<?php
/** admin2/api/auth.php — Auth rules + WoT status. */
require_once __DIR__ . '/../lib/helpers.php';
$pdo = db();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $input = json_decode(file_get_contents('php://input'), true);
    $action = $input['action'] ?? '';
    try {
        if ($action === 'add') {
            $pdo->prepare("INSERT INTO auth_rules (rule_type, pattern_type, pattern_value) VALUES (?, 'pubkey', ?)")->execute([$input['rule_type'], $input['pattern_value']]);
            json_response(['message' => 'Rule added']);
        } elseif ($action === 'remove') {
            $pdo->prepare("DELETE FROM auth_rules WHERE id = ?")->execute([intval($input['id'])]);
            json_response(['message' => 'Rule removed']);
        } elseif ($action === 'set_wot_level') {
            $pdo->prepare("UPDATE config SET value = ? WHERE key = 'wot_level'")->execute([strval($input['level'])]);
            json_response(['message' => 'WoT level set']);
        } elseif ($action === 'sync_wot') {
            json_response(['message' => 'WoT sync not available via PHP (requires relay)']);
        }
    } catch (PDOException $e) { json_response(['error' => $e->getMessage()]); }
}

// GET: WoT status
if (isset($_GET['action']) && $_GET['action'] === 'wot') {
    $level = $pdo->query("SELECT value FROM config WHERE key = 'wot_level'")->fetchColumn() ?: '0';
    $wl_count = 0;
    try { $wl_count = intval($pdo->query("SELECT count(*) FROM auth_rules WHERE rule_type = 'whitelist'")->fetchColumn()); } catch (PDOException $e) {}
    $descriptions = ['0' => 'Level 0: Open relay — anyone can read and write', '1' => 'Level 1: Write only — WoT users can write', '2' => 'Level 2: Full — WoT users only'];
    json_response(['kind3_status' => 'N/A (PHP admin)', 'whitelist_count' => $wl_count, 'level_description' => $descriptions[$level] ?? $descriptions['0']]);
}

// GET: auth rules
$rules = [];
try { $rules = $pdo->query("SELECT id, rule_type, pattern_type, pattern_value FROM auth_rules ORDER BY id")->fetchAll(); } catch (PDOException $e) {}
json_response(['rules' => $rules]);