<?php
// ============================================================
//  Admin — Edit / Add subscription
// ============================================================
//
//  Two modes:
//    ?id=X         — edit existing subscription (payment_token row)
//    ?action=add   — add a manual subscription for a member
//    ?action=add&member_id=X — pre-fill member
//
//  Changes that affect the website:
//    - status change    → member.status updated
//    - tier change      → member.tier updated
//    - next_charge_at   → updated on payment_tokens row
//    - renewal_date     → updated on members row
//    - activate         → member.status = active
//    - cancel           → member.status = cancelled (cancellation email queued)
//    - add manual sub   → creates payment_token row, activates member,
//                         creates invoice + transaction
//
// ============================================================

$page_title = 'Subscription';
require __DIR__ . '/_guard.php';
require_once __DIR__ . '/../includes/payfast.php';
require_once __DIR__ . '/../includes/member_history.php';

$action = $_GET['action'] ?? 'edit';
$sub_id = (int)($_GET['id'] ?? 0);
$sub    = null;
$member = null;

$TIER_PRICES = [
    'Bronze'   =>  50000,
    'Silver'   => 120000,
    'Gold'     => 250000,
    'Platinum' => 500000,
    'Diamond'  => 1000000,
];

// Load existing subscription
if ($sub_id) {
    $sub = db_row(
        'SELECT pt.*, m.first_name, m.last_name, m.email, m.business_name,
                m.tier, m.status AS member_status, m.renewal_date, m.id AS member_id
           FROM payment_tokens pt
           JOIN members m ON m.id = pt.member_id
           WHERE pt.id = :id',
        ['id' => $sub_id]
    );
    if (!$sub) { http_response_code(404); echo 'Subscription not found'; exit; }
    $member = db_row('SELECT * FROM members WHERE id = :id', ['id' => $sub['member_id']]);
}

// For add mode, load all members for the dropdown
$all_members = db_all(
    "SELECT id, email, first_name, last_name, business_name, tier, status
       FROM members ORDER BY business_name"
);

$errors  = [];
$success = '';

// ============================================================
//  Handle POST
// ============================================================
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    $do = $_POST['do'] ?? '';

    // ── Save changes to existing subscription ───────────────
    if ($do === 'save' && $sub_id) {
        $new_status         = $_POST['sub_status']    ?? $sub['status'];
        $new_next_charge    = $_POST['next_charge_at'] ?? $sub['next_charge_at'];
        $new_tier           = $_POST['tier']          ?? $sub['tier'];
        $new_renewal        = $_POST['renewal_date']  ?? $member['renewal_date'];
        $new_member_status  = $_POST['member_status'] ?? $sub['member_status'];

        // Validate
        if (!in_array($new_status, ['active','cancelled','failed'], true)) {
            $errors[] = 'Invalid subscription status.';
        }
        if (!in_array($new_tier, array_keys($TIER_PRICES), true)) {
            $errors[] = 'Invalid tier.';
        }
        if (!in_array($new_member_status, ['pending','active','suspended','cancelled'], true)) {
            $errors[] = 'Invalid member status.';
        }

        if (empty($errors)) {
            // Update payment_token
            db_exec(
                'UPDATE payment_tokens
                    SET status = :s,
                        next_charge_at = :nc,
                        cancelled_at = IF(:s2 = "cancelled" AND cancelled_at IS NULL, NOW(), cancelled_at)
                    WHERE id = :id',
                ['s' => $new_status, 'nc' => $new_next_charge ?: null,
                 's2' => $new_status, 'id' => $sub_id]
            );

            // Update member
            db_exec(
                'UPDATE members SET tier = :t, status = :ms, renewal_date = :rd WHERE id = :id',
                ['t' => $new_tier, 'ms' => $new_member_status,
                 'rd' => $new_renewal ?: null, 'id' => $sub['member_id']]
            );

            // Refresh + log
            $fresh_member = db_row('SELECT * FROM members WHERE id = :id', ['id' => $sub['member_id']]);
            app_log("Admin edited subscription #{$sub_id} for member {$sub['member_id']}");

