<?php

declare(strict_types=1);

session_set_cookie_params([
    'httponly' => true,
    'samesite' => 'Strict',
    'secure' => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
    'use_strict_mode' => true,
]);
session_start();
header('Content-Type: application/json; charset=UTF-8');
header('Cache-Control: no-store');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Referrer-Policy: no-referrer');
header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'");

require_once __DIR__ . '/inc/db.inc.php';

$query = trim((string) ($_GET['q'] ?? ''));
$roomType = trim((string) ($_GET['room_type'] ?? ''));

if (!in_array($roomType, ['double', 'multi'], true) || mb_strlen($query) < 2) {
    echo json_encode([], JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
    exit;
}

try {
    $pdo = new PDO(
        sprintf(
            'mysql:host=%s;port=%d;dbname=%s;charset=%s',
            $dbConfig['host'],
            $dbConfig['port'],
            $dbConfig['database'],
            $dbConfig['charset']
        ),
        $dbConfig['username'],
        $dbConfig['password'],
        [
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_EMULATE_PREPARES => false,
            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_COLUMN,
        ]
    );

    $statement = $pdo->prepare(
        'SELECT DISTINCT p.name
         FROM participants p
         INNER JOIN bookings b ON b.participant_id = p.id
         WHERE p.name LIKE :query
         ORDER BY p.name
         LIMIT 10'
    );
    $statement->execute([
        ':query' => '%' . $query . '%',
    ]);

    echo json_encode($statement->fetchAll(), JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
} catch (Throwable $exception) {
    error_log('Zimmernachbar-Suche fehlgeschlagen: ' . $exception->getMessage());
    http_response_code(500);
    echo json_encode(['error' => 'Vorschläge konnten nicht geladen werden.'], JSON_UNESCAPED_UNICODE);
}