<?php
declare(strict_types=1);

require __DIR__ . '/../app/bootstrap.php';

try {
    $action = $_GET['action'] ?? 'state';
    $method = $_SERVER['REQUEST_METHOD'] ?? 'GET';

    if ($method === 'GET' && $action === 'state') {
        if (!app_private_tools_enabled()) {
            json_response(['error' => 'Private tracker/admin tools are disabled for this public site.'], 403);
            exit;
        }
        json_response(state_payload($_GET));
        exit;
    }

    if ($method === 'GET' && $action === 'library_search') {
        json_response(library_search_payload($_GET));
        exit;
    }

    if ($method !== 'POST') {
        json_response(['error' => 'Unsupported method.'], 405);
        exit;
    }

    $data = json_input();
    $adminActions = [
        'create_user' => true,
        'update_user' => true,
        'delete_user' => true,
        'refresh_medication_sources' => true,
    ];
    $trackerActions = [
        'update_theme' => true,
        'create_exercise' => true,
        'create_supplement' => true,
        'create_nutrition_goal' => true,
        'create_routine' => true,
        'create_workout' => true,
        'update_workout' => true,
        'create_nutrition_log' => true,
        'create_supplement_log' => true,
        'create_body_metric' => true,
        'create_medication_log' => true,
        'create_vital_log' => true,
        'create_lab_result' => true,
        'create_symptom_log' => true,
        'create_allergy_record' => true,
        'create_appointment' => true,
        'create_immunization_record' => true,
    ];
    $routes = [
        'create_user' => 'create_user',
        'update_user' => 'update_user',
        'delete_user' => 'delete_user',
        'update_theme' => 'update_theme',
        'create_exercise' => 'create_exercise',
        'create_supplement' => 'create_supplement',
        'create_nutrition_goal' => 'create_nutrition_goal',
        'create_routine' => 'create_routine',
        'create_workout' => 'create_workout',
        'update_workout' => 'update_workout',
        'create_nutrition_log' => 'create_nutrition_log',
        'create_supplement_log' => 'create_supplement_log',
        'create_body_metric' => 'create_body_metric',
        'create_medication_log' => 'create_medication_log',
        'create_vital_log' => 'create_vital_log',
        'create_lab_result' => 'create_lab_result',
        'create_symptom_log' => 'create_symptom_log',
        'create_allergy_record' => 'create_allergy_record',
        'create_appointment' => 'create_appointment',
        'create_immunization_record' => 'create_immunization_record',
        'refresh_medication_sources' => 'refresh_medication_sources',
    ];

    if (!isset($routes[$action])) {
        json_response(['error' => 'Unknown API action.'], 404);
        exit;
    }

    if (isset($adminActions[$action]) && !app_admin_area_enabled()) {
        json_response(['error' => 'Admin tools are disabled for this public site.'], 403);
        exit;
    }

    if (isset($trackerActions[$action]) && !app_tracker_area_enabled()) {
        json_response(['error' => 'Tracker tools are disabled for this public site.'], 403);
        exit;
    }

    json_response($routes[$action]($data));
} catch (InvalidArgumentException $exception) {
    json_response(['error' => $exception->getMessage()], 400);
} catch (Throwable $exception) {
    json_response(['error' => 'Server error: ' . $exception->getMessage()], 500);
}