<?php
require_once '../includes/auth.php';
require_once '../includes/db.php';
require_once '../includes/api_helper.php';
require_once '../includes/logger.php';

// Check if user is admin
if (!isAdmin()) {
    sendJson(403, ['error' => 'Permission denied. Admins only.']);
}

$method = $_SERVER['REQUEST_METHOD'];

// Function to send JSON response
function sendJson($statusCode, $data) {
    http_response_code($statusCode);
    header('Content-Type: application/json');
    echo json_encode($data);
    exit();
}

// Function to validate password strength
function validatePassword($password) {
    if (strlen($password) < 6) return false;
    return true;
}

switch ($method) {
    case 'GET':
        // Read (List)
        try {
            $stmt = $pdo->query("SELECT id, username, id_card, full_name, role, created_at FROM users ORDER BY created_at DESC");
            $users = $stmt->fetchAll();
            sendJson(200, ['users' => $users]);
        } catch (PDOException $e) {
            sendJson(500, ['error' => 'Database error: ' . $e->getMessage()]);
        }
        break;

    case 'POST':
        // Create
        $data = json_decode(file_get_contents('php://input'), true);
        
        $id_card = trim($data['id_card'] ?? '');
        $full_name = trim($data['full_name'] ?? '');
        $role = trim($data['role'] ?? 'user');
        $password = $data['password'] ?? '';
        
        if (empty($id_card) || empty($full_name) || empty($password)) {
            sendJson(400, ['error' => 'Missing required fields']);
        }
        
        if (strlen($id_card) !== 13) {
            sendJson(400, ['error' => 'ID card must be 13 digits']);
        }

        if (!validatePassword($password)) {
            sendJson(400, ['error' => 'รหัสผ่านต้องมีความยาวไม่น้อยกว่า 6 ตัวอักษร']);
        }
        
        try {
            // Check if id_card already exists
            $stmt = $pdo->prepare("SELECT id FROM users WHERE id_card = ?");
            $stmt->execute([$id_card]);
            if ($stmt->fetch()) {
                sendJson(400, ['error' => 'ID card already exists']);
            }
            
            $hashedPassword = password_hash($password, PASSWORD_DEFAULT);
            $username = $id_card; // Use id_card as username fallback if username is NOT NULL
            
            $stmt = $pdo->prepare("INSERT INTO users (username, id_card, password, full_name, role) VALUES (?, ?, ?, ?, ?)");
            $stmt->execute([$username, $id_card, $hashedPassword, $full_name, $role]);
            
            $newUserId = $pdo->lastInsertId();
            logActivity("Create User ({$id_card})", 'users', $newUserId);
            
            sendJson(201, ['message' => 'User created successfully', 'id' => $newUserId]);
        } catch (PDOException $e) {
            sendJson(500, ['error' => 'Database error: ' . $e->getMessage()]);
        }
        break;

    case 'PUT':
        // Update
        $data = json_decode(file_get_contents('php://input'), true);
        $id = $data['id'] ?? null;
        
        if (!$id) {
            sendJson(400, ['error' => 'User ID is required']);
        }
        
        $id_card = trim($data['id_card'] ?? '');
        $full_name = trim($data['full_name'] ?? '');
        $role = trim($data['role'] ?? 'user');
        $password = $data['password'] ?? '';
        
        if (empty($id_card) || empty($full_name)) {
            sendJson(400, ['error' => 'Missing required fields']);
        }
        
        if (strlen($id_card) !== 13) {
            sendJson(400, ['error' => 'ID card must be 13 digits']);
        }
        
        try {
            // Check if id_card is taken by someone else
            $stmt = $pdo->prepare("SELECT id FROM users WHERE id_card = ? AND id != ?");
            $stmt->execute([$id_card, $id]);
            if ($stmt->fetch()) {
                sendJson(400, ['error' => 'ID card is already in use by another user']);
            }
            
            if (!empty($password)) {
                if (!validatePassword($password)) {
                    sendJson(400, ['error' => 'รหัสผ่านต้องมีความยาวไม่น้อยกว่า 6 ตัวอักษร']);
                }
                $hashedPassword = password_hash($password, PASSWORD_DEFAULT);
                $stmt = $pdo->prepare("UPDATE users SET id_card = ?, full_name = ?, role = ?, password = ? WHERE id = ?");
                $stmt->execute([$id_card, $full_name, $role, $hashedPassword, $id]);
            } else {
                $stmt = $pdo->prepare("UPDATE users SET id_card = ?, full_name = ?, role = ? WHERE id = ?");
                $stmt->execute([$id_card, $full_name, $role, $id]);
            }
            
            logActivity("Update User ({$id_card})", 'users', $id);
            
            sendJson(200, ['message' => 'User updated successfully']);
        } catch (PDOException $e) {
            sendJson(500, ['error' => 'Database error: ' . $e->getMessage()]);
        }
        break;

    case 'DELETE':
        // Delete
        $id = $_GET['id'] ?? null;
        
        if (!$id) {
            sendJson(400, ['error' => 'User ID is required']);
        }
        
        // Prevent deleting oneself
        if ($id == $_SESSION['user_id']) {
            sendJson(400, ['error' => 'Cannot delete your own account']);
        }
        
        try {
            // ดึงชื่อก่อนลบ
            $stmtName = $pdo->prepare("SELECT id_card FROM users WHERE id = ?");
            $stmtName->execute([$id]);
            $delUser = $stmtName->fetch();
            $delIdCard = $delUser ? $delUser['id_card'] : $id;
            
            $stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
            $stmt->execute([$id]);
            
            logActivity("Delete User ({$delIdCard})", 'users', $id);
            
            sendJson(200, ['message' => 'User deleted successfully']);
        } catch (PDOException $e) {
            sendJson(500, ['error' => 'Database error: ' . $e->getMessage()]);
        }
        break;

    default:
        sendJson(405, ['error' => 'Method Not Allowed']);
}