            // Member-history audit
            $changes = [];
            if ($sub['tier']          !== $new_tier)          $changes['tier']         = ['from'=>$sub['tier'],          'to'=>$new_tier];
            if ($sub['member_status'] !== $new_member_status) $changes['status']       = ['from'=>$sub['member_status'], 'to'=>$new_member_status];
            if ((string)($sub['renewal_date'] ?? '') !== (string)($new_renewal ?? '')) {
                $changes['renewal_date'] = ['from'=>$sub['renewal_date'] ?? '', 'to'=>$new_renewal ?? ''];
            }
            if (!empty($changes)) {
                $human = array_map(fn($k) => str_replace('_',' ',$k), array_keys($changes));
                member_history_log(
                    (int)$sub['member_id'],
                    'subscription_edited',
                    'Subscription updated: ' . implode(', ', $human),
                    $changes
                );
            }
            if ($new_member_status === 'cancelled' && $sub['member_status'] !== 'cancelled') {
                member_history_log((int)$sub['member_id'], 'subscription_cancelled',
                    'Subscription cancelled by admin', null);
            }

            header('Location: subscriptions.php?msg=' . urlencode('Subscription updated.'));
            exit;
        }
    }

    // ── Add a manual invoice / record a payment ─────────────
    if ($do === 'add_invoice' && $sub_id) {
        $amount_r   = (float)str_replace(',', '.', $_POST['amount'] ?? '0');
        $amount_c   = (int)round($amount_r * 100);
        $reference  = trim($_POST['reference'] ?? 'Manual / EFT');
        $description = trim($_POST['description'] ?? 'Manual payment');

        if ($amount_c <= 0) {
            $errors[] = 'Amount must be greater than zero.';
        } else {
            $inv_number = 'MAN-' . date('Y') . '-' . str_pad((string)$sub['member_id'], 4, '0', STR_PAD_LEFT)
                        . '-' . substr(bin2hex(random_bytes(2)), 0, 4);
            $inv_id = db_insert('invoices', [
                'member_id'    => $sub['member_id'],
                'type'         => 'membership',
                'number'       => $inv_number,
                'description'  => $description,
                'amount_cents' => $amount_c,
                'status'       => 'paid',
                'issued_at'    => date('Y-m-d'),
                'due_at'       => date('Y-m-d'),
                'paid_at'      => date('Y-m-d H:i:s'),
            ]);
            db_insert('transactions', [
                'member_id'    => $sub['member_id'],
                'invoice_id'   => $inv_id,
                'type'         => 'charge',
                'amount_cents' => $amount_c,
                'description'  => $description,
            ]);
            db_insert('transactions', [
                'member_id'    => $sub['member_id'],
                'invoice_id'   => $inv_id,
                'type'         => 'payment',
                'amount_cents' => -$amount_c,
                'description'  => 'Payment received — ' . $reference,
                'reference'    => $reference,
            ]);

            // Extend next charge and renewal
            db_exec(
                'UPDATE payment_tokens SET last_charge_at = NOW(),
                    next_charge_at = DATE_ADD(CURDATE(), INTERVAL 1 MONTH)
                    WHERE id = :id',
                ['id' => $sub_id]
            );
            db_exec(
                'UPDATE members SET status = "active",
                    renewal_date = DATE_ADD(CURDATE(), INTERVAL 1 MONTH)
                    WHERE id = :id',
                ['id' => $sub['member_id']]
            );

            $fresh = db_row('SELECT * FROM members WHERE id = :id', ['id' => $sub['member_id']]);
            app_log("Admin activated subscription #{$sub_id} for member {$sub['member_id']}");

            $amount_display = 'R ' . number_format($amount_c/100, 2, '.', ' ');
            member_history_log(
                (int)$sub['member_id'],
                'payment_received',
                "Manual payment recorded — {$amount_display} ({$reference})",
                ['amount' => $amount_display, 'reference' => $reference, 'recorded_by' => 'admin']
            );

            header('Location: subscription-edit.php?id=' . $sub_id . '&msg=' . urlencode('Invoice added and member extended by 1 month.'));
            exit;
        }
    }

