<?php
declare(strict_types=1);

require_once __DIR__ . '/store.php';


const STORE_ADMIN_SESSION_KEY = 'sekut_admin_user';
const STORE_ADMIN_CSRF_KEY = 'sekut_admin_csrf';

function admin_ensure_auth_schema(): void
{
    static $ready = false;
    if ($ready) {
        return;
    }

    $migrationPath = __DIR__ . '/db/migrations/20260526_create_admin_users.sql';
    if (is_file($migrationPath)) {
        $sql = file_get_contents($migrationPath);
        if (is_string($sql) && trim($sql) !== '') {
            db()->exec($sql);
            $ready = true;

            return;
        }
    }

    db()->exec(
        "CREATE TABLE IF NOT EXISTS admin_users (
            id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
            full_name VARCHAR(120) NOT NULL,
            email VARCHAR(160) NOT NULL UNIQUE,
            password_hash VARCHAR(255) NOT NULL,
            last_login_at TIMESTAMP NULL DEFAULT NULL,
            created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
            updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
            UNIQUE KEY uniq_admin_email (email),
            INDEX idx_admin_created_at (created_at)
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"
    );

    $ready = true;
}

function admin_has_users(): bool
{
    admin_ensure_auth_schema();

    $stmt = db()->query('SELECT COUNT(*) AS total FROM admin_users');
    $row = $stmt->fetch() ?: [];

    return (int)($row['total'] ?? 0) > 0;
}

function admin_current_user(): ?array
{
    $sessionUser = $_SESSION[STORE_ADMIN_SESSION_KEY] ?? null;
    if (!is_array($sessionUser)) {
        return null;
    }

    $id = (int)($sessionUser['id'] ?? 0);
    $fullName = store_sanitize_line((string)($sessionUser['full_name'] ?? ''), 120);
    $email = store_lower(trim((string)($sessionUser['email'] ?? '')));

    if ($id <= 0 || $fullName === '' || $email === '') {
        unset($_SESSION[STORE_ADMIN_SESSION_KEY]);

        return null;
    }

    return [
        'id' => $id,
        'full_name' => $fullName,
        'email' => $email,
    ];
}

function admin_store_session(array $user): void
{
    $_SESSION[STORE_ADMIN_SESSION_KEY] = [
        'id' => (int)($user['id'] ?? 0),
        'full_name' => store_sanitize_line((string)($user['full_name'] ?? ''), 120),
        'email' => store_lower(trim((string)($user['email'] ?? ''))),
    ];

    session_regenerate_id(true);
}

function admin_logout(): void
{
    unset($_SESSION[STORE_ADMIN_SESSION_KEY]);
    session_regenerate_id(true);
}

function admin_is_authenticated(): bool
{
    return admin_current_user() !== null;
}

function admin_csrf_token(): string
{
    $token = $_SESSION[STORE_ADMIN_CSRF_KEY] ?? '';
    if (!is_string($token) || $token === '') {
        try {
            $token = bin2hex(random_bytes(32));
        } catch (Throwable $exception) {
            $token = sha1(session_id() . '|' . microtime(true));
        }

        $_SESSION[STORE_ADMIN_CSRF_KEY] = $token;
    }

    return $token;
}

function admin_verify_csrf(?string $token): bool
{
    if (!is_string($token) || $token === '') {
        return false;
    }

    return hash_equals(admin_csrf_token(), $token);
}

function admin_auth_form_defaults(array $source = []): array
{
    return [
        'full_name' => store_sanitize_line((string)($source['full_name'] ?? ''), 120),
        'email' => store_lower(trim((string)($source['email'] ?? ''))),
    ];
}

function admin_password_error(string $password): string
{
    if (store_strlen($password) < 8) {
        return 'Password admin minimal 8 karakter.';
    }

    return '';
}

function admin_create_first_user(array $source): array
{
    admin_ensure_auth_schema();

    $form = admin_auth_form_defaults($source);
    $password = (string)($source['password'] ?? '');
    $confirmPassword = (string)($source['confirm_password'] ?? '');

    if (admin_has_users()) {
        return [
            'success' => false,
            'message' => 'Akun admin sudah dibuat. Silakan login dengan email dan password admin.',
            'form' => ['full_name' => '', 'email' => $form['email']],
        ];
    }

    if (store_strlen($form['full_name']) < 3) {
        return [
            'success' => false,
            'message' => 'Nama admin minimal 3 karakter.',
            'form' => $form,
        ];
    }

    if (!filter_var($form['email'], FILTER_VALIDATE_EMAIL)) {
        return [
            'success' => false,
            'message' => 'Masukkan email admin yang valid.',
            'form' => $form,
        ];
    }

    $passwordError = admin_password_error($password);
    if ($passwordError !== '') {
        return [
            'success' => false,
            'message' => $passwordError,
            'form' => $form,
        ];
    }

    if ($password !== $confirmPassword) {
        return [
            'success' => false,
            'message' => 'Konfirmasi password admin belum cocok.',
            'form' => $form,
        ];
    }

