<?php
// api/feedback.php
require_once dirname(__DIR__) . '/config/config.php';
require_once dirname(__DIR__) . '/config/database.php';

header('Content-Type: application/json');

// Need to be logged in
if (!isset($_SESSION['user_id'])) {
    echo json_encode(['status' => 'error', 'message' => 'Unauthorized']);
    exit;
}

$action = $_POST['action'] ?? '';

if ($action === 'rate_job') {
    // CSRF check
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF Token']);
        exit;
    }

    $job_id = $_POST['job_id'] ?? '';
    $rating = (int)($_POST['rating'] ?? 0);
    $feedback = trim($_POST['feedback'] ?? '');

    if (empty($job_id) || $rating < 1 || $rating > 5) {
        echo json_encode(['status' => 'error', 'message' => 'ข้อมูลไม่ครบถ้วน']);
        exit;
    }

    $conn = Database::getInstance();
    
    // Check if job exists and belongs to requester
    $checkQuery = "SELECT id, requester_id, status FROM jobs WHERE id = :job_id LIMIT 1";
    $checkStmt = $conn->prepare($checkQuery);
    $checkStmt->bindParam(':job_id', $job_id);
    $checkStmt->execute();
    
    if ($checkStmt->rowCount() === 0) {
        echo json_encode(['status' => 'error', 'message' => 'ไม่พบข้อมูลงาน']);
        exit;
    }
    
    $job = $checkStmt->fetch();
    
    // if ($job['requester_id'] != $_SESSION['user_id']) {
    //     echo json_encode(['status' => 'error', 'message' => 'ไม่มีสิทธิ์ประเมินงานนี้']);
    //     exit;
    // }
    
    if ($job['status'] !== 'completed') {
        echo json_encode(['status' => 'error', 'message' => 'สามารถประเมินได้เฉพาะงานที่เสร็จสิ้นแล้ว']);
        exit;
    }

    try {
        $query = "UPDATE jobs SET rating = :rating, feedback = :feedback WHERE id = :job_id";
        $stmt = $conn->prepare($query);
        $stmt->bindParam(':rating', $rating);
        $stmt->bindParam(':feedback', $feedback);
        $stmt->bindParam(':job_id', $job_id);
        $stmt->execute();

        echo json_encode(['status' => 'success']);
    } catch (Exception $e) {
        echo json_encode(['status' => 'error', 'message' => $e->getMessage()]);
    }
} else {
    echo json_encode(['status' => 'error', 'message' => 'Invalid action']);
}