<?php
/**
 * booking-broker.php – Buchung nachträglich mit einem Partner (Vermittler/Partnerprogramm) verknüpfen.
 * Admin-only. Setzt pacim_invoice.invoice_broker + Provisions-Snapshot (Park-/Zusatzsatz).
 *
 * Aktionen (action):
 *   search  GET q                       -> passende Partner [{broker_id,name,company,email,status,rate,addon_rate}]
 *   link    POST invoice_id, broker_id  -> verknüpfen (invoice_broker + Provisionssätze des Partners)
 *   unlink  POST invoice_id            -> Verknüpfung entfernen (invoice_broker=0, Provisionen NULL)
 */
require_once( __DIR__ . '/includes/config.inc.php' );
@ini_set( 'display_errors', '0' );
error_reporting( 0 );
ob_start();

function bb_json( $a ) { while ( ob_get_level() > 0 ) ob_end_clean(); header( 'Content-Type: application/json; charset=utf-8' ); echo json_encode( $a ); exit(); }
function bb_fail( $m ) { bb_json( array( 'ok' => false, 'error' => $m ) ); }

if ( ! function_exists( 'is_admin' ) || ! is_admin() ) { http_response_code( 403 ); bb_json( array( 'ok' => false, 'error' => 'forbidden' ) ); }

$action = $_POST['action'] ?? ( $_GET['action'] ?? '' );
$db     = new MysqliDb( MYSQL_HOST, MYSQL_USER, MYSQL_PASS, MYSQL_DB );
$LVL    = (int) BROKER_LEVEL;
$pct    = function ( $v ) { return ( $v === null || $v === '' ) ? '–' : rtrim( rtrim( number_format( (float) $v, 2, ',', '.' ), '0' ), ',' ) . ' %'; };

/* ---- Partner-Live-Suche (Name / Firma / E-Mail) ---- */
if ( $action === 'search' ) {
    $q = trim( (string) ( $_GET['q'] ?? ( $_POST['q'] ?? '' ) ) );
    if ( mb_strlen( $q ) < 2 ) bb_json( array( 'ok' => true, 'results' => array() ) );
    $like = '%' . mb_strtolower( $q, 'UTF-8' ) . '%';
    $rows = $db->rawQuery(
        "SELECT b.broker_id, b.broker_company, b.broker_active, b.broker_pending, u.user_firstname, u.user_lastname, u.user_email
           FROM pacim_broker b LEFT JOIN pacim_users u ON u.user_id = b.broker_id
          WHERE u.user_level = ?
            AND ( LOWER(b.broker_company) LIKE ? OR LOWER(u.user_firstname) LIKE ? OR LOWER(u.user_lastname) LIKE ? OR LOWER(u.user_email) LIKE ? )
          ORDER BY b.broker_active DESC, b.broker_id DESC LIMIT 20",
        array( $LVL, $like, $like, $like, $like ) );
    $out = array();
    foreach ( (array) $rows as $r ) {
        $nm = trim( $r['user_firstname'] . ' ' . $r['user_lastname'] ); if ( $nm === '' ) $nm = $r['broker_company'] ?: ( '#' . $r['broker_id'] );
        $st = ( (int) $r['broker_active'] === 1 ) ? 'aktiv' : ( (int) $r['broker_pending'] === 1 ? 'in Prüfung' : 'inaktiv' );
        $out[] = array(
            'broker_id' => (int) $r['broker_id'], 'name' => $nm, 'company' => (string) $r['broker_company'],
            'email' => (string) $r['user_email'], 'status' => $st,
            'rate' => $pct( function_exists( 'broker_commission_rate' ) ? broker_commission_rate( (int) $r['broker_id'] ) : null ),
            'addon_rate' => $pct( function_exists( 'broker_commission_addon_rate' ) ? broker_commission_addon_rate( (int) $r['broker_id'] ) : null ),
        );
    }
    bb_json( array( 'ok' => true, 'results' => $out ) );
}

/* ---- Verknüpfen ---- */
if ( $action === 'link' ) {
    if ( $_SERVER['REQUEST_METHOD'] !== 'POST' ) bb_fail( 'method' );
    $iid = (int) ( $_POST['invoice_id'] ?? 0 );
    $bid = (int) ( $_POST['broker_id'] ?? 0 );
    if ( $iid <= 0 ) bb_fail( 'Ungültige Rechnung.' );
    $inv = $db->rawQueryOne( "SELECT invoice_id, invoice_broker FROM pacim_invoice WHERE invoice_id = ?", array( $iid ) );
    if ( ! $inv ) bb_fail( 'Rechnung nicht gefunden.' );
    $brk = $db->rawQueryOne( "SELECT u.user_id, u.user_firstname, u.user_lastname, b.broker_company FROM pacim_users u JOIN pacim_broker b ON b.broker_id = u.user_id WHERE u.user_id = ? AND u.user_level = ?", array( $bid, $LVL ) );
    if ( ! $brk ) bb_fail( 'Partner nicht gefunden.' );