    $stmt = db()->prepare(
        'INSERT INTO admin_users (full_name, email, password_hash, last_login_at) VALUES (:full_name, :email, :password_hash, NOW())'
    );
    $stmt->bindValue(':full_name', $form['full_name']);
    $stmt->bindValue(':email', $form['email']);
    $stmt->bindValue(':password_hash', password_hash($password, PASSWORD_DEFAULT));
    $stmt->execute();

    $user = [
        'id' => (int)db()->lastInsertId(),
        'full_name' => $form['full_name'],
        'email' => $form['email'],
    ];
    admin_store_session($user);

    return [
        'success' => true,
        'message' => 'Akun admin pertama berhasil dibuat dan sesi login sudah aktif.',
        'form' => ['full_name' => '', 'email' => ''],
    ];
}

function admin_attempt_login(array $source): array
{
    admin_ensure_auth_schema();

    $form = admin_auth_form_defaults($source);
    $password = (string)($source['password'] ?? '');

    if (!admin_has_users()) {
        return [
            'success' => false,
            'message' => 'Belum ada akun admin. Buat akun admin pertama terlebih dahulu.',
            'form' => $form,
        ];
    }

    if (!filter_var($form['email'], FILTER_VALIDATE_EMAIL) || $password === '') {
        return [
            'success' => false,
            'message' => 'Masukkan email admin dan password yang benar.',
            'form' => $form,
        ];
    }

    $stmt = db()->prepare('SELECT id, full_name, email, password_hash FROM admin_users WHERE email = :email LIMIT 1');
    $stmt->bindValue(':email', $form['email']);
    $stmt->execute();
    $user = $stmt->fetch();

    if (!$user || !password_verify($password, (string)($user['password_hash'] ?? ''))) {
        return [
            'success' => false,
            'message' => 'Email admin atau password tidak cocok.',
            'form' => $form,
        ];
    }

    $update = db()->prepare('UPDATE admin_users SET last_login_at = NOW() WHERE id = :id LIMIT 1');
    $update->bindValue(':id', (int)($user['id'] ?? 0), PDO::PARAM_INT);
    $update->execute();

    if (password_needs_rehash((string)($user['password_hash'] ?? ''), PASSWORD_DEFAULT)) {
        $rehash = db()->prepare('UPDATE admin_users SET password_hash = :password_hash WHERE id = :id LIMIT 1');
        $rehash->bindValue(':password_hash', password_hash($password, PASSWORD_DEFAULT));
        $rehash->bindValue(':id', (int)($user['id'] ?? 0), PDO::PARAM_INT);
        $rehash->execute();
    }

    admin_store_session($user);

    return [
        'success' => true,
        'message' => 'Login admin berhasil.',
        'form' => ['full_name' => '', 'email' => ''],
    ];
}

function admin_status_options(): array
{
    $options = [];
    foreach (store_status_steps() as $step) {
        $value = (string)($step['value'] ?? '');
        $label = (string)($step['label'] ?? $value);
        if ($value !== '') {
            $options[$value] = $label;
        }
    }
    $options['Batal'] = 'Batal';

    return $options;
}

function admin_filters_from_source(array $source): array
{
    $statuses = admin_status_options();
    $search = store_sanitize_line((string)($source['search'] ?? ''), 120);
    $status = store_sanitize_line((string)($source['status'] ?? 'all'), 40);
    $selected = store_sanitize_line((string)($source['selected'] ?? ''), 30);

    if ($status !== 'all' && !isset($statuses[$status])) {
        $status = 'all';
    }

    return [
        'search' => $search,
        'status' => $status,
        'selected' => $selected,
    ];
}

function admin_url(array $filters, array $overrides = []): string
{
    $params = $filters;
    foreach ($overrides as $key => $value) {
        if (is_string($key) && is_string($value)) {
            $params[$key] = $value;
        }
    }

    $query = [];
    foreach ($params as $key => $value) {
        if (!is_string($key) || !is_string($value) || $value === '') {
            continue;
        }
        if ($key === 'status' && $value === 'all') {
            continue;
        }
        $query[$key] = $value;
    }

    return 'admin.php' . ($query ? '?' . http_build_query($query) : '');
}

function admin_order_dashboard(): array
{
    store_ensure_schema();

    $stmt = db()->query(
        "SELECT
            COUNT(*) AS total_orders,
            COALESCE(SUM(CASE WHEN status = 'Menunggu Pembayaran' THEN 1 ELSE 0 END), 0) AS pending_orders,
            COALESCE(SUM(CASE WHEN status IN ('Diproses', 'Dikirim') THEN 1 ELSE 0 END), 0) AS active_orders,
            COALESCE(SUM(CASE WHEN status = 'Selesai' THEN 1 ELSE 0 END), 0) AS completed_orders,
            COALESCE(SUM(grand_total), 0) AS gross_revenue,
            COALESCE(SUM(CASE WHEN created_at >= DATE_SUB(NOW(), INTERVAL 7 DAY) THEN 1 ELSE 0 END), 0) AS recent_orders
        FROM orders"
    );

