<?php
declare(strict_types=1);
require_once __DIR__ . '/common.php';

// Aufgaben sind für alle Mitarbeiter da, nicht nur Admins.
api_require_method('GET', 'POST');
$staff = api_require_staff();
$pdo = get_db();

if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $filter = $_GET['filter'] ?? 'my';
    $where = [];
    $params = [];
    if ($filter === 'my') {
        $where[] = 'ta.assigned_to = ?';
        $params[] = $staff['id'];
    } elseif ($filter === 'open') {
        $where[] = "ta.status != 'done'";
    } elseif ($filter === 'done') {
        $where[] = "ta.status = 'done'";
    }

    $sql = 'SELECT ta.*, s.name AS assigned_name, s2.name AS creator_name,
                   t.ticket_number, t.subject AS ticket_subject
            FROM tasks ta
            LEFT JOIN staff s ON s.id = ta.assigned_to
            LEFT JOIN staff s2 ON s2.id = ta.created_by
            LEFT JOIN tickets t ON t.id = ta.ticket_id'
         . ($where ? ' WHERE ' . implode(' AND ', $where) : '')
         . ' ORDER BY ta.due_at IS NULL, ta.due_at ASC, ta.created_at DESC LIMIT 200';
    $stmt = $pdo->prepare($sql);
    $stmt->execute($params);
    $tasks = $stmt->fetchAll();

    $allStaff = $pdo->query('SELECT id, name FROM staff WHERE is_active = 1 ORDER BY name')->fetchAll();

    api_json([
        'staffOptions' => array_map(fn(array $s) => ['id' => (int) $s['id'], 'name' => $s['name']], $allStaff),
        'items' => array_map(fn(array $t) => [
            'id' => (int) $t['id'],
            'title' => $t['title'],
            'description' => $t['description'],
            'status' => $t['status'],
            'assignedToId' => $t['assigned_to'] !== null ? (int) $t['assigned_to'] : null,
            'assignedName' => $t['assigned_name'],
            'creatorName' => $t['creator_name'],
            'dueAt' => $t['due_at'],
            'ticketNumber' => $t['ticket_number'],
            'ticketSubject' => $t['ticket_subject'],
        ], $tasks),
    ]);
}

$body = api_request_body();
$action = $body['action'] ?? '';

if ($action === 'create') {
    $title = trim((string) ($body['title'] ?? ''));
    $desc = trim((string) ($body['description'] ?? ''));
    $assignTo = isset($body['assignedToId']) && $body['assignedToId'] !== null ? (int) $body['assignedToId'] : null;
    $dueAt = trim((string) ($body['dueAt'] ?? '')) ?: null;
    $ticketNumber = trim((string) ($body['ticketNumber'] ?? ''));

    if ($title === '') api_error(422, 'TITLE_REQUIRED', 'Bitte einen Titel angeben.');

    $ticketId = null;
    if ($ticketNumber !== '') {
        $tStmt = $pdo->prepare('SELECT id FROM tickets WHERE ticket_number = ?');
        $tStmt->execute([$ticketNumber]);
        $ticketId = $tStmt->fetchColumn() ?: null;
        if ($ticketId === null) api_error(422, 'TICKET_NOT_FOUND', 'Das verknüpfte Ticket wurde nicht gefunden.');
        $ticketId = (int) $ticketId;
    }

    $pdo->prepare('INSERT INTO tasks (ticket_id,title,description,assigned_to,due_at,created_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?)')
        ->execute([$ticketId, $title, $desc ?: null, $assignTo, $dueAt, $staff['id'], db_now(), db_now()]);
    api_json(['id' => (int) $pdo->lastInsertId()]);
}

if ($action === 'update_status') {
    $id = (int) ($body['id'] ?? 0);
    $status = in_array($body['status'] ?? '', ['open', 'in_progress', 'done'], true) ? $body['status'] : 'open';
    $pdo->prepare('UPDATE tasks SET status=?, updated_at=? WHERE id=?')->execute([$status, db_now(), $id]);
    api_json(['ok' => true]);
}

if ($action === 'delete') {
    $id = (int) ($body['id'] ?? 0);
    $pdo->prepare('DELETE FROM tasks WHERE id=?')->execute([$id]);
    api_json(['ok' => true]);
}

api_error(422, 'INVALID_ACTION', 'Unbekannte Aktion.');