<?php
/** admin2/api/query.php — Direct SQL query (SELECT only, admin only). */
require_once __DIR__ . '/../lib/helpers.php';
$pdo = db();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    json_response(['error' => 'POST only']);
}

$input = json_decode(file_get_contents('php://input'), true);
$sql = trim($input['sql'] ?? '');

if (!$sql) json_response(['error' => 'No query provided']);
if (!preg_match('/^\s*SELECT/i', $sql)) json_response(['error' => 'Only SELECT queries are allowed']);

$start = microtime(true);
try {
    $stmt = $pdo->query($sql);
    $rows = $stmt->fetchAll();
    $time_ms = round((microtime(true) - $start) * 1000, 1);
    json_response(['rows' => $rows, 'row_count' => count($rows), 'time_ms' => $time_ms]);
} catch (PDOException $e) {
    json_response(['error' => $e->getMessage()]);
}