    $row = $stmt->fetch() ?: [];

    return [
        'total_orders' => (int)($row['total_orders'] ?? 0),
        'pending_orders' => (int)($row['pending_orders'] ?? 0),
        'active_orders' => (int)($row['active_orders'] ?? 0),
        'completed_orders' => (int)($row['completed_orders'] ?? 0),
        'gross_revenue' => (float)($row['gross_revenue'] ?? 0),
        'recent_orders' => (int)($row['recent_orders'] ?? 0),
    ];
}

function admin_list_orders(array $filters): array
{
    store_ensure_schema();

    $conditions = [];
    $params = [];

    if (($filters['search'] ?? '') !== '') {
        $conditions[] = '(order_number LIKE :search OR customer_name LIKE :search OR email LIKE :search OR phone LIKE :search)';
        $params['search'] = '%' . $filters['search'] . '%';
    }

    if (($filters['status'] ?? 'all') !== 'all') {
        $conditions[] = 'status = :status';
        $params['status'] = $filters['status'];
    }

    $sql = 'SELECT order_number, customer_name, email, phone, status, grand_total, payment_method, items_json, created_at, updated_at FROM orders';
    if ($conditions) {
        $sql .= ' WHERE ' . implode(' AND ', $conditions);
    }
    $sql .= ' ORDER BY created_at DESC LIMIT 100';

    $stmt = db()->prepare($sql);
    foreach ($params as $key => $value) {
        $stmt->bindValue(':' . $key, $value);
    }
    $stmt->execute();

    $methods = store_payment_methods();
    $orders = $stmt->fetchAll() ?: [];
    foreach ($orders as &$order) {
        $items = json_decode((string)($order['items_json'] ?? '[]'), true);
        $itemCount = 0;
        if (is_array($items)) {
            foreach ($items as $item) {
                if (is_array($item)) {
                    $itemCount += (int)($item['quantity'] ?? 0);
                }
            }
        }
        $methodKey = (string)($order['payment_method'] ?? '');
        $order['payment_method_label'] = $methods[$methodKey]['label'] ?? $methodKey;
        $order['item_count'] = $itemCount;
    }
    unset($order);

    return $orders;
}

function admin_update_order_status(string $orderNumber, string $status): array
{
    $orderNumber = store_sanitize_line($orderNumber, 30);
    $status = store_sanitize_line($status, 40);
    $options = admin_status_options();

    if ($orderNumber === '') {
        return ['success' => false, 'message' => 'Kode pesanan tidak valid.'];
    }

    if (!isset($options[$status])) {
        return ['success' => false, 'message' => 'Status pesanan tidak dikenali.'];
    }

    $existing = store_find_order($orderNumber);
    if (!$existing) {
        return ['success' => false, 'message' => 'Pesanan tidak ditemukan.'];
    }

    if ((string)$existing['status'] === $status) {
        return ['success' => true, 'message' => 'Status pesanan sudah berada di tahap ' . $options[$status] . '.'];
    }

    $stmt = db()->prepare('UPDATE orders SET status = :status WHERE order_number = :order_number LIMIT 1');
    $stmt->bindValue(':status', $status);
    $stmt->bindValue(':order_number', $orderNumber);
    $stmt->execute();

    return [
        'success' => true,
        'message' => 'Status pesanan ' . $orderNumber . ' diubah ke ' . $options[$status] . '.',
    ];
}

function admin_catalog_snapshot(): array
{
    $categories = store_categories();
    $snapshot = [];

    foreach ($categories as $slug => $category) {
        if ($slug === 'all') {
            continue;
        }

        $snapshot[$slug] = [
            'slug' => $slug,
            'label' => (string)($category['label'] ?? $slug),
            'description' => (string)($category['description'] ?? ''),
            'count' => 0,
            'min_price' => null,
            'max_price' => null,
            'products' => [],
        ];
    }

    foreach (store_products() as $product) {
        $categoryKey = (string)($product['category'] ?? '');
        if (!isset($snapshot[$categoryKey])) {
            continue;
        }

        $price = (float)($product['price'] ?? 0);
        $snapshot[$categoryKey]['count']++;
        $snapshot[$categoryKey]['min_price'] = $snapshot[$categoryKey]['min_price'] === null
            ? $price
            : min((float)$snapshot[$categoryKey]['min_price'], $price);
        $snapshot[$categoryKey]['max_price'] = $snapshot[$categoryKey]['max_price'] === null
            ? $price
            : max((float)$snapshot[$categoryKey]['max_price'], $price);
        $snapshot[$categoryKey]['products'][] = [
            'name' => (string)($product['name'] ?? ''),
            'price' => $price,
            'lead_time' => (string)($product['lead_time'] ?? ''),
            'slug' => (string)($product['slug'] ?? ''),
        ];
    }

    return array_values($snapshot);
}

$authForm = admin_auth_form_defaults();
$authError = '';
$filters = admin_filters_from_source($_GET);

