<?php
ob_start();
try { require_once __DIR__ . '/../../includes/auth.php'; } catch(Throwable $e) { ob_end_clean(); header('Content-Type: application/json'); echo json_encode(['success'=>false,'error'=>'Server error']); exit; }
ob_end_clean();
header('Content-Type: application/json');

$action  = $_GET['action'] ?? 'list';
$isAdmin = isLoggedIn() && !empty($_SESSION['is_admin']);

switch ($action) {

    // ── Public: active platforms for player app ───────────
    case 'list':
        $stmt = db()->query("SELECT slug,name,player_url,color,icon_path FROM platforms WHERE is_active=1 ORDER BY sort_order ASC, id ASC");
        $rows = $stmt->fetchAll();
        // Normalize to match old CFG format
        $out = array_map(fn($r) => [
            'id'    => $r['slug'],
            'name'  => $r['name'],
            'url'   => $r['player_url'],
            'color' => $r['color'],
        ], $rows);
        echo json_encode(['success'=>true, 'platforms'=>$out]);
        break;

    // ── Admin: full list including console_url and inactive ─
    case 'admin_list':
        if (!$isAdmin) { echo json_encode(['success'=>false,'error'=>'Forbidden']); exit; }
        $rows = db()->query("SELECT * FROM platforms ORDER BY sort_order ASC, id ASC")->fetchAll();
        echo json_encode(['success'=>true, 'platforms'=>$rows]);
        break;

    // ── Admin: create platform ────────────────────────────
    case 'create':
        if (!$isAdmin || $_SERVER['REQUEST_METHOD'] !== 'POST') { echo json_encode(['success'=>false,'error'=>'Forbidden']); exit; }
        $d = json_decode(file_get_contents('php://input'), true);
        $slug        = preg_replace('/[^a-z0-9_]/', '', strtolower(trim($d['slug'] ?? '')));
        $name        = substr(trim($d['name']        ?? ''), 0, 100);
        $player_url  = substr(trim($d['player_url']  ?? ''), 0, 500);
        $console_url = substr(trim($d['console_url'] ?? ''), 0, 500);
        $color       = preg_match('/^#[0-9a-fA-F]{3,8}$/', $d['color'] ?? '') ? $d['color'] : '#f0c040';
        $sort_order  = (int)($d['sort_order'] ?? 99);
        $is_active   = isset($d['is_active']) ? (int)(bool)$d['is_active'] : 1;
        if (!$slug || !$name || !$player_url) { echo json_encode(['success'=>false,'error'=>'Slug, name, and player URL are required']); exit; }
        try {
            $stmt = db()->prepare("INSERT INTO platforms (slug,name,player_url,console_url,color,sort_order,is_active) VALUES (?,?,?,?,?,?,?)");
            $stmt->execute([$slug,$name,$player_url,$console_url,$color,$sort_order,$is_active]);
            echo json_encode(['success'=>true,'id'=>db()->lastInsertId()]);
        } catch (Exception $e) {
            echo json_encode(['success'=>false,'error'=>'Slug already exists or DB error']);
        }
        break;

    // ── Admin: update platform ────────────────────────────
    case 'update':
        if (!$isAdmin || $_SERVER['REQUEST_METHOD'] !== 'POST') { echo json_encode(['success'=>false,'error'=>'Forbidden']); exit; }
        $d = json_decode(file_get_contents('php://input'), true);
        $id          = (int)($d['id'] ?? 0);
        $name        = substr(trim($d['name']        ?? ''), 0, 100);
        $player_url  = substr(trim($d['player_url']  ?? ''), 0, 500);
        $console_url = substr(trim($d['console_url'] ?? ''), 0, 500);
        $color       = preg_match('/^#[0-9a-fA-F]{3,8}$/', $d['color'] ?? '') ? $d['color'] : '#f0c040';
        $sort_order  = (int)($d['sort_order'] ?? 99);
        $is_active   = (int)(bool)($d['is_active'] ?? 1);
        if (!$id || !$name || !$player_url) { echo json_encode(['success'=>false,'error'=>'ID, name, and player URL required']); exit; }
        db()->prepare("UPDATE platforms SET name=?,player_url=?,console_url=?,color=?,sort_order=?,is_active=? WHERE id=?")
             ->execute([$name,$player_url,$console_url,$color,$sort_order,$is_active,$id]);
        echo json_encode(['success'=>true]);
        break;

    // ── Admin: delete platform ────────────────────────────
    case 'delete':
        if (!$isAdmin || $_SERVER['REQUEST_METHOD'] !== 'POST') { echo json_encode(['success'=>false,'error'=>'Forbidden']); exit; }
        $d = json_decode(file_get_contents('php://input'), true);
        $id = (int)($d['id'] ?? 0);
        if (!$id) { echo json_encode(['success'=>false,'error'=>'ID required']); exit; }
        db()->prepare("DELETE FROM platforms WHERE id=?")->execute([$id]);
        echo json_encode(['success'=>true]);
        break;

    // ── Admin: reorder platforms ──────────────────────────
    case 'reorder':
        if (!$isAdmin || $_SERVER['REQUEST_METHOD'] !== 'POST') { echo json_encode(['success'=>false,'error'=>'Forbidden']); exit; }
        $d = json_decode(file_get_contents('php://input'), true);
        $order = $d['order'] ?? []; // array of IDs in desired order
        $stmt = db()->prepare("UPDATE platforms SET sort_order=? WHERE id=?");
        foreach ($order as $i => $pid) { $stmt->execute([$i, (int)$pid]); }
        echo json_encode(['success'=>true]);
        break;

    default:
        echo json_encode(['success'=>false,'error'=>'Unknown action']);
}