<?php
// config/db.php
header("Content-Type: application/json; charset=UTF-8");
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With");

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

$db_host = 'localhost';
$db_name = 'skymall_db';
$db_user = 'root';
$db_pass = '';

try {
    $pdo = new PDO("mysql:host={$db_host};dbname={$db_name};charset=utf8mb4", $db_user, $db_pass, [
        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES   => false
    ]);
} catch (PDOException $e) {
    http_response_code(500);
    echo json_encode([
        'success' => false,
        'message' => 'Database connection failed: ' . $e->getMessage()
    ], JSON_UNESCAPED_UNICODE);
    exit;
}

function sendResponse($success, $data_or_msg, $statusCode = 200) {
    http_response_code($statusCode);
    if (is_string($data_or_msg)) {
        echo json_encode(['success' => $success, 'message' => $data_or_msg], JSON_UNESCAPED_UNICODE);
    } else {
        echo json_encode(array_merge(['success' => $success], $data_or_msg), JSON_UNESCAPED_UNICODE);
    }
    exit;
}

function getJsonInput() {
    $contentType = $_SERVER["CONTENT_TYPE"] ?? '';
    if (stripos($contentType, 'application/json') !== false) {
        $raw = file_get_contents('php://input');
        return json_decode($raw, true) ?? [];
    }
    return $_POST;
}

function requireAuth($allowedRoles = []) {
    if (!isset($_SESSION['user']) || empty($_SESSION['user']['id'])) {
        sendResponse(false, 'Unauthorized: กรุณาเข้าสู่ระบบก่อนทำรายการ', 401);
    }
    $user = $_SESSION['user'];
    if (!empty($allowedRoles) && !in_array($user['role'], $allowedRoles)) {
        sendResponse(false, 'Forbidden: คุณไม่มีสิทธิ์เข้าถึงส่วนนี้', 403);
    }
    return $user;
}