<?php
/**
 * 商城统一 API 端点（AJAX/XHR）
 *
 * 所有请求通过 action 参数路由，返回 JSON。
 * 需登录的操作会校验 session。
 * 用法: api.php?action=xxx [&参数]
 */
require __DIR__ . '/includes/init.php';

header('Content-Type: application/json; charset=utf-8');
header('X-Content-Type-Options: nosniff');

// ─── 通用响应函数 ───
function json_ok($data = null, $msg = '') {
    echo json_encode(['ok' => true, 'msg' => $msg, 'data' => $data], JSON_UNESCAPED_UNICODE);
    exit;
}

function json_err($code = 400, $msg = '操作失败') {
    http_response_code($code);
    echo json_encode(['ok' => false, 'msg' => $msg], JSON_UNESCAPED_UNICODE);
    exit;
}

// ─── CSRF 校验（写操作必须带 token）─────────────────────────────
function requireCsrf() {
    $token = trim($_SERVER['HTTP_X_CSRF_TOKEN'] ?? $_POST['csrf_token'] ?? '');
    if (!$token || !verifyCsrfToken($token)) {
        json_err(403, 'CSRF 验证失败，请刷新页面重试');
    }
}

$action = trim($_GET['action'] ?? $_POST['action'] ?? '');

// ─── 路由表 ───
$ROUTES = [
    // 购物车（需登录）
    'cart_get'     => true,   // GET  - 获取购物车
    'cart_add'     => true,   // POST - 加入购物车
    'cart_update'  => true,   // POST - 修改数量
    'cart_remove'  => true,   // POST - 删除一项
    'cart_clear'   => true,   // POST - 清空购物车

    // 用户操作（需登录）
    'sign_in'      => true,   // POST - 每日签到
    'ticket_submit'=> true,   // POST - 提交工单

    // 公开读取
    'search'       => false,  // GET  - 搜索商品
    'products'     => false,  // GET  - 分类筛选商品
    'product_info' => false,  // GET  - 商品详情
    'announcements'=> false,  // GET  - 公告列表
];

if (!isset($ROUTES[$action])) {
    json_err(404, '未知操作: ' . h($action));
}

$needAuth = $ROUTES[$action];
if ($needAuth && empty($_SESSION['user_id'])) {
    json_err(401, '请先登录');
}

$user = null;
if ($needAuth) {
    $user = currentUser();
    if (!$user) { json_err(401, '登录已过期'); }
}

// ─── 写操作统一 CSRF ───
$WRITE_ACTIONS = ['cart_add', 'cart_update', 'cart_remove', 'cart_clear', 'sign_in', 'ticket_submit'];
if (in_array($action, $WRITE_ACTIONS)) {
    requireCsrf();
}

// ─── 分发处理 ───
switch ($action) {

/* ================================================================
 *  购物车
 * ================================================================ */

case 'cart_get':
    $items = [];
    $total = 0;
    if (!empty($_SESSION['cart']) && is_array($_SESSION['cart'])) {
        $ids = array_keys($_SESSION['cart']);
        if (!empty($ids)) {
            $inPlaceholders = str_repeat('?', count($ids));
            $stmt = db()->prepare(
                'SELECT id,name,image,icon,category,points_price,stock,status FROM ' . tn('products') .
                ' WHERE id IN (' . $inPlaceholders . ') AND status=1'
            );
            $stmt->execute($ids);
            while ($p = $stmt->fetch()) {
                $qty = (int)($_SESSION['cart'][$p['id']] ?? 0);
                if ($qty <= 0) continue;
                $price = !empty($p['points_price']) ? (int)$p['points_price'] : 0;
                $items[] = [
                    'id'        => (int)$p['id'],
                    'name'      => $p['name'],
                    'image'     => $p['image'] ?: '',
                    'icon'      => $p['icon'] ?: '',
                    'category'  => $p['category'],
                    'qty'       => $qty,
                    'points_price' => $price,
                    'stock'     => (int)$p['stock'],
                    'subtotal'  => $price * $qty,
                ];
                $total += $price * $qty;
            }
        }
    }
    json_ok(['items' => $items, 'count' => count($items), 'total_points' => $total]);

