0xn0l

📂 /home/brightbrai/.trash/php.1

✎ EDIT: api.php ← BACK

<?php
// Strict error reporting for development. Comment out in production.
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

// =================================================================
// 1. CONFIGURATION - IMPORTANT: FILL IN YOUR DETAILS HERE
// =================================================================
define('DB_HOST', 'localhost'); // Your database host, e.g., 'localhost'
define('DB_USER', 'your_db_user');     // Your database username
define('DB_PASS', 'your_db_password'); // Your database password
define('DB_NAME', 'your_db_name');   // Your database name

// Optional: Add your Gemini API key for the AI Financial Reports
define('GEMINI_API_KEY', 'YOUR_GEMINI_API_KEY');

// =================================================================
// 2. HEADERS & SETUP
// =================================================================
header("Access-Control-Allow-Origin: *"); // Allow requests from any origin
header("Content-Type: application/json; charset=UTF-8");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");

// Handle preflight OPTIONS request
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
    exit(0);
}

// =================================================================
// 3. HELPER FUNCTIONS
// =================================================================

/**
 * Sends a JSON response to the client and terminates the script.
 * This is the ONLY function that should output to the browser to prevent HTML errors.
 * @param mixed $data The data to encode as JSON.
 * @param int $statusCode The HTTP status code to send.
 */
function send_json_response($data, $statusCode = 200) {
    http_response_code($statusCode);
    echo json_encode($data);
    exit;
}

/**
 * A simple helper to get all results from a prepared statement.
 * @param mysqli_stmt $stmt The prepared statement after execution.
 * @return array The fetched results.
 */
function get_stmt_results($stmt) {
    $result = $stmt->get_result();
    $data = [];
    while ($row = $result->fetch_assoc()) {
        // Attempt to decode any fields that look like JSON strings
        foreach ($row as $key => &$value) {
            if (is_string($value) && (strpos($value, '[') === 0 || strpos($value, '{') === 0)) {
                $decoded = json_decode($value, true);
                if (json_last_error() === JSON_ERROR_NONE) {
                    $value = $decoded;
                }
            }
        }
        $data[] = $row;
    }
    return $data;
}

// =================================================================
// 4. DATABASE CONNECTION
// =================================================================
// Use a try-catch block to handle connection errors gracefully
try {
    $conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
    if ($conn->connect_error) {
        throw new Exception('Database Connection Failed: ' . $conn->connect_error);
    }
    $conn->set_charset("utf8mb4");
} catch (Exception $e) {
    // If connection fails, send a JSON error response.
    send_json_response(['success' => false, 'message' => $e->getMessage()], 500);
}

// =================================================================
// 5. API ROUTER - Handles incoming requests
// =================================================================
$action = $_GET['action'] ?? null;
$data = json_decode(file_get_contents('php://input'), true);

try {
    switch ($action) {
        // --- GET actions ---
        case 'get_products':
        case 'get_vendors':
        case 'get_sales':
        case 'get_purchase_orders':
        case 'get_expenditures':
        case 'get_adjustments':
            $table = str_replace('get_', '', $action);
            $stmt = $conn->prepare("SELECT * FROM {$table} ORDER BY id DESC");
            $stmt->execute();
            send_json_response(get_stmt_results($stmt));
            break;

case 'get_users':
            $stmt = $conn->prepare("SELECT id, name, email, role, phone, joinDate, active, permissions FROM users ORDER BY name ASC");
            $stmt->execute();
            send_json_response(get_stmt_results($stmt));
            break;

case 'get_settings':
            $stmt = $conn->prepare("SELECT * FROM settings LIMIT 1");
            $stmt->execute();
            $result = $stmt->get_result();
            send_json_response($result->fetch_assoc() ?: []);
            break;
        
        // --- ADD actions ---
        case 'add_products':
            $stmt = $conn->prepare("INSERT INTO products (name, category, stripsPerPack, unitsPerStrip, pricePack, priceStrip, priceUnit, cost, stock, expiryDate, batchNumber, vendorId, autoUpdatePricing, allowDiscount, batches) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '[]')");
            $stmt->bind_param("ssiiidddisssii", $data['name'], $data['category'], $data['stripsPerPack'], $data['unitsPerStrip'], $data['pricePack'], $data['priceStrip'], $data['priceUnit'], $data['cost'], $data['stock'], $data['expiryDate'], $data['batchNumber'], $data['vendorId'], $data['autoUpdatePricing'], $data['allowDiscount']);
            $stmt->execute();
            send_json_response(['success' => true, 'id' => $conn->insert_id]);
            break;

case 'add_vendors':
            $stmt = $conn->prepare("INSERT INTO vendors (name, contact, email, address, payableAmount, activeOrders) VALUES (?, ?, ?, ?, 0, 0)");
            $stmt->bind_param("ssss", $data['name'], $data['contact'], $data['email'], $data['address']);
            $stmt->execute();
            send_json_response(['success' => true, 'id' => $conn->insert_id]);
            break;

