<?php
/**
 * API – Wettabgabe & Nutzer-Wettenliste
 *  POST  {action:"place", option_id, stake, csrf}
 *  POST  {action:"list", csrf}      -> aktuelle Wetten des Nutzers (JSON)
 *
 *  Sicherheit: Login-Pflicht, CSRF, serverseitige Quoten/Logik (BettingService).
 */
require_once __DIR__ . '/../includes/bootstrap.php';
header('Content-Type: application/json; charset=utf-8');

function out($data, int $code = 200): void
{
    http_response_code($code);
    echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    exit;
}

$user = current_user();
if (!$user) {
    out(['ok' => false, 'message' => 'Nicht eingeloggt.'], 401);
}
if ((int)($user['banned'] ?? 0) === 1) {
    out(['ok' => false, 'message' => 'Konto gesperrt.'], 403);
}

$payload = json_decode(file_get_contents('php://input'), true) ?: $_POST;
if (!csrf_verify($payload['csrf'] ?? ($_SERVER['HTTP_X_CSRF'] ?? null))) {
    out(['ok' => false, 'message' => 'Sicherheitstoken ungültig. Bitte Seite neu laden.'], 403);
}

update_playtime_ping((int)$user['id']);
$action = $payload['action'] ?? 'place';
$svc    = betting();

try {
    if ($action === 'place') {
        $optionId = (int)($payload['option_id'] ?? 0);
        $stake    = round((float)($payload['stake'] ?? 0), 2);
        if ($optionId <= 0) {
            out(['ok' => false, 'message' => 'Keine Wettoption gewählt.'], 400);
        }
        $r = $svc->placeBet((int)$user['id'], $optionId, $stake);
        out(['ok' => true, 'message' => 'Wette platziert.', 'bet' => $r, 'balance' => $r['balance']]);
    }

    if ($action === 'list') {
        $bets = $svc->userBets((int)$user['id']);
        $fresh = current_user();
        out(['ok' => true, 'bets' => $bets, 'stats' => $svc->userBetStats((int)$user['id']),
             'balance' => (float)$fresh['balance']]);
    }

    out(['ok' => false, 'message' => 'Unbekannte Aktion.'], 400);
} catch (BettingException $e) {
    out(['ok' => false, 'message' => $e->getMessage()], 400);
} catch (Throwable $e) {
    out(['ok' => false, 'message' => 'Interner Fehler bei der Wettabgabe.'], 500);
}