<?php

// Set CORS headers for API access
if (!headers_sent()) {
    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Auth-Token');
    header('Content-Type: application/json');
}

// Handle preflight requests
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}


require_once __DIR__.'/../models/database.php';
require_once __DIR__.'/../auth/middleware.php';

$user = authRequired();

$method = $_SERVER['REQUEST_METHOD'];

try {
    switch($method) {
        case 'GET':
            $locations = Database::findAll('tblocations', '1=1 ORDER BY receiveTime DESC');
            // Limit to 100 records for SQL Server
            $locations = array_slice($locations, 0, 100);
            echo json_encode($locations);
            break;

        case 'POST':
            $data = json_decode(file_get_contents("php://input"), true);
            if (!$data) {
                http_response_code(400);
                echo json_encode(['error' => 'Invalid JSON data']);
                break;
            }
            
            Database::insert('tblocations', $data);
            echo json_encode(['status' => 'ok']);
            break;

        case 'PUT':
            $data = json_decode(file_get_contents("php://input"), true);
            if (!$data || !isset($data['tid']) || !isset($data['time'])) {
                http_response_code(400);
                echo json_encode(['error' => 'tid and time are required for update']);
                break;
            }
            
            $updateData = $data;
            unset($updateData['tid'], $updateData['time']);
            
            Database::update('tblocations', $updateData, 'tid = :tid AND time = :time', [
                'tid' => $data['tid'],
                'time' => $data['time']
            ]);
            echo json_encode(['status' => 'ok']);
            break;

        case 'DELETE':
            $data = json_decode(file_get_contents("php://input"), true);
            if (!$data || !isset($data['tid']) || !isset($data['time'])) {
                http_response_code(400);
                echo json_encode(['error' => 'tid and time are required for delete']);
                break;
            }
            
            Database::delete('tblocations', 'tid = ? AND time = ?', [$data['tid'], $data['time']]);
            echo json_encode(['status' => 'ok']);
            break;

        default:
            http_response_code(405);
            echo json_encode(['error' => 'Method not allowed']);
            break;
    }
} catch (Exception $e) {
    http_response_code(500);
    echo json_encode(['error' => 'Database error: ' . $e->getMessage()]);
}