    // ── Add a brand new manual subscription ─────────────────
    if ($do === 'create') {
        $member_id  = (int)($_POST['member_id'] ?? 0);
        $tier       = $_POST['tier'] ?? 'Bronze';
        $method     = trim($_POST['method'] ?? 'eft');
        $amount_r   = (float)str_replace(',', '.', $_POST['amount'] ?? '0');
        $amount_c   = $amount_r > 0
            ? (int)round($amount_r * 100)
            : ($TIER_PRICES[$tier] ?? 50000);
        $reference  = trim($_POST['reference'] ?? 'Manual');
        $start_date = $_POST['start_date'] ?? date('Y-m-d');

        if (!$member_id) { $errors[] = 'Please select a member.'; }
        if (!in_array($tier, array_keys($TIER_PRICES), true)) { $errors[] = 'Invalid tier.'; }

        if (empty($errors)) {
            $target_member = db_row('SELECT * FROM members WHERE id = :id', ['id' => $member_id]);
            if (!$target_member) { $errors[] = 'Member not found.'; }
        }

        if (empty($errors)) {
            // Create a unique token for manual subscriptions
            $manual_token = 'manual-' . $member_id . '-' . time();

            $tok_id = db_insert('payment_tokens', [
                'member_id'     => $member_id,
                'gateway'       => $method === 'payfast' ? 'payfast' : 'manual',
                'token'         => $manual_token,
                'purpose'       => 'membership',
                'status'        => 'active',
                'last_charge_at' => $start_date . ' 00:00:00',
                'next_charge_at' => date('Y-m-d', strtotime($start_date . ' +1 month')),
            ]);

            // Update member tier + status + renewal
            db_exec(
                'UPDATE members SET tier = :t, status = "active",
                    renewal_date = DATE_ADD(:sd, INTERVAL 1 MONTH)
                    WHERE id = :id',
                ['t' => $tier, 'sd' => $start_date, 'id' => $member_id]
            );

            // Create paid invoice + transactions
            $inv_number = 'MAN-' . date('Y') . '-' . str_pad((string)$member_id, 4, '0', STR_PAD_LEFT)
                        . '-' . substr(bin2hex(random_bytes(2)), 0, 4);
            $inv_id = db_insert('invoices', [
                'member_id'    => $member_id,
                'type'         => 'membership',
                'number'       => $inv_number,
                'description'  => $tier . ' membership (monthly — manual)',
                'amount_cents' => $amount_c,
                'status'       => 'paid',
                'issued_at'    => $start_date,
                'due_at'       => $start_date,
                'paid_at'      => $start_date . ' 00:00:00',
            ]);
            db_insert('transactions', [
                'member_id'    => $member_id,
                'invoice_id'   => $inv_id,
                'type'         => 'charge',
                'amount_cents' => $amount_c,
                'description'  => $tier . ' membership charge',
                'occurred_at'  => $start_date . ' 00:00:00',
            ]);
            db_insert('transactions', [
                'member_id'    => $member_id,
                'invoice_id'   => $inv_id,
                'type'         => 'payment',
                'amount_cents' => -$amount_c,
                'description'  => 'Payment received — ' . $reference,
                'reference'    => $reference,
                'occurred_at'  => $start_date . ' 00:00:00',
            ]);

            $fresh = db_row('SELECT * FROM members WHERE id = :id', ['id' => $member_id]);
            app_log("Admin created manual subscription for member {$member_id} ({$fresh['email']})");

            $amount_display = 'R ' . number_format($amount_c/100, 2, '.', ' ');
            member_history_log(
                (int)$member_id,
                'subscription_added',
                "Manual subscription added — {$tier} ({$amount_display}, {$method})",
                ['tier'=>$tier, 'amount'=>$amount_display, 'method'=>$method, 'reference'=>$reference]
            );

            header('Location: subscription-edit.php?id=' . $tok_id . '&msg=' . urlencode('Subscription created and member activated.'));
            exit;
        }
    }
}

