<?php
/**
 * api.php
 * FKI Asset System RESTful API
 */

require_once 'config.php';

header('Content-Type: application/json; charset=utf-8');

$action = $_GET['action'] ?? '';

try {
    switch ($action) {
        case 'get_dashboard_stats':
            // Laptops
            $laptop_total = $db->query("SELECT COUNT(*) FROM laptop_assets")->fetchColumn();
            $laptop_assigned = $db->query("SELECT COUNT(*) FROM laptop_assets WHERE status = 'assigned'")->fetchColumn();

            // Cards
            $card_total = $db->query("SELECT COUNT(*) FROM access_cards")->fetchColumn();
            $card_assigned = $db->query("SELECT COUNT(*) FROM access_cards WHERE status = 'assigned'")->fetchColumn();

            // MFP
            $mfp_total = $db->query("SELECT COUNT(*) FROM mfp_accounts")->fetchColumn();
            $mfp_active = $db->query("SELECT COUNT(*) FROM mfp_accounts WHERE status = 'active'")->fetchColumn();

            // Users
            $users_general = $db->query("SELECT COUNT(*) FROM users WHERE accounting_type = '일반회계'")->fetchColumn();
            $users_special = $db->query("SELECT COUNT(*) FROM users WHERE accounting_type = '특별회계'")->fetchColumn();

            echo json_encode([
                'laptops' => ['total' => (int) $laptop_total, 'assigned' => (int) $laptop_assigned],
                'cards' => ['total' => (int) $card_total, 'assigned' => (int) $card_assigned],
                'mfp' => ['total' => (int) $mfp_total, 'active' => (int) $mfp_active],
                'users' => ['general' => (int) $users_general, 'special' => (int) $users_special]
            ]);
            break;

        case 'get_users':
            $query = "WITH RECURSIVE dept_path(id, path) AS (
                        SELECT id, name FROM departments WHERE parent_id IS NULL
                        UNION ALL
                        SELECT d.id, dp.path || ' > ' || d.name
                        FROM departments d JOIN dept_path dp ON d.parent_id = dp.id
                      )
                      SELECT u.*, dp.path as dept_name 
                      FROM users u 
                      LEFT JOIN dept_path dp ON u.department_id = dp.id";
            $search = $_GET['search'] ?? '';
            if ($search) {
                $query .= " WHERE u.name LIKE :search OR u.emp_id LIKE :search OR u.email LIKE :search";
                $stmt = $db->prepare($query);
                $stmt->execute(['search' => "%$search%"]);
            } else {
                $stmt = $db->query($query);
            }
            echo json_encode($stmt->fetchAll());
            break;

        case 'add_user':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("INSERT INTO users (emp_id, name, department_id, position, email, phone, mobile, accounting_type, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
            $stmt->execute([
                $data['emp_id'],
                $data['name'],
                $data['department_id'],
                $data['position'],
                $data['email'],
                $data['phone'] ?? '',
                $data['mobile'],
                $data['accounting_type'],
                $data['status'] ?? 'active'
            ]);
            echo json_encode(['success' => true]);
            break;

        case 'update_user':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("UPDATE users SET emp_id = ?, name = ?, department_id = ?, position = ?, email = ?, phone = ?, mobile = ?, accounting_type = ?, status = ? WHERE id = ?");
            $stmt->execute([
                $data['emp_id'],
                $data['name'],
                $data['department_id'],
                $data['position'],
                $data['email'],
                $data['phone'] ?? '',
                $data['mobile'],
                $data['accounting_type'],
                $data['status'],
                $data['id']
            ]);
            echo json_encode(['success' => true]);
            break;

        case 'get_laptops':
            $query = "SELECT a.*, m.model_name, m.manufacturer, m.specs, m.processor, m.ram, m.storage, u.name as user_name 
                      FROM laptop_assets a 
                      LEFT JOIN laptop_models m ON a.model_id = m.id 
                      LEFT JOIN users u ON a.current_user_id = u.id";
            echo json_encode($db->query($query)->fetchAll());
            break;

        case 'get_rental_laptops':
            $query = "SELECT a.*, m.model_name, m.manufacturer, m.product_name 
                      FROM laptop_assets a 
                      LEFT JOIN laptop_models m ON a.model_id = m.id 
                      WHERE a.assigned_user_name LIKE '%업무용%'";
            echo json_encode($db->query($query)->fetchAll());
            break;

        case 'update_rental':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("UPDATE laptop_assets SET rental_user_name = ? WHERE id = ?");
            $stmt->execute([$data['rental_user_name'], $data['id']]);

