<?php
require_once __DIR__ . '/../../config/config.php';
require_once __DIR__ . '/../../includes/auth.php';

requireAdmin();
$db = getDBConnection();

// Update order status or payment slip approval
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    verifyCSRFToken($_POST['csrf_token'] ?? '');
    $order_id = (int)($_POST['order_id'] ?? 0);
    $order_status = sanitize($_POST['order_status'] ?? 'pending');
    $payment_status = sanitize($_POST['payment_status'] ?? 'pending');
    $tracking_number = sanitize($_POST['tracking_number'] ?? '');

    $stmt = $db->prepare("UPDATE orders SET order_status = ?, payment_status = ?, tracking_number = ? WHERE id = ?");
    $stmt->execute([$order_status, $payment_status, $tracking_number, $order_id]);
    $_SESSION['flash_success'] = 'อัปเดตสถานะคำสั่งซื้อเรียบร้อยแล้ว';
    header('Location: orders.php');
    exit;
}

$orders = $db->query("SELECT o.*, u.fullname, u.email FROM orders o JOIN users u ON o.user_id = u.id ORDER BY o.id DESC")->fetchAll();

require_once __DIR__ . '/../../includes/admin_header.php';
?>

<h3 class="fw-bold mb-4">📦 จัดการคำสั่งซื้อ & ตรวจสอบสลิป</h3>

<div class="card card-custom p-4">
  <div class="table-responsive">
    <table class="table table-hover align-middle">
      <thead>
        <tr>
          <th>เลขที่ออเดอร์</th>
          <th>ลูกค้า</th>
          <th>ยอดเงิน</th>
          <th>วิธีชำระ</th>
          <th>สลิปโอน</th>
          <th>สถานะชำระ</th>
          <th>สถานะออเดอร์</th>
          <th>เลขพัสดุ</th>
          <th>จัดการ</th>
        </tr>
      </thead>
      <tbody>
        <?php foreach ($orders as $o): ?>
          <tr>
            <td class="fw-bold text-primary">#<?php echo sanitize($o['order_no']); ?></td>
            <td>
              <div><strong><?php echo sanitize($o['fullname']); ?></strong></div>
              <small class="text-muted"><?php echo sanitize($o['email']); ?></small>
            </td>
            <td class="fw-bold">฿<?php echo number_format($o['total_amount'], 2); ?></td>
            <td><span class="badge bg-secondary"><?php echo strtoupper($o['payment_method']); ?></span></td>
            <td>
              <?php if ($o['payment_slip']): ?>
                <a href="<?php echo UPLOAD_URL . sanitize($o['payment_slip']); ?>" target="_blank" class="btn btn-sm btn-outline-info">🔍 ดูสลิป</a>
              <?php else: ?>
                <span class="text-muted small">ไม่มีสลิป</span>
              <?php endif; ?>
            </td>
            <td>
              <span class="badge <?php echo $o['payment_status'] === 'paid' ? 'bg-success' : 'bg-warning text-dark'; ?>">
                <?php echo $o['payment_status']; ?>
              </span>
            </td>
            <td>
              <span class="badge bg-primary"><?php echo strtoupper($o['order_status']); ?></span>
            </td>
            <td><small class="fw-bold"><?php echo sanitize($o['tracking_number'] ?: '-'); ?></small></td>
            <td>
              <button class="btn btn-sm btn-primary-custom" onclick='openOrderModal(<?php echo json_encode($o); ?>)'>⚙️ อัปเดต</button>
            </td>
          </tr>
        <?php endforeach; ?>
      </tbody>
    </table>
  </div>
</div>

<!-- Modal Update Status -->
<div class="modal fade" id="orderModal" tabindex="-1">
  <div class="modal-dialog">
    <div class="modal-content">
      <form method="POST" action="">
        <div class="modal-header">
          <h5 class="modal-title fw-bold" id="orderModalTitle">อัปเดตคำสั่งซื้อ</h5>
          <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
        </div>
        <div class="modal-body">
          <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
          <input type="hidden" name="order_id" id="mod_order_id">

          <div class="mb-3">
            <label class="form-label">สถานะการชำระเงิน *</label>
            <select name="payment_status" id="mod_payment_status" class="form-select">
              <option value="pending">รอการตรวจสอบ (Pending)</option>
              <option value="paid">ชำระเงินเรียบร้อยแล้ว (Paid)</option>
              <option value="failed">ชำระเงินไม่สำเร็จ (Failed)</option>
            </select>
          </div>

          <div class="mb-3">
            <label class="form-label">สถานะออเดอร์ *</label>
            <select name="order_status" id="mod_order_status" class="form-select">
              <option value="pending">รอตรวจสอบ (Pending)</option>
              <option value="processing">กำลังจัดเตรียมสินค้า (Processing)</option>
              <option value="shipped">กำลังจัดส่งสินค้า (Shipped)</option>
              <option value="completed">สำเร็จ (Completed)</option>
              <option value="cancelled">ยกเลิกออเดอร์ (Cancelled)</option>
            </select>
          </div>

          <div class="mb-3">
            <label class="form-label">เลขพัสดุ (Tracking Number)</label>
            <input type="text" name="tracking_number" id="mod_tracking_number" class="form-control" placeholder="เช่น TH123456789">
          </div>
        </div>
        <div class="modal-footer">
          <button type="button" class="btn btn-secondary rounded-pill" data-bs-dismiss="modal">ยกเลิก</button>
          <button type="submit" class="btn btn-primary-custom rounded-pill">บันทึกสถานะ ✅</button>
        </div>
      </form>
    </div>
  </div>
</div>

<script>
function openOrderModal(o) {
    document.getElementById('orderModalTitle').innerText = 'อัปเดตคำสั่งซื้อ #' + o.order_no;
    document.getElementById('mod_order_id').value = o.id;
    document.getElementById('mod_payment_status').value = o.payment_status;
    document.getElementById('mod_order_status').value = o.order_status;
    document.getElementById('mod_tracking_number').value = o.tracking_number || '';
    new bootstrap.Modal(document.getElementById('orderModal')).show();
}
</script>

<?php require_once __DIR__ . '/../../includes/admin_footer.php'; ?>
