<?php
include('php/inc_functions.php');
require_once('php/inc_fx_messages.php');

$vPage = 'enregistrer.php';
global $db;

// Initialiser la variable option pour l'utiliser dans le switch plus bas
if (isset($_REQUEST['action']))
    $action = $_REQUEST['action'];
elseif (isset($_POST['action']))
    $action = $_POST['action'];
else
    $action = 'Aucune action d&eacute;finie';

// MSIN-4401 — Actions autorisées en session compte promoteur (com_info), sans usa_id :
// prefs rapport, dossard récupéré (remis), validation questions, toggles listes rapports (actif).
// Les autres actions restent réservées au canal superadm (usa_id).
if (session_status() !== PHP_SESSION_ACTIVE) {
    session_start();
}

$intComCompte = intval($_SESSION['com_info']['com_id'] ?? ($_SESSION['com_id'] ?? 0));
// Actions appelées depuis le site compte / rapports promoteur (sans usa_id).
$tabCompteActions = array(
    'chksave',
    'triechange',
    'triecheckall',
    'groupechange',
    'remis',           // dossard récupéré (compte / gestion V2)
    'validequestion',  // validation questions adhésion (inc_tableau_mail_questions)
    'actif',           // oui/non listes rapports custom (+ cadeaux MEC)
);
$blnComptePromoteur = in_array($action, $tabCompteActions, true)
    && $intComCompte > 0
    && empty($_SESSION['usa_id']);

if ($blnComptePromoteur) {
    header('Content-Type: application/json; charset=utf-8');

    if ($action === 'remis') {
        // Forcer l'identité + cibles (évite spoofing POST).
        $strParNom = trim(
            (string)($_SESSION['com_info']['com_prenom'] ?? '')
            . ' '
            . (string)($_SESSION['com_info']['com_nom'] ?? '')
        );
        if ($strParNom === '') {
            $strParNom = 'compte#' . $intComCompte;
        }
        $_REQUEST['par_id'] = $intComCompte;
        $_REQUEST['par'] = $strParNom;
        $_REQUEST['table'] = urlencode(base64_encode('resultats_participants'));
        $_REQUEST['field'] = 'no_bib_remis';
        $_REQUEST['key'] = 'par_id';
        if (isset($_POST['par_id'])) {
            $_POST['par_id'] = $_REQUEST['par_id'];
        }
        if (isset($_POST['par'])) {
            $_POST['par'] = $_REQUEST['par'];
        }
        if (isset($_POST['table'])) {
            $_POST['table'] = $_REQUEST['table'];
        }
        if (isset($_POST['field'])) {
            $_POST['field'] = $_REQUEST['field'];
        }
        if (isset($_POST['key'])) {
            $_POST['key'] = $_REQUEST['key'];
        }

        // Droit sur l'événement du participant (Legacy com_eve_promoteur OU V2 bib_remis).
        $intParCible = intval($_REQUEST['id'] ?? 0);
        $blnOkRemis = false;
        if ($intParCible > 0) {
            $intEveCible = intval($db->fxGetVar(
                'SELECT eve_id FROM resultats_participants WHERE par_id = ' . $intParCible . ' LIMIT 1'
            ));
            if ($intEveCible > 0) {
                $strEvePromoteur = (string)$db->fxGetVar(
                    'SELECT com_eve_promoteur FROM inscriptions_comptes WHERE com_id = ' . $intComCompte . ' LIMIT 1'
                );
                $arrEvePromo = array_filter(array_map('intval', explode(',', $strEvePromoteur)));
                if (in_array($intEveCible, $arrEvePromo, true)) {
                    $blnOkRemis = true;
                } else {
                    if (!function_exists('fxEveAccesHasPermission')) {
                        require_once dirname(__DIR__) . '/php/inc_fx_eve_acces.php';
                    }
                    $blnOkRemis = fxEveAccesHasPermission(
                        $intComCompte,
                        $intEveCible,
                        'inscriptions_gestion.bib_remis'
                    );
                }
            }
        }
        if (!$blnOkRemis) {
            echo json_encode(array(
                'state'   => 'error',
                'message' => 'Accès refusé pour ce dossard récupéré.',
                'code'    => 'forbidden',
            ));
            exit;
        }
    } elseif ($action === 'actif') {
        // Listes rapports custom : table = men_id encodé — vérifier le droit rapport.
        $intMenuRapport = intval(base64_decode(urldecode((string)($_REQUEST['table'] ?? ''))));
        if ($intMenuRapport <= 0 || !fxSuperadmReportMenuAllowed($intMenuRapport)) {
            echo json_encode(array(
                'state'   => 'error',
                'message' => 'Accès refusé pour cette action.',
                'code'    => 'forbidden',
            ));
            exit;
        }
    } elseif ($action === 'validequestion') {
        // Page compte mail questions — le promoteur doit avoir un accès événement (legacy ou V2).
        $blnOkQuestion = false;
        $strEvePromoteur = (string)$db->fxGetVar(
            'SELECT com_eve_promoteur FROM inscriptions_comptes WHERE com_id = ' . $intComCompte . ' LIMIT 1'
        );
        if (trim($strEvePromoteur) !== '') {
            $blnOkQuestion = true;
        } else {
            if (!function_exists('fxEveAccesComHasV2')) {
                require_once dirname(__DIR__) . '/php/inc_fx_eve_acces.php';
            }
            $blnOkQuestion = fxEveAccesComHasV2($intComCompte);
        }
        if (!$blnOkQuestion) {
            echo json_encode(array(
                'state'   => 'error',
                'message' => 'Accès refusé pour cette validation.',
                'code'    => 'forbidden',
            ));
            exit;
        }
    } else {
        // Prefs rapport : ne jamais laisser le promoteur écrire un autre com_id
        $_REQUEST['key'] = $intComCompte;
        if (isset($_POST['key'])) {
            $_POST['key'] = $_REQUEST['key'];
        }
    }
} else {
    fxSuperadmAjaxAuthOrJsonExit();
}

