<?php
require_once(__DIR__ . '/../../session.php');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    // CSRF Token validation
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        echo json_encode(['status' => 'error', 'message' => "Invalid CSRF Token!"]);
        exit();
    }

    $action = $_POST['action'] ?? null;
    $trxId = $_POST['trxid'] ?? null;

    if (!$action || !$trxId) {
        echo json_encode(['status' => 'error', 'message' => "Action or Transaction ID missing!"]);
        exit();
    }

    // Cek transaksi withdraw
    $checkTransaction = "SELECT user_id, Amount FROM transaction WHERE trxid = :trxId AND type = 'withdraw'";
    $stmt = $db->prepare($checkTransaction);
    $stmt->bindParam(':trxId', $trxId, PDO::PARAM_STR);
    $stmt->execute();
    $check = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$check) {
        echo json_encode(['status' => 'error', 'message' => "Transaction not found."]);
        exit();
    }

    $amount = (int) $check['Amount'];
    $user_id = $check['user_id'];

    // Ambil data user
    $query = "SELECT extplayer FROM user WHERE id = :user_id";
    $stmt = $db->prepare($query);
    $stmt->bindParam(':user_id', $user_id, PDO::PARAM_INT);
    $stmt->execute();
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$user) {
        echo json_encode(['status' => 'error', 'message' => "User not found."]);
        exit();
    }

    $extplayer = $user['extplayer'];

    if (!$extplayer) {
        echo json_encode(['status' => 'error', 'message' => "extplayer is empty!"]);
        exit();
    }

    if ($action === 'reject') {
        
        // Update status transaksi ke rejected
        $update_status = "UPDATE transaction SET status = 2, is_read = 0, updated_at = NOW() WHERE trxid = :trxId AND type = 'withdraw'";
        $stmt = $db->prepare($update_status);
        $stmt->bindParam(':trxId', $trxId, PDO::PARAM_STR);
        
        if (!$stmt->execute()) {
            echo json_encode(['status' => 'error', 'message' => "Failed to update transaction status."]);
            exit();
        }

        // Kembalikan saldo user
        $update_saldo = "UPDATE balance SET total_balance = total_balance + :amount, updated_at = NOW() WHERE user_id = :user_id";
        $stmt = $db->prepare($update_saldo);
        $stmt->bindParam(':amount', $amount, PDO::PARAM_INT);
        $stmt->bindParam(':user_id', $user_id, PDO::PARAM_INT);

        if ($stmt->execute()) {
            echo json_encode(['status' => 'success', 'message' => 'Transaction rejected and balance updated successfully.']);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'Failed to update balance.']);
        }
    } elseif ($action === 'approve') {
        $update_status = "UPDATE transaction SET status = 1, is_read = 0, updated_at = NOW() WHERE trxid = :trxId AND type = 'withdraw'";
        $stmt = $db->prepare($update_status);
        $stmt->bindParam(':trxId', $trxId, PDO::PARAM_STR);

        if ($stmt->execute()) {
            echo json_encode(['status' => 'success', 'message' => "Transaction successfully approved."]);
        } else {
            echo json_encode(['status' => 'error', 'message' => "Failed to update transaction status."]);
        }
    } else {
        echo json_encode(['status' => 'error', 'message' => "Invalid action!"]);
        exit();
    }
}
?>
