<?php
declare(strict_types=1);
/**
 * Öffentliche Ticket-API für Fremdsysteme (z. B. Website-Formulare, Shop, Monitoring).
 *
 *   POST /api/public/v1/tickets.php          Ticket anlegen   (Recht "Tickets anlegen")
 *        JSON: { "name", "email", "subject", "message", "helpTopicId"?, "departmentId"?, "priorityId"? }
 *   GET  /api/public/v1/tickets.php?number=…&email=…   Status + öffentlicher Verlauf (Recht "Tickets lesen")
 *
 * Authentifizierung: Header "X-API-Key: dh_…" oder "Authorization: Bearer dh_…".
 * Schlüssel verwaltet ein Administrator unter Verwalten → API-Schlüssel.
 */
require_once __DIR__ . '/../../../includes/bootstrap.php';

header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');

function public_api_fail(int $status, string $code, string $message): never
{
    http_response_code($status);
    echo json_encode(['error' => ['code' => $code, 'message' => $message]], JSON_UNESCAPED_UNICODE);
    exit;
}

$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
if (!in_array($method, ['GET', 'POST'], true)) {
    header('Allow: GET, POST');
    public_api_fail(405, 'METHOD_NOT_ALLOWED', 'Erlaubt sind GET und POST.');
}

$key = trim((string) ($_SERVER['HTTP_X_API_KEY'] ?? ''));
if ($key === '' && preg_match('/^Bearer\s+(\S+)$/i', (string) ($_SERVER['HTTP_AUTHORIZATION'] ?? ''), $m)) $key = $m[1];
$pdo = get_db();
$apiKey = $key !== '' ? api_key_verify($pdo, $key, client_ip()) : null;
if (!$apiKey) public_api_fail(401, 'UNAUTHENTICATED', 'Ein gültiger API-Schlüssel ist erforderlich (Header X-API-Key).');

if ($method === 'POST') {
    if (!$apiKey['can_create_tickets']) public_api_fail(403, 'FORBIDDEN', 'Dieser Schlüssel darf keine Tickets anlegen.');
    // Schutz vor Überflutung: höchstens 60 über die API angelegte Tickets pro Minute
    $recent = $pdo->prepare("SELECT COUNT(*) FROM tickets WHERE source = 'api' AND created_at >= ?");
    $recent->execute([date('Y-m-d H:i:s', time() - 60)]);
    if ((int) $recent->fetchColumn() >= 60) public_api_fail(429, 'RATE_LIMITED', 'Zu viele Anfragen. Bitte in einer Minute erneut versuchen.');

    $raw = file_get_contents('php://input') ?: '';
    if (strlen($raw) > 200000) public_api_fail(413, 'TOO_LARGE', 'Die Anfrage ist zu groß.');
    $body = json_decode($raw, true);
    if (!is_array($body)) public_api_fail(400, 'INVALID_JSON', 'Der Anfragekörper muss gültiges JSON sein.');
    try {
        $created = public_ticket_create($pdo, $body, client_ip());
    } catch (AdminModelException $e) {
        public_api_fail($e->httpStatus(), $e->errorCode(), $e->getMessage());
    }
    http_response_code(201);
    echo json_encode(['number' => $created['number'], 'status' => 'open'], JSON_UNESCAPED_UNICODE);
    exit;
}

// GET: Status eines Tickets (nur mit passender E-Mail-Adresse des Anfragenden)
if (!$apiKey['can_read_tickets']) public_api_fail(403, 'FORBIDDEN', 'Dieser Schlüssel darf keine Tickets lesen.');
$number = trim((string) ($_GET['number'] ?? ''));
$email = strtolower(trim((string) ($_GET['email'] ?? '')));
if ($number === '' || $email === '') public_api_fail(422, 'MISSING_PARAMS', 'Die Parameter number und email sind erforderlich.');
$stmt = $pdo->prepare('SELECT * FROM tickets WHERE ticket_number = ? AND LOWER(requester_email) = ?');
$stmt->execute([$number, $email]);
$ticket = $stmt->fetch();
if (!$ticket) public_api_fail(404, 'NOT_FOUND', 'Ticket nicht gefunden.');
$threads = $pdo->prepare('SELECT author_type, message, created_at FROM ticket_threads WHERE ticket_id = ? AND is_internal_note = 0 ORDER BY created_at, id');
$threads->execute([$ticket['id']]);
echo json_encode(['ticket' => [
    'number' => $ticket['ticket_number'], 'subject' => $ticket['subject'], 'status' => $ticket['status'],
    'createdAt' => $ticket['created_at'], 'updatedAt' => $ticket['updated_at'],
    'messages' => array_map(fn($t) => ['author' => $t['author_type'] === 'customer' ? 'customer' : 'staff', 'message' => trim(strip_tags((string) $t['message'])), 'createdAt' => $t['created_at']], $threads->fetchAll()),
]], JSON_UNESCAPED_UNICODE);