// Switch pour gérer les enregistrement à faire
switch ($action) {
    case 'actif': // Code pour changer actif/inactif
        $intMenu = base64_decode(urldecode($_REQUEST['table']));
        $tabRetour['pnq_cadeau'] = '';

        $sqlMenu = "SELECT men_table FROM adm_menus WHERE men_id = " . intval($intMenu);
        $strTable = $db->fxGetVar($sqlMenu);
        //$strTable = $intMenu;

        $sqlUpdate = "UPDATE " . $db->fxEscape($strTable) . " SET " . $db->fxEscape($_REQUEST['field']) . " = " . intval($_REQUEST['valeur']) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
        $qryUpdate = $db->fxQuery($sqlUpdate);

        if ($qryUpdate === false) {
            $tabRetour['state'] = 'erreur';
        } else {
            $tabRetour['state'] = 'success';
        }

        // PATCH TEMPO MSIN-633   -   Mettre à jour la date de récupération du cadeau
        if (strstr($_REQUEST['field'], 'pnq_cadeau')) {
            fxcreer_log($_REQUEST['field'] . "," . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']), 10, 0, 0, 0, intval($_REQUEST['id']));
            $strDate = $tabRetour['pnq_cadeau'] = fxGetDateTime();

            $sqlUpdate = "UPDATE resultats_participants SET " . $db->fxEscape($_REQUEST['field']) . "_date = '" . $strDate . "' WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
            $qryUpdate = $db->fxQuery($sqlUpdate);
        }

        //header("Location: " . $_SERVER['HTTP_REFERER']);
        echo json_encode($tabRetour);
        break;
    case 'actif2': // Code pour changer actif/inactif
        $strTable = base64_decode(urldecode($_REQUEST['table']));

        $sqlUpdate = "UPDATE " . $db->fxEscape($strTable) . " SET " . $db->fxEscape($_REQUEST['field']) . " = " . intval($_REQUEST['valeur']) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);


        $qryUpdate = $db->fxQuery($sqlUpdate);

        if ($qryUpdate === false) {
            $tabRetour['state'] = 'erreur';


        } else {
            $tabRetour['state'] = 'success';

        }

        echo json_encode($tabRetour);
        break;
    case 'delete2': // Code pour changer actif/inactif
        $strTable = base64_decode(urldecode($_REQUEST['table']));
        $intMenu = base64_decode(urldecode($_REQUEST['table']));


        $sqlMenu = "SELECT men_table FROM adm_menus WHERE men_id = " . intval($intMenu);
        $strTable = $db->fxGetVar($sqlMenu);
        //$strTable = $intMenu;
        $sqlUpdate = "delete from " . $db->fxEscape($strTable) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);

        $qryUpdate = $db->fxQuery($sqlUpdate);
        ;
        if ($qryUpdate === false) {
            $tabRetour['state'] =   'erreur';


        } else {
            $tabRetour['state'] = 'success';

        }

        echo json_encode($tabRetour);
        break;
    case 'validequestion': // changer la valeur du label
        if ($_REQUEST['valeur'] == 1) {
            $sqlUpdate = "UPDATE memberships_reponses SET  mr_valider_date=now(), mr_valider = '" . $_REQUEST['valeur'] . "' WHERE  mr_id = " . intval($_REQUEST['key']);

