<?php
// api_expire.php - AJAX handler to expire orders when countdown timer ends

require_once 'includes/helper.php';
require_once 'classes/Database.php';

start_secure_session();

// Verify user is logged in
if (!isset($_SESSION['user_id'])) {
    http_response_code(403);
    echo json_encode(['success' => false, 'message' => 'Forbidden']);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $orderId = (int)($_POST['order_id'] ?? 0);
    $token = $_POST['csrf_token'] ?? '';

    if (!validate_csrf_token($token)) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'Invalid CSRF token']);
        exit();
    }

    if ($orderId <= 0) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'Invalid Order ID']);
        exit();
    }

    try {
        $db = Database::getInstance()->getConnection();
        
        $db->beginTransaction();
        
        // Check order status before doing anything
        $stmt = $db->prepare("SELECT status, user_id FROM orders WHERE id = ? FOR UPDATE");
        $stmt->execute([$orderId]);
        $order = $stmt->fetch();
        
        if ($order && $order['user_id'] == $_SESSION['user_id'] && $order['status'] === 'pending') {
            // 1. Set state to expired
            $stmt = $db->prepare("UPDATE orders SET status = 'expired' WHERE id = ?");
            $stmt->execute([$orderId]);
            
            // 2. Return product inventory stock level
            $stmt = $db->prepare("SELECT product_id, quantity FROM order_items WHERE order_id = ?");
            $stmt->execute([$orderId]);
            $items = $stmt->fetchAll();
            
            foreach ($items as $item) {
                $stmt = $db->prepare("UPDATE products SET stock = stock + ? WHERE id = ?");
                $stmt->execute([$item['quantity'], $item['product_id']]);
            }
            
            $db->commit();
            echo json_encode(['success' => true, 'message' => 'Order successfully marked as expired']);
            exit();
        }
        
        $db->rollBack();
        echo json_encode(['success' => false, 'message' => 'Order already processed or access denied']);
        
    } catch (Exception $e) {
        $db->rollBack();
        http_response_code(500);
        echo json_encode(['success' => false, 'message' => $e->getMessage()]);
    }
} else {
    http_response_code(405);
    echo json_encode(['success' => false, 'message' => 'Method not allowed']);
}