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
    $action = store_sanitize_line((string)($_POST['action'] ?? ''), 40);

    if (!admin_verify_csrf((string)($_POST['csrf_token'] ?? ''))) {
        if ($action === 'setup_admin' || $action === 'login_admin') {
            $authForm = admin_auth_form_defaults($_POST);
            $authError = 'Sesi keamanan sudah berakhir. Muat ulang halaman admin lalu coba lagi.';
        } else {
            store_flash('danger', 'Sesi keamanan admin sudah berakhir. Coba ulangi tindakannya.');
            header('Location: admin.php');
            exit;
        }
    } elseif ($action === 'logout_admin') {
        admin_logout();
        store_flash('success', 'Sesi admin berhasil ditutup.');
        header('Location: admin.php');
        exit;
    } elseif ($action === 'setup_admin') {
        $result = admin_create_first_user($_POST);
        if (!empty($result['success'])) {
            store_flash('success', (string)($result['message'] ?? 'Akun admin berhasil dibuat.'));
            header('Location: admin.php');
            exit;
        }

        $authForm = is_array($result['form'] ?? null) ? $result['form'] : admin_auth_form_defaults($_POST);
        $authError = (string)($result['message'] ?? 'Setup admin gagal diproses.');
    } elseif ($action === 'login_admin') {
        $result = admin_attempt_login($_POST);
        if (!empty($result['success'])) {
            store_flash('success', (string)($result['message'] ?? 'Login admin berhasil.'));
            header('Location: admin.php');
            exit;
        }

        $authForm = is_array($result['form'] ?? null) ? $result['form'] : admin_auth_form_defaults($_POST);
        $authError = (string)($result['message'] ?? 'Login admin gagal diproses.');
    } elseif ($action === 'update_status') {
        if (!admin_is_authenticated()) {
            store_flash('danger', 'Silakan login admin terlebih dahulu.');
            header('Location: admin.php');
            exit;
        }

        $filters = admin_filters_from_source($_POST);
        $result = admin_update_order_status(
            (string)($_POST['order_number'] ?? ''),
            (string)($_POST['status_value'] ?? '')
        );

        store_flash(!empty($result['success']) ? 'success' : 'danger', (string)($result['message'] ?? 'Aksi admin gagal diproses.'));
        header('Location: ' . admin_url($filters, ['selected' => (string)($_POST['order_number'] ?? '')]));
        exit;
    } else {
        store_flash('danger', 'Aksi admin tidak dikenali.');
        header('Location: admin.php');
        exit;
    }
}

$adminUser = admin_current_user();

if (!$adminUser) {
    $hasAdminAccount = admin_has_users();