        } else {
            $sqlUpdate = "UPDATE memberships_reponses SET  mr_valider_date=null, mr_valider = '" . $_REQUEST['valeur'] . "' WHERE  mr_id = " . intval($_REQUEST['key']);

        }

        $qryUpdate = $db->fxQuery($sqlUpdate);

        if ($qryUpdate === false) {
            $tabRetour['state'] = 'erreur';


        } else {
            $tabRetour['state'] = 'success';

        }

        echo json_encode($tabRetour);
        break;
    case 'banquequestion': // changer la valeur du label

        $sqlUpdate = "UPDATE inscriptions_questions SET  que_banque_label = '" . $_REQUEST['valeur'] . "' WHERE  que_id = " . intval($_REQUEST['id']);

        $qryUpdate = $db->fxQuery($sqlUpdate);

        if ($qryUpdate === false) {
            $tabRetour['state'] = 'erreur';


        } else {
            $tabRetour['state'] = 'success';

        }

        echo json_encode($tabRetour);
        break;
    case 'remis': // Code pour changer actif/inactif
        $strTable = base64_decode(urldecode($_REQUEST['table']));
        $intParCibleAudit = intval($_REQUEST['id'] ?? 0);
        $intNewRemis = intval($_REQUEST['valeur'] ?? 0);
        // MSIN-4464 — ancienne valeur avant UPDATE (si whitelist no_bib_remis / last_touch).
        $strOldRemis = '';
        $intEveRemis = 0;
        if ($intParCibleAudit > 0) {
            $rowRemisAvant = $db->fxGetRow(
                'SELECT no_bib_remis, eve_id FROM resultats_participants WHERE par_id = '
                . $intParCibleAudit . ' LIMIT 1'
            );
            if (is_array($rowRemisAvant)) {
                $strOldRemis = (string)intval($rowRemisAvant['no_bib_remis'] ?? 0);
                $intEveRemis = intval($rowRemisAvant['eve_id'] ?? 0);
            }
        }

        $sqlUpdate = "UPDATE " . $db->fxEscape($strTable) . " SET no_bib_remis_par_id='" . intval($_REQUEST['par_id']) . "',no_bib_remis_par='" . $db->fxEscape($_REQUEST['par']) . "',no_bib_remis_date = now(),par_maj = par_maj," . $db->fxEscape($_REQUEST['field']) . " = " . intval($_REQUEST['valeur']) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);


        $qryUpdate = $db->fxQuery($sqlUpdate);

        if ($qryUpdate === false) {
            $tabRetour['state'] = 'erreur';
        } else {

            $sqlResult = "SELECT  * FROM " . $db->fxEscape($strTable) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
            $infoParticipant = $db->fxGetRow($sqlResult);


            $tabRetour['state'] = 'success';
            $tabRetour['result'] = $infoParticipant;

            if ($intParCibleAudit > 0) {
                if (!function_exists('fxFicheAuditRecordChange')) {
                    require_once dirname(__DIR__) . '/php/inc_fx_fiche_audit.php';
                }
                fxFicheAuditRecordChange(
                    $intParCibleAudit,
                    'no_bib_remis',
                    $strOldRemis,
                    (string)$intNewRemis,
                    'bib_remis',
                    $intEveRemis
                );
            }

        }

        echo json_encode($tabRetour);

        break;
    case 'change-var': // Code pour changer une variable
        $strKey = $db->fxEscape($_REQUEST['key']);
        $intVal = intval($_REQUEST['valeur']);
        $intExists = intval($db->fxGetVar(
            "SELECT COUNT(*) FROM variables WHERE var_nom = '" . $strKey . "'"
        ));

        if ($intExists > 0) {
            $sqlUpdate = "UPDATE variables SET var_valeur = " . $intVal
                . " WHERE var_nom = '" . $strKey . "'";
        } else {
            $sqlUpdate = "INSERT INTO variables (var_nom, var_valeur) VALUES ('"
                . $strKey . "', " . $intVal . ")";
        }

        $qryUpdate = $db->fxQuery($sqlUpdate);

        if ($qryUpdate === false) {
            $tabRetour['state'] = 'erreur';
        } else {
            $tabRetour['state'] = 'success';
        }

        echo json_encode($tabRetour);
        break;
    case 'update-panier':
        fxUpdateInfosPanier($_REQUEST['table'], $_REQUEST['id']);

