api.php

<?php

declare(strict_types=1);

date_default_timezone_set('Europe/Berlin');

require_once __DIR__ . '/src/Storage.php';
require_once __DIR__ . '/src/TokenManager.php';
require_once __DIR__ . '/src/Auth.php';
require_once __DIR__ . '/src/ICalParser.php';
require_once __DIR__ . '/src/TransitProviders/TransitProviderInterface.php';
require_once __DIR__ . '/src/TransitProviders/Ril100Registry.php';
require_once __DIR__ . '/src/TransitProviders/DbHafasProvider.php';
require_once __DIR__ . '/src/TransitProviders/InsaHafasProvider.php';
require_once __DIR__ . '/src/TransitProviders/VrrHafasProvider.php';
require_once __DIR__ . '/src/TransitProviders/VbbHafasProvider.php';
require_once __DIR__ . '/src/TransitProviders/CustomHafasProvider.php';
require_once __DIR__ . '/src/TransitProviders/ProviderRegistry.php';
require_once __DIR__ . '/src/TransitFetcher.php';
require_once __DIR__ . '/src/BoardManager.php';
require_once __DIR__ . '/src/Modules/PanelModuleInterface.php';
require_once __DIR__ . '/src/Modules/ModuleRegistry.php';
require_once __DIR__ . '/src/Updater.php';

use Dashboard\Auth;
use Dashboard\BoardManager;
use Dashboard\Modules\ModuleRegistry;
use Dashboard\Storage;
use Dashboard\TokenManager;
use Dashboard\Updater;

header('Content-Type: application/json; charset=utf-8');

Auth::startSession();
$user = Auth::currentUser();

if (!$user) {
    echo json_encode(['error' => 'Nicht angemeldet'], JSON_UNESCAPED_UNICODE);
    exit;
}

$action = $_GET['action'] ?? $_POST['action'] ?? '';
$params = array_merge($_GET, $_POST);

try {
    // 1. Direct Module Routing (module=xyz or action handled by module)
    $moduleType = $_GET['module'] ?? $_POST['module'] ?? null;
    if (!empty($moduleType)) {
        $module = ModuleRegistry::get($moduleType);
        if ($module !== null) {
            $res = $module->handleApi($action, $params);
            if ($res !== null) {
                echo json_encode($res, JSON_UNESCAPED_UNICODE);
                exit;
            }
        }
    }

    // 2. Action-based Module Auto-Routing
    $moduleForAction = ModuleRegistry::findModuleForAction($action);
    if ($moduleForAction !== null) {
        $res = $moduleForAction->handleApi($action, $params);
        if ($res !== null) {
            echo json_encode($res, JSON_UNESCAPED_UNICODE);
            exit;
        }
    }

    // 3. Core Engine API Actions
    switch ($action) {
        case 'check_board_status':
            $boardId = $_GET['board_id'] ?? $_POST['board_id'] ?? '';
            $board = BoardManager::getBoard($boardId);
            if (!$board) {
                echo json_encode(['success' => true, 'exists' => false, 'hash' => ''], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $hash = md5(json_encode($board));
            echo json_encode(['success' => true, 'exists' => true, 'hash' => $hash], JSON_UNESCAPED_UNICODE);
            break;

        case 'create_board':
            $title = $_POST['title'] ?? 'NEUES_BOARD';
            $newBoard = BoardManager::createBoard($title, $user['id']);
            echo json_encode(['success' => true, 'board' => $newBoard], JSON_UNESCAPED_UNICODE);
            break;

