<?php
session_start();
header('Content-Type: application/json');
require_once 'config.php';

const STREET_VENDOR_IDS = [62];
const ROWS = ['A','B','C','D','E','F','G','H','I','J'];
const COLS = [1,2,3,4,5,6];

function json_response($data, $status = 200) {
    http_response_code($status);
    echo json_encode($data);
    exit();
}

function is_admin() {
    return isset($_SESSION['admin_logged_in']) && $_SESSION['admin_logged_in'] === true;
}

function current_vendor_id() {
    return isset($_SESSION['vendor_spot_vendor_id']) ? (int)$_SESSION['vendor_spot_vendor_id'] : 0;
}

function requested_spots_for_vendor($vendor) {
    $id = (int)$vendor['id'];
    if (in_array($id, STREET_VENDOR_IDS, true)) {
        return 0;
    }
    return max(0, (int)$vendor['spots']);
}

function vendor_is_paid($vendor) {
    $status = strtolower(trim((string)($vendor['payment_status'] ?? '')));
    return $status === '1' || $status === 'paid';
}

function allowed_spots() {
    $allowed = [];
    foreach (ROWS as $row) {
        foreach ([1,2,4,5] as $col) {
            $allowed[] = $row . $col;
        }
    }
    return $allowed;
}

function validate_spot_ids($spot_ids) {
    $allowed = allowed_spots();
    $clean = [];
    foreach ($spot_ids as $spot_id) {
        $spot_id = strtoupper(trim((string)$spot_id));
        if (!in_array($spot_id, $allowed, true)) {
            json_response(['ok' => false, 'message' => 'One selected spot is not available.'], 400);
        }
        if (in_array($spot_id, $clean, true)) {
            json_response(['ok' => false, 'message' => 'Duplicate spot selected.'], 400);
        }
        $clean[] = $spot_id;
    }
    return $clean;
}

function get_connection() {
    $conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
    if ($conn->connect_error) {
        json_response(['ok' => false, 'message' => 'Database connection failed.'], 500);
    }
    return $conn;
}

function load_vendor($conn, $vendor_id) {
    $stmt = $conn->prepare("SELECT id, name, email, category, spots, payment_status, description, website FROM vendors WHERE id = ?");
    $stmt->bind_param('i', $vendor_id);
    $stmt->execute();
    $vendor = $stmt->get_result()->fetch_assoc();
    $stmt->close();
    return $vendor;
}

if (!is_admin() && current_vendor_id() < 1) {
    json_response(['ok' => false, 'message' => 'Please log in.'], 401);
}

$conn = get_connection();

if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $vendors = [];
    $vendor_sql = is_admin()
        ? "SELECT id, name, email, category, spots, payment_status, description, website FROM vendors ORDER BY name"
        : "SELECT id, name, email, category, spots, payment_status, description, website FROM vendors WHERE id = " . current_vendor_id();
    $vendor_result = $conn->query($vendor_sql);
    while ($row = $vendor_result->fetch_assoc()) {
        $row['requested_spots'] = requested_spots_for_vendor($row);
        $vendors[] = $row;
    }

    $assignments = [];
    $assignment_result = $conn->query("SELECT a.vendor_id, a.spot_id, v.name FROM vendor_spot_assignments a JOIN vendors v ON v.id = a.vendor_id ORDER BY a.spot_id");
    while ($row = $assignment_result->fetch_assoc()) {
        $assignments[] = $row;
    }

    json_response([
        'ok' => true,
        'isAdmin' => is_admin(),
        'currentVendorId' => current_vendor_id(),
        'vendors' => $vendors,
        'assignments' => $assignments,
        'allowedSpots' => allowed_spots(),
        'walkwaySpots' => array_map(fn($row) => $row . '3', ROWS),
        'bufferSpots' => array_map(fn($row) => $row . '6', ROWS),
    ]);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $payload = json_decode(file_get_contents('php://input'), true);
    if (!is_array($payload)) {
        json_response(['ok' => false, 'message' => 'Invalid request.'], 400);
    }

    $vendor_id = is_admin() ? (int)($payload['vendor_id'] ?? 0) : current_vendor_id();
    $vendor = load_vendor($conn, $vendor_id);
    if (!$vendor) {
        json_response(['ok' => false, 'message' => 'Vendor not found.'], 404);
    }

    $requested_spots = requested_spots_for_vendor($vendor);
    if (!is_admin() && !vendor_is_paid($vendor)) {
        json_response(['ok' => false, 'message' => 'Your registration must be paid before you can pick a vendor spot.'], 403);
    }

    $spot_ids = validate_spot_ids($payload['spot_ids'] ?? []);
    $admin_release = is_admin() && count($spot_ids) === 0;
    if (!$admin_release && count($spot_ids) !== $requested_spots) {
        json_response(['ok' => false, 'message' => 'Select exactly ' . $requested_spots . ' spot(s).'], 400);
    }

    $assigned_by = is_admin() ? 'admin' : 'vendor';
    $conn->begin_transaction();
    try {
        $delete = $conn->prepare("DELETE FROM vendor_spot_assignments WHERE vendor_id = ?");
        $delete->bind_param('i', $vendor_id);
        $delete->execute();
        $delete->close();

        if (count($spot_ids) > 0) {
            if (is_admin()) {
                $clear_conflicts = $conn->prepare("DELETE FROM vendor_spot_assignments WHERE spot_id = ? AND vendor_id <> ?");
                foreach ($spot_ids as $spot_id) {
                    $clear_conflicts->bind_param('si', $spot_id, $vendor_id);
                    $clear_conflicts->execute();
                }
                $clear_conflicts->close();
            }

            $check = $conn->prepare("SELECT vendor_id FROM vendor_spot_assignments WHERE spot_id = ? FOR UPDATE");
            $insert = $conn->prepare("INSERT INTO vendor_spot_assignments (vendor_id, spot_id, assigned_by) VALUES (?, ?, ?)");
            foreach ($spot_ids as $spot_id) {
                $check->bind_param('s', $spot_id);
                $check->execute();
                $existing = $check->get_result()->fetch_assoc();
                if ($existing && (int)$existing['vendor_id'] !== $vendor_id) {
                    throw new Exception($spot_id . ' has already been taken.');
                }
                $insert->bind_param('iss', $vendor_id, $spot_id, $assigned_by);
                $insert->execute();
            }
            $check->close();
            $insert->close();
        }

        $conn->commit();
        json_response(['ok' => true, 'message' => 'Spots saved.']);
    } catch (Exception $e) {
        $conn->rollback();
        json_response(['ok' => false, 'message' => $e->getMessage()], 409);
    }
}

json_response(['ok' => false, 'message' => 'Method not allowed.'], 405);
?>