<?php
require_once(__DIR__ . '/../../session.php');

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
  if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    echo json_encode(['status' => 'error', 'message' => "Invalid CSRF Token!"]);
    exit();
  }

  $action = $_POST['action'] ?? '';
  $fullname = trim($_POST['fullname'] ?? '');
  $username = trim($_POST['username'] ?? '');
  $password = $_POST['password'] ?? '';
  $level = trim($_POST['level'] ?? '');
  $status = isset($_POST['status']) ? 1 : 0;

  if ($action === 'add') {
    if (empty($fullname) || empty($username) || empty($password) || empty($level)) {
      echo json_encode(['status' => 'error', 'message' => 'Semua field harus diisi.']);
      exit();
    }

    $hashedPassword = password_hash($password, PASSWORD_BCRYPT);
    $insertAdmin = "INSERT INTO admin (fullname, username, password, level, status) VALUES (:fullname, :username, :password, :level, :status)";
    $stmt = $db->prepare($insertAdmin);
    $stmt->bindParam(':fullname', $fullname);
    $stmt->bindParam(':username', $username);
    $stmt->bindParam(':password', $hashedPassword);
    $stmt->bindParam(':level', $level);
    $stmt->bindParam(':status', $status);

    if ($stmt->execute()) {
      echo json_encode(['status' => 'success', 'message' => 'Data Berhasil Diperbaharui.']);
    } else {
      echo json_encode(['status' => 'error', 'message' => 'Gagal menambahkan Admin.']);
    }
  } elseif ($action === 'edit') {
    $id = $_POST['id'] ?? '';

    if (empty($id) || empty($fullname) || empty($username) || empty($level)) {
      echo json_encode(['status' => 'error', 'message' => 'ID, fullname, username, dan level harus diisi.']);
      exit();
    }

    if (!empty($password)) {
      $hashedPassword = password_hash($password, PASSWORD_BCRYPT);
      $updateAdmin = "UPDATE admin SET fullname = :fullname, username = :username, level = :level, password = :password, status = :status WHERE id = :id";
      $stmt = $db->prepare($updateAdmin);
      $stmt->bindParam(':password', $hashedPassword);
    } else {
      $updateAdmin = "UPDATE admin SET fullname = :fullname, username = :username, level = :level, status = :status WHERE id = :id";
      $stmt = $db->prepare($updateAdmin);
    }

    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->bindParam(':fullname', $fullname);
    $stmt->bindParam(':username', $username);
    $stmt->bindParam(':level', $level);
    $stmt->bindParam(':status', $status);

    if ($stmt->execute()) {
      echo json_encode(['status' => 'success', 'message' => 'Data Berhasil Diperbaharui.']);
    } else {
      echo json_encode(['status' => 'error', 'message' => 'Gagal memperbarui Admin.']);
    }
  } elseif ($action === 'delete') {
    $id = $_POST['id'] ?? '';

    if (empty($id)) {
      echo json_encode(['status' => 'error', 'message' => 'ID diperlukan untuk penghapusan.']);
      exit();
    }

    $stmt = $db->prepare("DELETE FROM admin WHERE id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);

    if ($stmt->execute()) {
      echo json_encode(['status' => 'success', 'message' => 'Data Berhasil Dihapus.']);
    } else {
      echo json_encode(['status' => 'error', 'message' => 'Gagal menghapus Admin.']);
    }
  } else {
    echo json_encode(['status' => 'error', 'message' => "Aksi tidak valid."]);
  }
} else {
  echo json_encode(['status' => 'error', 'message' => "Metode permintaan tidak valid."]);
}