    store_page_start(
        $hasAdminAccount ? 'Login Admin' : 'Setup Admin',
        $hasAdminAccount
            ? 'Masuk ke dashboard admin untuk memantau dan memperbarui pesanan bakery.'
            : 'Buat akun admin pertama untuk melindungi dashboard operasional bakery.',
        ['noindex' => true]
    );
    ?>
    <section class="hero-panel mb-4 mb-lg-5">
        <div class="row g-4 align-items-stretch">
            <div class="col-lg-6">
                <span class="eyebrow">Admin access</span>
                <h1 class="display-title"><?= $hasAdminAccount ? 'Masuk ke dashboard internal yang sudah dilindungi.' : 'Aktifkan login admin sebelum panel dipakai rutin.' ?></h1>
                <p class="lead-copy mb-0">
                    <?= $hasAdminAccount
                        ? 'Dashboard order sekarang butuh sesi login, jadi update status pesanan tidak lagi terbuka untuk publik.'
                        : 'Langkah setup ini hanya muncul sekali untuk membuat akun admin pertama. Setelah tersimpan, halaman otomatis berubah jadi form login.' ?>
                </p>
                <?php if ($authError !== ''): ?>
                    <div class="alert alert-danger mt-4 mb-0 border-0 shadow-sm" role="alert"><?= h($authError) ?></div>
                <?php else: ?>
                    <div class="alert alert-info mt-4 mb-0 border-0 shadow-sm" role="alert">
                        <strong><?= $hasAdminAccount ? 'Akses aman:' : 'Setup sekali:' ?></strong>
                        <?= $hasAdminAccount
                            ? 'gunakan email admin dan password yang sudah dibuat untuk membuka dashboard.'
                            : 'buat email admin internal dan password minimal 8 karakter agar halaman admin tidak lagi terbuka bebas.' ?>
                    </div>
                <?php endif; ?>
            </div>
            <div class="col-lg-6">
                <aside class="summary-card h-100">
                    <div class="card-kicker"><?= $hasAdminAccount ? 'Login required' : 'Setup pertama' ?></div>
                    <h2 class="summary-title"><?= $hasAdminAccount ? 'Masukkan email dan password admin.' : 'Buat akun admin internal untuk toko ini.' ?></h2>
                    <form action="admin.php" method="post" class="mt-4" data-auto-disable>
                        <input type="hidden" name="action" value="<?= $hasAdminAccount ? 'login_admin' : 'setup_admin' ?>">
                        <input type="hidden" name="csrf_token" value="<?= h(admin_csrf_token()) ?>">
                        <?php if (!$hasAdminAccount): ?>
                            <div class="mb-3">
                                <label class="form-label" for="full_name">Nama admin</label>
                                <input id="full_name" class="form-control" type="text" name="full_name" value="<?= h($authForm['full_name']) ?>" maxlength="120" autocomplete="name" placeholder="Contoh: Sekut Ops" required>
                            </div>
                        <?php endif; ?>
                        <div class="mb-3">
                            <label class="form-label" for="email">Email admin</label>
                            <input id="email" class="form-control" type="email" name="email" value="<?= h($authForm['email']) ?>" maxlength="160" autocomplete="username" placeholder="admin@sekutbakery.test" required>
                        </div>
                        <div class="mb-3">
                            <label class="form-label" for="password"><?= $hasAdminAccount ? 'Password' : 'Password admin' ?></label>
                            <input id="password" class="form-control" type="password" name="password" minlength="8" autocomplete="<?= $hasAdminAccount ? 'current-password' : 'new-password' ?>" placeholder="Minimal 8 karakter" required>
                        </div>
                        <?php if (!$hasAdminAccount): ?>
                            <div class="mb-4">
                                <label class="form-label" for="confirm_password">Konfirmasi password</label>
                                <input id="confirm_password" class="form-control" type="password" name="confirm_password" minlength="8" autocomplete="new-password" placeholder="Ulangi password admin" required>
                            </div>
                        <?php endif; ?>
                        <div class="d-grid gap-2">
                            <button class="btn btn-dark" type="submit"><?= $hasAdminAccount ? 'Masuk ke admin' : 'Buat akun admin' ?></button>
                            <a class="btn btn-outline-secondary" href="index.php">Kembali ke toko</a>
                        </div>
                    </form>
                    <ul class="list-clean compact-list mt-4 mb-0">
                        <?php if ($hasAdminAccount): ?>
                            <li><span class="list-index">1</span><span>Gunakan email admin yang dibuat saat setup pertama.</span></li>
                            <li><span class="list-index">2</span><span>Password admin disimpan sebagai hash aman di MySQL.</span></li>
                            <li><span class="list-index">3</span><span>Setelah login, kamu bisa lanjut mengubah status order dari dashboard.</span></li>
                        <?php else: ?>
                            <li><span class="list-index">1</span><span>Buat satu akun admin internal dengan email yang aktif.</span></li>
                            <li><span class="list-index">2</span><span>Gunakan password minimal 8 karakter agar panel tidak lagi terbuka publik.</span></li>
                            <li><span class="list-index">3</span><span>Sesudah akun pertama tersimpan, halaman ini otomatis berubah jadi form login.</span></li>
                        <?php endif; ?>
                    </ul>
                </aside>
            </div>
        </div>
    </section>
    <?php
    store_page_end();

    exit;
}

$dashboard = admin_order_dashboard();
$orders = admin_list_orders($filters);
$selectedOrderNumber = $filters['selected'];
if ($selectedOrderNumber === '' && !empty($orders[0]['order_number'])) {
    $selectedOrderNumber = (string)$orders[0]['order_number'];
}
$selectedOrder = $selectedOrderNumber !== '' ? store_find_order($selectedOrderNumber) : null;
$catalogSnapshot = admin_catalog_snapshot();
$statusOptions = admin_status_options();

store_page_start(
    'Admin Lite',
    'Dashboard internal untuk memantau pesanan bakery, melihat ringkasan katalog, dan mengubah status order.',
    ['noindex' => true]
);
?>
<section class="hero-panel mb-4 mb-lg-5">
    <div class="row g-4 align-items-start">
        <div class="col-lg-7">
            <span class="eyebrow">Internal admin</span>
            <h1 class="display-title">Pantau order masuk tanpa panel yang berat.</h1>
            <p class="lead-copy mb-0">
                Slice ini fokus ke kebutuhan operasional paling dekat: melihat antrean pesanan, membuka detail customer,
                lalu mengubah status order saat pembayaran masuk, produksi dimulai, atau pengiriman selesai.
            </p>
            <div class="alert alert-success mt-4 mb-0 border-0 shadow-sm" role="alert">
                <strong>Akses aman aktif:</strong> dashboard ini sekarang memerlukan login admin.
                Sesi aktif untuk <strong><?= h($adminUser['full_name']) ?></strong> (<?= h($adminUser['email']) ?>).
            </div>
        </div>
        <div class="col-lg-5">
            <aside class="summary-card h-100">
                <div class="card-kicker">Ruang lingkup iterasi ini</div>
                <h2 class="summary-title">Order management dulu, catalog CRUD nanti.</h2>
                <ul class="list-clean compact-list mb-4">
                    <li><span class="list-index">1</span><span>Dashboard sekarang dilindungi login berbasis session.</span></li>
                    <li><span class="list-index">2</span><span>Status order bisa diubah dari dashboard admin.</span></li>
                    <li><span class="list-index">3</span><span>Produk dan kategori tampil sebagai snapshot read-only.</span></li>
                </ul>
                <div class="d-flex flex-wrap gap-2">
                    <a class="btn btn-dark" href="index.php">Kembali ke toko</a>
                    <?php if ($selectedOrder): ?>
                        <a class="btn btn-outline-secondary" href="<?= h('order_status.php?order=' . urlencode((string)$selectedOrder['order_number']) . '&email=' . urlencode((string)$selectedOrder['email'])) ?>">Lihat halaman customer</a>
                    <?php endif; ?>
                    <form action="admin.php" method="post" class="d-inline">
                        <input type="hidden" name="action" value="logout_admin">
                        <input type="hidden" name="csrf_token" value="<?= h(admin_csrf_token()) ?>">
                        <button class="btn btn-outline-danger" type="submit">Logout</button>
                    </form>
                </div>
                <div class="small text-muted mt-3">Login sebagai <?= h($adminUser['full_name']) ?> • <?= h($adminUser['email']) ?></div>
            </aside>
        </div>
    </div>
</section>

