<?php
defined($security_key) or exit;

//------------------------------------------
// Report Builder - GET Endpoints
//------------------------------------------

// Set content type to JSON
header('Content-Type: application/json');

// Connect to DB
$pdo = dbConnect($dbname);

// Get the action parameter from URL
$criterias = [];
if (isset($get_content) && $get_content != '') {
    $requests = explode("&", $get_content);
    foreach ($requests as $y) {
        $v = explode("=", $y);
        if (isset($v[1])) {
            $criterias[$v[0]] = urldecode($v[1]);
        } else {
            $criterias[$v[0]] = '';
        }
    }
}

$action = strtolower($criterias['action'] ?? '');

/**
 * Validate table name - only allow alphanumeric, underscores, hyphens
 */
function sanitizeTableName($table) {
    if (!preg_match('/^[a-zA-Z0-9_-]+$/', $table)) {
        return false;
    }
    return $table;
}

/**
 * Get list of tables
 */
if ($action === 'gettables') {
    try {
        $result = $pdo->query("SHOW TABLES");
        $tables = [];
        while ($row = $result->fetch(PDO::FETCH_NUM)) {
            $tables[] = $row[0];
        }

        $messages = json_encode([
            'success' => true,
            'tables' => $tables
        ], JSON_UNESCAPED_UNICODE);
    } catch (Exception $e) {
        http_response_code(500);
        $messages = json_encode([
            'success' => false,
            'message' => 'Failed to fetch tables'
        ], JSON_UNESCAPED_UNICODE);
    }
}

/**
 * Get columns for a specific table
 */
elseif ($action === 'getcolumns') {
    $table = sanitizeTableName($criterias['table'] ?? '');

    if (!$table) {
        http_response_code(400);
        $messages = json_encode([
            'success' => false,
            'message' => 'Invalid table name'
        ], JSON_UNESCAPED_UNICODE);
    } else {
        try {
            $result = $pdo->query("SHOW COLUMNS FROM `$table`");
            $columns = [];
            while ($row = $result->fetch(PDO::FETCH_ASSOC)) {
                $columns[] = $row['Field'];
            }

            $messages = json_encode([
                'success' => true,
                'columns' => $columns
            ], JSON_UNESCAPED_UNICODE);
        } catch (Exception $e) {
            http_response_code(500);
            $messages = json_encode([
                'success' => false,
                'message' => 'Failed to fetch columns'
            ], JSON_UNESCAPED_UNICODE);
        }
    }
}

/**
 * Get table schema information
 */
elseif ($action === 'gettableschema') {
    $table = sanitizeTableName($criterias['table'] ?? '');

    if (!$table) {
        http_response_code(400);
        $messages = json_encode([
            'success' => false,
            'message' => 'Invalid table name'
        ], JSON_UNESCAPED_UNICODE);
    } else {
        try {
            $result = $pdo->query("DESCRIBE `$table`");
            $schema = [];
            while ($row = $result->fetch(PDO::FETCH_ASSOC)) {
                $schema[] = [
                    'field' => $row['Field'],
                    'type' => $row['Type'],
                    'null' => $row['Null'],
                    'key' => $row['Key'],
                    'default' => $row['Default'],
                    'extra' => $row['Extra']
                ];
            }

            $messages = json_encode([
                'success' => true,
                'schema' => $schema
            ], JSON_UNESCAPED_UNICODE);
        } catch (Exception $e) {
            http_response_code(500);
            $messages = json_encode([
                'success' => false,
                'message' => 'Failed to fetch table schema'
            ], JSON_UNESCAPED_UNICODE);
        }
    }
}

/**
 * Invalid or missing action
 */
else {
    http_response_code(400);
    $messages = json_encode([
        'success' => false,
        'message' => 'Invalid or missing action parameter'
    ], JSON_UNESCAPED_UNICODE);
}

// Send results
echo $messages;
?>