<?php
// NEXUS Commerce - Seller Orders API Endpoint
require_once __DIR__ . '/db.php';

header('Content-Type: application/json; charset=utf-8');

$action = $_GET['action'] ?? ($_POST['action'] ?? 'list');

try {
    // Ensure orders table has sample data if empty
    $count = $pdo->query("SELECT COUNT(*) FROM orders")->fetchColumn();
    if ($count == 0) {
        $pdo->exec("INSERT INTO orders (order_sn, user_id, total_amount, discount_amount, final_amount, status, tracking_number, shipping_address) VALUES 
            ('NEX-2026-001', 1, 2490.00, 200.00, 2290.00, 'preparing', 'TH902847291', 'Alex Vance, 123 Sukhumvit Rd, Wattana, Bangkok 10110'),
            ('NEX-2026-002', 1, 1890.00, 0.00, 1890.00, 'packed', 'TH902847292', 'Somsak P., 45 Silom Rd, Bangrak, Bangkok 10500'),
            ('NEX-2026-003', 1, 1290.00, 100.00, 1190.00, 'shipped', 'TH902847293', 'Narin K., 88 Nimman Rd, Mueang, Chiang Mai 50200'),
            ('NEX-2026-004', 1, 890.00, 0.00, 890.00, 'delivered', 'TH902847294', 'Ploy T., 12 Beach Rd, Pattaya, Chonburi 20150')
        ");
        
        $orderIds = $pdo->query("SELECT id FROM orders")->fetchAll(PDO::FETCH_COLUMN);
        $stmtItem = $pdo->prepare("INSERT INTO order_items (order_id, product_id, quantity, unit_price) VALUES (?, ?, ?, ?)");
        if (isset($orderIds[0])) $stmtItem->execute([$orderIds[0], 1, 1, 2490.00]);
        if (isset($orderIds[1])) $stmtItem->execute([$orderIds[1], 2, 1, 1890.00]);
        if (isset($orderIds[2])) $stmtItem->execute([$orderIds[2], 3, 1, 1290.00]);
        if (isset($orderIds[3])) $stmtItem->execute([$orderIds[3], 5, 1, 890.00]);
    }

    if ($action === 'list') {
        $status = $_GET['status'] ?? 'all';
        $sql = "SELECT o.*, u.name as customer_name, u.email as customer_email FROM orders o JOIN users u ON o.user_id = u.id";
        $params = [];
        if ($status !== 'all') {
            $sql .= " WHERE o.status = ?";
            $params[] = $status;
        }
        $sql .= " ORDER BY o.id DESC";

        $stmt = $pdo->prepare($sql);
        $stmt->execute($params);
        $orders = $stmt->fetchAll();

        foreach ($orders as &$ord) {
            $stmtItems = $pdo->prepare("SELECT oi.*, p.title, p.image_url, p.sku FROM order_items oi JOIN products p ON oi.product_id = p.id WHERE oi.order_id = ?");
            $stmtItems->execute([$ord['id']]);
            $ord['items'] = $stmtItems->fetchAll();
        }

        echo json_encode(['status' => 'success', 'data' => $orders]);
        exit;
    }

    if ($action === 'update_status') {
        $order_id = $_POST['order_id'] ?? null;
        $new_status = $_POST['new_status'] ?? 'shipped';
        $tracking_number = $_POST['tracking_number'] ?? ('TH' . rand(100000000, 999999999));

        if ($order_id) {
            $stmt = $pdo->prepare("UPDATE orders SET status = ?, tracking_number = ? WHERE id = ?");
            $stmt->execute([$new_status, $tracking_number, $order_id]);
            echo json_encode(['status' => 'success', 'message' => "Order #$order_id updated to $new_status", 'tracking_number' => $tracking_number]);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'Missing order ID']);
        }
        exit;
    }

} catch (Exception $e) {
    echo json_encode(['status' => 'error', 'message' => $e->getMessage()]);
}