<?php
/**
 * staff/push_subscribe.php
 * Speichert oder löscht eine Push-Subscription für den eingeloggten Mitarbeiter.
 */
require_once __DIR__ . '/../includes/bootstrap.php';
$staff = require_staff_login();
$pdo   = get_db();

header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405); echo json_encode(['error' => 'POST only']); exit;
}

$body   = json_decode(file_get_contents('php://input'), true);
$action = $body['action'] ?? 'subscribe';

if ($action === 'unsubscribe') {
    $endpoint = $body['endpoint'] ?? '';
    if ($endpoint) {
        $pdo->prepare('DELETE FROM push_subscriptions WHERE staff_id = ? AND endpoint = ?')
            ->execute([$staff['id'], $endpoint]);
    }
    echo json_encode(['ok' => true]);
    exit;
}

// Subscribe
$endpoint = $body['endpoint']         ?? '';
$p256dh   = $body['keys']['p256dh']  ?? '';
$auth     = $body['keys']['auth']     ?? '';

if (!$endpoint || !$p256dh || !$auth) {
    http_response_code(400); echo json_encode(['error' => 'Fehlende Felder']); exit;
}

// Duplicate check
$chk = $pdo->prepare('SELECT id FROM push_subscriptions WHERE endpoint = ?');
$chk->execute([$endpoint]);
if (!$chk->fetchColumn()) {
    $pdo->prepare(
        'INSERT INTO push_subscriptions (staff_id, endpoint, p256dh, auth, created_at) VALUES (?,?,?,?,?)'
    )->execute([$staff['id'], $endpoint, $p256dh, $auth, db_now()]);
}

echo json_encode(['ok' => true]);