case 'cart_add':
    $pid  = (int)($_POST['product_id'] ?? 0);
    $qty  = max(1, min(99, (int)($_POST['qty'] ?? 1)));
    if ($pid <= 0) { json_err(400, '商品 ID 无效'); }
    $stmt = db()->prepare('SELECT id,status,stock FROM ' . tn('products') . ' WHERE id=?');
    $stmt->execute([$pid]);
    $p = $stmt->fetch();
    if (!$p || (int)$p['status'] !== 1) { json_err(400, '商品不存在或已下架'); }
    if (!isset($_SESSION['cart'])) { $_SESSION['cart'] = []; }
    $current = (int)($_SESSION['cart'][$pid] ?? 0);
    $newQty = $current + $qty;
    if ((int)$p['stock'] >= 0 && $newQty > (int)$p['stock']) {
        json_err(400, '库存不足（剩余 ' . (int)$p['stock'] . ' 件）');
    }
    $_SESSION['cart'][$pid] = $newQty;
    $count = array_sum(array_map('intval', $_SESSION['cart']));
    json_ok(['cart_count' => $count, 'item_qty' => $newQty], '已加入购物车');

case 'cart_update':
    $pid = (int)($_POST['product_id'] ?? 0);
    $qty = max(1, min(99, (int)($_POST['qty'] ?? 1)));
    if ($pid <= 0) { json_err(400, '商品 ID 无效'); }
    if (!isset($_SESSION['cart'][$pid])) { json_err(400, '购物车中没有该商品'); }
    $stmt = db()->prepare('SELECT stock FROM ' . tn('products') . ' WHERE id=? AND status=1');
    $stmt->execute([$pid]);
    $p = $stmt->fetch();
    if (!$p) { json_err(400, '商品不存在或已下架'); }
    if ((int)$p['stock'] >= 0 && $qty > (int)$p['stock']) {
        json_err(400, '库存不足');
    }
    $_SESSION['cart'][$pid] = $qty;
    $count = array_sum(array_map('intval', $_SESSION['cart']));
    json_ok(['cart_count' => $count], '数量已更新');

case 'cart_remove':
    $pid = (int)($_POST['product_id'] ?? 0);
    if ($pid <= 0) { json_err(400, '商品 ID 无效'); }
    unset($_SESSION['cart'][$pid]);
    $count = isset($_SESSION['cart']) ? array_sum(array_map('intval', $_SESSION['cart'])) : 0;
    json_ok(['cart_count' => $count], '已移除');

case 'cart_clear':
    $_SESSION['cart'] = [];
    json_ok([], '购物车已清空');

/* ================================================================
 *  每日签到
 * ================================================================ */

case 'sign_in':
    $enabled = getSetting('points_enabled', '1') === '1';
    if (!$enabled) { json_err(400, '积分系统未启用'); }
    $today = date('Y-m-d');
    $stmt = db()->prepare('SELECT id FROM ' . tn('sign_logs') . ' WHERE user_id=? AND sign_date=?');
    $stmt->execute([$user['id'], $today]);
    if ($stmt->fetch()) { json_err(400, '今天已经签到了'); }
    $points = max(0, (int)getSetting('points_sign', 5));
    db()->beginTransaction();
    try {
        db()->prepare('INSERT INTO ' . tn('sign_logs') . ' (user_id,sign_date,points) VALUES (?,?,?)')
           ->execute([$user['id'], $today, $points]);
        db()->prepare('UPDATE ' . tn('users') . ' SET points=points+? WHERE id=?')
           ->execute([$points, $user['id']]);
        db()->commit();
    } catch (Exception $e) {
        db()->rollBack();
        json_err(500, '签到失败: 数据库错误');
    }
    $newTotal = getUserPoints($user['id']);
    json_ok(['points_gained' => $points, 'points_total' => $newTotal], "签到成功！+{$points} 积分");

/* ================================================================
 *  提交工单
 * ================================================================ */

case 'ticket_submit':
    $deptId = (int)($_POST['dept_id'] ?? 0);
    $title  = trim($_POST['title'] ?? '');
    $body   = trim($_POST['body'] ?? '');
    $priority = in_array($_POST['priority'] ?? '', ['low','normal','high']) ? $_POST['priority'] : 'normal';
    if ($title === '' || strlen($title) < 3) { json_err(400, '标题至少 3 个字'); }
    if ($body === '' || strlen($body) < 5) { json_err(400, '描述至少 5 个字'); }

    // 验证部门是否存在
    if ($deptId > 0) {
        $ds = db()->prepare('SELECT id FROM ' . tn('departments') . ' WHERE id=?');
        $ds->execute([$deptId]);
        if (!$ds->fetch()) { $deptId = 0; }
    }

    $orderId = !empty($_POST['order_id']) ? (int)$_POST['order_id'] : null;

    db()->prepare(
        'INSERT INTO ' . tn('tickets') . ' (user_id,dept_id,title,body,priority,order_id,status,created_at) VALUES (?,?,?,?,?,?,\'open\',NOW())'
    )->execute([$user['id'], $deptId, $title, $body, $priority, $orderId]);