        //header("Location: " . $_SERVER['HTTP_REFERER']);
        break;
    case 'influences_on':
        $arrReturn = array(
            'state' => 'Erreur lors du chargement de la liste.'
        );

        if (!empty($_REQUEST['influenced'])) { // vérifier si les paramètres sonr définis
            $arrInfluenced = explode(',', urldecode(trim($_REQUEST['influenced'])));
            $strKey = (!empty($_REQUEST['key'])) ? trim($_REQUEST['key']) : '';
            $intValue = (!empty($_REQUEST['value'])) ? intval(trim($_REQUEST['value'])) : '';
            $intMenu = (!empty($_REQUEST['men_id'])) ? trim($_REQUEST['men_id']) : 0;

            foreach ($arrInfluenced as $strSelect) { // bouble parmi les champs à modifier
                // Trouver la requête à modifier
                $sqlQuery = "SELECT lab_list FROM adm_labels WHERE lab_code = '" . $db->fxEscape($strSelect) . "' AND men_id = " . intval($intMenu);
                $strQuery = $db->fxGetVar($sqlQuery);

                $sqlData = str_replace('%' . $strKey . '%', $intValue, $strQuery); // remplacer la clé par la valeur
                $arrData = $db->fxGetResults($sqlData); // trouver le résultat

                if ($arrData != null) { // si aucune errveur, indiquer "success"
                    $arrReturn['state'] = 'success';
                    $arrReturn['data'] = array($strSelect => $arrData);
                }
            }
        }

        echo json_encode($arrReturn);
        break;
    case 'chksave':

        $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'chk_col', $_REQUEST['chk_col'], 1, 1);
        $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'chk_ques', $_REQUEST['chk_ques'], 1, 1);
        $arrReturn['state'] = 'success';


        echo json_encode($arrReturn);
        break;

    case 'triecheckall':

        $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie', 'N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N', 1, 1);


        $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0', 1, 1);
        $tabRetour['state'] = 'success';


        echo json_encode($tabRetour);

        break;
    case 'groupechange':

        $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_groupe', $_REQUEST['groupe'] , 1, 1);
         $tabRetour['state'] = 'success';


        echo json_encode($tabRetour);

        break;

    case 'triechange':

        $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie', ' ', 0, 1);
        $keytrie = explode(',', $result);

        switch ($_REQUEST['trie']) {
            case 'A':
                $mem_trie = 'D';
                break;
            case 'D':
                $mem_trie = 'N';
                break;
            case 'N':
                $mem_trie = 'A';
                break;
        }
        $keytrie[$_REQUEST['index'] - 1] = $mem_trie;
        $mem_string = implode(',', $keytrie);
        $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie', $mem_string, 1, 1);

        if ($mem_trie == 'N') {
            $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', ' ', 0, 1);
            $keytrie = explode(',', $result);
            $mem_ordre = $keytrie[$_REQUEST['index'] - 1];
            $keytrie[$_REQUEST['index'] - 1] = 0;
            for ($intCtrcol = 0; $intCtrcol <= count($keytrie); $intCtrcol++) {
                if ($keytrie[$intCtrcol] > $mem_ordre)
                    $keytrie[$intCtrcol] = $keytrie[$intCtrcol] - 1;
            }

            $mem_string = implode(',', $keytrie);
            $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', $mem_string, 1, 1);

        }
        if ($mem_trie == 'A') {
            $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', ' ', 0, 1);
            $keytrie = explode(',', $result);
            $mem_ordre = $keytrie[$_REQUEST['index'] - 1];

            $memmax = max($keytrie);
            $keytrie[$_REQUEST['index'] - 1] = $memmax + 1;
            $mem_string = implode(',', $keytrie);
            $result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', $mem_string, 1, 1);

        }
        //echo   '<br><pre>';
        //print_r($keytrie);
        //echo '</pre>';


        $arrReturn['state'] = 'success';


        echo json_encode($arrReturn);


        break;
    case 'delete':
        $arrReturn = array(
            'state' => 'Erreur lors de la suppression de l\'item.'
        );

        $qryDelete = fxSetForm('del', $_REQUEST['men_id'], $_REQUEST, '');

        if ($qryDelete !== false) {
            $arrReturn['state'] = 'success';
        }

        echo json_encode($arrReturn);
        break;
    case 'delete_file':
        $arrReturn = fxDeleteFile($_REQUEST['men_id'], $_REQUEST['key'], $_REQUEST['file']);

        echo json_encode($arrReturn);
        break;
    default:
        echo "Une erreur s'est produite au niveau de '" . $action . "'";
}