<?php
// Small JSON stock API (PHP + SQLite). Run: php -S 127.0.0.1:8098 api.php
// GET /api/products[?category=X]   GET /api/products/{sku}   POST /api/stock/adjust {"sku","delta","reason"} (needs X-Api-Key)
declare(strict_types=1);
const API_KEY = 'sample-key-change-me';
header('Content-Type: application/json');
$db = new PDO('sqlite:' . __DIR__ . '/stock.sqlite'); $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec("CREATE TABLE IF NOT EXISTS products(sku TEXT PRIMARY KEY, name TEXT, category TEXT, qty INTEGER CHECK(qty >= 0));
           CREATE TABLE IF NOT EXISTS movements(id INTEGER PRIMARY KEY, sku TEXT, delta INTEGER, reason TEXT, at TEXT)");
if (!$db->query('SELECT COUNT(*) FROM products')->fetchColumn()) {
    $seed = [['SKU-2001','Bin liners 50L','Cleaning',120],['SKU-2002','Hose nozzle','Garden',35],['SKU-2003','Desk organiser','Office',18],['SKU-2004','Chef knife 20cm','Kitchen',9],['SKU-2005','Nitrile gloves L','Cleaning',240],['SKU-2006','Plant pot 30cm','Garden',0]];
    $st = $db->prepare('INSERT INTO products VALUES (?,?,?,?)'); foreach ($seed as $s) $st->execute($s);
}
function out(int $code, array $body): void { http_response_code($code); echo json_encode($body, JSON_UNESCAPED_SLASHES), "\n"; exit; }
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH); $m = $_SERVER['REQUEST_METHOD'];
if ($m === 'GET' && $path === '/api/products') {
    $cat = $_GET['category'] ?? null;
    $st = $cat ? $db->prepare('SELECT * FROM products WHERE category = ? ORDER BY sku') : $db->prepare('SELECT * FROM products ORDER BY sku');
    $st->execute($cat ? [$cat] : []); $rows = $st->fetchAll(PDO::FETCH_ASSOC);
    out(200, ['count' => count($rows), 'items' => $rows]);
}
if ($m === 'GET' && preg_match('#^/api/products/(SKU-\d{4})$#', $path, $mm)) {
    $st = $db->prepare('SELECT * FROM products WHERE sku = ?'); $st->execute([$mm[1]]); $r = $st->fetch(PDO::FETCH_ASSOC);
    $r ? out(200, $r) : out(404, ['error' => 'Unknown SKU']);
}
if ($m === 'POST' && $path === '/api/stock/adjust') {
    if (($_SERVER['HTTP_X_API_KEY'] ?? '') !== API_KEY) out(401, ['error' => 'Missing or wrong API key']);
    $b = json_decode(file_get_contents('php://input'), true);
    if (!is_array($b) || !isset($b['sku'], $b['delta']) || !is_int($b['delta']) || $b['delta'] === 0) out(422, ['error' => 'Send sku and a non-zero whole-number delta']);
    $reason = trim((string)($b['reason'] ?? '')); if ($reason === '') out(422, ['error' => 'A reason is required']);
    $db->beginTransaction();
    $st = $db->prepare('SELECT qty FROM products WHERE sku = ?'); $st->execute([$b['sku']]); $q = $st->fetchColumn();
    if ($q === false) { $db->rollBack(); out(404, ['error' => 'Unknown SKU']); }
    if ($q + $b['delta'] < 0) { $db->rollBack(); out(409, ['error' => 'Stock cannot go below zero', 'on_hand' => (int)$q]); }
    $db->prepare('UPDATE products SET qty = qty + ? WHERE sku = ?')->execute([$b['delta'], $b['sku']]);
    $db->prepare('INSERT INTO movements(sku, delta, reason, at) VALUES (?,?,?,?)')->execute([$b['sku'], $b['delta'], $reason, gmdate('c')]);
    $db->commit(); out(200, ['sku' => $b['sku'], 'on_hand' => (int)$q + $b['delta']]);
}
out(404, ['error' => 'Not found']);