<section class="mb-4 mb-lg-5">
    <div class="row g-3">
        <div class="col-sm-6 col-xl-3">
            <div class="metric-card h-100">
                <div class="metric-value"><?= h((string)$dashboard['total_orders']) ?></div>
                <div class="metric-label">total pesanan tersimpan</div>
            </div>
        </div>
        <div class="col-sm-6 col-xl-3">
            <div class="metric-card h-100">
                <div class="metric-value"><?= h((string)$dashboard['pending_orders']) ?></div>
                <div class="metric-label">menunggu pembayaran</div>
            </div>
        </div>
        <div class="col-sm-6 col-xl-3">
            <div class="metric-card h-100">
                <div class="metric-value"><?= h((string)$dashboard['active_orders']) ?></div>
                <div class="metric-label">sedang diproses / dikirim</div>
            </div>
        </div>
        <div class="col-sm-6 col-xl-3">
            <div class="metric-card h-100">
                <div class="metric-value metric-value--small"><?= h(store_money((float)$dashboard['gross_revenue'])) ?></div>
                <div class="metric-label">gross value seluruh order</div>
            </div>
        </div>
    </div>
</section>

<section class="section-block pt-0">
    <div class="surface-panel p-4 mb-4">
        <div class="d-flex flex-column flex-lg-row justify-content-between gap-3 align-items-lg-end">
            <div>
                <div class="card-kicker">Filter antrean</div>
                <h2 class="summary-title mb-1">Cari order yang perlu ditindak.</h2>
                <p class="section-copy mb-0">Gunakan pencarian berdasarkan kode order, nama customer, email, atau telepon.</p>
            </div>
            <div class="text-muted small">Pesanan 7 hari terakhir: <strong class="text-dark"><?= h((string)$dashboard['recent_orders']) ?></strong></div>
        </div>
        <form action="admin.php" method="get" class="row g-3 mt-1">
            <div class="col-lg-7">
                <label class="form-label" for="search">Cari pesanan</label>
                <input id="search" class="form-control" type="search" name="search" value="<?= h($filters['search']) ?>" placeholder="Contoh: SB260526 atau nama customer">
            </div>
            <div class="col-lg-3">
                <label class="form-label" for="status">Filter status</label>
                <select id="status" class="form-control" name="status">
                    <option value="all">Semua status</option>
                    <?php foreach ($statusOptions as $value => $label): ?>
                        <option value="<?= h($value) ?>" <?= $filters['status'] === $value ? 'selected' : '' ?>><?= h($label) ?></option>
                    <?php endforeach; ?>
                </select>
            </div>
            <div class="col-lg-2 d-flex align-items-end gap-2">
                <button class="btn btn-dark w-100" type="submit">Terapkan</button>
            </div>
        </form>
    </div>

