<?php
require_once(__DIR__ . '/../../session.php');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        echo json_encode(['status' => 'error', 'message' => "Invalid CSRF Token!"]);
        exit();
    }

    $action = $_POST['action'];
    $bankName = $_POST['bankName'] ?? '';
    $bankHolder = $_POST['bankHolder'] ?? '';
    $bankNumber = $_POST['bankNumber'] ?? '';
    $paymentType = $_POST['paymentType'] ?? '';
    $status = isset($_POST['status']) ? 1 : 0;

    function convertImageToBase64($file)
    {
        $fileData = file_get_contents($file['tmp_name']);
        return base64_encode($fileData);
    }

    if ($action === 'add') {
        $imageBase64 = isset($_FILES['image']) && $_FILES['image']['error'] == UPLOAD_ERR_OK ? convertImageToBase64($_FILES['image']) : null;

        $sql = "INSERT INTO bank_admin (BankName, PaymentType, BankHolder, BankNumber, QR, status, created_at) VALUES (:bankName, :paymentType, :bankHolder, :bankNumber, :qrCode, :status, NOW())";
        $stmt = $db->prepare($sql);
        $stmt->bindParam(':bankName', $bankName);
        $stmt->bindParam(':paymentType', $paymentType);
        $stmt->bindParam(':bankHolder', $bankHolder);
        $stmt->bindParam(':bankNumber', $bankNumber);
        $stmt->bindParam(':qrCode', $imageBase64);
        $stmt->bindParam(':status', $status);

        if ($stmt->execute()) {
            echo json_encode(['status' => 'success', 'message' => 'Bank berhasil ditambahkan.']);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'Gagal menambahkan Bank.']);
        }
    } elseif ($action === 'edit') {
        $id = $_POST['id'] ?? '';
        $imageBase64 = isset($_FILES['image']) && $_FILES['image']['error'] == UPLOAD_ERR_OK ? convertImageToBase64($_FILES['image']) : null;

        $sql = "UPDATE bank_admin SET BankName = :bankName, PaymentType = :paymentType, BankHolder = :bankHolder, BankNumber = :bankNumber, status = :status";
        if ($imageBase64) {
            $sql .= ", QR = :qrCode";
        }
        $sql .= ", updated_at = NOW() WHERE id = :id";

        $stmt = $db->prepare($sql);
        $stmt->bindParam(':bankName', $bankName);
        $stmt->bindParam(':paymentType', $paymentType);
        $stmt->bindParam(':bankHolder', $bankHolder);
        $stmt->bindParam(':bankNumber', $bankNumber);
        $stmt->bindParam(':status', $status);
        $stmt->bindParam(':id', $id);
        if ($imageBase64) {
            $stmt->bindParam(':qrCode', $imageBase64);
        }

        if ($stmt->execute()) {
            echo json_encode(['status' => 'success', 'message' => 'Bank berhasil diperbarui.']);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'Gagal memperbarui Bank.']);
        }
    } elseif ($action === 'delete') {
        $id = $_POST['id'] ?? '';

        $sql = "DELETE FROM bank_admin WHERE id = :id";
        $stmt = $db->prepare($sql);
        $stmt->bindParam(':id', $id);

        if ($stmt->execute()) {
            echo json_encode(['status' => 'success', 'message' => 'Bank berhasil dihapus.']);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'Gagal menghapus Bank.']);
        }
    }
}
