<?php
session_start();
require_once 'db.php';

$action = (string)($_GET['action'] ?? 'dashboard');

// API updates for task kanban drag n drop
if ($action === 'api') {
    $api_action = $_GET['api_action'] ?? '';
    if(!isset($_SESSION['user_id'])) die(json_encode(['status'=>'error','msg'=>'unauthorized']));
    if($api_action === 'update_task_status') {
        $task_id = $_POST['task_id'] ?? null;
        $status = $_POST['status'] ?? null;
        $stmt = $pdo->prepare("UPDATE tasks SET status = ?, status_updated_at = CURRENT_TIMESTAMP WHERE id = ?");
        $stmt->execute([$status, $task_id]);
        echo json_encode(['status'=>'ok']);
    }
    exit;
}

if (!isset($_SESSION['user_id']) && $action !== 'login' && $action !== 'setup') {
    header('Location: ?action=login');
    exit;
}

$user_id = $_SESSION['user_id'] ?? null;
$current_user = null;
$unread_notifications = 0;
if ($user_id) {
    $current_user = get_user($user_id);
    $stmt = $pdo->prepare("SELECT COUNT(*) FROM notifications WHERE user_id = ? AND is_read = 0");
    $stmt->execute([$user_id]);
    $unread_notifications = $stmt->fetchColumn();
}

if ($action === 'logout') {
    session_destroy();
    header('Location: ?action=login');
    exit;
}

if ($action === 'setup') {
    include 'setup.php';
    exit;
}

if ($action === 'login') {
    $error = '';
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $username = trim((string)($_POST['username'] ?? ''));
        $password = trim((string)($_POST['password'] ?? ''));
        $stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
        $stmt->execute([$username]);
        $user = $stmt->fetch();
        if ($user && password_verify($password, $user['password_hash'])) {
            $_SESSION['user_id'] = $user['id'];
            $_SESSION['is_admin'] = $user['is_admin'];
            header('Location: ?action=dashboard');
            exit;
        } else {
            $error = "Invalid username or password";
        }
    }
    include 'views/login.php';
    exit;
}

$view_file = 'views/' . basename($action) . '.php';
if (file_exists($view_file)) {
    include 'views/layout_top.php';
    include $view_file;
    include 'views/layout_bottom.php';
} else {
    echo "404 Not Found";
}