points_api.php

<?php
header("Content-Type: application/json");
include "dbcon.php";

// =========================================================
// 1. GET METHOD → RETURN USER POINTS
// =========================================================
if ($_SERVER["REQUEST_METHOD"] === "GET") {

    if (!isset($_GET['id']) || empty($_GET['id'])) {
        echo json_encode(["status" => "error", "message" => "Missing or empty user ID"]);
        exit;
    }

    $userID = $_GET['id'];

    $stmt = $conn->prepare("SELECT points_total FROM users WHERE user_unique_id=?");
    $stmt->bind_param("s", $userID);
    $stmt->execute();
    $res = $stmt->get_result();

    if ($res->num_rows === 0) {
        echo json_encode(["status" => "error", "message" => "User not found"]);
        exit;
    }

    $user = $res->fetch_assoc();

    echo json_encode([
        "status" => "success",
        "mode" => "fetch_points",
        "user_id" => $userID,
        "points_total" => (int)$user["points_total"]
    ]);
    exit;
}



// =========================================================
// 2. POST METHOD → ADD OR DEDUCT POINTS
// =========================================================
if ($_SERVER["REQUEST_METHOD"] === "POST") {

    // Get JSON body
    $input = file_get_contents("php://input");
    $data = json_decode($input, true);

    if (!$data ||
        !isset($data["user_unique_id"]) ||
        !isset($data["points_added"])) {

        echo json_encode([
            "status" => "error",
            "message" => "Missing required fields: user_unique_id or points_added"
        ]);
        exit;
    }

    $userID = $data["user_unique_id"];
    $points_added = (int)$data["points_added"];
    $description = $data["description"] ?? "No description";
    $source = $data["source"] ?? "ESP32";

    // Check user exists
    $stmt = $conn->prepare("SELECT points_total FROM users WHERE user_unique_id=?");
    $stmt->bind_param("s", $userID);
    $stmt->execute();
    $res = $stmt->get_result();

    if ($res->num_rows === 0) {
        echo json_encode([
            "status" => "error",
            "message" => "User not found"
        ]);
        exit;
    }

    $user = $res->fetch_assoc();
    $currentPoints = (int)$user["points_total"];


    // Check if deduction exceeds current points
    if ($points_added < 0) {
        $deduction = abs($points_added);
        if ($currentPoints < $deduction) {
            echo json_encode([
                "status" => "error",
                "message" => "Not enough points",
                "current_points" => $currentPoints,
                "required" => $deduction
            ]);
            exit;
        }
    }


    // ================================================
    // SAFE DATABASE TRANSACTION
    // ================================================
    $conn->begin_transaction();

    try {

        // Update points
        $stmt = $conn->prepare("
            UPDATE users
            SET points_total = points_total + ?
            WHERE user_unique_id=?
        ");
        $stmt->bind_param("is", $points_added, $userID);
        $stmt->execute();
        $stmt->close();

        // Insert transaction log
        $stmt = $conn->prepare("
            INSERT INTO transactions (user_unique_id, points_added, description, source, created_at)
            VALUES (?, ?, ?, ?, NOW())
        ");
        $stmt->bind_param("siss", $userID, $points_added, $description, $source);
        $stmt->execute();
        $stmt->close();

        // Commit everything
        $conn->commit();

        echo json_encode([
            "status" => "success",
            "mode" => ($points_added < 0 ? "claim" : "deposit"),
            "user_id" => $userID,
            "points_change" => $points_added
        ]);
    }

    catch (Exception $e) {
        $conn->rollback();
        echo json_encode([
            "status" => "error",
            "message" => "Database error: " . $e->getMessage()
        ]);
    }

    exit;
}



// =========================================================
// 3. OTHER METHODS → NOT ALLOWED
// =========================================================
echo json_encode([
    "status" => "error",
    "message" => "Invalid request method"
]);
exit;
?>