<?php
/**
 * Modul-Aufträge der Klasse.
 *
 *   GET    /api/teacher/assignments?classId=42
 *   POST   /api/teacher/assignments  { classId, moduleSlug, difficulty, endsAt? }
 *   DELETE /api/teacher/assignments?id=4711   (deaktiviert)
 */
declare(strict_types=1);
require_once __DIR__ . '/../../bootstrap.php';

$method = v2_validate_method_in(['GET', 'POST', 'DELETE']);
$auth = v2_auth_require('teacher');
$teacherId = (int) ($auth['sub'] ?? 0);

if ($method === 'GET') {
    $classId = (int) ($_GET['classId'] ?? 0);
    if (!$classId) v2_response_error(400, 'missing_classId', 'classId fehlt.');
    $own = v2_db_one('SELECT id FROM classes WHERE id = :c AND teacher_id = :t', [':c' => $classId, ':t' => $teacherId]);
    if (!$own) v2_response_error(403, 'forbidden', 'Klasse nicht deine.');

    $rows = v2_db_all("
        SELECT a.id, a.module_slug, a.difficulty, a.starts_at, a.ends_at, a.active, a.created_at,
               mi.display_name, mi.icon
        FROM class_assignments_v2 a
        LEFT JOIN module_info_v2 mi ON mi.slug = a.module_slug
        WHERE a.class_id = :cid
        ORDER BY a.active DESC, a.created_at DESC
    ", [':cid' => $classId]);

    v2_response_ok(['assignments' => array_map(fn($r) => [
        'id' => (int) $r['id'],
        'moduleSlug' => $r['module_slug'],
        'displayName' => $r['display_name'] ?? $r['module_slug'],
        'icon' => $r['icon'] ?? '📘',
        'difficulty' => $r['difficulty'],
        'startsAt' => $r['starts_at'],
        'endsAt' => $r['ends_at'],
        'active' => (bool) $r['active'],
        'createdAt' => $r['created_at'],
    ], $rows)]);
}

if ($method === 'POST') {
    $body = v2_request_body_json_required();
    v2_validate_required($body, ['classId', 'moduleSlug', 'difficulty']);
    $classId = (int) $body['classId'];
    $own = v2_db_one('SELECT id FROM classes WHERE id = :c AND teacher_id = :t', [':c' => $classId, ':t' => $teacherId]);
    if (!$own) v2_response_error(403, 'forbidden', 'Klasse nicht deine.');

    // Vorherigen aktiven Auftrag für dasselbe Modul deaktivieren
    v2_db_exec(
        'UPDATE class_assignments_v2 SET active = 0, ends_at = NOW()
         WHERE class_id = :cid AND module_slug = :slug AND active = 1',
        [':cid' => $classId, ':slug' => $body['moduleSlug']]
    );

    v2_db_exec(
        'INSERT INTO class_assignments_v2 (class_id, teacher_id, module_slug, difficulty, ends_at)
         VALUES (:cid, :tid, :slug, :diff, :ends)',
        [
            ':cid' => $classId, ':tid' => $teacherId,
            ':slug' => $body['moduleSlug'],
            ':diff' => $body['difficulty'],
            ':ends' => $body['endsAt'] ?? null,
        ]
    );
    v2_response_created(['id' => (int) v2_db_insert_id()]);
}

// DELETE
$id = (int) ($_GET['id'] ?? 0);
if (!$id) v2_response_error(400, 'missing_id', 'id fehlt.');
$own = v2_db_one("
    SELECT a.id FROM class_assignments_v2 a
    JOIN classes c ON c.id = a.class_id
    WHERE a.id = :id AND c.teacher_id = :tid
", [':id' => $id, ':tid' => $teacherId]);
if (!$own) v2_response_error(403, 'forbidden', 'Auftrag nicht deiner.');

v2_db_exec('UPDATE class_assignments_v2 SET active = 0, ends_at = NOW() WHERE id = :id', [':id' => $id]);
v2_response_ok(['ok' => true]);