<?php
/**
 * 收银台 API（独立页面后端）
 * 支持：收银员登录/登出/会话、玩家查询、订单列表、收银员管理（仅管理员）
 */

// ★ 清除所有缓冲 + 发送 JSON Content-Type
while (ob_get_level() > 0) { @ob_end_clean(); }
ob_start();
header('Content-Type: application/json; charset=utf-8');
header('X-Content-Type-Options: nosniff');
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Pragma: no-cache');

error_reporting(E_ALL);
ini_set('display_errors', '0');
ini_set('log_errors', '1');
ini_set('memory_limit', '256M');

if (function_exists('opcache_invalidate')) { @opcache_invalidate(__FILE__); }

register_shutdown_function(function() {
    while (ob_get_level() > 0) {
        @ob_end_flush();
    }
});

if (!extension_loaded('sqlite3')) {
    exit(json_encode(['success' => false, 'message' => 'Missing SQLite3'], JSON_UNESCAPED_UNICODE));
}

require_once __DIR__ . '/../core.php';

if (!function_exists('error') || !function_exists('success') || !function_exists('getParam')) {
    exit(json_encode(['success' => false, 'message' => 'core.php load failed'], JSON_UNESCAPED_UNICODE));
}

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

$action = getParam('action', 'status');

try {
switch ($action) {
    case 'login':          cashierDoLogin(); break;
    case 'logout':         cashierDoLogout(); break;
    case 'session':        cashierSession(); break;
    case 'player_check':   cashierPlayerCheck(); break;
    case 'order_list':     cashierOrderList(); break;
    case 'cashier_list':   cashierList(); break;
    case 'add':            cashierAdd(); break;
    case 'edit':           cashierEdit(); break;
    case 'delete':         cashierDelete(); break;
    default:
        exit(json_encode(['success' => false, 'message' => '未知操作: ' . $action], JSON_UNESCAPED_UNICODE));
}
} catch (\Throwable $e) {
    // ★ 2026-07-07 补强：顶层统一捕获 Throwable（含 Error），避免致命错误逃逸导致前端收到
    //   非 JSON 响应（表现为“加载失败”却无具体原因）。同时落盘 debug.log 便于事后定位。
    debugLog('[cashier.php] 顶层未捕获异常: ' . $e->getMessage() . ' @ ' . $e->getFile() . ':' . $e->getLine());
    exit(json_encode(['success' => false, 'message' => '服务器错误: ' . $e->getMessage()], JSON_UNESCAPED_UNICODE));
}

// ===== 收银员登录 =====
function cashierDoLogin() {
    $username = trim(getParam('username', ''));
    $password = getParam('password', '');
    if ($username === '' || $password === '') {
        exit(json_encode(['success' => false, 'message' => '请输入账号和密码'], JSON_UNESCAPED_UNICODE));
    }
    if (cashierLogin($username, $password)) {
        $c = getCurrentCashier();
        exit(json_encode([
            'success' => true,
            'data' => [
                'username' => $c['username'],
                'discount_limit_percent' => $c['discount_limit_percent'],
                'can_cash' => (int)($c['can_cash'] ?? 0)
            ]
        ], JSON_UNESCAPED_UNICODE));
    }
    exit(json_encode(['success' => false, 'message' => '账号或密码错误'], JSON_UNESCAPED_UNICODE));
}

// ===== 收银员登出 =====
function cashierDoLogout() {
    cashierLogout();
    exit(json_encode(['success' => true, 'message' => '已退出登录'], JSON_UNESCAPED_UNICODE));
}

// ===== 当前会话信息 =====
function cashierSession() {
    if (isAdminLoggedIn()) {
        exit(json_encode([
            'success' => true,
            'data' => [
                'role' => 'admin',
                'username' => 'admin',
                'discount_limit_percent' => 100
            ]
        ], JSON_UNESCAPED_UNICODE));
    }
    if (isCashierLoggedIn()) {
        $c = getCurrentCashier();
        exit(json_encode([
            'success' => true,
            'data' => [
                'role' => 'cashier',
                'username' => $c['username'],
                'discount_limit_percent' => $c['discount_limit_percent'],
                'can_cash' => (int)($c['can_cash'] ?? 0)
            ]
        ], JSON_UNESCAPED_UNICODE));
    }
    exit(json_encode(['success' => false, 'message' => '未登录'], JSON_UNESCAPED_UNICODE));
}

// ===== 查询目标玩家余额/在线状态（收银员或管理员均可）=====
function cashierPlayerCheck() {
    requireCashierOrAdminSession();
    $player = trim(getParam('player'));
    if (!$player) exit(json_encode(['success' => false, 'message' => '请输入玩家名'], JSON_UNESCAPED_UNICODE));
    if (!preg_match('/^[a-zA-Z0-9_]{3,16}$/', $player)) {
        exit(json_encode(['success' => false, 'message' => '玩家名格式不正确（3-16位英文/数字/下划线）'], JSON_UNESCAPED_UNICODE));
    }
    $db = getDB();
    try {
        $db->exec("INSERT OR IGNORE INTO bond_cache (player_name, amount, updated_at) VALUES ('" . str_replace("'", "''", $player) . "', 0, " . time() . ")");
        $stmt = $db->prepare("SELECT amount FROM bond_cache WHERE player_name = :name");
        $stmt->bindValue(':name', $player, SQLITE3_TEXT);
        $row = $stmt->execute()->fetchArray(SQLITE3_ASSOC);
        $balance = $row ? (int)$row['amount'] : 0;

