<?php
declare(strict_types=1);
require_once __DIR__ . '/common.php';

api_require_method('GET', 'POST');
$staff = api_require_staff();
api_require_admin_or_permission($staff, 'manage_priorities');
$pdo = get_db();

if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $priorities = $pdo->query('SELECT * FROM priorities ORDER BY sort_order')->fetchAll();
    api_json(['items' => array_map(fn(array $p) => [
        'id' => (int) $p['id'],
        'name' => $p['name'],
        'color' => $p['color'],
        'responseHours' => (int) $p['response_hours'],
        'resolutionHours' => (int) $p['resolution_hours'],
        'sortOrder' => (int) $p['sort_order'],
        'notes' => $p['notes'] ?? null,
        'createdAt' => $p['created_at'] ?? null,
        'updatedAt' => $p['updated_at'] ?? null,
    ], $priorities)]);
}

$body = api_request_body();
$action = $body['action'] ?? '';

if ($action === 'save') {
    $id = (int) ($body['id'] ?? 0);
    $name = trim((string) ($body['name'] ?? ''));
    $color = trim((string) ($body['color'] ?? '#888888'));
    $response = (int) ($body['responseHours'] ?? 0);
    $resolution = (int) ($body['resolutionHours'] ?? 0);
    $sort = (int) ($body['sortOrder'] ?? 0);

    if ($name === '') api_error(422, 'NAME_REQUIRED', 'Bitte einen Namen angeben.');
    if ($response <= 0 || $resolution <= 0) api_error(422, 'INVALID_HOURS', 'Bitte gültige SLA-Stunden angeben (größer als 0).');
    if ($response > $resolution) api_error(422, 'INVALID_HOURS', 'Die Reaktionszeit darf nicht länger als die Lösungszeit sein.');
    $dup = $pdo->prepare('SELECT COUNT(*) FROM priorities WHERE LOWER(name) = LOWER(?) AND id <> ?');
    $dup->execute([$name, $id]);
    if ((int) $dup->fetchColumn() > 0) api_error(422, 'NAME_TAKEN', 'Eine Priorität mit diesem Namen existiert bereits.');
    $notes = null;
    if (array_key_exists('notes', $body)) {
        $notes = trim((string) $body['notes']) ?: null;
    } elseif ($id) {
        $n = $pdo->prepare('SELECT notes FROM priorities WHERE id = ?');
        $n->execute([$id]);
        $notes = $n->fetchColumn() ?: null;
    }
    if (!preg_match('/^#[0-9a-fA-F]{6}$/', $color)) api_error(422, 'INVALID_COLOR', 'Bitte eine gültige Farbe im Format #RRGGBB angeben.');

    if ($id === 0) {
        $pdo->prepare('INSERT INTO priorities (name, color, response_hours, resolution_hours, sort_order, notes, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?)')
            ->execute([$name, $color, $response, $resolution, $sort, $notes, db_now(), db_now()]);
        $newId = (int) $pdo->lastInsertId();
        audit_log($staff['id'], "Priorität erstellt: {$name} (Mobile App)");
    } else {
        $pdo->prepare('UPDATE priorities SET name=?, color=?, response_hours=?, resolution_hours=?, sort_order=?, notes=?, updated_at=? WHERE id=?')
            ->execute([$name, $color, $response, $resolution, $sort, $notes, db_now(), $id]);
        $newId = $id;
        audit_log($staff['id'], "Priorität aktualisiert: {$name} (Mobile App)");
    }
    api_json(['id' => $newId]);
}

if ($action === 'delete') {
    $id = (int) ($body['id'] ?? 0);
    $stmt = $pdo->prepare('SELECT COUNT(*) FROM tickets WHERE priority_id = ?');
    $stmt->execute([$id]);
    if ((int) $stmt->fetchColumn() > 0) {
        api_error(422, 'PRIORITY_IN_USE', 'Diese Priorität wird noch von Tickets verwendet und kann nicht gelöscht werden.');
    }
    $pdo->prepare('DELETE FROM priorities WHERE id = ?')->execute([$id]);
    audit_log($staff['id'], "Priorität gelöscht: #{$id} (Mobile App)");
    api_json(['ok' => true]);
}

api_error(422, 'INVALID_ACTION', 'Unbekannte Aktion.');