<?php
require_once(__DIR__ . '/../../session.php');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    echo json_encode(['status' => 'error', 'message' => "Invalid CSRF Token!"]);
    exit();
  }

  $action = $_POST['action'] ?? '';
  $id = $_POST['id'] ?? null;

  if ($action === 'edit') {
    $fullname = $_POST['fullname'] ?? '';
    $username = $_POST['username'] ?? '';
    $email = $_POST['email'] ?? '';
    $bankName = $_POST['bankName'] ?? '';
    $bankHolder = $_POST['bankHolder'] ?? '';
    $bankNumber = $_POST['bankNumber'] ?? '';
    $password = $_POST['password'] ?? '';
    $gameplay = isset($_POST['gameplay']) ? 1 : 0;
    $kodeunik = isset($_POST['kode_unik']) ? 1 : 0;
    $status = isset($_POST['status']) ? 1 : 0;

    $stmt = $db->prepare("
      UPDATE user SET fullname = :fullname, username = :username, email = :email, gameplay = :gameplay, kode_unik = :kode_unik, status = :status, updated_at = NOW() WHERE id = :id
    ");
    $stmt->bindParam(':fullname', $fullname, PDO::PARAM_STR);
    $stmt->bindParam(':username', $username, PDO::PARAM_STR);
    $stmt->bindParam(':email', $email, PDO::PARAM_STR);
    $stmt->bindParam(':gameplay', $gameplay, PDO::PARAM_INT);
    $stmt->bindParam(':kode_unik', $kodeunik, PDO::PARAM_INT);
    $stmt->bindParam(':status', $status, PDO::PARAM_INT);
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();

    $stmt = $db->prepare("
      UPDATE bank_user SET BankName = :bankName, BankHolder = :bankHolder, BankNumber = :bankNumber, updated_at = NOW() WHERE user_id = :id
    ");
    $stmt->bindParam(':bankName', $bankName, PDO::PARAM_STR);
    $stmt->bindParam(':bankHolder', $bankHolder, PDO::PARAM_STR);
    $stmt->bindParam(':bankNumber', $bankNumber, PDO::PARAM_STR);
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();

    if (!empty($password)) {
      $hashedPassword = password_hash($password, PASSWORD_DEFAULT);
      $stmt = $db->prepare("UPDATE user SET password = :password, updated_at = NOW() WHERE id = :id");
      $stmt->bindParam(':password', $hashedPassword, PDO::PARAM_STR);
      $stmt->bindParam(':id', $id, PDO::PARAM_INT);
      $stmt->execute();
    }

    echo json_encode(['status' => 'success', 'message' => "Data berhasil diperbaharui."]);
    exit();
  } elseif ($action === 'delete') {
    $stmt = $db->prepare("DELETE FROM user WHERE id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();

    $stmt = $db->prepare("DELETE FROM balance WHERE user_id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();

    $stmt = $db->prepare("DELETE FROM bank_user WHERE user_id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();

    $stmt = $db->prepare("DELETE FROM transaction WHERE user_id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();

    echo json_encode(['status' => 'success', 'message' => "Data berhasil dihapus."]);
    exit();
  } else {
    echo json_encode(['status' => 'error', 'message' => "Aksi tidak valid."]);
    exit();
  }
} else {
  echo json_encode(['status' => 'error', 'message' => "Metode permintaan tidak valid."]);
  exit();
}
