<?php
require_once __DIR__ . '/../includes/bootstrap.php';
header('Content-Type: application/json; charset=utf-8');

$user = current_user();
if (!$user) {
    http_response_code(401);
    echo json_encode(['ok' => false, 'message' => 'Nicht eingeloggt.']);
    exit;
}

$payload = json_decode(file_get_contents('php://input'), true) ?: [];
if (!csrf_verify($payload['csrf'] ?? ($_SERVER['HTTP_X_CSRF'] ?? null))) {
    http_response_code(403);
    echo json_encode(['ok' => false, 'message' => 'Sicherheitstoken ungültig. Bitte neu laden.']);
    exit;
}

update_playtime_ping((int)$user['id']);

$rawBets = is_array($payload['bets'] ?? null) ? $payload['bets'] : [];
$legal = roulette_legal_bets();

// Einsätze säubern & zusammenfassen (gleiche id summieren)
$betMap = [];
foreach ($rawBets as $b) {
    $id = (string)($b['id'] ?? '');
    $amount = round((float)($b['amount'] ?? 0), 2);
    if ($amount <= 0 || !isset($legal[$id])) continue;
    $betMap[$id] = ($betMap[$id] ?? 0) + $amount;
}
if (!$betMap) {
    http_response_code(400);
    echo json_encode(['ok' => false, 'message' => 'Keine gültigen Einsätze platziert.']);
    exit;
}
$betList = [];
foreach ($betMap as $id => $amount) $betList[] = ['id' => $id, 'amount' => $amount];
$totalBet = round(array_sum($betMap), 2);

$pdo = db();
$pdo->beginTransaction();
try {
    $stmt = $pdo->prepare('SELECT * FROM users WHERE id = ? FOR UPDATE');
    $stmt->execute([(int)$user['id']]);
    $user = $stmt->fetch();
    if (!$user) {
        throw new RuntimeException('Spieler nicht gefunden.');
    }
    if ((int)($user['banned'] ?? 0) === 1) {
        throw new RuntimeException('Dein Konto ist gesperrt.');
    }
    if ((float)$user['balance'] < $totalBet) {
        throw new RuntimeException('Nicht genug Coins für diese Einsätze.');
    }

    $number = roulette_spin_number();
    $result = roulette_resolve($betList, $number);
    // Spielerindividueller Gewinnfaktor (Admin); 1.00 = faires Roulette
    $playerFactor = player_rtp_factor($user);
    $totalReturn = round((float)$result['total_return'] * $playerFactor, 2);

    $newBalance   = round((float)$user['balance'] - $totalBet + $totalReturn, 2);
    $totalWagered = round((float)$user['total_wagered'] + $totalBet, 2);
    $totalWon     = round((float)$user['total_won'] + $totalReturn, 2);
    $ratio        = $totalBet > 0 ? round($totalReturn / $totalBet, 2) : (float)$user['best_win_ratio'];
    $bestRatio    = max((float)$user['best_win_ratio'], $ratio);
    $biggest      = max((float)$user['biggest_single_win'], $totalReturn);

    $pdo->prepare('UPDATE users SET balance=?, total_wagered=?, total_won=?, biggest_single_win=?, best_win_ratio=?, last_seen_at=NOW() WHERE id=?')
        ->execute([$newBalance, $totalWagered, $totalWon, $biggest, $bestRatio, (int)$user['id']]);

    // Runde in spins ablegen (mode_name=roulette, scatter_count = Gewinnzahl)
    $pdo->prepare('INSERT INTO spins (user_id, mode_name, line_count, bet_per_line, total_bet, total_win, scatter_count, free_spins_won, free_spins_after, is_free_spin, jackpot_bet, wins_json, grid_json, created_at) VALUES (?,?,?,?,?,?,?,0,0,0,0,?,?,NOW())')
        ->execute([
            (int)$user['id'], 'roulette', count($betList), 0, $totalBet, $totalReturn, $number,
            json_encode($result['per_bet'], JSON_UNESCAPED_UNICODE),
            json_encode(['number' => $number, 'color' => roulette_color($number)], JSON_UNESCAPED_UNICODE),
        ]);

    $pdo->commit();

    echo json_encode([
        'ok'           => true,
        'number'       => $number,
        'color'        => roulette_color($number),
        'total_bet'    => $totalBet,
        'total_return' => $totalReturn,
        'net'          => round($totalReturn - $totalBet, 2),
        'winning_ids'  => $result['winning_ids'],
        'per_bet'      => $result['per_bet'],
        'balance'      => $newBalance,
    ], JSON_UNESCAPED_UNICODE);
} catch (Throwable $ex) {
    if ($pdo->inTransaction()) {
        $pdo->rollBack();
    }
    http_response_code(400);
    echo json_encode(['ok' => false, 'message' => $ex->getMessage()]);
}