            // Log the rental action
            if ($data['rental_user_name']) {
                $log_stmt = $db->prepare("INSERT INTO asset_history (asset_id, log_type, user_name, action_date) VALUES (?, 'rental', ?, ?)");
                $log_stmt->execute([$data['id'], $data['rental_user_name'], date('Y-m-d')]);
            }
            echo json_encode(['success' => true]);
            break;

        case 'get_asset_history':
            $asset_id = $_GET['asset_id'];
            $rental_logs = $db->query("SELECT * FROM asset_history WHERE asset_id = $asset_id AND log_type = 'rental' ORDER BY id DESC LIMIT 20")->fetchAll();
            $assign_logs = $db->query("SELECT * FROM asset_history WHERE asset_id = $asset_id AND log_type = 'assignment' ORDER BY id DESC LIMIT 20")->fetchAll();
            echo json_encode([
                'rental' => $rental_logs,
                'assignment' => $assign_logs
            ]);
            break;

        case 'get_cards':
            echo json_encode($db->query("SELECT * FROM access_cards")->fetchAll());
            break;

        case 'add_card':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("INSERT INTO access_cards (card_number, card_type, nfc_id, status) VALUES (?, ?, ?, ?)");
            $stmt->execute([$data['card_number'], $data['card_type'], $data['nfc_id'], 'available']);
            echo json_encode(['success' => true]);
            break;

        case 'update_card':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("UPDATE access_cards SET card_number = ?, card_type = ?, nfc_id = ? WHERE id = ?");
            $stmt->execute([$data['card_number'], $data['card_type'], $data['nfc_id'], $data['id']]);
            echo json_encode(['success' => true]);
            break;

        case 'get_mfp':
            echo json_encode($db->query("SELECT * FROM mfp_accounts")->fetchAll());
            break;

        case 'add_mfp':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("INSERT INTO mfp_accounts (account_id, account_pw, purpose, status) VALUES (?, ?, ?, ?)");
            $stmt->execute([$data['account_id'], $data['account_pw'], $data['purpose'], 'active']);
            echo json_encode(['success' => true]);
            break;

        case 'update_mfp':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("UPDATE mfp_accounts SET account_id = ?, account_pw = ?, purpose = ? WHERE id = ?");
            $stmt->execute([$data['account_id'], $data['account_pw'], $data['purpose'], $data['id']]);
            echo json_encode(['success' => true]);
            break;

        case 'get_models':
            echo json_encode($db->query("SELECT * FROM laptop_models ORDER BY manufacturer, model_name")->fetchAll());
            break;

        case 'add_model':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("INSERT INTO laptop_models (
                model_name, manufacturer, specs, cpu, npu, hdd0_model, hdd0_capacity, 
                hdd1_model, hdd1_capacity, ram, asset_status, assigned_user, fixed_ip, 
                remarks, options, power_rating, purchase_date, vendor, product_name
            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
            $stmt->execute([
                $data['model_name'],
                $data['manufacturer'],
                $data['specs'] ?? '',
                $data['cpu'] ?? '',
                $data['npu'] ?? '',
                $data['hdd0_model'] ?? '',
                $data['hdd0_capacity'] ?? '',
                $data['hdd1_model'] ?? '',
                $data['hdd1_capacity'] ?? '',
                $data['ram'] ?? '',
                $data['asset_status'] ?? '',
                $data['assigned_user'] ?? '',
                $data['fixed_ip'] ?? '',
                $data['remarks'] ?? '',
                $data['options'] ?? '',
                $data['power_rating'] ?? '',
                $data['purchase_date'] ?? '',
                $data['vendor'] ?? '',
                $data['product_name'] ?? ''
            ]);
            echo json_encode(['success' => true]);
            break;

