<?php
require_once 'db/config.php';
session_start();

if (!isset($_SESSION['user_id'])) {
    http_response_code(401);
    die('Unauthorized');
}

$pdo = db();
$person_ids = json_decode($_POST['person_ids'] ?? '[]');
$process_id = $_POST['process_id'] ?? null;
$message = $_POST['description'] ?? null; // The form sends 'description'
$userId = $_SESSION['user_id'];

if (empty($person_ids) || !$process_id || !$message) {
    http_response_code(400);
    die('Missing parameters');
}

$placeholders = implode(',', array_fill(0, count($person_ids), '?'));

// Get all relevant instance IDs
$stmt = $pdo->prepare("SELECT id FROM process_instances WHERE processDefinitionId = ? AND personId IN ($placeholders)");
$params = array_merge([$process_id], $person_ids);
$stmt->execute($params);
$instance_ids = $stmt->fetchAll(PDO::FETCH_COLUMN);

if (!empty($instance_ids)) {
    $instance_placeholders = implode(',', array_fill(0, count($instance_ids), '?'));

    // Update last activity
    $stmt_update = $pdo->prepare("UPDATE process_instances SET lastActivityAt = NOW() WHERE id IN ($instance_placeholders)");
    $stmt_update->execute($instance_ids);

    // Bulk insert events
    $event_sql = "INSERT INTO process_events (processInstanceId, event_type, message, createdById) VALUES ";
    $event_rows = [];
    $event_params = [];
    foreach($instance_ids as $instance_id) {
        $event_rows[] = "(?, 'note', ?, ?)";
        $event_params[] = $instance_id;
        $event_params[] = $message;
        $event_params[] = $userId;
    }
    $event_sql .= implode(', ', $event_rows);
    $stmt_event = $pdo->prepare($event_sql);
    $stmt_event->execute($event_params);
}

$_SESSION['flash_message'] = "Bulk event addition completed.";
header('Location: process_dashboard.php');
exit;