<?php
// api/settings.php
require_once dirname(__DIR__) . '/config/config.php';
require_once dirname(__DIR__) . '/models/Setting.php';

header('Content-Type: application/json');

// Only allow Admin or Manager
if (!isset($_SESSION['user_id']) || !in_array($_SESSION['role'], ['admin', 'manager'])) {
    echo json_encode(['status' => 'error', 'message' => 'Unauthorized']);
    exit;
}

$action = $_REQUEST['action'] ?? '';

if ($action === 'save') {
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        echo json_encode(['status' => 'error', 'message' => 'Invalid method']);
        exit;
    }

    // CSRF Check
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF Token']);
        exit;
    }

    $settingsData = $_POST['settings'] ?? [];

    if (!empty($settingsData) && is_array($settingsData)) {
        $settingModel = new Setting();
        if ($settingModel->updateBulk($settingsData)) {
            echo json_encode(['status' => 'success', 'message' => 'บันทึกการตั้งค่าเรียบร้อย']);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถบันทึกข้อมูลลงฐานข้อมูลได้']);
        }
    } else {
        echo json_encode(['status' => 'error', 'message' => 'ไม่มีข้อมูลให้บันทึก']);
    }
} else {
    echo json_encode(['status' => 'error', 'message' => 'Unknown action']);
}