// Reload after any non-redirecting save
if ($sub_id) {
    $sub = db_row(
        'SELECT pt.*, m.first_name, m.last_name, m.email, m.business_name,
                m.tier, m.status AS member_status, m.renewal_date, m.id AS member_id
           FROM payment_tokens pt
           JOIN members m ON m.id = pt.member_id
           WHERE pt.id = :id',
        ['id' => $sub_id]
    );
    $member = db_row('SELECT * FROM members WHERE id = :id', ['id' => $sub['member_id']]);
}

// Invoice history for the member
$invoices = $member
    ? db_all('SELECT * FROM invoices WHERE member_id = :m ORDER BY issued_at DESC LIMIT 24',
             ['m' => $member['id']])
    : [];

function cents_to_rand(int $cents): string {
    return 'R ' . number_format($cents / 100, 2, '.', ' ');
}

$is_add = ($action === 'add' && !$sub_id);
$prefill_member_id = (int)($_GET['member_id'] ?? 0);
?>

<section class="section">
    <div class="container">

        <p class="muted" style="margin:0;"><a href="subscriptions.php">&larr; All subscriptions</a></p>
        <h1><?= $is_add ? 'Add subscription' : 'Edit subscription' ?></h1>

        <?php if (!empty($errors)): ?>
            <div class="alert alert-error">
                <?= implode('<br>', array_map('htmlspecialchars', $errors)) ?>
            </div>
        <?php endif; ?>
        <?php if (isset($_GET['msg'])): ?>
            <div class="alert alert-success" data-autohide>
                <?= htmlspecialchars($_GET['msg']) ?>
            </div>
        <?php endif; ?>

        <?php if ($is_add): ?>
        <!-- ── ADD A NEW MANUAL SUBSCRIPTION ──────────────────── -->
        <div class="card">
            <h2 style="margin-top:0;">New subscription</h2>
            <p class="muted">
                Use this to add a subscription for a member who paid by EFT or outside the website.
                This activates their account and updates their tier in the directory.
            </p>
            <form method="post" action="subscription-edit.php?action=add">
                <?= csrf_field() ?>
                <input type="hidden" name="do" value="create">

                <label>Member *</label>
                <select name="member_id" required>
                    <option value="">— choose —</option>
                    <?php foreach ($all_members as $m): ?>
                        <option value="<?= $m['id'] ?>"
                                <?= $m['id'] === $prefill_member_id ? 'selected' : '' ?>>
                            <?= htmlspecialchars($m['business_name']) ?>
                            (<?= htmlspecialchars($m['email']) ?>)
                            — <?= htmlspecialchars($m['status']) ?>
                        </option>
                    <?php endforeach; ?>
                </select>

                <div class="grid grid-2" style="gap:0 1.25rem;">
                    <div>
                        <label>Tier *</label>
                        <select name="tier" required id="tier-select">
                            <?php foreach (array_keys($TIER_PRICES) as $t): ?>
                                <option value="<?= $t ?>"><?= $t ?>
                                    (R <?= number_format($TIER_PRICES[$t] / 100, 0) ?>/mo)
                                </option>
                            <?php endforeach; ?>
                        </select>
                    </div>
                    <div>
                        <label>Amount (R) *
                            <small>leave blank to use tier default</small>
                        </label>
                        <input type="number" name="amount" step="0.01" min="0"
                               placeholder="e.g. 500.00" id="amount-input">
                    </div>
                </div>

                <div class="grid grid-2" style="gap:0 1.25rem;">
                    <div>
                        <label>Payment method</label>
                        <select name="method">
                            <option value="eft">EFT / Bank transfer</option>
                            <option value="cash">Cash</option>
                            <option value="payfast">PayFast (external)</option>
                            <option value="other">Other</option>
                        </select>
                    </div>
                    <div>
                        <label>Start date *</label>
                        <input type="date" name="start_date" required value="<?= date('Y-m-d') ?>">
                    </div>
                </div>