        case 'update_model':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("UPDATE laptop_models SET 
                model_name = ?, manufacturer = ?, specs = ?, cpu = ?, npu = ?, 
                hdd0_model = ?, hdd0_capacity = ?, hdd1_model = ?, hdd1_capacity = ?, 
                ram = ?, asset_status = ?, assigned_user = ?, fixed_ip = ?, 
                remarks = ?, options = ?, power_rating = ?, purchase_date = ?, 
                vendor = ?, product_name = ? 
                WHERE id = ?");
            $stmt->execute([
                $data['model_name'],
                $data['manufacturer'],
                $data['specs'] ?? '',
                $data['cpu'] ?? '',
                $data['npu'] ?? '',
                $data['hdd0_model'] ?? '',
                $data['hdd0_capacity'] ?? '',
                $data['hdd1_model'] ?? '',
                $data['hdd1_capacity'] ?? '',
                $data['ram'] ?? '',
                $data['asset_status'] ?? '',
                $data['assigned_user'] ?? '',
                $data['fixed_ip'] ?? '',
                $data['remarks'] ?? '',
                $data['options'] ?? '',
                $data['power_rating'] ?? '',
                $data['purchase_date'] ?? '',
                $data['vendor'] ?? '',
                $data['product_name'] ?? '',
                $data['id']
            ]);
            echo json_encode(['success' => true]);
            break;

        case 'get_departments':
            $sql = "WITH RECURSIVE dept_path(id, name, path, level, parent_id) AS (
                        SELECT id, name, name, level, parent_id FROM departments WHERE parent_id IS NULL
                        UNION ALL
                        SELECT d.id, d.name, dp.path || ' > ' || d.name, d.level, d.parent_id
                        FROM departments d
                        JOIN dept_path dp ON d.parent_id = dp.id
                    )
                    SELECT dp.*, 
                           (SELECT COUNT(*) FROM users WHERE department_id = dp.id) as member_count 
                    FROM dept_path dp 
                    ORDER BY path";
            echo json_encode($db->query($sql)->fetchAll());
            break;

        case 'add_laptop_asset':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("INSERT INTO laptop_assets (
                asset_tag, model_id, current_user_id, status, serial_number, purchase_date, ip_address, 
                cpu, npu, hdd0_model, hdd0_capacity, hdd1_model, hdd1_capacity, ram, 
                asset_status, assigned_user_name, fixed_ip, options, power_rating, manufacturer, vendor, product_name, remarks, last_confirmed_date
            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
            $stmt->execute([
                $data['asset_tag'],
                $data['model_id'],
                $data['current_user_id'] ?: null,
                $data['current_user_id'] ? 'assigned' : 'stock',
                $data['serial_number'],
                $data['purchase_date'],
                $data['ip_address'] ?? null,
                $data['cpu'] ?? '',
                $data['npu'] ?? '',
                $data['hdd0_model'] ?? '',
                $data['hdd0_capacity'] ?? '',
                $data['hdd1_model'] ?? '',
                $data['hdd1_capacity'] ?? '',
                $data['ram'] ?? '',
                $data['asset_status'] ?? '',
                $data['assigned_user_name'] ?? '',
                $data['fixed_ip'] ?? '',
                $data['options'] ?? '',
                $data['power_rating'] ?? '',
                $data['manufacturer'] ?? '',
                $data['vendor'] ?? '',
                $data['product_name'] ?? '',
                $data['remarks'] ?? '',
                $data['last_confirmed_date'] ?? null
            ]);
            $new_asset_id = $db->lastInsertId();
            if ($data['assigned_user_name']) {
                $log_stmt = $db->prepare("INSERT INTO asset_history (asset_id, log_type, user_name, action_date) VALUES (?, 'assignment', ?, ?)");
                $log_stmt->execute([$new_asset_id, $data['assigned_user_name'], date('Y-m-d')]);
            }
            echo json_encode(['success' => true]);
            break;

        case 'update_laptop_asset':
            $data = json_decode(file_get_contents('php://input'), true);

            // Get old data for logging comparison
            $old_stmt = $db->prepare("SELECT assigned_user_name FROM laptop_assets WHERE id = ?");
            $old_stmt->execute([$data['id']]);
            $old_asset = $old_stmt->fetch();

