<?php
require_once __DIR__ . '/../../includes/init_praticien.php';
header('Content-Type: application/json; charset=utf-8');
function out($ok,$m,$x=[]){ echo json_encode(['ok'=>$ok,'message'=>$m]+$x); exit; }

$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
$csrf=(string)($_POST['csrf'] ?? '');
if (!hash_equals($_SESSION['cl_csrf'] ?? '', $csrf)) out(false,'CSRF');

$note_id = (int)($_POST['note_id'] ?? 0);
if ($note_id<=0) out(false,'Bad note');

// Vérif propriétaire + dossier_id
$sql = "SELECT s.id, s.dossier_id, d.praticien_id 
        FROM client_suivi s JOIN client_dossiers d ON d.id=s.dossier_id
        WHERE s.id=:id AND d.praticien_id=:p AND d.archived_at IS NULL";
$st = $pdo->prepare($sql);
$st->execute([':id'=>$note_id, ':p'=>$praticien_id]);
$own = $st->fetch(PDO::FETCH_ASSOC);
if(!$own) out(false,'Not allowed');

$date_rdv = (string)($_POST['date_rdv'] ?? '');
$type_rdv = (string)($_POST['type_rdv'] ?? 'autre');
$titre    = trim((string)($_POST['titre'] ?? ''));
$notes    = trim((string)($_POST['notes'] ?? ''));
$prochaine= trim((string)($_POST['prochaine_action'] ?? ''));
$duree    = (int)($_POST['duree_minutes'] ?? 0);

if ($titre==='' || $notes==='') out(false,'Champs requis');

try{
  $pdo->beginTransaction();

  $upd = $pdo->prepare("UPDATE client_suivi
    SET date_rdv=:dt, type_rdv=:ty, titre=:ti, notes=:no, prochaine_action=:pa, duree_minutes=:du
    WHERE id=:id");
  $upd->execute([
    ':dt'=> (new DateTime($date_rdv ?: 'now'))->format('Y-m-d H:i:s'),
    ':ty'=> in_array($type_rdv,['online','cabinet','tel','autre'],true) ? $type_rdv : 'autre',
    ':ti'=> $titre, ':no'=> $notes,
    ':pa'=> ($prochaine !== '' ? $prochaine : null),
    ':du'=> ($duree > 0 ? $duree : null),
    ':id'=> $note_id
  ]);

  // Uploads additionnels
  if (!empty($_FILES['files']) && is_array($_FILES['files']['name'])) {
    $baseDir = $_SERVER['DOCUMENT_ROOT'].'/uploads/suivi/'. (int)$own['dossier_id'];
    if (!is_dir($baseDir)) @mkdir($baseDir, 0775, true);

    $allowed = ['pdf','jpg','jpeg','png','doc','docx','txt'];
    for($i=0;$i<count($_FILES['files']['name']);$i++){
      $err = (int)($_FILES['files']['error'][$i] ?? UPLOAD_ERR_NO_FILE);
      if ($err !== UPLOAD_ERR_OK) continue;
      $name = (string)($_FILES['files']['name'][$i] ?? '');
      $tmp  = (string)($_FILES['files']['tmp_name'][$i] ?? '');
      $size = (int)($_FILES['files']['size'][$i] ?? 0);
      if ($size <= 0 || $size > 8*1024*1024) continue; // 8 Mo
      $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
      if (!in_array($ext,$allowed,true)) continue;

      $new   = (int)$own['dossier_id'].'_'.time().'_'.bin2hex(random_bytes(4)).'.'.$ext;
      $dest  = $baseDir.'/'.$new;
      if (@move_uploaded_file($tmp, $dest)) {
        $rel = '/uploads/suivi/'.(int)$own['dossier_id'].'/'.$new;
        $mime= mime_content_type($dest) ?: null;

        $pdo->prepare("INSERT INTO client_suivi_files (entry_id, path, mime, size_bytes) VALUES (:e,:p,:m,:s)")
            ->execute([':e'=>$note_id, ':p'=>$rel, ':m'=>$mime, ':s'=>$size]);
      }
    }
  }

  $pdo->commit();
  out(true,'OK');
}catch(Throwable $e){
  if($pdo->inTransaction()) $pdo->rollBack();
  error_log('ajax_editer_note: '.$e->getMessage());
  out(false,'Erreur');
}