<?php
/**
 * API: Level-Konfiguration (Admin)
 * GET  /api/levels?game_id=heli_start     → Alle Levels eines Spiels
 * POST /api/levels {action}               → Level erstellen/bearbeiten/löschen
 */

$method = $_SERVER['REQUEST_METHOD'];
$db = Database::get();

if ($method === 'GET') {
    $gameId = $_GET['game_id'] ?? '';
    if (!$gameId) Response::error('game_id erforderlich');

    $levels = $db->fetchAll(
        'SELECT id, game_id, level_name, scenario, params, sort_order FROM game_levels WHERE game_id = ? ORDER BY sort_order, id',
        [$gameId]
    );
    // Parse JSON params
    foreach ($levels as &$l) {
        $l['params'] = json_decode($l['params'], true);
    }
    Response::ok($levels);
}

if ($method === 'POST') {
    // Admin check
    $adminId = Session::adminId();
    $teacherId = Session::teacherId();
    if (!$adminId && !$teacherId) Response::error('Nicht autorisiert', 401);

    $body = json_decode(file_get_contents('php://input'), true);
    $action = $body['action'] ?? '';

    if ($action === 'save') {
        $gameId = $body['gameId'] ?? '';
        $levelName = mb_substr(trim($body['levelName'] ?? ''), 0, 64);
        $scenario = $body['scenario'] ?? '';
        $params = json_encode($body['params'] ?? []);
        $sortOrder = (int)($body['sortOrder'] ?? 0);
        $levelId = (int)($body['levelId'] ?? 0);

        if (!$gameId || !$levelName || !$scenario) Response::error('gameId, levelName und scenario erforderlich');

        if ($levelId) {
            $db->execute(
                'UPDATE game_levels SET level_name = ?, scenario = ?, params = ?, sort_order = ?, updated_at = NOW() WHERE id = ?',
                [$levelName, $scenario, $params, $sortOrder, $levelId]
            );
        } else {
            $db->execute(
                'INSERT INTO game_levels (game_id, level_name, scenario, params, sort_order) VALUES (?, ?, ?, ?, ?)',
                [$gameId, $levelName, $scenario, $params, $sortOrder]
            );
            $levelId = (int)$db->lastInsertId();
        }
        Response::ok(['id' => $levelId]);
    }

    if ($action === 'delete') {
        $levelId = (int)($body['levelId'] ?? 0);
        if (!$levelId) Response::error('levelId erforderlich');
        $db->execute('DELETE FROM game_levels WHERE id = ?', [$levelId]);
        Response::ok();
    }

    Response::error('Unbekannte Aktion');
}

Response::error('Methode nicht erlaubt', 405);