<?php
// /api/seller/orders.php — GET list | PUT update status
require_once __DIR__ . '/../init.php';

$user = AuthMiddleware::verifyToken();
AuthMiddleware::requireRole(['seller', 'admin']);

$sellerId = (int)$user['id'];
$db       = DB::conn();
$method   = $_SERVER['REQUEST_METHOD'];

// ─── GET — list orders ────────────────────────────────────────
if ($method === 'GET') {
    $status = $_GET['status'] ?? '';
    $page   = max(1, (int)($_GET['page'] ?? 1));
    $limit  = 20;
    $offset = ($page - 1) * $limit;

    $where  = 'o.seller_id = ?';
    $params = [$sellerId];
    if ($status) { $where .= ' AND o.status = ?'; $params[] = $status; }

    $stmt = $db->prepare("
        SELECT o.id, o.total_amount, o.status, o.address, o.note, o.created_at,
               u.username as buyer_name, u.email as buyer_email,
               (SELECT COUNT(*) FROM order_items oi WHERE oi.order_id = o.id) as item_count
        FROM orders o
        JOIN users u ON u.id = o.buyer_id
        WHERE $where
        ORDER BY o.created_at DESC
        LIMIT $limit OFFSET $offset
    ");
    $stmt->execute($params);
    $orders = $stmt->fetchAll();

    // Count total
    $stmtCount = $db->prepare("SELECT COUNT(*) as cnt FROM orders o WHERE $where");
    $stmtCount->execute($params);
    $total = (int)$stmtCount->fetch()['cnt'];

    foreach ($orders as &$o) {
        $o['id']           = (int)$o['id'];
        $o['total_amount'] = (float)$o['total_amount'];
        $o['item_count']   = (int)$o['item_count'];

        // Fetch items for each order
        $stmtItems = $db->prepare(
            'SELECT oi.qty, oi.unit_price, p.name, p.image_url
             FROM order_items oi JOIN products p ON p.id = oi.product_id
             WHERE oi.order_id = ?'
        );
        $stmtItems->execute([$o['id']]);
        $o['items'] = $stmtItems->fetchAll();
    }

    Response::success('Orders fetched.', [
        'orders' => $orders,
        'total'  => $total,
        'page'   => $page,
        'pages'  => ceil($total / $limit),
    ]);
}

// ─── PUT — update order status ────────────────────────────────
if ($method === 'PUT') {
    $body    = getBody();
    $orderId = (int)($body['id'] ?? 0);
    $status  = $body['status'] ?? '';

    $allowed = ['confirmed', 'shipping', 'delivered', 'cancelled'];
    if (!$orderId || !in_array($status, $allowed)) {
        Response::error('Invalid order ID or status.');
    }

    $stmt = $db->prepare('SELECT id FROM orders WHERE id = ? AND seller_id = ?');
    $stmt->execute([$orderId, $sellerId]);
    if (!$stmt->fetch()) Response::error('ไม่พบคำสั่งซื้อหรือคุณไม่มีสิทธิ์', 403);

    $db->prepare('UPDATE orders SET status = ? WHERE id = ?')->execute([$status, $orderId]);
    Response::success('อัปเดตสถานะสำเร็จ', ['status' => $status]);
}

Response::error('Method not allowed.', 405);