                <label>Payment reference
                    <small>invoice number, proof of payment ref, etc.</small>
                </label>
                <input type="text" name="reference" placeholder="e.g. EFT20260422">

                <div class="mt-3">
                    <button type="submit" class="btn">Create subscription + activate member</button>
                    <a href="subscriptions.php" class="btn btn-outline">Cancel</a>
                </div>

                <p class="muted mt-2" style="font-size:.85rem;">
                    This will: activate the member account, update their directory listing,
                    and create a paid invoice.
                </p>
            </form>
        </div>

        <script>
        // Auto-fill amount from tier default
        const prices = <?= json_encode(array_map(fn($c) => $c/100, $TIER_PRICES)) ?>;
        document.getElementById('tier-select').addEventListener('change', function() {
            const amtInput = document.getElementById('amount-input');
            if (!amtInput.value) {
                amtInput.placeholder = (prices[this.value] ?? '') + '.00';
            }
        });
        </script>

        <?php else: ?>
        <!-- ── EDIT EXISTING SUBSCRIPTION ─────────────────────── -->
        <div class="grid grid-2">

            <!-- Main form -->
            <form method="post" action="subscription-edit.php?id=<?= $sub_id ?>" class="card">
                <?= csrf_field() ?>
                <input type="hidden" name="do" value="save">

                <h2 style="margin-top:0;">
                    <?= htmlspecialchars($sub['business_name']) ?>
                </h2>
                <p class="muted" style="margin-top:0;">
                    <?= htmlspecialchars($sub['email']) ?><br>
                    <small>Token: <?= $sub['token'] ? substr($sub['token'], 0, 12) . '…' : 'manual' ?></small>
                </p>

                <label>Subscription status</label>
                <select name="sub_status">
                    <option value="active"    <?= $sub['status']==='active'?'selected':'' ?>>Active</option>
                    <option value="cancelled" <?= $sub['status']==='cancelled'?'selected':'' ?>>Cancelled</option>
                    <option value="failed"    <?= $sub['status']==='failed'?'selected':'' ?>>Failed</option>
                </select>
                <p class="muted" style="font-size:.8rem;margin-top:.25rem;">
                    Setting to "Cancelled" also sets member status to cancelled and fires the
                    cancellation email.
                </p>

                <label>Member status</label>
                <select name="member_status">
                    <option value="active"    <?= $sub['member_status']==='active'?'selected':'' ?>>Active</option>
                    <option value="pending"   <?= $sub['member_status']==='pending'?'selected':'' ?>>Pending</option>
                    <option value="suspended" <?= $sub['member_status']==='suspended'?'selected':'' ?>>Suspended</option>
                    <option value="cancelled" <?= $sub['member_status']==='cancelled'?'selected':'' ?>>Cancelled</option>
                </select>
                <p class="muted" style="font-size:.8rem;margin-top:.25rem;">
                    Controls whether the member can log in and whether their listing is public.
                </p>

                <label>Tier</label>
                <select name="tier">
                    <?php foreach (array_keys($TIER_PRICES) as $t): ?>
                        <option value="<?= $t ?>" <?= $sub['tier']===$t?'selected':'' ?>>
                            <?= $t ?> (R <?= number_format($TIER_PRICES[$t]/100, 0) ?>/mo)
                        </option>
                    <?php endforeach; ?>
                </select>

                <div class="grid grid-2" style="gap:0 1.25rem;">
                    <div>
                        <label>Next charge date</label>
                        <input type="date" name="next_charge_at"
                               value="<?= htmlspecialchars($sub['next_charge_at'] ?? '') ?>">
                    </div>
                    <div>
                        <label>Renewal date (member record)</label>
                        <input type="date" name="renewal_date"
                               value="<?= htmlspecialchars($member['renewal_date'] ?? '') ?>">
                    </div>
                </div>

