<?php
// Einzige Stelle, die HTTP-Details von omsorgCore kennt (Basis-URL, Header, JSON-(De)Kodierung) -
// analog zu httpClient.cjs/authClient.cjs in omsorgapp. Alle Aufrufer bekommen ein einheitliches
// Ergebnis-Array: ['ok' => bool, 'status' => int, 'data' => array|null].

function omsorgcore_request(array $config, string $method, string $path, ?array $body = null, ?string $accessToken = null): array
{
    $url = rtrim($config['omsorg_core_url'], '/') . $path;

    $headers = ['Content-Type: application/json'];
    if ($accessToken !== null) {
        $headers[] = 'Authorization: Bearer ' . $accessToken;
    }

    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_HTTPHEADER     => $headers,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 15,
        CURLOPT_POSTFIELDS     => $body !== null ? json_encode($body) : null,
    ]);

    $responseBody = curl_exec($ch);
    if ($responseBody === false) {
        $error = curl_error($ch);
        curl_close($ch);
        return ['ok' => false, 'status' => 0, 'data' => null, 'error' => $error];
    }

    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $data = null;
    if ($responseBody !== '') {
        $decoded = json_decode($responseBody, true);
        $data = json_last_error() === JSON_ERROR_NONE ? $decoded : null;
    }

    return ['ok' => $status >= 200 && $status < 300, 'status' => $status, 'data' => $data];
}

// --- Auth ---

function omsorgcore_login(array $config, string $username, string $password): array
{
    return omsorgcore_request($config, 'POST', '/api/auth/login', ['username' => $username, 'password' => $password]);
}

function omsorgcore_refresh(array $config, string $refreshToken): array
{
    return omsorgcore_request($config, 'POST', '/api/auth/refresh', ['refreshToken' => $refreshToken]);
}

function omsorgcore_logout(array $config, string $refreshToken): array
{
    return omsorgcore_request($config, 'POST', '/api/auth/logout', ['refreshToken' => $refreshToken]);
}

function omsorgcore_me(array $config, string $accessToken): array
{
    return omsorgcore_request($config, 'GET', '/api/auth/me', null, $accessToken);
}

function omsorgcore_change_password(array $config, string $accessToken, string $currentPassword, string $newPassword): array
{
    return omsorgcore_request($config, 'POST', '/api/auth/change-password', [
        'currentPassword' => $currentPassword,
        'newPassword'     => $newPassword,
    ], $accessToken);
}

function omsorgcore_forgot_password_request(array $config, string $username): array
{
    return omsorgcore_request($config, 'POST', '/api/auth/forgot-password/request', ['username' => $username]);
}

function omsorgcore_forgot_password_verify(array $config, string $username, string $pin): array
{
    return omsorgcore_request($config, 'POST', '/api/auth/forgot-password/verify', ['username' => $username, 'pin' => $pin]);
}

function omsorgcore_forgot_password_reset(array $config, string $resetToken, string $newPassword): array
{
    return omsorgcore_request($config, 'POST', '/api/auth/forgot-password/reset', [
        'resetToken' => $resetToken,
        'newPassword' => $newPassword,
    ]);
}

// --- Users ---

function omsorgcore_users_list(array $config, string $accessToken): array
{
    return omsorgcore_request($config, 'GET', '/api/users', null, $accessToken);
}

function omsorgcore_users_create(array $config, string $accessToken, array $payload): array
{
    return omsorgcore_request($config, 'POST', '/api/users', $payload, $accessToken);
}

function omsorgcore_users_update(array $config, string $accessToken, string $userId, array $payload): array
{
    return omsorgcore_request($config, 'PUT', '/api/users/' . urlencode($userId), $payload, $accessToken);
}

function omsorgcore_users_reset_password(array $config, string $accessToken, string $userId, array $payload): array
{
    return omsorgcore_request($config, 'POST', '/api/users/' . urlencode($userId) . '/reset-password', $payload, $accessToken);
}

// --- Roles ---

function omsorgcore_roles_list(array $config, string $accessToken): array
{
    return omsorgcore_request($config, 'GET', '/api/roles', null, $accessToken);
}

function omsorgcore_roles_create(array $config, string $accessToken, string $name): array
{
    return omsorgcore_request($config, 'POST', '/api/roles', ['name' => $name], $accessToken);
}

// --- Employees (für die Datenmigration gebraucht - Employee je PHP-User finden/anlegen) ---

function omsorgcore_employees_list(array $config, string $accessToken, int $page = 1, int $pageSize = 100): array
{
    return omsorgcore_request($config, 'GET', '/api/employees?page=' . $page . '&pageSize=' . $pageSize, null, $accessToken);
}

function omsorgcore_employees_get(array $config, string $accessToken, string $employeeId): array
{
    return omsorgcore_request($config, 'GET', '/api/employees/' . urlencode($employeeId), null, $accessToken);
}

function omsorgcore_employees_create(array $config, string $accessToken, array $payload): array
{
    return omsorgcore_request($config, 'POST', '/api/employees', $payload, $accessToken);
}

function omsorgcore_employees_update(array $config, string $accessToken, string $employeeId, array $payload): array
{
    return omsorgcore_request($config, 'PUT', '/api/employees/' . urlencode($employeeId), $payload, $accessToken);
}
