<?php
declare(strict_types=1);
require_once __DIR__ . '/common.php';

/**
 * Cc-Empfänger (Kollaboratoren) eines Tickets: sie bekommen öffentliche Antworten per Mail in Kopie.
 *   GET  ?number=…                          Liste
 *   POST {number, action:"add", email, name?}
 *   POST {number, action:"remove", id}
 * Beobachter (Mitarbeiter) werden über ticket_update.php ("following") gesetzt und kommen mit ticket.php.
 */
api_require_method('GET', 'POST');
$staff = api_require_staff();
$pdo = get_db();
$isPost = $_SERVER['REQUEST_METHOD'] === 'POST';
$body = $isPost ? api_request_body() : [];
$number = trim((string) ($isPost ? ($body['number'] ?? '') : ($_GET['number'] ?? '')));
if ($number === '') api_error(422, 'TICKET_NUMBER_REQUIRED', 'Eine Ticketnummer ist erforderlich.');
$ticket = api_find_ticket($pdo, $staff, $number);

if ($isPost) {
    $action = (string) ($body['action'] ?? '');
    if ($action === 'add') {
        $email = trim((string) ($body['email'] ?? ''));
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) api_error(422, 'INVALID_EMAIL', 'Bitte eine gültige E-Mail-Adresse angeben.');
        $name = trim(mb_substr((string) ($body['name'] ?? ''), 0, 120));
        $dup = $pdo->prepare('SELECT COUNT(*) FROM ticket_collaborators WHERE ticket_id = ? AND LOWER(email) = LOWER(?)');
        $dup->execute([$ticket['id'], $email]);
        if ((int) $dup->fetchColumn() === 0) {
            $pdo->prepare('INSERT INTO ticket_collaborators (ticket_id, email, name, added_by, created_at) VALUES (?,?,?,?,?)')
                ->execute([$ticket['id'], $email, $name !== '' ? $name : null, $staff['id'], db_now()]);
            log_activity($pdo, (int) $ticket['id'], (int) $staff['id'], "Kollaborator hinzugefügt: {$email}");
        }
    } elseif ($action === 'remove') {
        $s = $pdo->prepare('SELECT email FROM ticket_collaborators WHERE id = ? AND ticket_id = ?');
        $s->execute([(int) ($body['id'] ?? 0), $ticket['id']]);
        $email = $s->fetchColumn();
        if ($email !== false) {
            $pdo->prepare('DELETE FROM ticket_collaborators WHERE id = ? AND ticket_id = ?')->execute([(int) $body['id'], $ticket['id']]);
            log_activity($pdo, (int) $ticket['id'], (int) $staff['id'], "Kollaborator entfernt: {$email}");
        }
    } else {
        api_error(422, 'UNKNOWN_ACTION', 'Unbekannte Aktion.');
    }
}
api_json(['collaborators' => api_ticket_collaborators($pdo, (int) $ticket['id'])]);