            $stmt = $db->prepare("UPDATE laptop_assets SET 
                asset_tag = ?, model_id = ?, current_user_id = ?, status = ?, serial_number = ?, purchase_date = ?, ip_address = ?,
                cpu = ?, npu = ?, hdd0_model = ?, hdd0_capacity = ?, hdd1_model = ?, hdd1_capacity = ?, ram = ?, 
                asset_status = ?, assigned_user_name = ?, fixed_ip = ?, options = ?, power_rating = ?, manufacturer = ?, vendor = ?, product_name = ?, remarks = ?, last_confirmed_date = ?
                WHERE id = ?");
            $stmt->execute([
                $data['asset_tag'],
                $data['model_id'],
                $data['current_user_id'] ?: null,
                $data['current_user_id'] ? 'assigned' : 'stock',
                $data['serial_number'],
                $data['purchase_date'],
                $data['ip_address'] ?? null,
                $data['cpu'] ?? '',
                $data['npu'] ?? '',
                $data['hdd0_model'] ?? '',
                $data['hdd0_capacity'] ?? '',
                $data['hdd1_model'] ?? '',
                $data['hdd1_capacity'] ?? '',
                $data['ram'] ?? '',
                $data['asset_status'] ?? '',
                $data['assigned_user_name'] ?? '',
                $data['fixed_ip'] ?? '',
                $data['options'] ?? '',
                $data['power_rating'] ?? '',
                $data['manufacturer'] ?? '',
                $data['vendor'] ?? '',
                $data['product_name'] ?? '',
                $data['remarks'] ?? '',
                $data['last_confirmed_date'] ?? null,
                $data['id']
            ]);

            // Auto-log assignment change
            if ($data['assigned_user_name'] && $data['assigned_user_name'] !== ($old_asset['assigned_user_name'] ?? '')) {
                $log_stmt = $db->prepare("INSERT INTO asset_history (asset_id, log_type, user_name, action_date) VALUES (?, 'assignment', ?, ?)");
                $log_stmt->execute([$data['id'], $data['assigned_user_name'], date('Y-m-d')]);
            }

            echo json_encode(['success' => true]);
            break;

        case 'add_dept':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("INSERT INTO departments (name, parent_id, level) VALUES (?, ?, ?)");
            $stmt->execute([$data['name'], $data['parent_id'] ?: null, $data['level'] ?: 1]);
            echo json_encode(['success' => true]);
            break;

        case 'update_dept':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("UPDATE departments SET name = ?, parent_id = ? WHERE id = ?");
            $stmt->execute([$data['name'], $data['parent_id'] ?: null, $data['id']]);
            echo json_encode(['success' => true]);
            break;

        case 'get_dept_users':
            $dept_id = $_GET['dept_id'];
            $stmt = $db->prepare("SELECT id, name, emp_id, position FROM users WHERE department_id = ?");
            $stmt->execute([$dept_id]);
            echo json_encode($stmt->fetchAll());
            break;

        case 'reassign_user':
            $data = json_decode(file_get_contents('php://input'), true);
            $stmt = $db->prepare("UPDATE users SET department_id = ? WHERE id = ?");
            foreach ($data['user_ids'] as $u_id) {
                $stmt->execute([$data['new_dept_id'], $u_id]);
            }
            echo json_encode(['success' => true]);
            break;

        case 'bulk_update_laptops':
            $data = json_decode(file_get_contents('php://input'), true);
            $ids = $data['ids'];
            $newStatus = $data['status'] ?? null;
            $newModelId = $data['model_id'] ?? null;
            if (empty($ids)) {
                echo json_encode(['success' => false, 'error' => 'No items selected']);
                break;
            }
            $updates = [];
            $params = [];
            if ($newStatus) {
                $updates[] = "status = ?";
                $params[] = $newStatus;
            }
            if ($newModelId) {
                $updates[] = "model_id = ?";
                $params[] = $newModelId;
            }
            if (empty($updates)) {
                echo json_encode(['success' => false, 'error' => 'No updates specified']);
                break;
            }
            $sql = "UPDATE laptop_assets SET " . implode(", ", $updates) . " WHERE id IN (" . implode(",", array_fill(0, count($ids), "?")) . ")";
            $stmt = $db->prepare($sql);
            $stmt->execute(array_merge($params, $ids));
            echo json_encode(['success' => true]);
            break;

