<?php
require '../config.php';
require 'auth.php';

$id   = intval($_POST['id']);
$acao = $_POST['acao'] ?? null;

$saque = $conn->prepare("
    SELECT * FROM withdrawals 
    WHERE id=? AND admin_action='PENDING'
");
$saque->execute([$id]);
$s = $saque->fetch();

if (!$s) {
    header("Location: dashboard.php");
    exit;
}

/* =========================
   REJEITAR SAQUE
========================= */
if ($acao === 'rejeitar') {

    $conn->beginTransaction();

    // devolve saldo
    $conn->prepare("
        UPDATE users SET saldo = saldo + ?
        WHERE id=?
    ")->execute([$s['amount'], $s['user_id']]);

    // marca rejeitado
    $conn->prepare("
        UPDATE withdrawals 
        SET admin_action='REJECTED', status='FAILED'
        WHERE id=?
    ")->execute([$id]);

    $conn->commit();

    header("Location: dashboard.php");
    exit;
}

/* =========================
   APROVAR + ENVIAR CONNECTPAY
========================= */
if ($acao === 'aprovar') {

    try {

        /* PAYLOAD CORRETO (DOCS OFICIAL) */
        $payload = [
            "external_id" => "wd_" . $s['id'],
            "pix_key"     => $s['pix_key'],
            "pix_type"    => strtoupper($s['pix_type']), // CPF | EMAIL | PHONE | RANDOM
            "amount"      => (float)$s['amount'],
            "webhook_url" => "https://n-inc-meta.space/investimento/api/webhook_connectpay.php"
        ];

        $ch = curl_init("https://api.connectpay.vc/v1/cashout");

        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_POST => true,
            CURLOPT_HTTPHEADER => [
                "api-secret: sk_08455b685c1ca9d3813474e87d3c43de951406abd67908021d9094ad7782a09a7e32d4c6fedf4aed7dec4174f051187f954f49e298b2cb2682652f8d5fe0fb83",
                "Content-Type: application/json"
            ],
            CURLOPT_POSTFIELDS => json_encode($payload),
            CURLOPT_TIMEOUT => 30,
            CURLOPT_SSL_VERIFYPEER => true
        ]);

        $response = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

        if ($response === false) {
            throw new Exception("Erro cURL: " . curl_error($ch));
        }

        curl_close($ch);

        if ($httpCode !== 200 && $httpCode !== 201) {
            throw new Exception("Erro API ConnectPay: " . $response);
        }

        $res = json_decode($response, true);
$res = json_decode($response, true);

if (
    empty($res['success']) ||
    empty($res['data']['cashout_id'])
) {
    throw new Exception("Resposta inválida da API: " . $response);
}

$transactionId = $res['data']['cashout_id'];


        // grava sucesso
        $conn->prepare("
            UPDATE withdrawals 
            SET admin_action='APPROVED',
                status='PENDING',
                transaction_id=?
            WHERE id=?
        ")->execute([$res['id'], $id]);

    } catch (Exception $e) {

        // falhou → devolve saldo
        $conn->beginTransaction();

        $conn->prepare("
            UPDATE users SET saldo = saldo + ?
            WHERE id=?
        ")->execute([$s['amount'], $s['user_id']]);

        $conn->prepare("
            UPDATE withdrawals 
            SET admin_action='FAILED',
                status='FAILED'
            WHERE id=?
        ")->execute([$id]);

        $conn->commit();

        die("Erro ao enviar saque: " . $e->getMessage());
    }

    header("Location: dashboard.php");
    exit;
}