<?php
require_once __DIR__ . '/includes/auth.php';
require_admin();

if ($_SERVER['REQUEST_METHOD'] === 'POST' && csrf_check()) {
    $name = trim($_POST['name'] ?? '');
    $role = trim($_POST['role'] ?? '');
    $quote = trim($_POST['quote'] ?? '');
    $rating = max(1, min(5, (int)($_POST['rating'] ?? 5)));
    $sortOrder = (int)($_POST['sort_order'] ?? 0);
    if ($name !== '' && $quote !== '') {
        if (!empty($_POST['id'])) {
            db()->prepare('UPDATE testimonials SET name=?, role=?, quote=?, rating=?, sort_order=? WHERE id=?')
                ->execute([$name, $role, $quote, $rating, $sortOrder, (int)$_POST['id']]);
        } else {
            db()->prepare('INSERT INTO testimonials (name, role, quote, rating, sort_order, photo) VALUES (?,?,?,?,?,\'\')')
                ->execute([$name, $role, $quote, $rating, $sortOrder]);
        }
    }
    header('Location: /admin/testimonials.php');
    exit;
}
if (!empty($_GET['delete']) && isset($_GET['csrf']) && hash_equals($_SESSION['csrf'] ?? '', $_GET['csrf'])) {
    db()->prepare('DELETE FROM testimonials WHERE id=?')->execute([(int)$_GET['delete']]);
    header('Location: /admin/testimonials.php');
    exit;
}

$editing = null;
if (!empty($_GET['edit'])) {
    $stmt = db()->prepare('SELECT * FROM testimonials WHERE id=?');
    $stmt->execute([(int)$_GET['edit']]);
    $editing = $stmt->fetch();
}

$testimonials = db()->query('SELECT * FROM testimonials ORDER BY sort_order')->fetchAll();
$pageTitle = 'Testimonials';
include __DIR__ . '/includes/layout-header.php';
?>
<div class="admin-card mb-6">
  <h3><?= $editing ? 'Edit Testimonial' : 'Add Testimonial' ?></h3>
  <form method="post">
    <input type="hidden" name="csrf" value="<?= e(csrf_token()) ?>">
    <?php if ($editing): ?><input type="hidden" name="id" value="<?= (int)$editing['id'] ?>"><?php endif; ?>
    <div class="field-row mb-4">
      <div class="field"><label>Name</label><input type="text" name="name" value="<?= e($editing['name'] ?? '') ?>" required></div>
      <div class="field"><label>Role / Location</label><input type="text" name="role" value="<?= e($editing['role'] ?? '') ?>"></div>
    </div>
    <div class="field mb-4"><label>Quote</label><textarea name="quote" rows="3" required><?= e($editing['quote'] ?? '') ?></textarea></div>
    <div class="field-row mb-4">
      <div class="field"><label>Rating (1-5)</label><input type="number" min="1" max="5" name="rating" value="<?= e($editing['rating'] ?? '5') ?>"></div>
      <div class="field"><label>Sort Order</label><input type="number" name="sort_order" value="<?= e($editing['sort_order'] ?? '0') ?>"></div>
    </div>
    <button type="submit" class="btn btn-primary"><?= $editing ? 'Update' : 'Add' ?> Testimonial</button>
    <?php if ($editing): ?><a href="/admin/testimonials.php" class="btn btn-outline">Cancel</a><?php endif; ?>
  </form>
</div>
<div class="admin-card" style="padding:0;overflow-x:auto;">
  <table class="admin-table">
    <thead><tr><th>Name</th><th>Quote</th><th>Rating</th><th></th></tr></thead>
    <tbody>
      <?php foreach ($testimonials as $t): ?>
        <tr>
          <td><?= e($t['name']) ?><br><span class="text-muted text-xs"><?= e($t['role']) ?></span></td>
          <td><?= e(truncate($t['quote'], 80)) ?></td>
          <td><?= str_repeat('★', (int)$t['rating']) ?></td>
          <td class="flex gap-2">
            <a href="/admin/testimonials.php?edit=<?= (int)$t['id'] ?>" class="btn btn-outline btn-sm">Edit</a>
            <a href="/admin/testimonials.php?delete=<?= (int)$t['id'] ?>&csrf=<?= e(csrf_token()) ?>" class="btn btn-outline btn-sm" onclick="return confirm('Delete this testimonial?')">Delete</a>
          </td>
        </tr>
      <?php endforeach; ?>
    </tbody>
  </table>
</div>
<?php include __DIR__ . '/includes/layout-footer.php'; ?>
