<?php
/**
 * API: Waypoints (Geo-Koordinaten)
 * GET  /api/waypoints              → Alle Waypoints
 * GET  /api/waypoints?region=tirol → Gefiltert
 * POST /api/waypoints {action}     → CRUD (Admin)
 */

$method = $_SERVER['REQUEST_METHOD'];
$db = Database::get();

if ($method === 'GET') {
    $region = $_GET['region'] ?? '';
    $type = $_GET['type'] ?? '';
    $where = '1=1';
    $params = [];
    if ($region) { $where .= ' AND region = ?'; $params[] = $region; }
    if ($type) { $where .= ' AND wp_type = ?'; $params[] = $type; }
    $wps = $db->fetchAll("SELECT id, wp_key, name, lat, lon, region, wp_type, info FROM geo_waypoints WHERE $where ORDER BY region, wp_type, name", $params);
    Response::ok($wps);
}

if ($method === 'POST') {
    Session::start();
    $adminId = $_SESSION['admin_id'] ?? null;
    $teacherId = Session::teacherId();
    if (!$adminId && !$teacherId) Response::error('Nicht autorisiert', 401);

    $body = json_decode(file_get_contents('php://input'), true);
    $action = $body['action'] ?? '';

    if ($action === 'save') {
        $wpKey = preg_replace('/[^a-z0-9_]/', '', strtolower(trim($body['wpKey'] ?? '')));
        $name = mb_substr(trim($body['name'] ?? ''), 0, 100);
        $lat = (float)($body['lat'] ?? 0);
        $lon = (float)($body['lon'] ?? 0);
        $region = trim($body['region'] ?? 'vorarlberg');
        $wpType = $body['wpType'] ?? 'village';
        $info = mb_substr(trim($body['info'] ?? ''), 0, 255);
        if (!$wpKey || !$name || !$lat || !$lon) Response::error('wpKey, name, lat, lon erforderlich');

        $db->execute(
            'INSERT INTO geo_waypoints (wp_key, name, lat, lon, region, wp_type, info)
             VALUES (?, ?, ?, ?, ?, ?, ?)
             ON DUPLICATE KEY UPDATE name=VALUES(name), lat=VALUES(lat), lon=VALUES(lon), region=VALUES(region), wp_type=VALUES(wp_type), info=VALUES(info)',
            [$wpKey, $name, $lat, $lon, $region, $wpType, $info ?: null]
        );
        Response::ok();
    }

    if ($action === 'delete') {
        $id = (int)($body['id'] ?? 0);
        if (!$id) Response::error('id erforderlich');
        $db->execute('DELETE FROM geo_waypoints WHERE id = ?', [$id]);
        Response::ok();
    }

    Response::error('Unbekannte Aktion');
}

Response::error('Methode nicht erlaubt', 405);