    <div class="row g-4 align-items-start">
        <div class="col-xl-7">
            <?php if (!$orders): ?>
                <div class="empty-state-card">
                    <span class="eyebrow">Belum ada hasil</span>
                    <h2 class="section-title">Tidak ada pesanan yang cocok dengan filter ini.</h2>
                    <p class="section-copy mb-0">Coba reset pencarian atau ubah status filter untuk melihat antrean yang lain.</p>
                </div>
            <?php else: ?>
                <div class="surface-panel p-0 overflow-hidden">
                    <div class="p-4 border-bottom">
                        <div class="card-kicker">Order queue</div>
                        <h2 class="summary-title mb-1"><?= h((string)count($orders)) ?> pesanan tampil di dashboard.</h2>
                        <p class="section-copy mb-0">Klik detail untuk membuka panel ringkasan dan mengubah status order.</p>
                    </div>
                    <div class="table-responsive">
                        <table class="table order-table align-middle mb-0">
                            <thead>
                                <tr>
                                    <th scope="col">Pesanan</th>
                                    <th scope="col">Customer</th>
                                    <th scope="col">Status</th>
                                    <th scope="col" class="text-end">Total</th>
                                    <th scope="col" class="text-end">Aksi</th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ($orders as $order): ?>
                                    <tr class="<?= $selectedOrderNumber === (string)$order['order_number'] ? 'table-active' : '' ?>">
                                        <td>
                                            <strong><?= h((string)$order['order_number']) ?></strong>
                                            <div class="small text-muted"><?= h((string)$order['item_count']) ?> item • <?= h((string)$order['payment_method_label']) ?></div>
                                        </td>
                                        <td>
                                            <strong><?= h((string)$order['customer_name']) ?></strong>
                                            <div class="small text-muted"><?= h((string)$order['email']) ?></div>
                                            <div class="small text-muted"><?= h((string)$order['phone']) ?></div>
                                        </td>
                                        <td>
                                            <span class="<?= h(store_status_class((string)$order['status'])) ?>"><?= h((string)$order['status']) ?></span>
                                        </td>
                                        <td class="text-end">
                                            <strong><?= h(store_money((float)$order['grand_total'])) ?></strong>
                                            <div class="small text-muted"><?= h(store_format_datetime((string)$order['created_at'])) ?></div>
                                        </td>
                                        <td class="text-end">
                                            <a class="btn btn-outline-secondary btn-sm" href="<?= h(admin_url($filters, ['selected' => (string)$order['order_number']])) ?>">Detail</a>
                                        </td>
                                    </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                    </div>
                </div>
            <?php endif; ?>
        </div>
        <div class="col-xl-5">
            <?php if ($selectedOrder): ?>
                <aside class="summary-card">
                    <div class="d-flex flex-wrap justify-content-between gap-2 align-items-start">
                        <div>
                            <div class="card-kicker">Pesanan dipilih</div>
                            <h2 class="summary-title mb-1"><?= h((string)$selectedOrder['order_number']) ?></h2>
                            <p class="text-muted mb-0">Dibuat pada <?= h(store_format_datetime((string)$selectedOrder['created_at'])) ?></p>
                        </div>
                        <span class="<?= h(store_status_class((string)$selectedOrder['status'])) ?>"><?= h((string)$selectedOrder['status']) ?></span>
                    </div>

                    <form action="admin.php" method="post" class="mt-4" data-auto-disable>
                        <input type="hidden" name="action" value="update_status">
                        <input type="hidden" name="csrf_token" value="<?= h(admin_csrf_token()) ?>">
                        <input type="hidden" name="order_number" value="<?= h((string)$selectedOrder['order_number']) ?>">
                        <input type="hidden" name="search" value="<?= h($filters['search']) ?>">
                        <input type="hidden" name="status" value="<?= h($filters['status']) ?>">
                        <input type="hidden" name="selected" value="<?= h((string)$selectedOrder['order_number']) ?>">
                        <label class="form-label" for="status_value">Ubah status pesanan</label>
                        <div class="d-grid gap-2">
                            <select id="status_value" class="form-control" name="status_value">
                                <?php foreach ($statusOptions as $value => $label): ?>
                                    <option value="<?= h($value) ?>" <?= (string)$selectedOrder['status'] === $value ? 'selected' : '' ?>><?= h($label) ?></option>
                                <?php endforeach; ?>
                            </select>
                            <button class="btn btn-dark" type="submit">Simpan status</button>
                        </div>
                    </form>

                    <div class="info-box mt-4">
                        <div class="card-kicker">Data customer</div>
                        <p class="mb-1"><strong><?= h((string)$selectedOrder['customer_name']) ?></strong></p>
                        <p class="mb-1"><?= h((string)$selectedOrder['email']) ?></p>
                        <p class="mb-1"><?= h((string)$selectedOrder['phone']) ?></p>
                        <p class="mb-0"><?= nl2br(h((string)$selectedOrder['address'])) ?></p>
                    </div>

                    <div class="info-box mt-3">
                        <div class="card-kicker">Pembayaran & catatan</div>
                        <p class="mb-1"><strong><?= h((string)$selectedOrder['payment_method_label']) ?></strong></p>
                        <p class="mb-0"><?= h((string)$selectedOrder['payment_instruction']) ?></p>
                        <?php if (!empty($selectedOrder['note'])): ?>
                            <div class="note-copy mt-3"><strong>Catatan customer:</strong> <?= h((string)$selectedOrder['note']) ?></div>
                        <?php endif; ?>
                    </div>

