geograsim/App/php/api/profile.php

<?php
/**
 * API: Profil (Schueler + Lehrer)
 * GET  /api/profile           → Eigenes Profil laden
 * POST /api/profile {action}  → Profil aktualisieren
 */

$method = $_SERVER['REQUEST_METHOD'];
$db = Database::get();

if ($method === 'GET') {
    Session::start();
    $teacherId = Session::teacherId();
    $studentSessionId = Session::studentId();

    if ($teacherId) {
        $teacher = $db->fetchOne(
            'SELECT id, username, email, display_name, school_name, created_at FROM teachers WHERE id = ?',
            [$teacherId]
        );
        Response::ok(['role' => 'teacher', 'profile' => $teacher]);
    }

    if ($studentSessionId) {
        // Session → Student verknuepfen
        $session = $db->fetchOne('SELECT class_id, display_name FROM student_sessions WHERE id = ?', [$studentSessionId]);
        if ($session) {
            $student = $db->fetchOne(
                'SELECT s.id, s.username, s.display_name, s.first_name, s.last_name, s.email, s.emoji_avatar, s.created_at, c.name as class_name, c.join_code
                 FROM students s JOIN classes c ON c.id = s.class_id
                 WHERE s.class_id = ? AND s.display_name = ?',
                [$session['class_id'], $session['display_name']]
            );
            if ($student) {
                Response::ok(['role' => 'student', 'profile' => $student]);
            }
        }
        Response::ok(['role' => 'guest', 'profile' => null]);
    }

    Response::ok(['role' => 'guest', 'profile' => null]);
}

if ($method === 'POST') {
    Session::start();
    $body = json_decode(file_get_contents('php://input'), true);
    $action = $body['action'] ?? 'update';

    $teacherId = Session::teacherId();
    $studentSessionId = Session::studentId();

    // Lehrperson-Profil aktualisieren
    if ($teacherId) {
        // Account löschen (Soft-Delete)
        if ($action === 'delete_account') {
            // Klassen soft-deleten
            $db->execute('UPDATE classes SET deleted_at = NOW() WHERE teacher_id = ? AND deleted_at IS NULL', [$teacherId]);
            // Lehrperson soft-deleten
            $db->execute('UPDATE teachers SET deleted_at = NOW() WHERE id = ?', [$teacherId]);
            Session::logout();
            Response::ok(['message' => 'Konto wurde gelöscht.']);
        }

        $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);
        $schoolName = mb_substr(trim($body['schoolName'] ?? ''), 0, 255);
        $email = trim($body['email'] ?? '');
        $emojiAvatar = mb_substr(trim($body['emojiAvatar'] ?? ''), 0, 8);

        if ($displayName) $db->execute('UPDATE teachers SET display_name = ? WHERE id = ?', [$displayName, $teacherId]);
        if ($schoolName !== '') $db->execute('UPDATE teachers SET school_name = ? WHERE id = ?', [$schoolName, $teacherId]);
        if ($email) {
            if (!filter_var($email, FILTER_VALIDATE_EMAIL)) Response::error('Ungültige E-Mail-Adresse');
            $existing = $db->fetchOne('SELECT id FROM teachers WHERE email = ? AND id != ?', [$email, $teacherId]);
            if ($existing) Response::error('Diese E-Mail-Adresse wird bereits verwendet');
            $db->execute('UPDATE teachers SET email = ? WHERE id = ?', [$email, $teacherId]);
        }
        if ($emojiAvatar) $db->execute('UPDATE teachers SET emoji_avatar = ? WHERE id = ?', [$emojiAvatar, $teacherId]);

        // Passwort ändern
        if (!empty($body['oldPassword']) && !empty($body['newPassword'])) {
            $teacher = $db->fetchOne('SELECT password FROM teachers WHERE id = ?', [$teacherId]);
            if (!password_verify($body['oldPassword'], $teacher['password'])) {
                Response::error('Altes Passwort ist falsch');
            }
            if (strlen($body['newPassword']) < 8) Response::error('Neues Passwort muss mindestens 8 Zeichen haben');
            $db->execute('UPDATE teachers SET password = ? WHERE id = ?', [password_hash($body['newPassword'], PASSWORD_DEFAULT), $teacherId]);
        }

        Response::ok();
    }

    // Schueler-Profil aktualisieren
    if ($studentSessionId) {
        $session = $db->fetchOne('SELECT class_id, display_name FROM student_sessions WHERE id = ?', [$studentSessionId]);
        if (!$session) Response::error('Session nicht gefunden');

        $student = $db->fetchOne(
            'SELECT id FROM students WHERE class_id = ? AND display_name = ?',
            [$session['class_id'], $session['display_name']]
        );
        if (!$student) Response::error('Schüler nicht gefunden');

        $emojiAvatar = mb_substr(trim($body['emojiAvatar'] ?? ''), 0, 8);
        $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);

        if ($emojiAvatar) $db->execute('UPDATE students SET emoji_avatar = ? WHERE id = ?', [$emojiAvatar, $student['id']]);
        if ($displayName) $db->execute('UPDATE students SET display_name = ? WHERE id = ?', [$displayName, $student['id']]);

        Response::ok();
    }

    Response::error('Nicht angemeldet', 401);
}

Response::error('Methode nicht erlaubt', 405);