<?php
/**
 * Terminal-Konfig-API für Reel Royale (token-authentifiziert).
 * Genutzt von den Terminal-Einstellungen: verfügbare Spiele + Guthaben je Terminal.
 *   ?action=games|state   (GET)
 *   action=set            (POST: balance, games[])
 */
require_once __DIR__ . '/includes/bootstrap.php';
require_once __DIR__ . '/includes/terminal.php';
header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');

$hash = (string)($_REQUEST['h'] ?? '');
$view = (string)($_REQUEST['v'] ?? '');
$tok  = (string)($_REQUEST['t'] ?? '');
$action = (string)($_REQUEST['action'] ?? '');

if (!rr_term_verify($hash, $view, $tok)) {
    http_response_code(403);
    echo json_encode(['ok' => false, 'error' => 'forbidden']);
    exit;
}

if ($action === 'games') {
    echo json_encode(['ok' => true, 'games' => rr_term_games_all()], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    exit;
}

$row = rr_term_ensure($hash, $view);
$uid = (int)$row['slots_user_id'];

if ($action === 'state') {
    $bal = db()->prepare('SELECT balance FROM users WHERE id = ?');
    $bal->execute([$uid]);
    echo json_encode([
        'ok' => true,
        'balance' => (float)$bal->fetchColumn(),
        'selected' => rr_term_selected_games($row),
        'games' => rr_term_games_all(),
        'currency' => app_config()['app']['currency'] ?? 'Coins',
    ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    exit;
}

if ($action === 'set') {
    // Guthaben (optional)
    if (isset($_POST['balance']) && $_POST['balance'] !== '') {
        $b = round((float)str_replace(',', '.', (string)$_POST['balance']), 2);
        if ($b < 0) $b = 0;
        db()->prepare('UPDATE users SET balance = ? WHERE id = ?')->execute([$b, $uid]);
    }
    // Verfügbare Spiele (Auswahl; leer = alle)
    $valid = array_map(function ($g) { return $g['id']; }, rr_term_games_all());
    $sel = isset($_POST['games']) && is_array($_POST['games']) ? $_POST['games'] : [];
    $sel = array_values(array_intersect(array_map('strval', $sel), $valid));
    db()->prepare('UPDATE term_slots SET games_json = ?, updated_at = NOW() WHERE terminal_hash = ? AND view_token = ?')
        ->execute([json_encode($sel, JSON_UNESCAPED_UNICODE), $hash, $view]);
    echo json_encode(['ok' => true]);
    exit;
}

echo json_encode(['ok' => false, 'error' => 'unknown_action']);