<?php
require_once __DIR__ . '/../core/bootstrap.php';
Auth::requireRole('super_admin');
require_once __DIR__ . '/_layout.php';

$siteId = (int)e_get('site');
$qs     = $siteId ? '&amp;site=' . $siteId : '';
$back   = 'reviews.php' . ($siteId ? '?site=' . $siteId : '');

$guard = function () {
    if (empty($_GET['csrf']) || !hash_equals(csrf_token(), (string)$_GET['csrf'])) {
        http_response_code(400);
        die('Invalid security token.');
    }
};

foreach (['approve' => 1, 'unapprove' => 0] as $action => $flag) {
    if ($v = e_get($action)) {
        $guard();
        db()->prepare("UPDATE reviews SET is_approved = ? WHERE id = ?")->execute([$flag, (int)$v]);
        flash('ok', $flag ? 'Review published.' : 'Review taken down.');
        redirect($back);
    }
}

if ($del = e_get('delete')) {
    $guard();
    $st = db()->prepare("SELECT image_path FROM reviews WHERE id = ?");
    $st->execute([(int)$del]);
    if ($r = $st->fetch()) {
        // shared stock images (review1.png ... review11.png) are never removed from disk
        if ($r['image_path'] && !preg_match('/^review\d+\.png$/', $r['image_path'])) {
            $f = __DIR__ . '/../uploads/vehicles/' . basename($r['image_path']);
            if (is_file($f)) @unlink($f);
        }
    }
    db()->prepare("DELETE FROM reviews WHERE id = ?")->execute([(int)$del]);
    flash('ok', 'Review deleted.');
    redirect($back);
}

if ($siteId) {
    $st = db()->prepare("SELECT r.* FROM reviews r
                         JOIN review_sites rs ON rs.review_id = r.id
                         WHERE rs.site_id = ?
                         ORDER BY r.is_approved ASC, r.created_at DESC LIMIT 300");
    $st->execute([$siteId]);
} else {
    $st = db()->query("SELECT r.* FROM reviews r ORDER BY r.is_approved ASC, r.created_at DESC LIMIT 300");
}
$reviews = $st->fetchAll();

// which sites each review is shown on, in one query
$map = [];
if ($reviews) {
    $ids = implode(',', array_map(fn($r) => (int)$r['id'], $reviews));
    foreach (db()->query("SELECT rs.review_id, s.company_name FROM review_sites rs
                          JOIN sites s ON s.id = rs.site_id
                          WHERE rs.review_id IN ($ids) ORDER BY s.company_name")->fetchAll() as $r) {
        $map[(int)$r['review_id']][] = $r['company_name'];
    }
}

$pending = (int)db()->query("SELECT COUNT(*) c FROM reviews WHERE is_approved = 0")->fetch()['c'];

admin_head('Reviews');
admin_topbar('Reviews', '<a href="review_form.php" class="btn">+ Add review</a>');
?>
<div class="card">
  <form method="get" class="filters">
    <select name="site" onchange="this.form.submit()">
      <option value="">All sites</option>
      <?php foreach (all_sites() as $s): ?>
        <option value="<?= (int)$s['id'] ?>" <?= $siteId === (int)$s['id'] ? 'selected' : '' ?>><?= h($s['company_name']) ?></option>
      <?php endforeach; ?>
    </select>
    <?php if ($pending): ?><span class="muted"><?= $pending ?> pending across the platform</span><?php endif; ?>
    <noscript><button class="btn small" type="submit">Filter</button></noscript>
  </form>

  <table>
    <tr><th>Date</th><th>Author</th><th>Rating</th><th>Content</th><th>Shown on</th><th>Status</th><th></th></tr>
    <?php foreach ($reviews as $r): $sitesOf = $map[(int)$r['id']] ?? []; ?>
    <tr<?= $r['is_approved'] ? '' : ' class="unread"' ?>>
      <td style="white-space:nowrap"><?= h(date('d M Y', strtotime($r['created_at']))) ?></td>
      <td><?= h($r['author_name']) ?></td>
      <td style="white-space:nowrap"><?= str_repeat('★', (int)$r['rating']) . str_repeat('☆', 5 - (int)$r['rating']) ?></td>
      <td><div class="msgbox"><?= h($r['content']) ?></div></td>
      <td>
        <div class="pillrow">
          <?php if ($sitesOf): foreach ($sitesOf as $n): ?><span class="p"><?= h($n) ?></span><?php endforeach;
                else: ?><span class="p none">no site</span><?php endif; ?>
        </div>
      </td>
      <td><span class="badge <?= $r['is_approved'] ? 'available' : 'reserved' ?>"><?= $r['is_approved'] ? 'Published' : 'Pending' ?></span></td>
      <td style="white-space:nowrap">
        <a class="btn small secondary" href="review_form.php?id=<?= (int)$r['id'] ?>">Edit</a>
        <?php if ($r['is_approved']): ?>
          <a class="btn small secondary" href="reviews.php?unapprove=<?= (int)$r['id'] ?>&amp;csrf=<?= h(csrf_token()) ?><?= $qs ?>">Take down</a>
        <?php else: ?>
          <a class="btn small" href="reviews.php?approve=<?= (int)$r['id'] ?>&amp;csrf=<?= h(csrf_token()) ?><?= $qs ?>">Publish</a>
        <?php endif; ?>
        <a class="btn small danger" href="reviews.php?delete=<?= (int)$r['id'] ?>&amp;csrf=<?= h(csrf_token()) ?><?= $qs ?>" onclick="return confirm('Delete this review?')">Delete</a>
      </td>
    </tr>
    <?php endforeach; ?>
    <?php if (!$reviews): ?><tr><td colspan="7">No reviews. <a href="review_form.php">Add one</a>.</td></tr><?php endif; ?>
  </table>
</div>
<?php admin_foot(); ?>