        case 'delete_board':
            $boardId = $_POST['board_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Nur Board-Admins können dieses Board löschen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $ok = BoardManager::deleteBoard($boardId, $user['id']);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'save_board_columns':
            $boardId = $_POST['board_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Nur Board-Admins können die Spaltenkonfiguration ändern.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $rawCols = $_POST['columns'] ?? '[]';
            $columns = is_array($rawCols) ? $rawCols : json_decode($rawCols, true);
            $ok = BoardManager::updateBoardColumns($boardId, (array)$columns);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'save_board_theme':
            $boardId = $_POST['board_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Ändern des Farbschemas auf diesem Board.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $themeConfig = [
                'bg_color' => $_POST['bg_color'] ?? '#080d08',
                'text_color' => $_POST['text_color'] ?? '#00ff66',
                'border_color' => $_POST['border_color'] ?? '#00aa44',
                'header_bg' => $_POST['header_bg'] ?? '#002200',
                'accent_color' => $_POST['accent_color'] ?? '#33ff88',
                'scanlines' => !empty($_POST['scanlines'])
            ];
            $ok = BoardManager::updateBoardTheme($boardId, $themeConfig);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'update_board_access':
            $boardId = $_POST['board_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Nur Board-Admins können Zugriffsrechte ändern.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $rawAdmins = $_POST['admins'] ?? '[]';
            $rawViewers = $_POST['viewers'] ?? '[]';
            $admins = is_array($rawAdmins) ? $rawAdmins : json_decode($rawAdmins, true);
            $viewers = is_array($rawViewers) ? $rawViewers : json_decode($rawViewers, true);

            $ok = BoardManager::updateBoardAccess($boardId, (array)$admins, (array)$viewers);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'add_view':
            $boardId = $_POST['board_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Hinzufügen von Views.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $title = $_POST['title'] ?? 'NEUER_VIEW';
            $colIndex = (int)($_POST['column'] ?? 0);
            $newView = BoardManager::addView($boardId, strtoupper($title), $colIndex);
            echo json_encode(['success' => (bool)$newView, 'view' => $newView], JSON_UNESCAPED_UNICODE);
            break;

        case 'rename_view':
            $boardId = $_POST['board_id'] ?? '';
            $viewId = $_POST['view_id'] ?? '';
            $title = $_POST['title'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Umbenennen des Views.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $ok = BoardManager::updateViewTitle($boardId, $viewId, $title);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'update_view_column':
            $boardId = $_POST['board_id'] ?? '';
            $viewId = $_POST['view_id'] ?? '';
            $colIndex = (int)($_POST['column'] ?? 0);
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Verschieben des Views.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $ok = BoardManager::moveViewToColumn($boardId, $viewId, $colIndex);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'delete_view':
            $boardId = $_POST['board_id'] ?? '';
            $viewId = $_POST['view_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Löschen des Views.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $ok = BoardManager::deleteView($boardId, $viewId);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'add_widget':
            $boardId = $_POST['board_id'] ?? '';
            $viewId = $_POST['view_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Hinzufügen von Widgets.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $widgetData = [
                'title' => strtoupper($_POST['title'] ?? 'PANEL'),
                'type' => $_POST['type'] ?? 'transit'
            ];

            $wType = $widgetData['type'];
            if ($wType === 'transit') {
                $widgetData['station'] = $_POST['station'] ?? 'Hauptbahnhof';
                $widgetData['provider'] = $_POST['provider'] ?? 'db';
                $widgetData['custom_api_url'] = $_POST['custom_api_url'] ?? '';
                $widgetData['variant'] = $_POST['variant'] ?? 'standard';
                $widgetData['limit'] = (int)($_POST['limit'] ?? 6);
                $widgetData['show_delay'] = !empty($_POST['show_delay']);
                $widgetData['lookahead'] = (int)($_POST['lookahead'] ?? 60);
                $widgetData['lookbehind'] = (int)($_POST['lookbehind'] ?? 0);
                $widgetData['show_national'] = !empty($_POST['show_national']);
                $widgetData['show_regional'] = !empty($_POST['show_regional']);
                $widgetData['show_suburban'] = !empty($_POST['show_suburban']);
                $widgetData['show_tram'] = !empty($_POST['show_tram']);
                $widgetData['show_bus'] = !empty($_POST['show_bus']);
            } elseif ($wType === 'weather') {
                $widgetData['location'] = $_POST['location'] ?? 'Musterstadt';
                $widgetData['provider'] = $_POST['provider'] ?? 'open_meteo';
                $widgetData['variant'] = $_POST['variant'] ?? 'forecast_3';
                $widgetData['unit'] = $_POST['unit'] ?? 'celsius';
                $widgetData['show_details'] = !empty($_POST['show_details']);
            } elseif ($wType === 'clock') {
                $widgetData['timezone'] = $_POST['timezone'] ?? 'Europe/Berlin';
                $widgetData['variant'] = $_POST['variant'] ?? 'digital_large';
                $widgetData['show_seconds'] = !empty($_POST['show_seconds']);
                $widgetData['show_date'] = !empty($_POST['show_date']);
                $widgetData['format_12h'] = !empty($_POST['format_12h']);
            } elseif ($wType === 'ical') {
                $rawCals = $_POST['calendars_json'] ?? '[]';
                $widgetData['calendars'] = is_array($rawCals) ? $rawCals : json_decode($rawCals, true);
            } elseif ($wType === 'notes') {
                $widgetData['content'] = $_POST['content'] ?? '';
            } elseif ($wType === 'webtext') {
                $widgetData['url'] = $_POST['url'] ?? '';
            } elseif ($wType === 'webpage') {
                $widgetData['url'] = $_POST['url'] ?? '';
            } elseif ($wType === 'parsed_website') {
                $widgetData['url'] = $_POST['url'] ?? '';
                $widgetData['translate_headings'] = !empty($_POST['translate_headings']);
                $widgetData['custom_dictionary'] = $_POST['custom_dictionary'] ?? '';
            }

