<?php
declare(strict_types=1);
require_once __DIR__ . '/common.php';
require_once __DIR__ . '/../../../includes/imap_spam.php';

api_require_method('POST');
$staff = api_require_staff();
$body = api_request_body();
$number = trim((string)($body['number'] ?? ''));
$action = ($body['action'] ?? '') === 'restore' ? 'restore' : 'mark';
if ($number === '') api_error(422, 'TICKET_NUMBER_REQUIRED', 'Eine Ticketnummer ist erforderlich.');
$pdo = get_db();
$ticket = api_find_ticket($pdo, $staff, $number);
api_require_permission($staff, 'close_ticket', (int) $ticket['department_id']);
if ($ticket['source'] !== 'email') api_error(422, 'EMAIL_TICKET_REQUIRED', 'Nur E-Mail-Tickets können als Spam geändert werden.');
$result = set_ticket_spam($pdo, $ticket, (int)$staff['id'], $action === 'restore');
if ($result['error']) api_error(422, 'SPAM_MOVE_FAILED', $result['error']);
$updated = api_find_ticket($pdo, $staff, $number);
api_json(['ticket' => api_ticket_summary($updated), 'moved' => $result['moved'], 'failed' => $result['failed']]);