<?php
// router.php
// ----------------------------------------------------------
// SAFE SESSION START
// ----------------------------------------------------------
if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

// Ambil route dari URL
$route = $_GET['route'] ?? '';
$route = trim($route, '/');

// ----------------------------------------------------------
// Boleh diakses tanpa login
// ----------------------------------------------------------
$publicRoutes = ['login', 'logout'];

if (!in_array($route, $publicRoutes) && empty($_SESSION['admin'])) {
    header("Location: /presensi_v1/login");
    exit;
}

// ----------------------------------------------------------
// ROUTING
// ----------------------------------------------------------
switch (true) {

    /* ========== LOGIN / LOGOUT ========== */
    case ($route === 'login'):
        require __DIR__ . '/auth/login.php';
        break;

    case ($route === 'logout'):
        require __DIR__ . '/auth/logout.php';
        break;

    /* ========== DASHBOARD ========== */
    case ($route === '' || $route === 'dashboard'):
        require __DIR__ . '/pages/dashboard.php';
        break;

    /* ========== SISWA ========== */
    case ($route === 'siswa'):
        require __DIR__ . '/pages/manage_siswa.php';
        break;

    case ($route === 'siswa/add'):
        $_GET['action'] = 'add';
        require __DIR__ . '/pages/manage_siswa.php';
        break;

    case (preg_match('#^siswa/edit/([0-9]+)$#', $route, $m)):
        $_GET['action'] = 'edit';
        $_GET['id'] = (int)$m[1];
        require __DIR__ . '/pages/manage_siswa.php';
        break;

    /* ========== UID / KARTU ========== */
    case ($route === 'uid' || $route === 'kartu'):
        require __DIR__ . '/pages/manage_uid.php';
        break;

    case ($route === 'uid/pool'):
        require __DIR__ . '/pages/manage_uid.php';
        break;

    /* ========== SETTINGS ========== */
    case ($route === 'settings'):
        require __DIR__ . '/pages/settings.php';
        break;

    /* ========== REKAP PRESENSI ========== */
    case ($route === 'rekap'):
        require __DIR__ . '/pages/rekap.php';
        break;

    case (preg_match('#^rekap/([0-9]{4})/([0-9]{2})$#', $route, $m)):
        $_GET['from'] = $m[1] . "-" . $m[2] . "-01";
        $_GET['to']   = $m[1] . "-" . $m[2] . "-31";
        require __DIR__ . '/pages/rekap.php';
        break;

    /* ========== PROCESS (POST only) ========== */
    case preg_match('#^process/([a-zA-Z0-9_-]+)\.php$#', $route, $m):

        // hanya file whitelist yang boleh diakses
        $allowedProcess = [
            'siswa_save',
            'siswa_delete',
            'bulk_delete',
            'siswa_import',
            'uid_delete',
            'uid_assign'
        ];

        if (!in_array($m[1], $allowedProcess)) {
            http_response_code(403);
            echo "Forbidden";
            exit;
        }

        require __DIR__ . "/process/{$m[1]}.php";
        break;

    /* ========== 404 ========== */
    default:
        http_response_code(404);
        echo "<h1>404 - Halaman tidak ditemukan</h1>";
        echo "Route: <b>" . htmlspecialchars($route) . "</b>";
        break;
}
