<?php

declare(strict_types=1);
require_once __DIR__ . '/../app/config/bootstrap.php';
require_once __DIR__ . '/../app/core/Auth.php';
require_once __DIR__ . '/../app/core/AdminLayout.php';
require_once __DIR__ . '/../app/models/Order.php';
require_once __DIR__ . '/../app/core/Csrf.php';
Auth::requireAdmin();
$model = new Order();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (Csrf::validate($_POST['_csrf'] ?? null)) {
        $model->updateStatus(
            (int)($_POST['order_id'] ?? 0),
            trim((string)($_POST['status'] ?? 'pending_payment')),
            trim((string)($_POST['tracking_code'] ?? '')) ?: null
        );
    }
}
$orders = $model->latest(200);
?>
<!doctype html>
<html lang="fa" dir="rtl">

<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="stylesheet" href="<?= htmlspecialchars(assetPath('/assets/css/admin.css')) ?>">
    <title>مدیریت سفارش</title>
</head>

<body>
    <div class="admin-wrap">
        <?php renderAdminSidebar('orders'); ?>
        <main class="content">
            <h1>مدیریت سفارش‌ها</h1>
            <table class="admin-table">
                <thead>
                    <tr>
                        <th>#</th>
                        <th>شناسه پیگیری</th>
                        <th>مشتری</th>
                        <th>تلفن</th>
                        <th>مبلغ</th>
                        <th>وضعیت</th>
                        <th>پرداخت</th>
                        <th>ارسال / رهگیری پستی</th>
                    </tr>
                </thead>
                <tbody><?php foreach ($orders as $o): ?><tr>
                            <td><?= (int)$o['id'] ?></td>
                            <td><code><?= htmlspecialchars((string)($o['order_tracking_id'] ?? '-')) ?></code></td>
                            <td><?= htmlspecialchars($o['customer_name']) ?></td>
                            <td><?= htmlspecialchars($o['customer_phone']) ?></td>
                            <td><?= number_format((float)$o['total_amount']) ?></td>
                            <td><?= htmlspecialchars($o['status']) ?></td>
                            <td><?= htmlspecialchars($o['payment_status']) ?></td>
                            <td>
                                <form method="post" class="admin-inline-stack">
                                    <input type="hidden" name="_csrf" value="<?= htmlspecialchars(Csrf::token()) ?>">
                                    <input type="hidden" name="order_id" value="<?= (int)$o['id'] ?>">
                                    <select name="status">
                                        <option value="pending_payment" <?= ($o['status'] ?? '') === 'pending_payment' ? 'selected' : '' ?>>pending_payment</option>
                                        <option value="paid" <?= ($o['status'] ?? '') === 'paid' ? 'selected' : '' ?>>paid</option>
                                        <option value="processing" <?= ($o['status'] ?? '') === 'processing' ? 'selected' : '' ?>>processing</option>
                                        <option value="shipped" <?= ($o['status'] ?? '') === 'shipped' ? 'selected' : '' ?>>shipped</option>
                                        <option value="delivered" <?= ($o['status'] ?? '') === 'delivered' ? 'selected' : '' ?>>delivered</option>
                                        <option value="cancelled" <?= ($o['status'] ?? '') === 'cancelled' ? 'selected' : '' ?>>cancelled</option>
                                    </select>
                                    <input name="tracking_code" placeholder="کد رهگیری پست" value="<?= htmlspecialchars((string)($o['tracking_code'] ?? '')) ?>">
                                    <button type="submit" class="btn-sm">ثبت</button>
                                </form>
                            </td>
                        </tr><?php endforeach; ?></tbody>
            </table>
        </main>
    </div>
    <script src="<?= htmlspecialchars(assetPath('/assets/js/admin.js')) ?>" defer></script>
</body>

</html>
<?php Performance::finish('admin.orders'); ?>
