<?php
require __DIR__ . '/_bootstrap.php';

/**
 * @OA\Post(
 *   path="/share-respond.php",
 *   tags={"Sharing"},
 *   summary="Accept/decline an invitation",
 *   security={{"bearerAuth":{}}},
 *   @OA\RequestBody(required=true, @OA\JsonContent(
 *     required={"idsharing","status"},
 *     @OA\Property(property="idsharing", type="integer"),
 *     @OA\Property(property="status", type="string", enum={"accepted","rejected"})
 *   )),
 *   @OA\Response(response=200, ref="#/components/responses/Success"),
 *   @OA\Response(response=403, ref="#/components/responses/Forbidden"),
 *   @OA\Response(response=422, ref="#/components/responses/ValidationError")
 * )
 */
require_method('POST');
$user = require_auth($pdo);
$in   = body();

$idsharing = (int) ($in['idsharing'] ?? 0);
$status    = (string) ($in['status'] ?? '');

if ($idsharing <= 0 || !in_array($status, ['accepted', 'rejected'], true)) {
    json_error(422, 'idsharing and valid status are required');
}

// I am the recipient of this invitation.
$stmt = $pdo->prepare(
    'SELECT * FROM home_sharing WHERE idsharing = ? AND (idshareduser = ? OR shared_email = ?) LIMIT 1'
);
$stmt->execute([$idsharing, $user['id'], $user['email']]);
if (!$stmt->fetch()) {
    json_error(403, 'No access to this invitation');
}

// Set status and bind the recipient if they were invited by e-mail.
$pdo->prepare('UPDATE home_sharing SET status = ?, idshareduser = ? WHERE idsharing = ?')
    ->execute([$status, $user['id'], $idsharing]);

json_ok();