<?php
// Define TONSUI_LOADED constant to prevent direct access to session_init.php
define('TONSUI_LOADED', true);

// Include centralized session initialization
require_once __DIR__ . '/session_init.php';

header('Content-Type: application/json');
// Critical: Add cache control headers
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Pragma: no-cache');
header('Expires: 0');
// CRITICAL: Allow origin with credentials
$allowed_origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : '*';
header("Access-Control-Allow-Origin: $allowed_origin");
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

require_once 'config.php';
require_once 'db.php';

header('Content-Type: application/json');
// Critical: Add cache control headers
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Pragma: no-cache');
header('Expires: 0');

// Admin session check
// session_start(); // Already started by session_init.php
if (!isset($_SESSION['admin_logged_in']) || $_SESSION['admin_logged_in'] !== true) {
    http_response_code(401);
    echo json_encode(["error" => "Unauthorized"]);
    exit;
}

// Get JSON input
$input = json_decode(file_get_contents('php://input'), true);

// Validate input
if (empty($input['section_key']) || !isset($input['content'])) {
    http_response_code(400);
    echo json_encode([
        'success' => false,
        'error' => 'Section key and content are required.'
    ]);
    exit;
}

// Define valid sections to prevent SQL injection
$validSections = ['landing', 'faq', 'testimonials', 'banner'];
if (!in_array($input['section_key'], $validSections)) {
    http_response_code(400);
    echo json_encode([
        'success' => false,
        'error' => 'Invalid section key.'
    ]);
    exit;
}

try {
    // Start transaction
    $pdo->beginTransaction();
    
    // Check if section exists
    $stmt = $pdo->prepare("SELECT * FROM content_sections WHERE section_key = ?");
    $stmt->execute([$input['section_key']]);
    $section = $stmt->fetch(PDO::FETCH_ASSOC);
    
    if ($section) {
        // Update existing section
        $stmt = $pdo->prepare("
            UPDATE content_sections 
            SET content = :content, updated_at = NOW()
            WHERE section_key = :section_key
        ");
    } else {
        // Insert new section
        $stmt = $pdo->prepare("
            INSERT INTO content_sections (section_key, content, created_at, updated_at)
            VALUES (:section_key, :content, NOW(), NOW())
        ");
    }
    
    $stmt->execute([
        ':section_key' => $input['section_key'],
        ':content' => $input['content']
    ]);
    
    // Log the action
    $stmt = $pdo->prepare("
        INSERT INTO admin_logs (admin_id, action, details)
        VALUES (:admin_id, :action, :details)
    ");
    $stmt->execute([
        ':admin_id' => isset($_SESSION['admin_id']) ? $_SESSION['admin_id'] : 1,
        ':action' => 'update_content',
        ':details' => json_encode([
            'section' => $input['section_key'],
            'content_length' => strlen($input['content'])
        ])
    ]);
    
    // Commit transaction
    $pdo->commit();
    
    // Get the updated section
    $stmt = $pdo->prepare("SELECT * FROM content_sections WHERE section_key = ?");
    $stmt->execute([$input['section_key']]);
    $updatedSection = $stmt->fetch(PDO::FETCH_ASSOC);
    
    echo json_encode([
        'success' => true,
        'section' => $updatedSection
    ]);
    
} catch (Exception $e) {
    // Rollback transaction on error
    if ($pdo->inTransaction()) {
        $pdo->rollBack();
    }
    
    http_response_code(500);
    echo json_encode([
        'success' => false,
        'error' => 'Failed to update content: ' . $e->getMessage()
    ]);
}