            $newW = BoardManager::addWidget($boardId, $viewId, $widgetData);
            echo json_encode(['success' => (bool)$newW, 'widget' => $newW], JSON_UNESCAPED_UNICODE);
            break;

        case 'update_widget':
            $boardId = $_POST['board_id'] ?? '';
            $viewId = $_POST['view_id'] ?? '';
            $widgetId = $_POST['widget_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Bearbeiten von Widgets.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $widgetData = [
                'title' => strtoupper($_POST['title'] ?? 'PANEL'),
                'type' => $_POST['type'] ?? 'transit'
            ];

            $wType = $widgetData['type'];
            if ($wType === 'transit') {
                $widgetData['station'] = $_POST['edit_transit_station'] ?? 'Hauptbahnhof';
                $widgetData['provider'] = $_POST['edit_transit_provider'] ?? 'db';
                $widgetData['custom_api_url'] = $_POST['edit_transit_custom_url'] ?? '';
                $widgetData['variant'] = $_POST['edit_transit_variant'] ?? 'standard';
                $widgetData['limit'] = (int)($_POST['edit_transit_limit'] ?? 6);
                $widgetData['show_delay'] = !empty($_POST['edit_transit_show_delay']);
                $widgetData['lookahead'] = (int)($_POST['edit_transit_lookahead'] ?? 60);
                $widgetData['lookbehind'] = (int)($_POST['edit_transit_lookbehind'] ?? 0);
                $widgetData['show_national'] = !empty($_POST['edit_transit_show_national']);
                $widgetData['show_regional'] = !empty($_POST['edit_transit_show_regional']);
                $widgetData['show_suburban'] = !empty($_POST['edit_transit_show_suburban']);
                $widgetData['show_tram'] = !empty($_POST['edit_transit_show_tram']);
                $widgetData['show_bus'] = !empty($_POST['edit_transit_show_bus']);
            } elseif ($wType === 'weather') {
                $widgetData['location'] = $_POST['edit_weather_location'] ?? 'Musterstadt';
                $widgetData['provider'] = $_POST['edit_weather_provider'] ?? 'open_meteo';
                $widgetData['variant'] = $_POST['edit_weather_variant'] ?? 'forecast_3';
                $widgetData['unit'] = $_POST['edit_weather_unit'] ?? 'celsius';
                $widgetData['show_details'] = !empty($_POST['edit_weather_show_details']);
            } elseif ($wType === 'clock') {
                $widgetData['timezone'] = $_POST['edit_clock_timezone'] ?? 'Europe/Berlin';
                $widgetData['variant'] = $_POST['edit_clock_variant'] ?? 'digital_large';
                $widgetData['show_seconds'] = !empty($_POST['edit_clock_show_seconds']);
                $widgetData['show_date'] = !empty($_POST['edit_clock_show_date']);
                $widgetData['format_12h'] = !empty($_POST['edit_clock_format_12h']);
            } elseif ($wType === 'ical') {
                $rawCals = $_POST['calendars_json'] ?? '[]';
                $widgetData['calendars'] = is_array($rawCals) ? $rawCals : json_decode($rawCals, true);
            } elseif ($wType === 'notes') {
                $widgetData['content'] = $_POST['edit_notes_content'] ?? '';
            } elseif ($wType === 'webtext') {
                $widgetData['url'] = $_POST['edit_webtext_url'] ?? '';
            } elseif ($wType === 'webpage') {
                $widgetData['url'] = $_POST['edit_webpage_url'] ?? '';
            } elseif ($wType === 'parsed_website') {
                $widgetData['url'] = $_POST['edit_parsed_url'] ?? '';
                $widgetData['translate_headings'] = !empty($_POST['edit_parsed_translate']);
                $widgetData['custom_dictionary'] = $_POST['edit_parsed_dict'] ?? '';
            }

