<?php
declare(strict_types=1);
require_once __DIR__ . '/common.php';

api_require_method('GET');
$staff = api_require_staff();
$pdo = get_db();

// department_id ist NULLable (fuer alle Abteilungen sichtbar) — dept_filter_sql() kann das nicht
// abbilden (es haengt ein UND an, wir brauchen aber "IS NULL ODER eigene Abteilung"), daher hier
// manuell gebaut.
$departmentIds = staff_department_ids($staff);
$deptFilter = '';
$deptParams = [];
if ($departmentIds !== null) {
    if (count($departmentIds) === 0) {
        $deptFilter = ' AND cr.department_id IS NULL';
    } else {
        $placeholders = implode(',', array_fill(0, count($departmentIds), '?'));
        $deptFilter = " AND (cr.department_id IS NULL OR cr.department_id IN ({$placeholders}))";
        $deptParams = $departmentIds;
    }
}

// Optional: nur Textbausteine für die Abteilung eines Tickets (diese Abteilung plus die für alle Abteilungen)
$onlyDept = isset($_GET['departmentId']) && ctype_digit((string) $_GET['departmentId']) ? (int) $_GET['departmentId'] : null;
if ($onlyDept !== null) {
    if ($departmentIds !== null && !in_array($onlyDept, $departmentIds, true)) {
        api_error(403, 'FORBIDDEN', 'Kein Zugriff auf diese Abteilung.');
    }
    $deptFilter = ' AND (cr.department_id IS NULL OR cr.department_id = ?)';
    $deptParams = [$onlyDept];
}

$stmt = $pdo->prepare(
    "SELECT cr.id, cr.title, cr.body, cr.department_id
     FROM canned_responses cr
     WHERE 1=1{$deptFilter}
     ORDER BY cr.title"
);
$stmt->execute($deptParams);

$responses = array_map(fn(array $row) => [
    'id' => (int) $row['id'],
    'title' => $row['title'],
    'body' => api_plain_text($row['body']),
    'departmentId' => $row['department_id'] !== null ? (int) $row['department_id'] : null,
], $stmt->fetchAll());

api_json(['items' => $responses]);