    $ticketId = (int)db()->lastInsertId();

    // 通知处理人员
    notifyAdmins('新工单 #' . $ticketId . ': ' . $title, "用户 {$user['username']} 提交了新工单，请及时处理。");

    json_ok(['ticket_id' => $ticketId], '工单提交成功！我们会尽快处理。');

/* ================================================================
 *  商品搜索 / 分类筛选（公开）
 * ================================================================ */

case 'search':
    $q = trim($_GET['q'] ?? '');
    if ($q === '') { json_err(400, '请输入搜索关键词'); }
    $where = ['status = 1', 'name LIKE ?'];
    $params = ['%' . $q . '%'];
    $sql = 'SELECT id,name,category,image,icon,points_price,stock,description FROM ' . tn('products') .
           ' WHERE ' . implode(' AND ', $where) . ' ORDER BY created_at DESC LIMIT 50';
    $stmt = db()->prepare($sql);
    $stmt->execute($params);
    $products = [];
    while ($r = $stmt->fetch()) {
        $products[] = [
            'id'           => (int)$r['id'],
            'name'         => $r['name'],
            'category'     => $r['category'],
            'image'        => $r['image'] ?: '',
            'icon'         => $r['icon'] ?: '',
            'points_price' => !empty($r['points_price']) ? (int)$r['points_price'] : null,
            'stock'        => (int)$r['stock'],
            'description'  => mb_substr($r['description'] ?? '', 0, 100),
        ];
    }
    json_ok(['products' => $products, 'query' => $q, 'count' => count($products)]);

case 'products':
    $cat = trim($_GET['cat'] ?? '');
    $where = ['status = 1'];
    $params = [];
    if ($cat !== '') {
        $where[] = 'category = ?';
        $params[] = $cat;
    }
    $sql = 'SELECT id,name,category,image,icon,points_price,stock FROM ' . tn('products') .
           ' WHERE ' . implode(' AND ', $where) . ' ORDER BY created_at DESC LIMIT 100';
    $stmt = db()->prepare($sql);
    $stmt->execute($params);
    $products = [];
    while ($r = $stmt->fetch()) {
        $products[] = [
            'id'           => (int)$r['id'],
            'name'         => $r['name'],
            'category'     => $r['category'],
            'image'        => $r['image'] ?: '',
            'icon'         => $r['icon'] ?: '',
            'points_price' => !empty($r['points_price']) ? (int)$r['points_price'] : null,
            'stock'        => (int)$r['stock'],
        ];
    }
    json_ok(['products' => $products, 'category' => $cat, 'count' => count($products)]);

case 'product_info':
    $pid = (int)($_GET['id'] ?? 0);
    if ($pid <= 0) { json_err(400, '商品 ID 无效'); }
    $stmt = db()->prepare(
        'SELECT id,name,category,image,icon,points_price,cash_price,stock,period,description,created_at FROM ' . tn('products') . ' WHERE id=? AND status=1'
    );
    $stmt->execute([$pid]);
    $p = $stmt->fetch();
    if (!$p) { json_err(404, '商品不存在'); }
    json_ok([
        'id'           => (int)$p['id'],
        'name'         => $p['name'],
        'category'     => $p['category'],
        'image'        => $p['image'] ?: '',
        'icon'         => $p['icon'] ?: '',
        'points_price' => !empty($p['points_price']) ? (int)$p['points_price'] : null,
        'cash_price'   => !empty($p['cash_price']) ? floatval($p['cash_price']) : null,
        'stock'        => (int)$p['stock'],
        'period'       => $p['period'] ?: '',
        'description'  => $p['description'] ?: '',
    ]);

case 'announcements':
    $limit = min(20, max(1, (int)($_GET['limit'] ?? 10)));
    $stmt = db()->query(
        'SELECT id,title,pinned,content,created_at FROM ' . tn('announcements') .
        ' WHERE status=1 ORDER BY pinned DESC, created_at DESC LIMIT ' . $limit
    );
    $list = [];
    while ($a = $stmt->fetch()) {
        $list[] = [
            'id'         => (int)$a['id'],
            'title'      => $a['title'],
            'pinned'     => (int)$a['pinned'],
            'excerpt'    => mb_substr(strip_tags($a['content'] ?? ''), 0, 120),
            'created_at' => $a['created_at'],
        ];
    }
    json_ok(['announcements' => $list]);

default:
    json_err(404, '未知操作: ' . h($action));
}