<?php
require_once(__DIR__ . '/../session.php');

header('Content-Type: application/json');

// =========================
// READ INPUT
// =========================
$data = json_decode(file_get_contents("php://input"), true);

$api_key = $data['api_key'] ?? '';

// =========================
// SECURITY
// =========================
if ($api_key != 'cxfcore_secure_123') {
    echo json_encode([
        "status" => false,
        "msg" => "Unauthorized"
    ]);
    exit;
}

$action = $data['action'] ?? '';


// ==================================================
// 💰 SALDO ADD
// ==================================================
if ($action == "saldo_add") {

    $user_id = $data['user_id'];
    $amount  = $data['amount'];

    mysqli_query($conn,
        "UPDATE tb_balance 
         SET active = active + '$amount' 
         WHERE userID = '$user_id'"
    );

    echo json_encode([
        "status" => true,
        "msg" => "Saldo berhasil ditambah"
    ]);
    exit;
}


// ==================================================
// 🔍 WD SEARCH
// ==================================================
if ($action == "wd_search") {

    $name = $data['name'];

    $q = mysqli_query($conn,
        "SELECT * FROM tb_user 
         WHERE username LIKE '%$name%' 
         OR extplayer LIKE '%$name%'"
    );

    $result = [];

    while ($u = mysqli_fetch_array($q)) {

        $wd = mysqli_query($conn,
            "SELECT * FROM tb_transaksi 
             WHERE userID='".$u['cuid']."' 
             AND jenis='wd' 
             AND status=0"
        );

        $list = [];

        while ($w = mysqli_fetch_array($wd)) {
            $list[] = [
                "id" => $w['cuid'],
                "amount" => $w['total']
            ];
        }

        $result[] = [
            "username" => $u['username'],
            "wd" => $list
        ];
    }

    echo json_encode($result);
    exit;
}


// ==================================================
// 💸 APPROVE WD
// ==================================================
if ($action == "wd_acc") {

    $username = $data['username'];

    $user = mysqli_fetch_array(
        mysqli_query($conn,
        "SELECT * FROM tb_user 
         WHERE username='$username' 
         OR extplayer='$username'")
    );

    $trx = mysqli_fetch_array(
        mysqli_query($conn,
        "SELECT * FROM tb_transaksi 
         WHERE userID='".$user['cuid']."' 
         AND jenis='wd' 
         AND status=0 
         ORDER BY cuid DESC LIMIT 1")
    );

    mysqli_query($conn,
        "UPDATE tb_transaksi 
         SET status=1 
         WHERE cuid='".$trx['cuid']."'"
    );

    mysqli_query($conn,
        "UPDATE tb_balance 
         SET pending = pending - '".$trx['total']."',
             payout = payout + '".$trx['total']."'
         WHERE userID='".$user['cuid']."'"
    );

    echo json_encode([
        "status" => true,
        "msg" => "WD approved"
    ]);
    exit;
}


// ==================================================
// ❌ REJECT WD
// ==================================================
if ($action == "wd_reject") {

    $username = $data['username'];

    $user = mysqli_fetch_array(
        mysqli_query($conn,
        "SELECT * FROM tb_user 
         WHERE username='$username' 
         OR extplayer='$username'")
    );

    mysqli_query($conn,
        "UPDATE tb_transaksi 
         SET status=2 
         WHERE userID='".$user['cuid']."' 
         AND jenis='wd' 
         AND status=0 
         ORDER BY cuid DESC LIMIT 1"
    );

    echo json_encode([
        "status" => true,
        "msg" => "WD rejected"
    ]);
    exit;
}


// ==================================================
echo json_encode([
    "status" => false,
    "msg" => "Action not found"
]);