                <button type="submit" class="btn mt-3">Save changes</button>
                <a href="subscriptions.php" class="btn btn-outline mt-3">Cancel</a>

                <p class="muted mt-2" style="font-size:.85rem;">
                    Saving updates the subscription, member account, and directory listing.
                </p>
            </form>

            <div>
                <!-- Add manual payment -->
                <div class="card">
                    <h3 style="margin-top:0;">Record a manual payment</h3>
                    <p class="muted" style="font-size:.9rem;">
                        Use this when a member paid by EFT for another month.
                        Creates a paid invoice and extends their subscription by 1 month.
                    </p>
                    <form method="post" action="subscription-edit.php?id=<?= $sub_id ?>">
                        <?= csrf_field() ?>
                        <input type="hidden" name="do" value="add_invoice">

                        <label>Amount (R) *</label>
                        <input type="number" name="amount" step="0.01" min="1" required
                               value="<?= number_format(($TIER_PRICES[$sub['tier']] ?? 50000) / 100, 2) ?>">

                        <label>Description</label>
                        <input type="text" name="description"
                               value="<?= htmlspecialchars($sub['tier']) ?> membership (monthly)">

                        <label>Payment reference</label>
                        <input type="text" name="reference" placeholder="EFT ref / proof of payment">

                        <button type="submit" class="btn mt-2">
                            Record payment + extend 1 month
                        </button>
                    </form>
                </div>

                <!-- Subscription info -->
                <div class="card mt-3">
                    <h3 style="margin-top:0;">Subscription details</h3>
                    <table>
                        <tr>
                            <td class="muted">Gateway</td>
                            <td><?= htmlspecialchars($sub['gateway']) ?></td>
                        </tr>
                        <tr>
                            <td class="muted">Created</td>
                            <td><?= date('j M Y', strtotime($sub['created_at'])) ?></td>
                        </tr>
                        <tr>
                            <td class="muted">Last charged</td>
                            <td><?= $sub['last_charge_at'] ? date('j M Y H:i', strtotime($sub['last_charge_at'])) : '—' ?></td>
                        </tr>
                        <tr>
                            <td class="muted">Next charge</td>
                            <td><?= $sub['next_charge_at'] ? date('j M Y', strtotime($sub['next_charge_at'])) : '—' ?></td>
                        </tr>
                        <tr>
                            <td class="muted">Cancelled</td>
                            <td><?= $sub['cancelled_at'] ? date('j M Y', strtotime($sub['cancelled_at'])) : '—' ?></td>
                        </tr>
                    </table>
                    <div class="mt-2">
                        <a href="member-edit.php?id=<?= $sub['member_id'] ?>" class="btn btn-outline">
                            View full member profile &rarr;
                        </a>
                    </div>
                </div>
            </div>
        </div>

        <!-- Invoice history -->
        <div class="card mt-3">
            <h2 style="margin-top:0;">Invoice history</h2>
            <?php if (empty($invoices)): ?>
                <p class="muted">No invoices yet.</p>
            <?php else: ?>
                <table>
                    <tr>
                        <th>Number</th>
                        <th>Date</th>
                        <th>Description</th>
                        <th style="text-align:right;">Amount</th>
                        <th>Status</th>
                    </tr>
                    <?php foreach ($invoices as $inv): ?>
                        <tr>
                            <td><code><?= htmlspecialchars($inv['number']) ?></code></td>
                            <td><?= date('j M Y', strtotime($inv['issued_at'])) ?></td>
                            <td><?= htmlspecialchars($inv['description']) ?></td>
                            <td style="text-align:right;"><?= cents_to_rand((int)$inv['amount_cents']) ?></td>
                            <td>
                                <?php $cls = $inv['status']==='paid'?'tag-ok':'tag-err'; ?>
                                <span class="tag <?= $cls ?>"><?= htmlspecialchars($inv['status']) ?></span>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                </table>
            <?php endif; ?>
        </div>

        <?php endif; ?>

    </div>
</section>

<?php require __DIR__ . '/_footer.php'; ?>