        $online = false;
        try {
            $ostmt = $db->prepare("SELECT player_name FROM online_players WHERE player_name = :name");
            $ostmt->bindValue(':name', $player, SQLITE3_TEXT);
            $orow = $ostmt->execute()->fetchArray(SQLITE3_ASSOC);
            $online = $orow ? true : false;
        } catch (\Throwable $e) {}

        exit(json_encode([
            'success' => true,
            'data' => ['player' => $player, 'exists' => true, 'balance' => $balance, 'online' => $online]
        ], JSON_UNESCAPED_UNICODE));
    } catch (Exception $e) {
        @error_log('[cashier.php] Player check error: ' . $e->getMessage());
        exit(json_encode(['success' => false, 'message' => '查询失败: ' . $e->getMessage()], JSON_UNESCAPED_UNICODE));
    }
}

// ===== 订单列表 =====
function cashierOrderList() {
    $role = requireCashierOrAdminSession();
    // 收银员只能看自己的订单
    $c = null;
    if ($role === 'cashier') {
        $c = getCurrentCashier();
    }
    // ★ 尽早释放会话锁：查询期间不再占用 session 文件，避免阻塞同会话并发请求
    if (session_status() === PHP_SESSION_ACTIVE) session_write_close();

    // ★ 直接从独立 orders.db 读取：该库 Java 永不读写，彻底脱离 web.db 文件锁竞争，
    //   因此不再需要 busy_timeout=15000 与 5 次重试兜底 hack —— 干净稳定的单次查询。
    try {
        $db = getOrdersDB();
    } catch (\Throwable $e) {
        exit(json_encode(['success' => false, 'message' => '订单库不可用: ' . $e->getMessage()], JSON_UNESCAPED_UNICODE));
    }

    $limit = (int)getParam('limit', 100);
    if ($limit <= 0 || $limit > 500) $limit = 100;
    $sql = "SELECT * FROM cashier_orders";
    $params = [];
    if ($role === 'cashier' && $c) {
        $sql .= " WHERE operator_name = :op";
        $params[':op'] = $c['username'];
    }
    $sql .= " ORDER BY created_at DESC LIMIT " . (int)$limit;

    $rows = [];
    try {
        $stmt = $db->prepare($sql);
        if (!$stmt) {
            exit(json_encode(['success' => false, 'message' => '查询失败: ' . $db->lastErrorMsg()], JSON_UNESCAPED_UNICODE));
        }
        foreach ($params as $k => $v) {
            $stmt->bindValue($k, $v, SQLITE3_TEXT);
        }
        $result = $stmt->execute();
        while ($r = $result->fetchArray(SQLITE3_ASSOC)) {
            if (!empty($r['items_detail'])) {
                $r['items_detail'] = json_decode($r['items_detail'], true) ?: [];
            }
            $rows[] = $r;
        }
    } catch (\Throwable $e) {
        // ★ 2026-07-07 加固：任何查询异常都返回合法 JSON，绝不把 PHP 报错文本注入响应
        //   （否则前端 r.json() 失败，订单页表现为“加载失败/报错”）。
        debugLog('[cashier.php] order_list 查询异常: ' . $e->getMessage() . ' @ ' . $e->getFile() . ':' . $e->getLine());
        debugLog('[cashier.php] order_list 异常堆栈: ' . $e->getTraceAsString());
        exit(json_encode([
            'success' => false,
            'message' => '订单查询异常: ' . $e->getMessage()
        ], JSON_UNESCAPED_UNICODE));
    }
    exit(json_encode(['success' => true, 'data' => $rows], JSON_UNESCAPED_UNICODE));
}

// ===== 收银员列表（仅管理员）=====
function cashierList() {
    requireAdminSession();
    $db = getDB();
    $result = $db->prepare("SELECT id, username, discount_limit_percent, can_cash, created_at, created_by FROM cashiers ORDER BY id ASC")->execute();
    $rows = [];
    while ($r = $result->fetchArray(SQLITE3_ASSOC)) {
        $rows[] = $r;
    }
    exit(json_encode(['success' => true, 'data' => $rows], JSON_UNESCAPED_UNICODE));
}