    $first = $db->rawQueryOne( "SELECT booking_id, booking_no FROM pacim_booking WHERE booking_invoice = ? ORDER BY booking_id ASC LIMIT 1", array( $iid ) );
    $logBefore = ( class_exists( 'apilog' ) && $first ) ? apilog::snapshot( $db, (int) $first['booking_id'] ) : null;

    // Provisions-Snapshot aus den aktuell gültigen Sätzen des Partners (wie bei der Neuanlage).
    $rate  = function_exists( 'broker_commission_rate' ) ? broker_commission_rate( $bid ) : null;
    $addon = function_exists( 'broker_commission_addon_rate' ) ? broker_commission_addon_rate( $bid ) : null;
    $db->where( 'invoice_id', $iid );
    $ok = $db->update( 'pacim_invoice', array(
        'invoice_broker' => $bid,
        'invoice_broker_commission' => $rate,
        'invoice_broker_commission_addon' => $addon,
    ) );
    if ( ! $ok ) bb_fail( 'Verknüpfung konnte nicht gespeichert werden.' );

    $nm = trim( $brk['user_firstname'] . ' ' . $brk['user_lastname'] ); if ( $nm === '' ) $nm = (string) $brk['broker_company'];
    if ( class_exists( 'apilog' ) && $first ) {
        apilog::record( array(
            'key_name' => trim( (string) ( $_SESSION['user_name'] ?? 'Administrator' ) ),
            'ip' => $_SERVER['REMOTE_ADDR'] ?? '', 'method' => 'POST',
            'resource' => 'booking', 'action' => 'broker_link', 'kind' => 'write',
            'booking' => (int) $first['booking_id'], 'invoice' => $iid,
            'target' => 'Partner verknüpft: ' . $nm . ' (' . $first['booking_no'] . ')',
            'changes' => apilog::diff( $logBefore, apilog::snapshot( $db, (int) $first['booking_id'] ) ),
        ) );
    }
    bb_json( array( 'ok' => true, 'broker_id' => $bid, 'name' => $nm, 'company' => (string) $brk['broker_company'] ) );
}

/* ---- Verknüpfung entfernen ---- */
if ( $action === 'unlink' ) {
    if ( $_SERVER['REQUEST_METHOD'] !== 'POST' ) bb_fail( 'method' );
    $iid = (int) ( $_POST['invoice_id'] ?? 0 );
    if ( $iid <= 0 ) bb_fail( 'Ungültige Rechnung.' );
    $inv = $db->rawQueryOne( "SELECT invoice_id FROM pacim_invoice WHERE invoice_id = ?", array( $iid ) );
    if ( ! $inv ) bb_fail( 'Rechnung nicht gefunden.' );
    $first = $db->rawQueryOne( "SELECT booking_id, booking_no FROM pacim_booking WHERE booking_invoice = ? ORDER BY booking_id ASC LIMIT 1", array( $iid ) );
    $logBefore = ( class_exists( 'apilog' ) && $first ) ? apilog::snapshot( $db, (int) $first['booking_id'] ) : null;
    $db->where( 'invoice_id', $iid );
    $db->update( 'pacim_invoice', array( 'invoice_broker' => 0, 'invoice_broker_commission' => null, 'invoice_broker_commission_addon' => null ) );
    if ( class_exists( 'apilog' ) && $first ) {
        apilog::record( array(
            'key_name' => trim( (string) ( $_SESSION['user_name'] ?? 'Administrator' ) ),
            'ip' => $_SERVER['REMOTE_ADDR'] ?? '', 'method' => 'POST',
            'resource' => 'booking', 'action' => 'broker_unlink', 'kind' => 'write',
            'booking' => (int) $first['booking_id'], 'invoice' => $iid,
            'target' => 'Partner-Verknüpfung entfernt (' . $first['booking_no'] . ')',
            'changes' => apilog::diff( $logBefore, apilog::snapshot( $db, (int) $first['booking_id'] ) ),
        ) );
    }
    bb_json( array( 'ok' => true ) );
}

bb_fail( 'Unbekannte Aktion.' );