            $ok = BoardManager::updateWidget($boardId, $viewId, $widgetId, $widgetData);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'delete_widget':
            $boardId = $_POST['board_id'] ?? '';
            $viewId = $_POST['view_id'] ?? '';
            $widgetId = $_POST['widget_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Keine Rechte zum Löschen von Widgets.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $ok = BoardManager::deleteWidget($boardId, $viewId, $widgetId);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'create_kiosk_token':
            $boardId = $_POST['board_id'] ?? '';
            $perm = BoardManager::getBoardPermission($user['id'], $boardId);
            if ($perm !== 'admin') {
                echo json_encode(['error' => 'Nur Board-Admins können Login-Token erstellen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $name = $_POST['name'] ?? 'Kiosk Token';
            $fullscreen = !empty($_POST['fullscreen']);

            $tokenData = TokenManager::createToken($name, $boardId, $fullscreen, $user['id']);
            echo json_encode(['success' => true, 'token' => $tokenData], JSON_UNESCAPED_UNICODE);
            break;

        case 'delete_kiosk_token':
            $tokenStr = $_POST['token'] ?? '';
            $tokenData = TokenManager::getToken($tokenStr);
            if ($tokenData) {
                $perm = BoardManager::getBoardPermission($user['id'], $tokenData['board_id']);
                if ($perm !== 'admin') {
                    echo json_encode(['error' => 'Keine Rechte zum Löschen dieses Tokens.'], JSON_UNESCAPED_UNICODE);
                    exit;
                }
                $ok = TokenManager::deleteToken($tokenStr);
                echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => 'Token nicht gefunden.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'create_software_user':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur Software-Admins können neue Benutzer anlegen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }

            $username = $_POST['username'] ?? '';
            $displayName = $_POST['display_name'] ?? '';
            $password = $_POST['password'] ?? '';
            $role = $_POST['role'] ?? 'user';