case 'add_users':
            $hashed_password = password_hash($data['password'], PASSWORD_DEFAULT);
            $permissions_json = json_encode($data['permissions']);
            $stmt = $conn->prepare("INSERT INTO users (name, email, password, role, phone, joinDate, active, permissions) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
            $stmt->bind_param("ssssssis", $data['name'], $data['email'], $hashed_password, $data['role'], $data['phone'], $data['joinDate'], $data['active'], $permissions_json);
            $stmt->execute();
            send_json_response(['success' => true, 'id' => $conn->insert_id]);
            break;

case 'add_sales':
            $conn->begin_transaction();
            $items_json = json_encode($data['items']);
            $stmt = $conn->prepare("INSERT INTO sales (date, items, totalAmount, discount, paymentMethod) VALUES (?, ?, ?, ?, ?)");
            $stmt->bind_param("ssdds", $data['date'], $items_json, $data['totalAmount'], $data['discount'], $data['paymentMethod']);
            $stmt->execute();

// Update stock for each item sold
            foreach ($data['items'] as $item) {
                $qty_in_units = $item['quantity'];
                if ($item['saleUnit'] === 'Pack') {
                    $qty_in_units *= ($item['stripsPerPack'] * $item['unitsPerStrip']);
                } else if ($item['saleUnit'] === 'Strip') {
                    $qty_in_units *= $item['unitsPerStrip'];
                }
                $stmt_stock = $conn->prepare("UPDATE products SET stock = stock - ? WHERE id = ?");
                $stmt_stock->bind_param("ii", $qty_in_units, $item['id']);
                $stmt_stock->execute();
            }

$conn->commit();
            send_json_response(['success' => true, 'id' => $conn->insert_id]);
            break;

case 'add_expenditures':
            $stmt = $conn->prepare("INSERT INTO expenditures (date, category, amount, description) VALUES (?, ?, ?, ?)");
            $stmt->bind_param("ssds", $data['date'], $data['category'], $data['amount'], $data['description']);
            $stmt->execute();
            send_json_response(['success' => true, 'id' => $conn->insert_id]);
            break;

case 'add_adjustments':
            $conn->begin_transaction();
            $stmt = $conn->prepare("INSERT INTO adjustments (date, productId, productName, type, reason, quantity, unitType, value) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
            $stmt->bind_param("sisssisd", $data['date'], $data['productId'], $data['productName'], $data['type'], $data['reason'], $data['quantity'], $data['unitType'], $data['value']);
            $stmt->execute();
            
            // Adjust stock based on transaction type
            $stock_change = 0;
            if ($data['type'] === 'Sale Return') {
                $stock_change = $data['quantity'];
            } else if ($data['type'] === 'Purchase Return' || $data['type'] === 'Wastage') {
                $stock_change = -$data['quantity'];
            }
            
            if ($stock_change !== 0) {
                $stmt_stock = $conn->prepare("UPDATE products SET stock = stock + ? WHERE id = ?");
                $stmt_stock->bind_param("ii", $stock_change, $data['productId']);
                $stmt_stock->execute();
            }
            
            $conn->commit();
            send_json_response(['success' => true, 'id' => $conn->insert_id]);
            break;

// --- EDIT actions ---
        case 'edit_products':
            $stmt = $conn->prepare("UPDATE products SET name=?, category=?, stripsPerPack=?, unitsPerStrip=?, pricePack=?, priceStrip=?, priceUnit=?, cost=?, stock=?, expiryDate=?, batchNumber=?, vendorId=?, autoUpdatePricing=?, allowDiscount=? WHERE id=?");
            $stmt->bind_param("ssiiidddisssiii", $data['name'], $data['category'], $data['stripsPerPack'], $data['unitsPerStrip'], $data['pricePack'], $data['priceStrip'], $data['priceUnit'], $data['cost'], $data['stock'], $data['expiryDate'], $data['batchNumber'], $data['vendorId'], $data['autoUpdatePricing'], $data['allowDiscount'], $data['id']);
            $stmt->execute();
            send_json_response(['success' => $stmt->affected_rows > 0]);
            break;
            
        case 'edit_vendors':
            $stmt = $conn->prepare("UPDATE vendors SET name=?, contact=?, email=?, address=?, payableAmount=?, activeOrders=? WHERE id=?");
            $stmt->bind_param("ssssdii", $data['name'], $data['contact'], $data['email'], $data['address'], $data['payableAmount'], $data['activeOrders'], $data['id']);
            $stmt->execute();
            send_json_response(['success' => $stmt->affected_rows > 0]);
            break;
            
        case 'edit_users':
            $permissions_json = json_encode($data['permissions']);
            if (!empty($data['password'])) {
                $hashed_password = password_hash($data['password'], PASSWORD_DEFAULT);
                $stmt = $conn->prepare("UPDATE users SET name=?, email=?, password=?, role=?, phone=?, joinDate=?, active=?, permissions=? WHERE id=?");
                $stmt->bind_param("ssssssisi", $data['name'], $data['email'], $hashed_password, $data['role'], $data['phone'], $data['joinDate'], $data['active'], $permissions_json, $data['id']);
            } else {
                $stmt = $conn->prepare("UPDATE users SET name=?, email=?, role=?, phone=?, joinDate=?, active=?, permissions=? WHERE id=?");
                $stmt->bind_param("sssssisi", $data['name'], $data['email'], $data['role'], $data['phone'], $data['joinDate'], $data['active'], $permissions_json, $data['id']);
            }
            $stmt->execute();
            send_json_response(['success' => $stmt->affected_rows > 0]);
            break;

