<?php
// Matikan error output agar tidak merusak JSON
ini_set('display_errors', 0);
error_reporting(0);

header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-API-Key');
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(200); exit; }

require_once __DIR__ . '/../config/db.php';

$endpoint = $_GET['endpoint'] ?? '';
$method   = $_SERVER['REQUEST_METHOD'];

function respond(array $data, int $code = 200): void {
    http_response_code($code);
    echo json_encode($data, JSON_UNESCAPED_UNICODE);
    exit;
}

// ══════════════════════════════════════════════════════════════════
// MIDTRANS WEBHOOK — bypass API key, pakai signature verification
// HARUS di atas API key check!
// ══════════════════════════════════════════════════════════════════
if ($endpoint === 'midtrans_webhook' && $method === 'POST') {
    require __DIR__ . '/endpoints/midtrans_webhook_post.php';
    exit;
}

// ══════════════════════════════════════════════════════════════════
// API Key check untuk semua endpoint lain
// ══════════════════════════════════════════════════════════════════
define('API_KEY', 'spp_secret_key_2024');
$reqKey = $_SERVER['HTTP_X_API_KEY'] ?? ($_GET['api_key'] ?? '');
if ($reqKey !== API_KEY) {
    http_response_code(401);
    echo json_encode(['status' => 'error', 'message' => 'Unauthorized']);
    exit;
}

$body = json_decode(file_get_contents('php://input'), true) ?? [];

// ── LOGIN ──
if ($endpoint === 'login' && $method === 'POST') {
    require __DIR__ . '/endpoints/login_post.php';

// ── SISWA ──
} elseif ($endpoint === 'siswa' && $method === 'GET') {
    require __DIR__ . '/endpoints/siswa_get.php';
} elseif ($endpoint === 'siswa' && $method === 'POST') {
    require __DIR__ . '/endpoints/siswa_post.php';
} elseif ($endpoint === 'siswa' && $method === 'PUT') {
    require __DIR__ . '/endpoints/siswa_put.php';
} elseif ($endpoint === 'siswa' && $method === 'DELETE') {
    require __DIR__ . '/endpoints/siswa_delete.php';

// ── TAGIHAN ──
} elseif ($endpoint === 'tagihan' && $method === 'GET') {
    require __DIR__ . '/endpoints/tagihan_get.php';

// ── TAGIHAN SISWA ──
} elseif ($endpoint === 'tagihan_siswa' && $method === 'GET') {
    require __DIR__ . '/endpoints/tagihan_siswa_get.php';

// ── PEMBAYARAN ──
} elseif ($endpoint === 'pembayaran' && $method === 'POST') {
    require __DIR__ . '/endpoints/pembayaran_post.php';

// ── MIDTRANS TOKEN ──
} elseif ($endpoint === 'midtrans_token' && $method === 'POST') {
    require __DIR__ . '/endpoints/midtrans_token_post.php';

// ── RIWAYAT ──
} elseif ($endpoint === 'riwayat' && $method === 'GET') {
    require __DIR__ . '/endpoints/riwayat_get.php';

// ── RIWAYAT SISWA ──
} elseif ($endpoint === 'riwayat_siswa' && $method === 'GET') {
    require __DIR__ . '/endpoints/riwayat_siswa_get.php';

// ── DASHBOARD ──
} elseif ($endpoint === 'dashboard' && $method === 'GET') {
    require __DIR__ . '/endpoints/dashboard_get.php';

// ── GANTI PASSWORD ──
} elseif ($endpoint === 'ganti_password' && $method === 'POST') {
    require __DIR__ . '/endpoints/ganti_password_post.php';

} else {
    http_response_code(404);
    echo json_encode(['status' => 'error', 'message' => 'Endpoint tidak ditemukan'], JSON_UNESCAPED_UNICODE);
}
