<?php
/**
 * users-api.php – Benutzerverwaltung (Einstellungen → Benutzer).
 * Hinter dem PaCIM-Login. CRUD auf pacim_users, Passwörter werden gehasht.
 *
 * POST action=list|create|update|delete
 *   create: firstname,lastname,email,password,level
 *   update: id,firstname,lastname,email,level[,password]
 *   delete: id
 * -> { success, message?, users:[...] }
 */
require_once( __DIR__ . "/includes/config.inc.php" );
@ini_set( 'display_errors', '0' );
header( 'Content-Type: application/json; charset=utf-8' );

if ( !isset( $_SESSION['user'] ) || $_SESSION['user'] != LOGIN_USER ) {
    http_response_code( 403 );
    echo json_encode( array( 'success' => false, 'message' => 'Nicht angemeldet.' ) );
    exit();
}

$oUser  = new user();
$db     = new MysqliDb( MYSQL_HOST, MYSQL_USER, MYSQL_PASS, MYSQL_DB );
$action = isset( $_POST['action'] ) ? $_POST['action'] : ( isset( $_GET['action'] ) ? $_GET['action'] : 'list' );

// Spalte für Superrecht sicherstellen (lazy)
try { $db->rawQuery( 'ALTER TABLE pacim_users ADD COLUMN user_superdelete TINYINT(1) NOT NULL DEFAULT 0' ); } catch ( Exception $e ) {}

/** Superrecht setzen – NUR erlaubt, wenn der aktuelle Benutzer selbst Super-Admin ist. */
function save_superdelete( $db, $uid ) {
    if ( ! ( function_exists( 'is_super' ) && is_super() ) ) return; // kein Super → Feld ignorieren
    $val = ! empty( $_POST['superdelete'] ) ? 1 : 0;
    $db->where( 'user_id', (int) $uid );
    $db->update( 'pacim_users', array( 'user_superdelete' => $val ) );
}

function field( $k ) { return isset( $_POST[$k] ) ? trim( (string) $_POST[$k] ) : ''; }
function fail( $msg ) { echo json_encode( array( 'success' => false, 'message' => $msg ) ); exit(); }
function ok( $oUser, $msg = '' ) { echo json_encode( array( 'success' => true, 'message' => $msg, 'users' => $oUser->all() ) ); exit(); }

/** Benachrichtigungseinstellungen (pacim_user_notify) aus dem POST übernehmen + systemweiten App-Token pflegen. */
function save_notify( $db, $uid ) {
    $uid = (int) $uid;
    if ( $uid <= 0 ) return;
    $flag = function ( $k ) { return ! empty( $_POST[ $k ] ) ? 1 : 0; };
    $key  = isset( $_POST['notify_pushover_key'] ) ? trim( (string) $_POST['notify_pushover_key'] ) : '';
    $allowed = array( 'own', 'partner', 'aida', 'parkinglist' );
    $srcRaw  = isset( $_POST['notify_booking_sources'] ) ? (string) $_POST['notify_booking_sources'] : '';
    $src = array_values( array_intersect( $allowed, array_filter( array_map( 'trim', explode( ',', $srcRaw ) ) ) ) );
    $row = array(
        'notify_user'            => $uid,
        'notify_pushover_key'    => substr( $key, 0, 64 ),
        'notify_booking'         => $flag( 'notify_booking' ),
        'notify_booking_sources' => implode( ',', $src ),
        'notify_partner_signup'  => $flag( 'notify_partner_signup' ),
        'notify_contact'         => $flag( 'notify_contact' ),
        'notify_period'          => $flag( 'notify_period' ),
        'notify_booking_update'  => $flag( 'notify_booking_update' ),
        'notify_updated'         => date( 'Y-m-d H:i:s' ),
    );
    $ex = $db->rawQueryOne( 'SELECT notify_user FROM pacim_user_notify WHERE notify_user = ?', array( $uid ) );
    if ( $ex ) { $db->where( 'notify_user', $uid ); $db->update( 'pacim_user_notify', $row ); }
    else       { $db->insert( 'pacim_user_notify', $row ); }
    // Systemweiter App-Token: nur ändern, wenn ein Wert eingegeben wurde (sonst unverändert lassen).
    if ( isset( $_POST['pushover_app_token'] ) ) {
        $tok = trim( (string) $_POST['pushover_app_token'] );
        if ( $tok !== '' && class_exists( 'settings' ) ) settings::set( 'pushover_app_token', pacim_encrypt( $tok ) );
    }
}

