geograsim/App/php/api/profile.php

<?php
/**
 * API: Profil (Schueler + Lehrer)
 * GET  /api/profile           → Eigenes Profil laden
 * POST /api/profile {action}  → Profil aktualisieren
 */

$method = $_SERVER['REQUEST_METHOD'];
$db = Database::get();

if ($method === 'GET') {
    Session::start();
    $teacherId = Session::teacherId();
    $studentSessionId = Session::studentId();

    // ─── Sub-View: eigene Reflexionen einer Schüler:in ──────────────────
    if (($_GET['view'] ?? '') === 'reflections') {
        if (!$studentSessionId) Response::error('Nur eingeloggte Schüler:innen', 401);
        $session = $db->fetchOne('SELECT class_id, display_name, student_id FROM student_sessions WHERE id = ?', [$studentSessionId]);
        if (!$session) Response::error('Session nicht gefunden', 404);
        // student_id (FK) statt fragilem display_name-Join; Fallback für seltene Alt-Sessions ohne FK.
        $sid = $session['student_id'] ?? null;
        if (!$sid) {
            $st = $db->fetchOne('SELECT id FROM students WHERE class_id = ? AND display_name = ?', [$session['class_id'], $session['display_name']]);
            $sid = $st ? (int)$st['id'] : 0;
        }
        // Reflexionen über alle Sessions dieser Schüler:in (per student_id verknüpft).
        $rows = $db->fetchAll(
            "SELECT a.sim_id, a.submitted_at, a.reflections
               FROM assessments a
               JOIN student_sessions ss ON ss.id = a.session_id
              WHERE ss.student_id = ?
                AND a.reflections IS NOT NULL
                AND JSON_LENGTH(a.reflections) > 0
              ORDER BY a.submitted_at DESC
              LIMIT 50",
            [$sid]
        );
        $items = [];
        foreach ($rows as $r) {
            $arr = $r['reflections'] ? json_decode($r['reflections'], true) : [];
            if (!is_array($arr)) continue;
            foreach ($arr as $rf) {
                if (!is_array($rf)) continue;
                $items[] = [
                    'simId'      => $r['sim_id'],
                    'level'      => $rf['level']    ?? null,
                    'question'   => $rf['question'] ?? '',
                    'answer'     => $rf['answer']   ?? '',
                    'recordedAt' => $rf['recorded_at'] ?? $r['submitted_at'],
                ];
            }
        }
        usort($items, function($a, $b) { return strcmp($b['recordedAt'], $a['recordedAt']); });
        Response::ok(['items' => $items]);
    }

    if ($teacherId) {
        $teacher = $db->fetchOne(
            'SELECT id, username, email, display_name, school_name, emoji_avatar, country, created_at FROM teachers WHERE id = ?',
            [$teacherId]
        );
        Response::ok(['role' => 'teacher', 'profile' => $teacher]);
    }

    if ($studentSessionId) {
        // Session → Student verknuepfen
        $session = $db->fetchOne('SELECT class_id, display_name FROM student_sessions WHERE id = ?', [$studentSessionId]);
        if ($session) {
            $student = $db->fetchOne(
                'SELECT s.id, s.username, s.display_name, s.first_name, s.last_name, s.email, s.emoji_avatar, s.created_at, c.name as class_name, c.join_code
                 FROM students s JOIN classes c ON c.id = s.class_id
                 WHERE s.class_id = ? AND s.display_name = ?',
                [$session['class_id'], $session['display_name']]
            );
            if ($student) {
                Response::ok(['role' => 'student', 'profile' => $student]);
            }
        }
        Response::ok(['role' => 'guest', 'profile' => null]);
    }

    Response::ok(['role' => 'guest', 'profile' => null]);
}

if ($method === 'POST') {
    Session::start();
    $body = json_decode(file_get_contents('php://input'), true);
    $action = $body['action'] ?? 'update';

    $teacherId = Session::teacherId();
    $studentSessionId = Session::studentId();

