<?php
session_start();
require_once 'db/config.php';

header('Content-Type: application/json');

// Proteger el endpoint
if (!isset($_SESSION['user_id'])) {
    http_response_code(401);
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit;
}

$response = ['success' => false, 'message' => 'An error occurred.'];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = trim($_POST['name'] ?? '');
    $lastname = trim($_POST['lastname'] ?? '');
    $age = trim($_POST['age'] ?? '');
    $insurance = trim($_POST['insurance'] ?? '');
    $symptoms = trim($_POST['symptoms'] ?? '');
    $specialty = trim($_POST['specialty'] ?? '');
    $pre_arrival_instructions = trim($_POST['pre_arrival_instructions'] ?? '');

    if (empty($name) || empty($lastname) || empty($age) || empty($insurance) || empty($symptoms) || empty($specialty) || empty($pre_arrival_instructions)) {
        $response['message'] = 'Please fill in all required fields.';
    } else {
        try {
            $pdo = db();
            $sql = "INSERT INTO patients (name, lastname, age, insurance, symptoms, specialty, pre_arrival_instructions) VALUES (?, ?, ?, ?, ?, ?, ?)";
            $stmt = $pdo->prepare($sql);
            $stmt->execute([$name, $lastname, $age, $insurance, $symptoms, $specialty, $pre_arrival_instructions]);

            $response['success'] = true;
            $response['message'] = 'Patient data submitted successfully!';
        } catch (PDOException $e) {
            $response['message'] = 'Database error: ' . $e->getMessage();
        }
    }
}

echo json_encode($response);