// ===== 新增收银员（仅管理员）=====
function cashierAdd() {
    requireAdminSession();
    $username = trim(getParam('username', ''));
    $password = getParam('password', '');
    $discountLimit = (int)getParam('discount_limit_percent', 0);
    $canCash = (int)getParam('can_cash', 0);
    if ($username === '' || $password === '') {
        exit(json_encode(['success' => false, 'message' => '账号和密码不能为空'], JSON_UNESCAPED_UNICODE));
    }
    if (!preg_match('/^[a-zA-Z0-9_]{3,20}$/', $username)) {
        exit(json_encode(['success' => false, 'message' => '账号格式不正确（3-20位英文/数字/下划线）'], JSON_UNESCAPED_UNICODE));
    }
    if ($discountLimit < 0 || $discountLimit > 100) {
        exit(json_encode(['success' => false, 'message' => '折扣上限需在0-100之间'], JSON_UNESCAPED_UNICODE));
    }
    if ($canCash < 0 || $canCash > 1) {
        exit(json_encode(['success' => false, 'message' => '现金收款权限需为0或1'], JSON_UNESCAPED_UNICODE));
    }
    $db = getDB();
    // 查重
    $chk = $db->prepare("SELECT id FROM cashiers WHERE username = :u");
    $chk->bindValue(':u', $username, SQLITE3_TEXT);
    if ($chk->execute()->fetchArray(SQLITE3_ASSOC)) {
        exit(json_encode(['success' => false, 'message' => '账号已存在'], JSON_UNESCAPED_UNICODE));
    }
    $hash = password_hash($password, PASSWORD_DEFAULT);
    $salt = bin2hex(random_bytes(8));
    $stmt = $db->prepare("INSERT INTO cashiers (username, password_hash, salt, discount_limit_percent, can_cash, created_at, created_by) VALUES (:u,:h,:s,:d,:c,:t,'admin')");
    $stmt->bindValue(':u', $username, SQLITE3_TEXT);
    $stmt->bindValue(':h', $hash, SQLITE3_TEXT);
    $stmt->bindValue(':s', $salt, SQLITE3_TEXT);
    $stmt->bindValue(':d', $discountLimit, SQLITE3_INTEGER);
    $stmt->bindValue(':c', $canCash, SQLITE3_INTEGER);
    $stmt->bindValue(':t', time(), SQLITE3_INTEGER);
    $stmt->execute();
    exit(json_encode(['success' => true, 'message' => '收银员创建成功'], JSON_UNESCAPED_UNICODE));
}

// ===== 编辑收银员（仅管理员）：可改密码 / 折扣上限 =====
function cashierEdit() {
    requireAdminSession();
    $id = (int)getParam('id', 0);
    if ($id <= 0) exit(json_encode(['success' => false, 'message' => '缺少id'], JSON_UNESCAPED_UNICODE));
    $db = getDB();
    $chk = $db->prepare("SELECT id FROM cashiers WHERE id = :id");
    $chk->bindValue(':id', $id, SQLITE3_INTEGER);
    if (!$chk->execute()->fetchArray(SQLITE3_ASSOC)) {
        exit(json_encode(['success' => false, 'message' => '收银员不存在'], JSON_UNESCAPED_UNICODE));
    }
    $sets = [];
    $params = [':id' => $id];
    $newPassword = getParam('password', '');
    if ($newPassword !== '') {
        $sets[] = "password_hash = :h";
        $params[':h'] = password_hash($newPassword, PASSWORD_DEFAULT);
        $sets[] = "salt = :s";
        $params[':s'] = bin2hex(random_bytes(8));
    }
    if (getParam('discount_limit_percent') !== null && getParam('discount_limit_percent') !== '') {
        $dl = (int)getParam('discount_limit_percent', 0);
        if ($dl < 0 || $dl > 100) {
            exit(json_encode(['success' => false, 'message' => '折扣上限需在0-100之间'], JSON_UNESCAPED_UNICODE));
        }
        $sets[] = "discount_limit_percent = :d";
        $params[':d'] = $dl;
    }
    if (getParam('can_cash') !== null && getParam('can_cash') !== '') {
        $cc = (int)getParam('can_cash', 0);
        if ($cc < 0 || $cc > 1) {
            exit(json_encode(['success' => false, 'message' => '现金收款权限需为0或1'], JSON_UNESCAPED_UNICODE));
        }
        $sets[] = "can_cash = :c";
        $params[':c'] = $cc;
    }
    if (empty($sets)) {
        exit(json_encode(['success' => false, 'message' => '没有可更新的字段'], JSON_UNESCAPED_UNICODE));
    }
    $sql = "UPDATE cashiers SET " . implode(', ', $sets) . " WHERE id = :id";
    $stmt = $db->prepare($sql);
    foreach ($params as $k => $v) {
        $stmt->bindValue($k, $v, is_int($v) ? SQLITE3_INTEGER : SQLITE3_TEXT);
    }
    $stmt->execute();
    exit(json_encode(['success' => true, 'message' => '收银员信息已更新'], JSON_UNESCAPED_UNICODE));
}

// ===== 删除收银员（仅管理员）=====
function cashierDelete() {
    requireAdminSession();
    $id = (int)getParam('id', 0);
    if ($id <= 0) exit(json_encode(['success' => false, 'message' => '缺少id'], JSON_UNESCAPED_UNICODE));
    $db = getDB();
    $stmt = $db->prepare("DELETE FROM cashiers WHERE id = :id");
    $stmt->bindValue(':id', $id, SQLITE3_INTEGER);
    $stmt->execute();
    exit(json_encode(['success' => true, 'message' => '收银员已删除'], JSON_UNESCAPED_UNICODE));
}