<?php
/**
 * Orders API Endpoint
 * Handles fetching orders, tracking orders, and creating new orders in MySQL.
 */

require_once __DIR__ . '/db.php';

$method = $_SERVER['REQUEST_METHOD'];

switch ($method) {
    case 'GET':
        handleGet($pdo);
        break;
    case 'POST':
        handlePost($pdo);
        break;
    case 'PUT':
        handlePut($pdo);
        break;
    default:
        sendResponse(false, null, 'Method not allowed', 405);
}

function handleGet($pdo) {
    // 1. Get by specific Order ID or Tracking Code
    if (isset($_GET['id']) || isset($_GET['trackingCode'])) {
        $code = $_GET['id'] ?? $_GET['trackingCode'];
        $stmt = $pdo->prepare("SELECT * FROM orders WHERE id = :code OR tracking_code = :code LIMIT 1");
        $stmt->execute([':code' => $code]);
        $order = $stmt->fetch();

        if ($order) {
            $formatted = formatOrderRow($order);
            sendResponse(true, $formatted, 'พบข้อมูลคำสั่งซื้อ');
        } else {
            sendResponse(false, null, 'ไม่พบคำสั่งซื้อนี้', 404);
        }
    }

    // 2. Search / List orders by User Email
    $userEmail = $_GET['userEmail'] ?? null;
    $search = $_GET['q'] ?? null;

    $query = "SELECT * FROM orders WHERE 1=1";
    $params = [];

    if ($userEmail) {
        $query .= " AND LOWER(user_email) = LOWER(:email)";
        $params[':email'] = $userEmail;
    }

    if ($search) {
        $query .= " AND (id LIKE :q OR shipping_phone LIKE :q OR tracking_code LIKE :q)";
        $params[':q'] = '%' . $search . '%';
    }

    $query .= " ORDER BY created_at DESC LIMIT 100";

    $stmt = $pdo->prepare($query);
    $stmt->execute($params);
    $rows = $stmt->fetchAll();

    $orders = array_map('formatOrderRow', $rows);
    sendResponse(true, $orders, 'ดึงรายการคำสั่งซื้อสำเร็จ');
}

function handlePost($pdo) {
    $body = getJsonInput();

    if (empty($body['items']) || !isset($body['totalAmount']) || empty($body['shippingAddress'])) {
        sendResponse(false, null, 'กรุณาส่งข้อมูลคำสั่งซื้อให้ครบถ้วน', 400);
    }

    $orderId = !empty($body['id']) ? $body['id'] : ('ORD-' . rand(100000, 999999));
    $trackingCode = !empty($body['trackingCode']) ? $body['trackingCode'] : ('CTC-' . rand(100000000, 999999000));
    $userEmail = $body['userEmail'] ?? null;
    $totalAmount = (float)$body['totalAmount'];
    $status = $body['status'] ?? 'pending';
    $paymentMethod = $body['paymentMethod'] ?? 'bank_transfer';
    $itemsJson = json_encode($body['items'], JSON_UNESCAPED_UNICODE);

    $addr = $body['shippingAddress'];
    $recipientName = $addr['recipientName'] ?? '';
    $phone = $addr['phone'] ?? '';
    $addressLine = $addr['addressLine'] ?? '';
    $subdistrict = $addr['subdistrict'] ?? '';
    $district = $addr['district'] ?? '';
    $province = $addr['province'] ?? '';
    $postalCode = $addr['postalCode'] ?? '';

    try {
        $sql = "INSERT INTO orders (
            id, user_email, total_amount, status, payment_method, tracking_code, items_json,
            shipping_recipient_name, shipping_phone, shipping_address_line,
            shipping_subdistrict, shipping_district, shipping_province, shipping_postal_code,
            created_at
        ) VALUES (
            :id, :user_email, :total_amount, :status, :payment_method, :tracking_code, :items_json,
            :recipient_name, :phone, :address_line,
            :subdistrict, :district, :province, :postal_code,
            NOW()
        )";

        $stmt = $pdo->prepare($sql);
        $stmt->execute([
            ':id'             => $orderId,
            ':user_email'     => $userEmail,
            ':total_amount'   => $totalAmount,
            ':status'         => $status,
            ':payment_method' => $paymentMethod,
            ':tracking_code'  => $trackingCode,
            ':items_json'     => $itemsJson,
            ':recipient_name' => $recipientName,
            ':phone'          => $phone,
            ':address_line'   => $addressLine,
            ':subdistrict'    => $subdistrict,
            ':district'       => $district,
            ':province'       => $province,
            ':postal_code'    => $postalCode
        ]);

        $createdOrder = [
            'id'              => $orderId,
            'items'           => $body['items'],
            'totalAmount'     => $totalAmount,
            'status'          => $status,
            'shippingAddress' => $addr,
            'paymentMethod'   => $paymentMethod,
            'trackingCode'    => $trackingCode,
            'createdAt'       => date('c'),
            'userEmail'       => $userEmail
        ];

        sendResponse(true, $createdOrder, 'บันทึกคำสั่งซื้อสำเร็จ', 201);
    } catch (Exception $e) {
        sendResponse(false, null, 'ไม่สามารถบันทึกคำสั่งซื้อ: ' . $e->getMessage(), 500);
    }
}

function handlePut($pdo) {
    $body = getJsonInput();
    $orderId = $body['id'] ?? null;
    $status = $body['status'] ?? null;

    if (!$orderId || !$status) {
        sendResponse(false, null, 'ข้อมูลไม่ครบถ้วน', 400);
    }

    $stmt = $pdo->prepare("UPDATE orders SET status = :status WHERE id = :id");
    $stmt->execute([':status' => $status, ':id' => $orderId]);

    sendResponse(true, ['id' => $orderId, 'status' => $status], 'อัปเดตสถานะสำเร็จ');
}

function formatOrderRow($row) {
    return [
        'id'              => $row['id'],
        'items'           => json_decode($row['items_json'] ?? '[]', true),
        'totalAmount'     => (float)$row['total_amount'],
        'status'          => $row['status'],
        'paymentMethod'   => $row['payment_method'],
        'trackingCode'    => $row['tracking_code'],
        'createdAt'       => $row['created_at'],
        'userEmail'       => $row['user_email'],
        'shippingAddress' => [
            'recipientName' => $row['shipping_recipient_name'],
            'phone'         => $row['shipping_phone'],
            'addressLine'   => $row['shipping_address_line'],
            'subdistrict'   => $row['shipping_subdistrict'],
            'district'      => $row['shipping_district'],
            'province'      => $row['shipping_province'],
            'postalCode'    => $row['shipping_postal_code']
        ]
    ];
}