<?php
require_once __DIR__ . '/config.php';

$currentUser = requireAuth();
$db = getDB();
$action = $_GET['action'] ?? 'list';
$id = intval($_GET['id'] ?? 0);

header('Content-Type: application/json');

switch ($action) {

    case 'get_settings':
        $rows = $db->query("SELECT setting_key, setting_value FROM settings")->fetchAll();
        $settings = [];
        foreach ($rows as $r) $settings[$r['setting_key']] = $r['setting_value'];
        jsonResponse(['success' => true, 'data' => $settings]);
        break;

    case 'update_settings':
        if ($currentUser['role'] !== 'admin') jsonResponse(['success' => false, 'error' => 'Unauthorized'], 403);
        $input = getInput();
        $allowed = ['agency_name','agency_phone','agency_email','agency_address','agency_website','default_currency','default_markup'];
        $stmt = $db->prepare("INSERT INTO settings (setting_key, setting_value) VALUES (?,?) ON DUPLICATE KEY UPDATE setting_value=?");
        foreach ($allowed as $key) {
            if (isset($input[$key])) {
                $stmt->execute([$key, $input[$key], $input[$key]]);
            }
        }
        jsonResponse(['success' => true, 'message' => 'Settings saved']);
        break;

    case 'list_users':
        $users = $db->query("SELECT id, name, email, role, phone, is_active, created_at FROM users ORDER BY name")->fetchAll();
        jsonResponse(['success' => true, 'data' => $users]);
        break;

    case 'create_user':
        if ($currentUser['role'] !== 'admin') jsonResponse(['success' => false, 'error' => 'Unauthorized'], 403);
        $input = getInput();
        if (empty($input['email']) || empty($input['password'])) jsonResponse(['success' => false, 'error' => 'Email and password required']);
        $hash = password_hash($input['password'], PASSWORD_BCRYPT);
        try {
            $stmt = $db->prepare("INSERT INTO users (name, email, password_hash, role, phone) VALUES (?,?,?,?,?)");
            $stmt->execute([trim($input['name'] ?? ''), trim($input['email']), $hash, $input['role'] ?? 'agent', trim($input['phone'] ?? '')]);
            jsonResponse(['success' => true, 'id' => $db->lastInsertId(), 'message' => 'User created']);
        } catch (PDOException $e) {
            jsonResponse(['success' => false, 'error' => 'Email already exists']);
        }
        break;

    case 'update_user':
        if ($currentUser['role'] !== 'admin') jsonResponse(['success' => false, 'error' => 'Unauthorized'], 403);
        $input = getInput();
        $stmt = $db->prepare("UPDATE users SET name=?, email=?, role=?, phone=?, is_active=? WHERE id=?");
        $stmt->execute([trim($input['name'] ?? ''), trim($input['email'] ?? ''), $input['role'] ?? 'agent', trim($input['phone'] ?? ''), intval($input['is_active'] ?? 1), $id]);
        jsonResponse(['success' => true, 'message' => 'User updated']);
        break;

    case 'delete_user':
        if ($currentUser['role'] !== 'admin') jsonResponse(['success' => false, 'error' => 'Unauthorized'], 403);
        if ($id == $currentUser['id']) jsonResponse(['success' => false, 'error' => 'Cannot delete yourself']);
        $db->prepare("DELETE FROM users WHERE id=?")->execute([$id]);
        jsonResponse(['success' => true, 'message' => 'User deleted']);
        break;

    default:
        jsonResponse(['success' => false, 'error' => 'Unknown action'], 400);
}