        case 'bulk_update_cards':
            $data = json_decode(file_get_contents('php://input'), true);
            $ids = $data['ids'];
            $newStatus = $data['status'] ?? null;
            $newCardType = $data['card_type'] ?? null;
            if (empty($ids)) {
                echo json_encode(['success' => false, 'error' => 'No items selected']);
                break;
            }
            $updates = [];
            $params = [];
            if ($newStatus) {
                $updates[] = "status = ?";
                $params[] = $newStatus;
            }
            if ($newCardType) {
                $updates[] = "card_type = ?";
                $params[] = $newCardType;
            }
            if (empty($updates)) {
                echo json_encode(['success' => false, 'error' => 'No updates specified']);
                break;
            }
            $sql = "UPDATE access_cards SET " . implode(", ", $updates) . " WHERE id IN (" . implode(",", array_fill(0, count($ids), "?")) . ")";
            $stmt = $db->prepare($sql);
            $stmt->execute(array_merge($params, $ids));
            echo json_encode(['success' => true]);
            break;

        case 'bulk_update_mfp':
            $data = json_decode(file_get_contents('php://input'), true);
            $ids = $data['ids'];
            $newStatus = $data['status'] ?? null;
            $newPurpose = $data['purpose'] ?? null;
            if (empty($ids)) {
                echo json_encode(['success' => false, 'error' => 'No items selected']);
                break;
            }
            $updates = [];
            $params = [];
            if ($newStatus) {
                $updates[] = "status = ?";
                $params[] = $newStatus;
            }
            if ($newPurpose) {
                $updates[] = "purpose = ?";
                $params[] = $newPurpose;
            }
            if (empty($updates)) {
                echo json_encode(['success' => false, 'error' => 'No updates specified']);
                break;
            }
            $sql = "UPDATE mfp_accounts SET " . implode(", ", $updates) . " WHERE id IN (" . implode(",", array_fill(0, count($ids), "?")) . ")";
            $stmt = $db->prepare($sql);
            $stmt->execute(array_merge($params, $ids));
            echo json_encode(['success' => true]);
            break;

        case 'bulk_update_models':
            $data = json_decode(file_get_contents('php://input'), true);
            $ids = $data['ids'];
            $newManufacturer = $data['manufacturer'] ?? null;
            $newProductName = $data['product_name'] ?? null;
            if (empty($ids)) {
                echo json_encode(['success' => false, 'error' => 'No items selected']);
                break;
            }
            $updates = [];
            $params = [];
            if ($newManufacturer) {
                $updates[] = "manufacturer = ?";
                $params[] = $newManufacturer;
            }
            if ($newProductName) {
                $updates[] = "product_name = ?";
                $params[] = $newProductName;
            }
            if (empty($updates)) {
                echo json_encode(['success' => false, 'error' => 'No updates specified']);
                break;
            }
            $sql = "UPDATE laptop_models SET " . implode(", ", $updates) . " WHERE id IN (" . implode(",", array_fill(0, count($ids), "?")) . ")";
            $stmt = $db->prepare($sql);
            $stmt->execute(array_merge($params, $ids));
            echo json_encode(['success' => true]);
            break;

        case 'bulk_update_users':
            $data = json_decode(file_get_contents('php://input'), true);
            $userIds = $data['user_ids'];
            $newStatus = $data['status'] ?? null;
            $newDeptId = $data['department_id'] ?? null;

            if (empty($userIds)) {
                echo json_encode(['success' => false, 'error' => 'No users selected']);
                break;
            }

            $sql = "UPDATE users SET ";
            $params = [];
            $updates = [];
            if ($newStatus) {
                $updates[] = "status = ?";
                $params[] = $newStatus;
            }
            if ($newDeptId) {
                $updates[] = "department_id = ?";
                $params[] = $newDeptId;
            }

            if (empty($updates)) {
                echo json_encode(['success' => false, 'error' => 'No updates specified']);
                break;
            }

            $sql .= implode(", ", $updates) . " WHERE id IN (" . implode(",", array_fill(0, count($userIds), "?")) . ")";
            $params = array_merge($params, $userIds);

            $stmt = $db->prepare($sql);
            $stmt->execute($params);
            echo json_encode(['success' => true]);
            break;

        default:
            echo json_encode(['error' => 'Invalid action']);
            break;
    }
} catch (Exception $e) {
    http_response_code(500);
    echo json_encode(['error' => $e->getMessage()]);
}