    // Lehrperson-Profil aktualisieren
    if ($teacherId) {
        // Account löschen (Soft-Delete)
        if ($action === 'delete_account') {
            // Klassen soft-deleten
            $db->execute('UPDATE classes SET deleted_at = NOW() WHERE teacher_id = ? AND deleted_at IS NULL', [$teacherId]);
            // Lehrperson soft-deleten
            $db->execute('UPDATE teachers SET deleted_at = NOW() WHERE id = ?', [$teacherId]);
            Session::logout();
            Response::ok(['message' => 'Konto wurde gelöscht.']);
        }

        $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);
        $schoolName = mb_substr(trim($body['schoolName'] ?? ''), 0, 255);
        $email = trim($body['email'] ?? '');
        // 64 Zeichen — passt für Emojis UND 'avatar:<slug>'-Werte (vorher 8: zerschnitt 'avatar:…' beim Speichern)
        $emojiAvatar = mb_substr(trim($body['emojiAvatar'] ?? ''), 0, 64);

        if ($displayName) $db->execute('UPDATE teachers SET display_name = ? WHERE id = ?', [$displayName, $teacherId]);
        if ($schoolName !== '') $db->execute('UPDATE teachers SET school_name = ? WHERE id = ?', [$schoolName, $teacherId]);
        if (isset($body['country'])) {
            $cc = strtoupper(trim((string)$body['country']));
            if (in_array($cc, ['AT','DE','CH','LI'], true)) $db->execute('UPDATE teachers SET country = ? WHERE id = ?', [$cc, $teacherId]);
        }
        if ($email) {
            if (!filter_var($email, FILTER_VALIDATE_EMAIL)) Response::error('Ungültige E-Mail-Adresse');
            $existing = $db->fetchOne('SELECT id FROM teachers WHERE email = ? AND id != ?', [$email, $teacherId]);
            if ($existing) Response::error('Diese E-Mail-Adresse wird bereits verwendet');
            $db->execute('UPDATE teachers SET email = ? WHERE id = ?', [$email, $teacherId]);
        }
        if ($emojiAvatar) $db->execute('UPDATE teachers SET emoji_avatar = ? WHERE id = ?', [$emojiAvatar, $teacherId]);

        // Passwort ändern
        if (!empty($body['oldPassword']) && !empty($body['newPassword'])) {
            $teacher = $db->fetchOne('SELECT password FROM teachers WHERE id = ?', [$teacherId]);
            if (!password_verify($body['oldPassword'], $teacher['password'])) {
                Response::error('Altes Passwort ist falsch');
            }
            if (strlen($body['newPassword']) < 8) Response::error('Neues Passwort muss mindestens 8 Zeichen haben');
            $db->execute('UPDATE teachers SET password = ? WHERE id = ?', [password_hash($body['newPassword'], PASSWORD_DEFAULT), $teacherId]);
        }

        Response::ok();
    }

    // Schueler-Profil aktualisieren
    if ($studentSessionId) {
        $session = $db->fetchOne('SELECT class_id, display_name FROM student_sessions WHERE id = ?', [$studentSessionId]);
        if (!$session) Response::error('Session nicht gefunden');

        $student = $db->fetchOne(
            'SELECT id FROM students WHERE class_id = ? AND display_name = ?',
            [$session['class_id'], $session['display_name']]
        );
        if (!$student) Response::error('Schüler nicht gefunden');

        // Schueler*innen duerfen nur emoji_avatar aendern. Anzeigename bleibt
        // bei dem, was die Lehrkraft beim Anlegen gesetzt hat.
        $emojiAvatar = mb_substr(trim($body['emojiAvatar'] ?? ''), 0, 64);

        if ($emojiAvatar) $db->execute('UPDATE students SET emoji_avatar = ? WHERE id = ?', [$emojiAvatar, $student['id']]);

        Response::ok();
    }

    Response::error('Nicht angemeldet', 401);
}

Response::error('Methode nicht erlaubt', 405);