<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);

session_start();
header('Content-Type: application/json');

// Basic security checks
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405); // Method Not Allowed
    echo json_encode(['success' => false, 'message' => 'Metodo non consentito.']);
    exit;
}

if (!isset($_SESSION['is_admin']) || $_SESSION['is_admin'] !== true) {
    http_response_code(403); // Forbidden
    echo json_encode(['success' => false, 'message' => 'Accesso negato.']);
    exit;
}

require_once '../db/config.php';

// Get the posted data
$data = json_decode(file_get_contents('php://input'), true);

$puzzle_id = $data['puzzle_id'] ?? null;
$is_public = $data['is_public'] ?? null;

if ($puzzle_id === null || $is_public === null) {
    http_response_code(400); // Bad Request
    echo json_encode(['success' => false, 'message' => 'Dati mancanti.']);
    exit;
}

// Update the database
try {
    $pdo = db();
    $stmt = $pdo->prepare('UPDATE puzzles SET is_public = ? WHERE id = ?');
    $stmt->execute([(int)$is_public, $puzzle_id]);

    if ($stmt->rowCount() > 0) {
        echo json_encode(['success' => true, 'message' => 'Stato del puzzle aggiornato.']);
    } else {
        // This can happen if the puzzle ID doesn't exist or the state was already the same
        echo json_encode(['success' => true, 'message' => 'Nessuna modifica necessaria o puzzle non trovato.']);
    }
} catch (PDOException $e) {
    http_response_code(500); // Internal Server Error
    error_log('PDOException in toggle_puzzle_status.php: ' . $e->getMessage());
    echo json_encode(['success' => false, 'message' => 'Errore del database.']);
}