*) FROM users WHERE username = ? AND id != ?", [$username, $id]);
    if ($dup) json_response(false, 'Bu kullanıcı adı başka kullanıcıda kullanılıyor.');

    if ($password) {
        $hash = password_hash($password, PASSWORD_DEFAULT);
        db_run(
            "UPDATE users SET full_name=?, username=?, password_hash=?, role=?, is_active=? WHERE id=?",
            [$full_name, $username, $hash, $role, $is_active, $id]
        );
    } else {
        db_run(
            "UPDATE users SET full_name=?, username=?, role=?, is_active=? WHERE id=?",
            [$full_name, $username, $role, $is_active, $id]
        );
    }

    if ($role === 'staff') {
        do_save_permissions($id);
    } else {
        db_run("DELETE FROM user_permissions WHERE user_id = ?", [$id]);
    }

    json_response(true, 'Kullanıcı güncellendi.');
}

function action_delete(): void
{
    $id = post_int('id');
    $me = current_user();
    if (!$id) json_response(false, 'ID gerekli.');
    if ($id === $me['id']) json_response(false, 'Kendinizi silemezsiniz.');

    $user = db_row("SELECT id FROM users WHERE id = ?", [$id]);
    if (!$user) json_response(false, 'Kullanıcı bulunamadı.');

    db_run("DELETE FROM users WHERE id = ?", [$id]);
    json_response(true, 'Kullanıcı silindi.');
}

function do_save_permissions(int $user_id): void
{
    $all_modules = $GLOBALS['_modules'];

    $perm_raw = $_POST['permissions'] ?? '';
    $selected = ($perm_raw !== '')
        ? array_values(array_filter(array_map('trim', explode(',', (string)$perm_raw))))
        : [];

    db_run("DELETE FROM user_permissions WHERE user_id = ?", [$user_id]);

    foreach ($all_modules as $module) {
        $active = in_array($module, $selected, true) ? 1 : 0;
        db_run(
            "INSERT INTO user_permissions (user_id, module_key, is_active) VALUES (?, ?, ?)",
            [$user_id, $module, $active]
        );
    }
}