<?php
require_once __DIR__ . '/../../includes/init_praticien.php';
header('Content-Type: application/json; charset=utf-8');

function out($ok,$msg,$extra=[]){ echo json_encode(['ok'=>$ok,'message'=>$msg]+$extra); exit; }

$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
$csrf = (string)($_POST['csrf'] ?? '');
if (!hash_equals($_SESSION['cl_csrf'] ?? '', $csrf)) out(false, 'CSRF');

$dossier_id = (int)($_POST['dossier_id'] ?? 0);
if ($dossier_id<=0) out(false, 'Bad dossier');

// Owner
$st = $pdo->prepare("SELECT d.id, d.client_id FROM client_dossiers d WHERE d.id=:d AND d.praticien_id=:p AND d.archived_at IS NULL");
$st->execute([':d'=>$dossier_id, ':p'=>$praticien_id]);
$dos = $st->fetch(PDO::FETCH_ASSOC);
if(!$dos) out(false, 'Not allowed');

$date_rdv = (string)($_POST['date_rdv'] ?? '');
$type_rdv = (string)($_POST['type_rdv'] ?? 'autre');
$titre    = trim((string)($_POST['titre'] ?? ''));
$notes    = trim((string)($_POST['notes'] ?? ''));
$prochaine= trim((string)($_POST['prochaine_action'] ?? ''));
$duree    = (int)($_POST['duree_minutes'] ?? 0);

if ($titre==='' || $notes==='') out(false, 'Champs requis');

try{
  $pdo->beginTransaction();
  $ins = $pdo->prepare("INSERT INTO client_suivi (dossier_id, rdv_id, date_rdv, type_rdv, titre, notes, prochaine_action, duree_minutes, prive)
                        VALUES (:d, NULL, :dt, :ty, :ti, :no, :pa, :du, 1)");
  $ins->execute([
    ':d'=>$dossier_id,
    ':dt'=> (new DateTime($date_rdv ?: 'now'))->format('Y-m-d H:i:s'),
    ':ty'=> in_array($type_rdv,['online','cabinet','tel','autre'],true) ? $type_rdv : 'autre',
    ':ti'=> $titre,
    ':no'=> $notes,
    ':pa'=> ($prochaine !== '' ? $prochaine : null),
    ':du'=> ($duree > 0 ? $duree : null),
  ]);
  $entry_id = (int)$pdo->lastInsertId();

  // Upload files
  if (!empty($_FILES['files']) && is_array($_FILES['files']['name'])) {
    $baseDir = $_SERVER['DOCUMENT_ROOT'].'/uploads/suivi/'. $dossier_id;
    if (!is_dir($baseDir)) @mkdir($baseDir, 0775, true);

    $allowed = ['pdf','jpg','jpeg','png','doc','docx','txt'];
    for($i=0;$i<count($_FILES['files']['name']);$i++){
      $err = (int)($_FILES['files']['error'][$i] ?? UPLOAD_ERR_NO_FILE);
      if ($err !== UPLOAD_ERR_OK) continue;
      $name = (string)($_FILES['files']['name'][$i] ?? '');
      $tmp  = (string)($_FILES['files']['tmp_name'][$i] ?? '');
      $size = (int)($_FILES['files']['size'][$i] ?? 0);
      if ($size <= 0 || $size > 8*1024*1024) continue; // 8 Mo
      $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
      if (!in_array($ext,$allowed,true)) continue;

      $clean = preg_replace('~[^a-zA-Z0-9._-]+~','_', $name);
      $new   = $dossier_id.'_'.time().'_'.bin2hex(random_bytes(4)).'.'.$ext;
      $dest  = $baseDir.'/'.$new;
      if (@move_uploaded_file($tmp, $dest)) {
        $rel = '/uploads/suivi/'.$dossier_id.'/'.$new;
        $mime= mime_content_type($dest) ?: null;

        $pdo->prepare("INSERT INTO client_suivi_files (entry_id, path, mime, size_bytes) VALUES (:e,:p,:m,:s)")
            ->execute([':e'=>$entry_id, ':p'=>$rel, ':m'=>$mime, ':s'=>$size]);
      }
    }
  }

  $pdo->commit();
  out(true, $translations['cl_enregistre_ok'] ?? 'Note enregistrée.');
}catch(Throwable $e){
  if ($pdo->inTransaction()) $pdo->rollBack();
  error_log('ajax_ajouter_note: '.$e->getMessage());
  out(false, $translations['cl_enregistre_ko'] ?? 'Erreur lors de l’enregistrement.');
}