// --- DELETE actions ---
        case 'delete_products':
        case 'delete_vendors':
        case 'delete_users':
        case 'delete_expenditures':
            $table = str_replace('delete_', '', $action);
            $stmt = $conn->prepare("DELETE FROM {$table} WHERE id = ?");
            $stmt->bind_param("i", $data['id']);
            $stmt->execute();
            send_json_response(['success' => $stmt->affected_rows > 0]);
            break;

// --- SPECIAL actions ---
        case 'login':
            $stmt = $conn->prepare("SELECT * FROM users WHERE email = ?");
            $stmt->bind_param("s", $data['email']);
            $stmt->execute();
            $result = $stmt->get_result();
            $user = $result->fetch_assoc();
            
            // For testing, bypass password check. In production, use password_verify.
            // if ($user && password_verify($data['password'], $user['password'])) {
            if ($user) {
                unset($user['password']); // Don't send password hash to client
                $user['permissions'] = json_decode($user['permissions'], true);
                send_json_response(['success' => true, 'user' => $user]);
            } else {
                send_json_response(['success' => false, 'message' => 'Invalid email or password.'], 401);
            }
            break;

case 'process_purchase':
            $conn->begin_transaction();
            $purchase = $data['purchase'];
            $updates = $data['updates'];

$items_json = json_encode($purchase['items']);
            $stmt_po = $conn->prepare("INSERT INTO purchase_orders (vendorId, vendorName, date, status, totalCost, items) VALUES (?, ?, ?, ?, ?, ?)");
            $stmt_po->bind_param("isssds", $purchase['vendorId'], $purchase['vendorName'], $purchase['date'], $purchase['status'], $purchase['totalCost'], $items_json);
            $stmt_po->execute();
            
            foreach ($updates as $productId => $update) {
                $stmt_prod = $conn->prepare("UPDATE products SET stock = stock + ?, pricePack = ?, priceStrip = ?, priceUnit = ?, autoUpdatePricing = ?, batchNumber = ?, expiryDate = ? WHERE id = ?");
                $stmt_prod->bind_param("idddissi", $update['quantity'], $update['pricePack'], $update['priceStrip'], $update['priceUnit'], $update['autoUpdatePricing'], $update['batch'], $update['expiry'], $productId);
                $stmt_prod->execute();
            }

$stmt_vendor = $conn->prepare("UPDATE vendors SET payableAmount = payableAmount + ? WHERE id = ?");
            $stmt_vendor->bind_param("di", $purchase['totalCost'], $purchase['vendorId']);
            $stmt_vendor->execute();

$conn->commit();
            send_json_response(['success' => true]);
            break;

case 'analyzeFinancials':
            $timeframe = $data['timeframe'];
            $financial_data = $data['data'];

$prompt = "You are a financial analyst for a small medical store. Based on the following " . $timeframe . " financial summary, provide a concise analysis (3-4 paragraphs). Identify key strengths, weaknesses, and give one actionable recommendation. Be direct and use simple business terms. Do not use markdown formatting.\n\n";
            $prompt .= json_encode($financial_data, JSON_PRETTY_PRINT);
            
            $gemini_url = 'https://generativelanguage.googleapis.com/v1beta/models/gemini-pro:generateContent?key=' . GEMINI_API_KEY;
            
            $post_data = ['contents' => [['parts' => [['text' => $prompt]]]]];
            
            $ch = curl_init($gemini_url);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_POST, true);
            curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
            curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
            
            $response = curl_exec($ch);
            $httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            if ($httpcode == 200) {
                $result = json_decode($response, true);
                $analysis = $result['candidates'][0]['content']['parts'][0]['text'] ?? "AI analysis could not be generated.";
                send_json_response(['success' => true, 'analysis' => $analysis]);
            } else {
                send_json_response(['success' => false, 'message' => 'Failed to connect to Gemini API.', 'details' => json_decode($response)], 500);
            }
            break;

default:
            send_json_response(['success' => false, 'message' => 'Invalid API action specified.'], 404);
            break;
    }
} catch (Exception $e) {
    if ($conn->in_transaction) {
        $conn->rollback();
    }
    // Any error caught in the switch block will be sent as a JSON response.
    send_json_response(['success' => false, 'message' => 'An error occurred: ' . $e->getMessage()], 500);
}

$conn->close();
?>

0xn0l - 0011000001111000011011100011000001101100