<?php
declare(strict_types=1);

require_once __DIR__ . '/bootstrap.php';
require_once __DIR__ . '/admin_auth_lib.php';

mocker_admin_require_permission('wheel');
mocker_admin_require_any_permission(['members', 'ip-clashes']);

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['ok' => false, 'error' => 'method'], JSON_UNESCAPED_UNICODE);
    exit;
}

mocker_require_csrf_post();

require_once __DIR__ . '/db.php';

$input = json_decode((string) file_get_contents('php://input'), true) ?: [];
$userId = (int) ($input['userId'] ?? 0);
$action = trim((string) ($input['action'] ?? ''));

if ($userId <= 0) {
    http_response_code(400);
    echo json_encode(['ok' => false, 'error' => 'user'], JSON_UNESCAPED_UNICODE);
    exit;
}
if ($action !== 'allow' && $action !== 'lock') {
    http_response_code(400);
    echo json_encode(['ok' => false, 'error' => 'action'], JSON_UNESCAPED_UNICODE);
    exit;
}

try {
    $pdo = mocker_db();
} catch (Throwable $e) {
    http_response_code(503);
    echo json_encode(['ok' => false, 'error' => 'db'], JSON_UNESCAPED_UNICODE);
    exit;
}

$st = $pdo->prepare('SELECT id FROM users WHERE id = :id LIMIT 1');
$st->execute([':id' => $userId]);
if (!$st->fetch()) {
    http_response_code(404);
    echo json_encode(['ok' => false, 'error' => 'not_found'], JSON_UNESCAPED_UNICODE);
    exit;
}

if ($action === 'allow') {
    $up = $pdo->prepare('UPDATE users SET last_wheel_spin_at = NULL WHERE id = :id');
    $up->execute([':id' => $userId]);
} else {
    $now = time();
    $up = $pdo->prepare('UPDATE users SET last_wheel_spin_at = :t WHERE id = :id');
    $up->execute([':t' => $now, ':id' => $userId]);
}

require_once __DIR__ . '/admin_audit_lib.php';
mocker_admin_audit_write($pdo, $userId, 'user_wheel', [
    'wheelAction' => $action,
]);

header('Content-Type: application/json; charset=utf-8');
echo json_encode(['ok' => true, 'userId' => $userId, 'action' => $action], JSON_UNESCAPED_UNICODE);
