<?php
// index.php

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

// --- HEADERS CORS (Indispensables pour ton site et ton appli mobile) ---
header("Access-Control-Allow-Origin: *");
header("Content-Type: application/json; charset=UTF-8");
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");

// Si le navigateur fait une pré-requête OPTIONS, on répond OK direct
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
    http_response_code(200);
    exit();
}

// --- CONFIGURATION ---
require_once __DIR__ . '/config/database.php';
require_once __DIR__ . '/controllers/UserController.php';
require_once __DIR__ . '/utils/JWT.php';
require_once __DIR__ . '/controllers/MovieController.php';

// Initialisation de la BDD et du contrôleur
$database = new Database();
$db = $database->getConnection();
$jwt_secret = $database->jwt_secret;

$userController = new UserController($db, $jwt_secret);
$movieController = new MovieController($db);

// On récupère la route épurée (ex: si on tape /register, $route vaudra 'register')
$request_uri = explode('?', $_SERVER['REQUEST_URI'], 2)[0];
$route = trim($request_uri, '/');
$method = $_SERVER['REQUEST_METHOD'];

// Récupération des données JSON reçues (ex: les credentials d'inscription)
$data = json_decode(file_get_contents('php://input'), true) ?? [];

// --- FONCTION DE SÉCURISATION DES ROUTES ---
function getAuthenticatedUserId($secret) {
    $headers = apache_request_headers();
    // On gère les différentes casses possibles pour le header Authorization
    $authHeader = $headers['Authorization'] ?? $headers['authorization'] ?? null;

    if (!$authHeader || !preg_match('/Bearer\s(\S+)/', $authHeader, $matches)) {
        http_response_code(401);
        echo json_encode(["error" => "Accès refusé. Token manquant."]);
        exit();
    }

    $token = $matches[1];
    $decoded = JWT::validate($token, $secret);

    if (!$decoded) {
        http_response_code(401);
        echo json_encode(["error" => "Session expirée ou token invalide."]);
        exit();
    }

    return $decoded['user_id']; // Retourne le vrai user_id extrait du token
}

// --- ROUTEUR ---
switch ($route) {
    
    case 'register':
        if ($method === 'POST') $userController->register($data);
        else http_response_code(405);
        break;

    case 'login':
        if ($method === 'POST') $userController->login($data);
        else http_response_code(405);
        break;

    // --- TOUTES LES ROUTES CI-DESSOUS DEVIENNENT SÉCURISÉES ---
    case 'link-partner':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret); // Plus besoin d'envoyer user_id en clair, le token le donne !
            $userController->link($data);
        } else { http_response_code(405); }
        break;

    case 'pairing-status':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret);
            $userController->pairingStatus($data);
        } else { http_response_code(405); }
        break;

    case 'unlink-partner':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret);
            $userController->unlink($data);
        } else { http_response_code(405); }
        break;

    case 'add-movie':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret);
            $movieController->add($data);
        } else { http_response_code(405); }
        break;

    case 'share-movie':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret);
            $movieController->share($data);
        } else { http_response_code(405); }
        break;

    case 'get-lists':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret);
            $movieController->getLists($data);
        } else { http_response_code(405); }
        break;

    case 'remove-movie':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret);
            $movieController->remove($data);
        } else { http_response_code(405); }
        break;

    case 'mark-watched':
        if ($method === 'POST') {
            $data['user_id'] = getAuthenticatedUserId($jwt_secret);
            $movieController->markWatched($data);
        } else { http_response_code(405); }
        break;

    default:
        http_response_code(404);
        echo json_encode(["error" => "Route /" . $route . " non trouvée"]);
        break;
}