<?php
require __DIR__.'/lib.php';
$u=user(); $err='';
if($_SERVER['REQUEST_METHOD']==='POST'){
  check_csrf();
  $q=($_POST['qty']??'')==='other' ? (int)($_POST['qty_other']??0) : (int)($_POST['qty']??0);
  $q=max(1,min(100000,$q));
  $print=!empty($_POST['print']);
  $sn=trim($_POST['ship_name']??''); $sa=trim($_POST['ship_addr']??''); $notes=trim($_POST['notes']??'');
  if(!$sn||!$sa) $err='Adresse de livraison obligatoire.';
  if(!$u && !$err){
    $email=strtolower(trim($_POST['email']??'')); $name=trim($_POST['name']??''); $p=$_POST['pass']??'';
    if(!filter_var($email,FILTER_VALIDATE_EMAIL)||!$name||strlen($p)<10) $err='E-mail, nom et mot de passe (10 caractères minimum) requis.';
    else { $s=pdo()->prepare('SELECT 1 FROM users WHERE email=?'); $s->execute([$email]); if($s->fetch()) $err='Un compte existe déjà : connectez-vous d’abord.'; }
  }
  $file=null;
  if(!$err && $print && !empty($_FILES['art']['tmp_name']) && is_uploaded_file($_FILES['art']['tmp_name'])){
    $f=$_FILES['art']; $mime=(new finfo(FILEINFO_MIME_TYPE))->file($f['tmp_name']);
    $ext=['image/png'=>'png','image/jpeg'=>'jpg','application/pdf'=>'pdf'][$mime]??null;
    if(!$ext||$f['size']>5*1024*1024) $err='Visuel : PNG, JPG ou PDF, 5 Mo maximum.';
    else { $file=bin2hex(random_bytes(12)).'.'.$ext; move_uploaded_file($f['tmp_name'],__DIR__.'/uploads/'.$file); }
  }
  if(!$err){
    $db=pdo();
    if(!$u){ $db->prepare("INSERT INTO users(email,name,pass_hash,role) VALUES(?,?,?,'client')")->execute([$email,$name,password_hash($p,PASSWORD_DEFAULT)]); login_user((int)$db->lastInsertId()); $u=user(); }
    $unit=unit_price($q); $pc=$print?PRINT_CENTS:0; $total=$q*($unit+$pc);
    $ref='LC'.date('ymd').strtoupper(bin2hex(random_bytes(3)));
    $db->prepare('INSERT INTO orders(client_id,ref,qty,unit_cents,print_custom,print_cents,print_file,print_notes,total_cents,ship_name,ship_addr) VALUES(?,?,?,?,?,?,?,?,?,?,?)')
       ->execute([$u['id'],$ref,$q,$unit,(int)$print,$pc,$file,mb_substr($notes,0,500),$total,$sn,$sa]);
    header('Location: /order.php?ref='.$ref); exit;
  }
}
ob_start(); ?>
<h1>Commander des cartes NFC</h1>
<?php if($err):?><p class="err"><?=h($err)?></p><?php endif?>
<form method="post" enctype="multipart/form-data" class="c"><?=csrf_field()?>
<label>Quantité</label><select name="qty" id="qty"><?php foreach([1,10,50,100,250,500] as $n):?><option value="<?=$n?>"><?=$n?> carte<?=$n>1?'s':''?></option><?php endforeach?><option value="other">Autre quantité…</option></select>
<input type="number" min="1" max="100000" name="qty_other" id="qo" placeholder="Quantité souhaitée" style="display:none;margin-top:8px">
<label><input type="checkbox" name="print" id="print" style="width:auto"> Personnaliser mes cartes avec impression (+<?=money(PRINT_CENTS)?> / carte)</label>
<div id="pz" style="display:none"><label>Visuel (PNG, JPG ou PDF — 5 Mo max)</label><input type="file" name="art" accept=".png,.jpg,.jpeg,.pdf"><label>Instructions d’impression</label><textarea name="notes" rows="2" maxlength="500"></textarea></div>
<label>Nom pour la livraison</label><input name="ship_name" required value="<?=h($u['name']??'')?>">
<label>Adresse de livraison</label><textarea name="ship_addr" rows="2" required></textarea>
<?php if(!$u):?><h3>Votre compte client</h3><label>Nom</label><input name="name" required><label>E-mail</label><input type="email" name="email" required><label>Mot de passe (10 caractères minimum)</label><input type="password" name="pass" required minlength="10" autocomplete="new-password"><?php endif?>
<h2 id="tot"></h2><button>Commander et payer par virement instantané</button></form>
<script>
var T=<?=json_encode(TIERS)?>,P=<?=PRINT_CENTS?>;
function up(q){for(var i=0;i<T.length;i++)if(q>=T[i][0])return T[i][1];return T[T.length-1][1]}
function calc(){var s=document.getElementById('qty'),o=document.getElementById('qo');o.style.display=s.value==='other'?'block':'none';
var q=s.value==='other'?(+o.value||1):+s.value,pr=document.getElementById('print').checked;document.getElementById('pz').style.display=pr?'block':'none';
var u=up(q)+(pr?P:0);document.getElementById('tot').textContent='Total : '+(q*u/100).toFixed(2).replace('.',',')+' € ('+(u/100).toFixed(2).replace('.',',')+' € / carte)'}
['qty','qo','print'].forEach(function(i){document.getElementById(i).addEventListener('input',calc)});calc();
</script>
<?php layout('Boutique',ob_get_clean(),'<a href="/login.php">Espace client</a>');
