<?php
require_once __DIR__ . '/../lib/auth.php';
require_admin();

header('Content-Type: application/json');

if (($_SERVER['HTTP_X_REQUESTED_WITH'] ?? '') !== 'XMLHttpRequest') {
    echo json_encode(['ok' => false, 'error' => 'forbidden']);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(['ok' => false, 'error' => 'method']);
    exit;
}

$body  = file_get_contents('php://input');
$data  = json_decode($body, true);
$order = $data['order'] ?? null;

if (!is_array($order)) {
    echo json_encode(['ok' => false, 'error' => 'invalid']);
    exit;
}

$ids = array_values(array_filter(array_map('intval', $order), fn($v) => $v > 0));

if (empty($ids)) {
    echo json_encode(['ok' => true]);
    exit;
}

$now  = date('c');
$pos  = 10;
$stmt = db()->prepare('UPDATE fortbildung_materials SET sort_order = ?, updated_at = ? WHERE id = ?');

db()->beginTransaction();
foreach ($ids as $id) {
    $stmt->execute([$pos, $now, $id]);
    $pos += 10;
}
db()->commit();

echo json_encode(['ok' => true]);
exit;