erp_naurua/public/api/market-occurrence.php

<?php
declare(strict_types=1);

require_once __DIR__ . '/../../modules/shared/db.php';
require_once __DIR__ . '/../../modules/shared/auth/service.php';
require_once __DIR__ . '/../../modules/erp/kontakte/service.php';
require_once __DIR__ . '/../../modules/market_management/service.php';

header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');

$env = expand_env_values(parse_env_file(__DIR__ . '/../../.env'));
$pdo = connect_database($env);
auth_bootstrap_session();

if (auth_current_user($pdo) === null) {
    http_response_code(401);
    echo json_encode(['ok' => false, 'error' => 'Unauthorized']);
    exit;
}

$requestMethod = strtoupper((string) ($_SERVER['REQUEST_METHOD'] ?? 'GET'));
if ($requestMethod === 'POST') {
    $csrf = (string) ($_SERVER['HTTP_X_CSRF_TOKEN'] ?? '');
    if (!auth_validate_csrf_token($csrf)) {
        http_response_code(419);
        echo json_encode(['ok' => false, 'error' => 'Ungültiges Sicherheits-Token']);
        exit;
    }
    $payload = json_decode((string) file_get_contents('php://input'), true);
    if (!is_array($payload)) {
        http_response_code(400);
        echo json_encode(['ok' => false, 'error' => 'Ungültige Anfrage']);
        exit;
    }
    try {
        $scope = (string) ($payload['scope'] ?? '');
        $id = market_management_require_positive_id($payload['id'] ?? null, 'id');
        $fields = is_array($payload['fields'] ?? null) ? $payload['fields'] : [];
        if (($payload['action'] ?? '') === 'delete') {
            if (($payload['confirmation'] ?? '') !== 'DELETE') {
                throw new InvalidArgumentException('Die Löschbestätigung muss exakt DELETE lauten.');
            }
            market_management_set_occurrence_archive($pdo, $id, true);
        } elseif (($payload['action'] ?? '') === 'create_day') {
            $fields['occurrence_id'] = $id;
            $day = market_management_create_day($pdo, $fields);
            echo json_encode(['ok' => true, 'day' => $day]);
            exit;
        } elseif ($scope === 'day') {
            market_management_update_day($pdo, $id, $fields);
        } elseif (in_array($scope, ['occurrence', 'status', 'overview', 'participation', 'infrastructure', 'travel', 'notes'], true)) {
        $marketFields = [];
        foreach (['market_name', 'category_id', 'website_url'] as $marketField) {
            if (array_key_exists($marketField, $fields)) {
                $marketFields[$marketField === 'market_name' ? 'name' : $marketField] = $fields[$marketField];
                unset($fields[$marketField]);
            }
        }
        $contactFields = [];
        foreach (['contact_email', 'contact_phone'] as $contactField) {
            if (array_key_exists($contactField, $fields)) {
                $contactFields[substr($contactField, 8)] = $fields[$contactField];
                unset($fields[$contactField]);
            }
        }
        $existingOccurrence = null;
        if ($marketFields !== [] || $contactFields !== [] || array_key_exists('organization_contact_id', $fields) || array_key_exists('contact_person_id', $fields)) {
            $existingOccurrence = market_management_get_occurrence($pdo, $id, true);
        }
        if ($marketFields !== []) {
            market_management_update_market($pdo, (int) ($existingOccurrence['market_definition_id'] ?? 0), $marketFields);
        }
        if ($contactFields !== []) {
            $submittedContactId = trim((string) ($fields['contact_person_id'] ?? ''));
            $contactId = (int) ($submittedContactId !== '' ? $submittedContactId : ($existingOccurrence['contact_person_id'] ?? 0));
            $hasContactValue = array_reduce($contactFields, static fn (bool $carry, mixed $value): bool => $carry || trim((string) $value) !== '', false);
            if ($contactId > 0 && ($hasContactValue || $submittedContactId !== '')) {
                update_contact_details($pdo, $contactId, $contactFields);
            } elseif ($hasContactValue) {
                throw new InvalidArgumentException('Für E-Mail oder Telefon muss eine Kontaktperson ausgewählt sein.');
            }
        }
        $organizerFields = [];
        foreach (['organization_contact_id', 'contact_person_id'] as $organizerField) {
            if (array_key_exists($organizerField, $fields)) {
                $value = trim((string) $fields[$organizerField]);
                if ($value !== '') {
                    $organizerFields[$organizerField] = $value;
                }
                unset($fields[$organizerField]);
            }
        }
        if ($organizerFields !== []) {
            $existingOccurrence ??= market_management_get_occurrence($pdo, $id, true);
            $existingOrganizer = $existingOccurrence['organizer'] ?? null;
            $organizerFields['occurrence_id'] = $id;
            $organizerFields['organization_contact_id'] ??= $existingOrganizer['organization_contact_id'] ?? null;
            $organizerFields['contact_person_id'] ??= $existingOrganizer['contact_person_id'] ?? null;
            market_management_set_organizer($pdo, $organizerFields);
        }
        if ($fields !== []) {
            market_management_update_occurrence($pdo, $id, $fields);
        }
        } else {
            throw new InvalidArgumentException('Ungültiger Bearbeitungsbereich.');
        }
        echo json_encode(['ok' => true]);
        exit;
    } catch (Throwable $error) {
        http_response_code(422);
        echo json_encode(['ok' => false, 'error' => $error->getMessage()], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
        exit;
    }
}

$occurrenceId = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if (!is_int($occurrenceId) || $occurrenceId <= 0) {
    http_response_code(400);
    echo json_encode(['ok' => false, 'error' => 'Invalid occurrence id']);
    exit;
}

$occurrence = market_management_get_occurrence($pdo, $occurrenceId);
if ($occurrence === null) {
    http_response_code(404);
    echo json_encode(['ok' => false, 'error' => 'Occurrence not found']);
    exit;
}

$market = market_management_get_market($pdo, (int) $occurrence['market_definition_id']);
if ($market === null) {
    http_response_code(404);
    echo json_encode(['ok' => false, 'error' => 'Market not found']);
    exit;
}

echo json_encode(['ok' => true, 'market' => $market, 'occurrence' => $occurrence], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);