<?php
// api/news_actions.php - Handle hide and delete news actions
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');

require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/logger.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(['status' => 'error', 'message' => 'Invalid request method']);
    exit;
}

$input = json_decode(file_get_contents('php://input'), true);
if (!$input) {
    $input = $_POST;
}

$action = $input['action'] ?? '';
$id = $input['id'] ?? '';

if (empty($action) || empty($id)) {
    echo json_encode(['status' => 'error', 'message' => 'Missing action or id']);
    exit;
}

try {
    $dbInfo = getDbConnection();
    $pdo = $dbInfo['pdo'];

    if ($action === 'delete_news') {
        // Fetch attachments first to delete them from Google Drive
        $stmt = $pdo->prepare("SELECT file_url FROM attachments WHERE news_id = ?");
        $stmt->execute([$id]);
        $attachments = $stmt->fetchAll(PDO::FETCH_ASSOC);

        if (!empty($attachments)) {
            // Get GAS URL
            $settingsStmt = $pdo->query("SELECT setting_value FROM system_settings WHERE setting_key = 'gdrive_gas_url'");
            $gasUrlRow = $settingsStmt->fetch();
            $gasUrl = $gasUrlRow ? $gasUrlRow['setting_value'] : '';

            if (!empty($gasUrl)) {
                foreach ($attachments as $att) {
                    if (!empty($att['file_url'])) {
                        preg_match('/\/d\/([a-zA-Z0-9_-]+)/', $att['file_url'], $matches);
                        if (!empty($matches[1])) {
                            $fileId = $matches[1];
                            $payload = json_encode(['action' => 'delete', 'fileId' => $fileId]);
                            
                            $ch = curl_init($gasUrl);
                            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                            curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
                            curl_setopt($ch, CURLOPT_POST, true);
                            curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
                            curl_setopt($ch, CURLOPT_TIMEOUT, 30);
                            curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
                            curl_exec($ch);
                            curl_close($ch);
                        }
                    }
                }
            }
        }

        // Delete from attachments table (cascading might handle this, but to be safe)
        $stmt = $pdo->prepare("DELETE FROM attachments WHERE news_id = ?");
        $stmt->execute([$id]);

        $stmt = $pdo->prepare("DELETE FROM news WHERE id = ?");
        $stmt->execute([$id]);

        $actionUserId = $input['action_user_id'] ?? 'SYSTEM';
        $actionUserName = $input['action_user_name'] ?? 'SYSTEM';
        logActivity($pdo, $actionUserId, $actionUserName, 'DELETE_NEWS', ['news_id' => $id]);

        echo json_encode(['status' => 'success', 'message' => 'ลบข้อมูลและไฟล์แนบที่เกี่ยวข้องเรียบร้อยแล้ว']);
    } 
    elseif ($action === 'toggle_hide_news') {
        // First get current status
        $stmt = $pdo->prepare("SELECT is_hidden FROM news WHERE id = ?");
        $stmt->execute([$id]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        
        if ($row) {
            $newStatus = $row['is_hidden'] ? 0 : 1;
            $update = $pdo->prepare("UPDATE news SET is_hidden = ? WHERE id = ?");
            $update->execute([$newStatus, $id]);

            $actionUserId = $input['action_user_id'] ?? 'SYSTEM';
            $actionUserName = $input['action_user_name'] ?? 'SYSTEM';
            logActivity($pdo, $actionUserId, $actionUserName, 'TOGGLE_HIDE_NEWS', ['news_id' => $id, 'is_hidden' => $newStatus]);

            echo json_encode(['status' => 'success', 'message' => 'อัปเดตสถานะเรียบร้อยแล้ว', 'is_hidden' => $newStatus]);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'ไม่พบข้อมูล']);
        }
    } 
    else {
        echo json_encode(['status' => 'error', 'message' => 'Invalid action']);
    }
} catch (\Exception $e) {
    echo json_encode(['status' => 'error', 'message' => 'Database Error: ' . $e->getMessage()]);
}
?>