<?php
/**
 * API: Logistik-Savegames
 *
 * GET  /api/logistik-saves?slot=1
 *   -> laedt Savegame-Slot (slot = 1..5, default 1)
 *
 * POST /api/logistik-saves {slot: 1, data: "...", version: 1}
 *   -> speichert Savegame
 *
 * DELETE /api/logistik-saves?slot=1
 *   -> loescht Savegame
 *
 * Persistiert in der generischen game_saves-Tabelle mit Namespace-Key
 * "logistik:save:<slot>". Keine eigene Tabelle noetig.
 *
 * Security: Session-ID validiert gegen student_sessions; keine fremden
 * Saves abrufbar.
 */

$method = $_SERVER['REQUEST_METHOD'];
$db = Database::get();

/** Session pruefen, gegen student_sessions validieren. */
function lgs_requireValidStudent(): string {
    $sid = Session::requireStudent();
    $db = Database::get();
    $row = $db->fetchOne('SELECT id FROM student_sessions WHERE id = ?', [$sid]);
    if (!$row) {
        http_response_code(401);
        echo json_encode(['error' => 'Session ungueltig']);
        exit;
    }
    return $sid;
}

function lgs_slotKey($slot): string {
    $slot = max(1, min(5, (int)$slot));
    return 'logistik:save:' . $slot;
}

if ($method === 'GET') {
    $sid = lgs_requireValidStudent();
    $slot = (int)($_GET['slot'] ?? 1);
    $key = lgs_slotKey($slot);

    $row = $db->fetchOne(
        'SELECT save_data, save_version, updated_at FROM game_saves WHERE session_id = ? AND save_key = ?',
        [$sid, $key]
    );
    if (!$row) Response::ok(['data' => null, 'slot' => $slot]);
    Response::ok([
        'slot'      => $slot,
        'data'      => $row['save_data'],
        'version'   => (int)$row['save_version'],
        'updatedAt' => $row['updated_at'],
    ]);
}

if ($method === 'POST') {
    $sid = lgs_requireValidStudent();
    $body = json_decode(file_get_contents('php://input'), true);
    if (!is_array($body) || !isset($body['data'])) {
        Response::error('data-Feld fehlt', 400);
    }
    $slot = (int)($body['slot'] ?? 1);
    $key  = lgs_slotKey($slot);
    $data = is_string($body['data']) ? $body['data'] : json_encode($body['data']);
    if (strlen($data) > 500000) Response::error('Payload zu gross (>500KB)', 413);
    $version = (int)($body['version'] ?? 1);

    $db->execute(
        'INSERT INTO game_saves (session_id, save_key, save_data, save_version)
         VALUES (?, ?, ?, ?)
         ON DUPLICATE KEY UPDATE save_data = VALUES(save_data), save_version = VALUES(save_version)',
        [$sid, $key, $data, $version]
    );
    Response::ok(['slot' => $slot, 'saved' => true]);
}

if ($method === 'DELETE') {
    $sid = lgs_requireValidStudent();
    $slot = (int)($_GET['slot'] ?? 1);
    $key = lgs_slotKey($slot);
    $db->execute(
        'DELETE FROM game_saves WHERE session_id = ? AND save_key = ?',
        [$sid, $key]
    );
    Response::ok(['slot' => $slot, 'deleted' => true]);
}

Response::error('Methode nicht erlaubt', 405);