<?php
declare(strict_types=1);
require_once __DIR__ . '/common.php';

/**
 * Statusseite für Kunden.
 *   GET → Zusammenfassung (Gesamtzustand, Dienste, Meldungen); für alle Mitarbeiter lesbar
 *   POST (nur Administratoren):
 *     {action:"set_component", id, status}
 *     {action:"create_incident", title, body?, status?, componentId?, componentState?}
 *     {action:"update_incident", id, status, body?}
 *     {action:"delete_incident", id}
 *     {action:"set_enabled", enabled}
 */
api_require_method('GET', 'POST');
$staff = api_require_staff();
$pdo = get_db();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    api_require_admin_or_permission($staff, 'manage_status_page');
    $b = api_request_body();
    $action = (string) ($b['action'] ?? '');
    if ($action === 'set_component') {
        if (!status_set_component($pdo, (int) ($b['id'] ?? 0), (string) ($b['status'] ?? ''))) api_error(422, 'INVALID_STATUS', 'Ungültiger Dienst oder Zustand.');
    } elseif ($action === 'create_incident') {
        $cid = (int) ($b['componentId'] ?? 0) ?: null;
        $cs = isset($b['componentState']) && $b['componentState'] !== '' ? (string) $b['componentState'] : null;
        $r = status_create_incident($pdo, (string) ($b['title'] ?? ''), (string) ($b['body'] ?? ''), (string) ($b['status'] ?? 'investigating'), $cid, $cs, (int) $staff['id']);
        if (!$r['ok']) api_error(422, 'INVALID_INCIDENT', $r['error']);
        audit_log($staff['id'], 'Statusseite: Meldung veröffentlicht (App)');
    } elseif ($action === 'update_incident') {
        $r = status_update_incident($pdo, (int) ($b['id'] ?? 0), (string) ($b['status'] ?? ''), (string) ($b['body'] ?? ''), (int) $staff['id'], true);
        if (!$r['ok']) api_error(422, 'INVALID_INCIDENT', $r['error']);
    } elseif ($action === 'delete_incident') {
        status_delete_incident($pdo, (int) ($b['id'] ?? 0));
    } elseif ($action === 'set_enabled') {
        set_setting('status_page_enabled', !empty($b['enabled']) ? '1' : '0');
    } else {
        api_error(422, 'UNKNOWN_ACTION', 'Unbekannte Aktion.');
    }
}
api_json(['status' => status_summary($pdo)] + ['canManage' => has_permission($staff, 'manage_status_page')]);