<?php
/**
 * settings-api.php – Lesen/Speichern von Einstellungen (pacim_settings), whitelisted.
 *  GET                 -> { ok, settings:{ key:value, ... } }
 *  POST key=value...   -> speichert die erlaubten Keys, { ok, settings:{...} }
 */
require_once( __DIR__ . '/includes/config.inc.php' );
@ini_set( 'display_errors', '0' );
error_reporting( 0 );
header( 'Content-Type: application/json; charset=utf-8' );

if ( ! isset( $_SESSION['user'] ) || $_SESSION['user'] != LOGIN_USER ) {
    http_response_code( 403 );
    echo json_encode( array( 'ok' => false, 'error' => 'unauthorized' ) );
    exit();
}

$action = isset( $_GET['action'] ) ? $_GET['action'] : ( isset( $_POST['action'] ) ? $_POST['action'] : '' );

/* ---------------- Buchungsquellen (customer_source) verwalten ---------------- */
if ( $action === 'sources' ) {
    $db = new MysqliDb( MYSQL_HOST, MYSQL_USER, MYSQL_PASS, MYSQL_DB );
    $counts = array();
    foreach ( $db->rawQuery( "SELECT customer_source AS s, COUNT(*) AS c FROM pacim_customer GROUP BY customer_source" ) as $r ) {
        $counts[ (string) $r['s'] ] = (int) $r['c'];
    }
    $list = array();
    foreach ( pacim_sources() as $s ) {
        $s['count'] = isset( $counts[ $s['key'] ] ) ? $counts[ $s['key'] ] : 0;
        unset( $counts[ $s['key'] ] );
        $list[] = $s;
    }
    $other = array();
    foreach ( $counts as $k => $c ) { if ( trim( (string) $k ) === '' ) continue; $other[] = array( 'key' => (string) $k, 'count' => (int) $c ); }
    echo json_encode( array( 'ok' => true, 'sources' => $list, 'other' => $other ) );
    exit();
}

if ( $action === 'source-save' ) {
    $key   = trim( (string) ( $_POST['key'] ?? '' ) );
    $label = trim( (string) ( $_POST['label'] ?? '' ) );
    $orig  = trim( (string) ( $_POST['orig'] ?? '' ) );
    if ( $key === '' ) { echo json_encode( array( 'ok' => false, 'error' => 'Bitte einen Wert (Quelle) angeben.' ) ); exit(); }
    if ( $orig !== '' && pacim_source_is_builtin( $orig ) ) { echo json_encode( array( 'ok' => false, 'error' => 'Feste Quellen können nicht bearbeitet werden.' ) ); exit(); }
    if ( pacim_source_is_builtin( $key ) ) { echo json_encode( array( 'ok' => false, 'error' => 'Dieser Wert ist bereits eine feste Quelle.' ) ); exit(); }
    $raw = settings::get( 'customer_sources_custom', '' );
    $custom = $raw ? json_decode( $raw, true ) : array();
    if ( ! is_array( $custom ) ) $custom = array();
    $new = array();
    foreach ( $custom as $c ) {
        $ck = isset( $c['key'] ) ? trim( (string) $c['key'] ) : '';
        if ( $ck === '' ) continue;
        if ( strcasecmp( $ck, $orig ) === 0 || strcasecmp( $ck, $key ) === 0 ) continue; // alte/gleiche entfernen
        $new[] = $c;
    }
    $new[] = array( 'key' => $key, 'label' => $label !== '' ? $label : $key );
    pacim_sources_custom_save( $new );
    echo json_encode( array( 'ok' => true ) );
    exit();
}

if ( $action === 'source-delete' ) {
    $key = trim( (string) ( $_POST['key'] ?? '' ) );
    if ( pacim_source_is_builtin( $key ) ) { echo json_encode( array( 'ok' => false, 'error' => 'Feste Quellen können nicht gelöscht werden.' ) ); exit(); }
    $raw = settings::get( 'customer_sources_custom', '' );
    $custom = $raw ? json_decode( $raw, true ) : array();
    if ( ! is_array( $custom ) ) $custom = array();
    $new = array();
    foreach ( $custom as $c ) { if ( isset( $c['key'] ) && strcasecmp( trim( (string) $c['key'] ), $key ) === 0 ) continue; $new[] = $c; }
    pacim_sources_custom_save( $new );
    echo json_encode( array( 'ok' => true ) );
    exit();
}

// Erlaubte Einstellungen + Default (Default = bisherige Konstante, falls vorhanden)
$ALLOWED = array(
    'gdrive_accounting_folder' => defined( 'GDRIVE_ACCOUNTING_FOLDER' ) ? GDRIVE_ACCOUNTING_FOLDER : '',
);

function settings_payload( $allowed ) {
    $out = array();
    foreach ( $allowed as $key => $default ) $out[ $key ] = settings::get( $key, $default );
    // Pushover App-Token ist ein Geheimnis -> nie im Klartext ausliefern, nur ob gesetzt.
    $out['pushover_app_token_set'] = ( class_exists( 'pushnotify' ) && pushnotify::appToken() !== '' );
    return $out;
}

if ( $_SERVER['REQUEST_METHOD'] === 'POST' ) {
    foreach ( $ALLOWED as $key => $default ) {
        if ( isset( $_POST[ $key ] ) ) settings::set( $key, trim( (string) $_POST[ $key ] ) );
    }
    // Pushover App-Token (systemweit): verschlüsselt speichern; leer = unverändert lassen.
    if ( isset( $_POST['pushover_app_token'] ) ) {
        $tok = trim( (string) $_POST['pushover_app_token'] );
        if ( $tok !== '' ) settings::set( 'pushover_app_token', pacim_encrypt( $tok ) );
    }
    echo json_encode( array( 'ok' => true, 'settings' => settings_payload( $ALLOWED ) ) );
    exit();
}

echo json_encode( array( 'ok' => true, 'settings' => settings_payload( $ALLOWED ) ) );