<?php
/**
 * Admin-only dev fixture import (local / test environments).
 */

require_once __DIR__ . '/../lib/dev_fixture.php';

$tokenRec = require_valid_token_web();
require_role(['admin'], $tokenRec);

if ($method !== 'POST') {
    json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
}

$body = read_json_body();
$action = trim((string)($body['action'] ?? 'import'));

try {
    [$pdo, $tmpDb, $lockFp] = qdb_open(true);

    if ($action === 'remove') {
        $result = qdb_remove_dev_test_data($pdo, [
            'usernamePrefix'  => $body['usernamePrefix'] ?? 'dev_',
            'clientCodePrefix' => $body['clientCodePrefix'] ?? 'DEV-CL-',
        ]);
        qdb_save($tmpDb, $lockFp);
        json_success($result);
    }

    if ($action === 'wipeExceptAdmins') {
        $result = qdb_wipe_all_data_except_admins($pdo);
        qdb_save($tmpDb, $lockFp);
        json_success($result);
    }

    $fixture = $body['fixture'] ?? null;
    if (!is_array($fixture)) {
        qdb_discard($tmpDb, $lockFp);
        json_error('MISSING_FIELDS', 'fixture object is required for import', 400);
    }

    $result = qdb_import_dev_fixture($pdo, $fixture);
    qdb_save($tmpDb, $lockFp);
    json_success($result);
} catch (Throwable $e) {
    if (isset($tmpDb, $lockFp)) {
        qdb_discard($tmpDb, $lockFp);
    }
    $labels = [
        'remove'           => 'Remove',
        'wipeExceptAdmins' => 'Wipe',
        'import'           => 'Import',
    ];
    $label = $labels[$action ?? 'import'] ?? 'Operation';
    error_log("dev fixture $label: " . $e->getMessage());
    json_error('SERVER_ERROR', "$label failed: " . $e->getMessage(), 500);
}