<?php
declare(strict_types=1);
require_once __DIR__ . '/common.php';

api_require_method('GET', 'POST');
$staff = api_require_staff();

$slug = (string) ($_GET['p'] ?? '');
$endpoint = (string) ($_GET['endpoint'] ?? '');
$entry = plugin_valid_slug($slug) ? (plugin_state()['api'][$slug][$endpoint] ?? null) : null;
if (!$entry) api_error(404, 'NOT_FOUND', 'Plugin-Endpunkt nicht gefunden oder Plugin nicht aktiv.');
if ($entry['permission'] !== null) api_require_permission($staff, $entry['permission']);

$request = $_SERVER['REQUEST_METHOD'] === 'POST' ? api_request_body() : $_GET;
$failed = false;
$result = plugin_guard($slug, fn() => ($entry['fn'])($staff, $request), null);
if (!is_array($result)) api_error(500, 'PLUGIN_ERROR', 'Das Plugin hat keine gültige Antwort geliefert.');
api_json($result);