<?php
/**
 * Notifications API
 * 
 * GET /api/notifications.php - Get user notifications
 * POST /api/notifications.php?action=mark_read - Mark notification(s) as read
 * POST /api/notifications.php?action=mark_all_read - Mark all as read
 * DELETE /api/notifications.php?id=X - Delete notification
 */

require_once dirname(__DIR__) . '/f_core/config.boot.php';
require_once dirname(__DIR__) . '/f_core/f_classes/class.notifications.php';
require_once dirname(__DIR__) . '/f_core/f_classes/class.auth.php';

header('Content-Type: application/json');

// Require authentication
session_start();
if (empty($_SESSION['user_id'])) {
    http_response_code(401);
    echo json_encode(['success' => false, 'error' => 'Authentication required']);
    exit;
}

$usr_id = $_SESSION['user_id'];
$notifications = new VNotifications();

// Handle different request methods
$method = $_SERVER['REQUEST_METHOD'];

if ($method === 'GET') {
    // Get notifications
    $limit = min(intval($_GET['limit'] ?? 20), 100);
    $offset = intval($_GET['offset'] ?? 0);
    $unread_only = isset($_GET['unread_only']) && $_GET['unread_only'] === 'true';
    
    $items = $notifications->getUserNotifications($usr_id, $limit, $offset, $unread_only);
    $unread_count = $notifications->getUnreadCount($usr_id);
    
    // Mark as seen
    $notifications->markAsSeen($usr_id);
    
    echo json_encode([
        'success' => true,
        'data' => [
            'notifications' => $items,
            'unread_count' => $unread_count,
            'limit' => $limit,
            'offset' => $offset
        ]
    ]);
    
} elseif ($method === 'POST') {
    $action = $_GET['action'] ?? $_POST['action'] ?? '';
    
    if ($action === 'mark_read') {
        $id = $_POST['id'] ?? $_GET['id'] ?? null;
        
        if (!$id) {
            http_response_code(400);
            echo json_encode(['success' => false, 'error' => 'Notification ID required']);
            exit;
        }
        
        // Support marking multiple IDs
        if (strpos($id, ',') !== false) {
            $ids = explode(',', $id);
            $result = $notifications->markAsRead($ids, $usr_id);
        } else {
            $result = $notifications->markAsRead($id, $usr_id);
        }
        
        echo json_encode([
            'success' => (bool)$result,
            'unread_count' => $notifications->getUnreadCount($usr_id)
        ]);
        
    } elseif ($action === 'mark_all_read') {
        $result = $notifications->markAllAsRead($usr_id);
        
        echo json_encode([
            'success' => (bool)$result,
            'unread_count' => 0
        ]);
        
    } else {
        http_response_code(400);
        echo json_encode(['success' => false, 'error' => 'Invalid action']);
    }
    
} elseif ($method === 'DELETE') {
    parse_str(file_get_contents('php://input'), $_DELETE);
    $id = $_GET['id'] ?? $_DELETE['id'] ?? null;
    
    if (!$id) {
        http_response_code(400);
        echo json_encode(['success' => false, 'error' => 'Notification ID required']);
        exit;
    }
    
    $result = $notifications->delete($id, $usr_id);
    
    echo json_encode([
        'success' => (bool)$result,
        'unread_count' => $notifications->getUnreadCount($usr_id)
    ]);
    
} else {
    http_response_code(405);
    echo json_encode(['success' => false, 'error' => 'Method not allowed']);
}