            $res = Auth::register($username, $displayName, $password, $role);
            if ($res === true) {
                echo json_encode(['success' => true], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Erstellen des Benutzers.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'change_own_password':
            $oldPass = $_POST['old_password'] ?? '';
            $newPass = $_POST['new_password'] ?? '';
            $res = Auth::changePassword($user['id'], $oldPass, $newPass);
            if ($res === true) {
                echo json_encode(['success' => true], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Ändern des Passworts.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'update_session_settings':
            $days = (int)($_POST['session_lifetime_days'] ?? 7);
            $res = Auth::updateSessionLifetime($user['id'], $days);
            if ($res === true) {
                echo json_encode(['success' => true], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Speichern der Sitzungsdauer.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'update_user_role':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur System-Admins dürfen Benutzerrollen ändern.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $targetId = $_POST['user_id'] ?? '';
            $role = $_POST['role'] ?? 'user';
            $res = Auth::updateUserRole($targetId, $role);
            if ($res === true) {
                echo json_encode(['success' => true], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Ändern der Rolle.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'reset_one_time_password':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur System-Admins dürfen Einmalpasswörter zurücksetzen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $targetId = $_POST['user_id'] ?? '';
            $res = Auth::resetOneTimePassword($targetId);
            if (is_array($res) && !empty($res['success'])) {
                echo json_encode($res, JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Zurücksetzen.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'delete_software_user':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur System-Admins dürfen Benutzerkonten löschen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $targetId = $_POST['user_id'] ?? '';
            $res = Auth::deleteUser($targetId);
            if ($res === true) {
                echo json_encode(['success' => true], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Löschen des Benutzers.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'update_display_name':
            $targetId = $_POST['user_id'] ?? $user['id'];
            if ($targetId !== $user['id'] && !Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Keine Berechtigung zum Ändern des Anzeigenamens dieses Benutzers.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $newName = $_POST['display_name'] ?? '';
            $res = Auth::updateDisplayName($targetId, $newName);
            if ($res === true) {
                echo json_encode(['success' => true], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Ändern des Anzeigenamens.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'update_username':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur System-Admins dürfen Benutzernamen ändern.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $targetId = $_POST['user_id'] ?? '';
            $newUsername = $_POST['username'] ?? '';
            $res = Auth::updateUsername($targetId, $newUsername);
            if ($res === true) {
                echo json_encode(['success' => true], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => is_string($res) ? $res : 'Fehler beim Ändern des Benutzernamens.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        case 'save_system_config':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur System-Admins dürfen System-Konfigurationen ändern.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $showDefaultCreds = !empty($_POST['show_default_credentials']);
            $autoUpdateCheck = !empty($_POST['auto_update_check']);
            $systemTitle = trim($_POST['system_title'] ?? '') ?: 'RETRO CONSOLE DASHBOARD';
            $distroUrl = trim($_POST['distro_url'] ?? '') ?: Updater::DEFAULT_DISTRO_URL;
            $config = Storage::getSystemConfig();
            $config['show_default_credentials'] = $showDefaultCreds;
            $config['auto_update_check'] = $autoUpdateCheck;
            $config['system_title'] = $systemTitle;
            $config['distro_url'] = $distroUrl;
            $config['login_theme'] = [
                'bg_color' => $_POST['login_bg_color'] ?? '#080d08',
                'text_color' => $_POST['login_text_color'] ?? '#00ff66',
                'border_color' => $_POST['login_border_color'] ?? '#00aa44',
                'header_bg' => $_POST['login_header_bg'] ?? '#002200',
                'accent_color' => $_POST['login_accent_color'] ?? '#33ff88',
                'scanlines' => !empty($_POST['login_scanlines'])
            ];
            $ok = Storage::saveSystemConfig($config);
            echo json_encode(['success' => $ok], JSON_UNESCAPED_UNICODE);
            break;

        case 'check_for_updates':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur System-Admins dürfen nach Updates suchen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $res = Updater::checkForUpdates();
            echo json_encode($res, JSON_UNESCAPED_UNICODE);
            break;

        case 'perform_update':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur System-Admins dürfen Software-Updates ausführen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $res = Updater::performUpdate();
            echo json_encode($res, JSON_UNESCAPED_UNICODE);
            break;

        case 'get_documentation':
            if (!Auth::isGlobalAdmin()) {
                echo json_encode(['error' => 'Nur Software-Admins dürfen die System-Dokumentation einsehen.'], JSON_UNESCAPED_UNICODE);
                exit;
            }
            $docFile = $_GET['doc'] ?? 'de/README.md';
            $cleanPath = str_replace('..', '', $docFile);
            $targetPath = __DIR__ . '/Documentation/' . ltrim($cleanPath, '/');
            if (!file_exists($targetPath)) {
                $targetPath = __DIR__ . '/' . ltrim($cleanPath, '/');
            }

            if (file_exists($targetPath) && is_file($targetPath)) {
                $content = file_get_contents($targetPath);
                echo json_encode(['success' => true, 'doc' => $docFile, 'content' => $content], JSON_UNESCAPED_UNICODE);
            } else {
                echo json_encode(['error' => 'Dokumentation nicht gefunden.'], JSON_UNESCAPED_UNICODE);
            }
            break;

        default:
            echo json_encode(['error' => 'Unbekannte Aktion'], JSON_UNESCAPED_UNICODE);
            break;
    }
} catch (Throwable $e) {
    echo json_encode(['error' => $e->getMessage()], JSON_UNESCAPED_UNICODE);
}