<?php
/**
 * API: Spielstaende speichern/laden
 * GET  /api/saves?key=klimawaechter-save  → Spielstand laden
 * POST /api/saves {key, data, version}     → Spielstand speichern
 */

header('Content-Type: application/json; charset=utf-8');

$method = $_SERVER['REQUEST_METHOD'];
$db = Database::get();

if ($method === 'GET') {
    $sessionId = Session::studentId();
    if (!$sessionId) {
        Response::json(['data' => null]);
    }
    $key = $_GET['key'] ?? '';
    if (!$key) Response::error('key fehlt');

    $row = $db->fetchOne(
        'SELECT save_data, save_version FROM game_saves WHERE session_id = ? AND save_key = ?',
        [$sessionId, $key]
    );
    Response::json(['data' => $row ? $row['save_data'] : null, 'version' => $row ? (int)$row['save_version'] : null]);
}

if ($method === 'POST') {
    $sessionId = Session::requireStudent();
    $body = json_decode(file_get_contents('php://input'), true);
    if (!$body || !isset($body['key']) || !isset($body['data'])) {
        Response::error('key und data erforderlich');
    }

    $db->execute(
        'INSERT INTO game_saves (session_id, save_key, save_data, save_version)
         VALUES (?, ?, ?, ?)
         ON DUPLICATE KEY UPDATE save_data = VALUES(save_data), save_version = VALUES(save_version)',
        [$sessionId, $body['key'], $body['data'], $body['version'] ?? 2]
    );
    Response::ok();
}

Response::error('Methode nicht erlaubt', 405);