if ( $action === 'list' ) {
    echo json_encode( array( 'success' => true, 'users' => $oUser->all() ) );
    exit();
}

if ( $action === 'delete' ) {
    $id = (int) field( 'id' );
    if ( $id <= 0 ) fail( 'Ungültige Benutzer-ID.' );
    $oUser->remove( $id );
    ok( $oUser, 'Benutzer gelöscht.' );
}

if ( $action === 'create' || $action === 'update' ) {
    $id        = (int) field( 'id' );
    $firstname = field( 'firstname' );
    $lastname  = field( 'lastname' );
    $email     = field( 'email' );
    $password  = isset( $_POST['password'] ) ? (string) $_POST['password'] : '';
    $level     = field( 'level' ) !== '' ? (int) field( 'level' ) : 1;

    if ( $firstname === '' || $lastname === '' ) fail( 'Vor- und Nachname sind erforderlich.' );
    if ( !filter_var( $email, FILTER_VALIDATE_EMAIL ) ) fail( 'Bitte eine gültige E-Mail-Adresse angeben.' );
    if ( $oUser->emailExists( $email, $action === 'update' ? $id : 0 ) ) fail( 'Diese E-Mail-Adresse ist bereits vergeben.' );

    $data = array( 'firstname' => $firstname, 'lastname' => $lastname, 'email' => $email, 'level' => $level, 'password' => $password );

    if ( $action === 'create' ) {
        if ( strlen( $password ) < 6 ) fail( 'Das Passwort muss mindestens 6 Zeichen lang sein.' );
        $newId = $oUser->create( $data );
        save_notify( $db, (int) $newId );
        save_superdelete( $db, (int) $newId );
        ok( $oUser, 'Benutzer angelegt.' );
    } else {
        if ( $id <= 0 ) fail( 'Ungültige Benutzer-ID.' );
        if ( $password !== '' && strlen( $password ) < 6 ) fail( 'Das Passwort muss mindestens 6 Zeichen lang sein.' );
        $oUser->modify( $id, $data );
        save_notify( $db, $id );
        save_superdelete( $db, $id );
        ok( $oUser, 'Benutzer aktualisiert.' );
    }
}

/* -------- Benachrichtigungseinstellungen eines Benutzers laden -------- */
if ( $action === 'notify-get' ) {
    $uid = (int) field( 'id' );
    $r = $uid > 0 ? $db->rawQueryOne( 'SELECT * FROM pacim_user_notify WHERE notify_user = ?', array( $uid ) ) : null;
    echo json_encode( array(
        'success'  => true,
        'settings' => $r ? array(
            'pushover_key'    => (string) $r['notify_pushover_key'],
            'booking'         => (int) $r['notify_booking'],
            'booking_sources' => array_values( array_filter( array_map( 'trim', explode( ',', (string) $r['notify_booking_sources'] ) ) ) ),
            'partner_signup'  => (int) $r['notify_partner_signup'],
            'contact'         => (int) $r['notify_contact'],
            'period'          => (int) $r['notify_period'],
            'booking_update'  => (int) $r['notify_booking_update'],
        ) : null,
        'app_token_set' => ( class_exists( 'pushnotify' ) && pushnotify::appToken() !== '' ),
    ) );
    exit();
}

/* -------- Test-Benachrichtigung senden -------- */
if ( $action === 'notify-test' ) {
    $key = trim( (string) ( $_POST['notify_pushover_key'] ?? '' ) );
    $tok = trim( (string) ( $_POST['pushover_app_token'] ?? '' ) );
    if ( $tok !== '' && class_exists( 'settings' ) ) settings::set( 'pushover_app_token', pacim_encrypt( $tok ) ); // eingegebenen Token sofort übernehmen
    if ( ! class_exists( 'pushnotify' ) || pushnotify::appToken() === '' ) fail( 'Bitte zuerst den systemweiten Pushover App-Token hinterlegen.' );
    if ( $key === '' ) fail( 'Bitte einen Pushover User-Key eingeben.' );
    $err = null;
    $sent = pushnotify::push( $key, 'PaCIM · Test', 'Test-Benachrichtigung – die Einrichtung funktioniert.', SITE_URL, 'PaCIM öffnen', $err );
    if ( $sent ) { echo json_encode( array( 'success' => true, 'message' => 'Test-Benachrichtigung gesendet.' ) ); exit(); }
    fail( $err ? $err : 'Senden fehlgeschlagen.' );
}

fail( 'Unbekannte Aktion.' );