                    <div class="surface-panel p-4 mt-3">
                        <div class="card-kicker">Ringkasan item</div>
                        <div class="receipt-card receipt-card--flat">
                            <?php foreach ($selectedOrder['items'] as $item): ?>
                                <div class="receipt-line">
                                    <span><?= h((string)$item['name']) ?> × <?= h((string)$item['quantity']) ?></span>
                                    <strong><?= h(store_money((float)$item['line_total'])) ?></strong>
                                </div>
                            <?php endforeach; ?>
                            <div class="receipt-line">
                                <span>Subtotal</span>
                                <strong><?= h(store_money((float)$selectedOrder['subtotal'])) ?></strong>
                            </div>
                            <div class="receipt-line">
                                <span>Ongkir</span>
                                <strong><?= h(store_money((float)$selectedOrder['shipping_fee'])) ?></strong>
                            </div>
                            <div class="receipt-line receipt-line--total">
                                <span>Grand total</span>
                                <strong><?= h(store_money((float)$selectedOrder['grand_total'])) ?></strong>
                            </div>
                        </div>
                    </div>

                    <?php if ((string)$selectedOrder['status'] !== 'Batal'): ?>
                        <?php $currentIndex = store_status_index((string)$selectedOrder['status']); ?>
                        <div class="surface-panel p-4 mt-3">
                            <div class="card-kicker">Progress customer-facing</div>
                            <div class="timeline-list mt-3">
                                <?php foreach (store_status_steps() as $index => $step): ?>
                                    <?php
                                    $stateClass = 'timeline-step';
                                    if ($index < $currentIndex) {
                                        $stateClass .= ' is-complete';
                                    } elseif ($index === $currentIndex) {
                                        $stateClass .= ' is-current';
                                    }
                                    ?>
                                    <div class="<?= h($stateClass) ?>">
                                        <div class="timeline-step__dot"></div>
                                        <div>
                                            <div class="timeline-step__title"><?= h((string)$step['label']) ?></div>
                                            <p class="timeline-step__copy mb-0"><?= h((string)$step['description']) ?></p>
                                        </div>
                                    </div>
                                <?php endforeach; ?>
                            </div>
                        </div>
                    <?php else: ?>
                        <div class="info-box mt-3 mb-0">
                            <div class="card-kicker">Status batal</div>
                            <p class="mb-0">Pesanan ini sudah dibatalkan, jadi timeline customer tidak lagi berjalan.</p>
                        </div>
                    <?php endif; ?>
                </aside>
            <?php else: ?>
                <div class="empty-state-card">
                    <span class="eyebrow">Pilih pesanan</span>
                    <h2 class="section-title">Belum ada order yang dibuka.</h2>
                    <p class="section-copy mb-0">Klik tombol detail pada tabel agar admin bisa melihat item, data customer, dan mengganti status pesanan.</p>
                </div>
            <?php endif; ?>
        </div>
    </div>
</section>

<section class="section-block pt-0">
    <div class="section-heading mb-4">
        <span class="eyebrow">Catalog snapshot</span>
        <h2 class="section-title">Produk dan kategori tampil sebagai referensi operasional.</h2>
        <p class="section-copy mb-0">Di slice ini catalog belum editable dari admin. Fokusnya masih order handling agar alur transaksi sudah bisa dijalankan dulu.</p>
    </div>

    <div class="row g-3 mb-4">
        <?php foreach ($catalogSnapshot as $category): ?>
            <div class="col-md-6 col-xl-4">
                <div class="feature-card h-100">
                    <div class="card-kicker"><?= h((string)$category['label']) ?></div>
                    <div class="metric-value"><?= h((string)$category['count']) ?></div>
                    <div class="metric-label">produk aktif di kategori ini</div>
                    <p class="feature-card__copy mt-3 mb-2"><?= h((string)$category['description']) ?></p>
                    <?php if ($category['min_price'] !== null && $category['max_price'] !== null): ?>
                        <div class="price-tag"><?= h(store_money((float)$category['min_price'])) ?> — <?= h(store_money((float)$category['max_price'])) ?></div>
                    <?php endif; ?>
                </div>
            </div>
        <?php endforeach; ?>
    </div>

    <div class="surface-panel p-0 overflow-hidden">
        <div class="p-4 border-bottom">
            <div class="card-kicker">Produk aktif</div>
            <h2 class="summary-title mb-1"><?= h((string)count(store_products())) ?> produk ada di katalog saat ini.</h2>
            <p class="section-copy mb-0">Langkah berikutnya bila dibutuhkan: pindahkan katalog ke tabel DB agar admin bisa menambah/edit produk dari UI.</p>
        </div>
        <div class="table-responsive">
            <table class="table order-table align-middle mb-0">
                <thead>
                    <tr>
                        <th scope="col">Produk</th>
                        <th scope="col">Kategori</th>
                        <th scope="col">Lead time</th>
                        <th scope="col" class="text-end">Harga</th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach (store_products() as $product): ?>
                        <tr>
                            <td>
                                <strong><?= h((string)$product['name']) ?></strong>
                                <div class="small text-muted"><?= h((string)$product['slug']) ?></div>
                            </td>
                            <td><?= h((string)$product['category_label']) ?></td>
                            <td><?= h((string)$product['lead_time']) ?></td>
                            <td class="text-end"><strong><?= h(store_money((float)$product['price'])) ?></strong></td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        </div>
    </div>
</section>
<?php store_page_end();