From a27c76d872fecc8ab84c035eb2023bc01c20a946 Mon Sep 17 00:00:00 2001
From: solocla <info@claudiosironi.com>
Date: Mon, 24 Aug 2026 16:30:35 +0200
Subject: [PATCH] api pending

---
 public/api/api_teacher_add_booking.php     | 13 ++++--
 public/api/api_teacher_classes.php         | 12 ++++-
 public/api/api_teacher_confirm_pending.php | 51 ++++++++++++++++++++++
 3 files changed, 70 insertions(+), 6 deletions(-)
 create mode 100644 public/api/api_teacher_confirm_pending.php

diff --git a/public/api/api_teacher_add_booking.php b/public/api/api_teacher_add_booking.php
index 519e0aed..7b48efba 100644
--- a/public/api/api_teacher_add_booking.php
+++ b/public/api/api_teacher_add_booking.php
@@ -200,16 +200,21 @@ try {
     // 2b) Anti-duplicato
     // ------------------------------------------------------------------
     $dup = $db->prepare(
-        "SELECT COUNT(*) FROM bookingclass
+        "SELECT status FROM bookingclass
          WHERE iduser = :uid
            AND idserviceschedule = :idschedule
-           AND status != 'cancelled'"
+           AND status != 'cancelled'
+         LIMIT 1"
     );
     $dup->execute([':uid' => $userid, ':idschedule' => $idserviceschedule]);
-    if ((int) $dup->fetchColumn() > 0) {
+    $dupStatus = $dup->fetchColumn();
+    if ($dupStatus !== false) {
         $db->rollBack();
         http_response_code(409);
-        echo json_encode(['success' => false, 'message' => 'Questo utente è già prenotato in questa classe.']);
+        $msg = ($dupStatus === 'pending')
+            ? 'Questo utente ha una prenotazione in attesa in questa classe: confermala o rimuovila dalla sezione "In attesa".'
+            : 'Questo utente è già prenotato in questa classe.';
+        echo json_encode(['success' => false, 'message' => $msg]);
         exit;
     }
 
diff --git a/public/api/api_teacher_classes.php b/public/api/api_teacher_classes.php
index a022d450..f4eec8e8 100644
--- a/public/api/api_teacher_classes.php
+++ b/public/api/api_teacher_classes.php
@@ -63,13 +63,14 @@ if (!empty($scheduleIds)) {
     $sqlBookings = "SELECT bookingclass.idbookingclass,
                            bookingclass.idserviceschedule,
                            bookingclass.lostlesson,
+                           bookingclass.status,
                            auth_users.first_name,
                            auth_users.last_name,
                            auth_users.avatar
                     FROM bookingclass
                     LEFT JOIN auth_users ON bookingclass.iduser = auth_users.id
                     WHERE bookingclass.idserviceschedule IN ($ph)
-                      AND bookingclass.status = 'booked'
+                      AND bookingclass.status IN ('booked', 'pending')
                     ORDER BY auth_users.last_name, auth_users.first_name";
     $stmtB = $db->prepare($sqlBookings);
     $stmtB->execute(array_values($scheduleIds));
@@ -85,6 +86,7 @@ if (!empty($scheduleIds)) {
             'last_name'  => $last,
             'full_name'  => trim($first . ' ' . $last),
             'is_lost'    => ($b['lostlesson'] === 'Y'),
+            'is_pending' => ($b['status'] === 'pending'),
             // avatar: solo il filename; l'app compone l'URL se serve
             'avatar'     => $avatar !== '' ? $avatar : null,
         ];
@@ -96,7 +98,13 @@ $classes = [];
 foreach ($scheduleRows as $sch) {
     $sid = (int) $sch['idserviceschedule'];
     $participants = $bookingsBySchedule[$sid] ?? [];
-    $count = count($participants); // tutti i booked, perse incluse
+    // contatore: solo confermati (booked, perse incluse); i pending NON contano
+    $count = 0;
+    foreach ($participants as $pp) {
+        if (empty($pp['is_pending'])) {
+            $count++;
+        }
+    }
     $maxcap = (int) $sch['maxcapacity'];
 
     $classes[] = [
diff --git a/public/api/api_teacher_confirm_pending.php b/public/api/api_teacher_confirm_pending.php
new file mode 100644
index 00000000..b6d18833
--- /dev/null
+++ b/public/api/api_teacher_confirm_pending.php
@@ -0,0 +1,51 @@
+<?php
+
+/**
+ * api_teacher_confirm_pending.php
+ * --------------------------------------------------------------------------
+ * Conferma una prenotazione in attesa: pending -> booked.
+ * Solo staff (Admin=1 / teacher=3).
+ *
+ * Posizione: public/api/api_teacher_confirm_pending.php
+ * Metodo:    POST
+ * Auth:      Bearer token (Sanctum) via _bootstrap.php
+ * Body:      booking_id=<int>
+ * --------------------------------------------------------------------------
+ */
+
+require_once __DIR__ . '/_bootstrap.php';
+
+// Gate staff
+$roleId = (int) $user->role_id;
+if (!in_array($roleId, [1, 3], true)) {
+    http_response_code(403);
+    echo json_encode(['success' => false, 'message' => 'Forbidden']);
+    exit;
+}
+
+$bookingId = isset($_POST['booking_id']) ? (int) $_POST['booking_id'] : 0;
+
+if ($bookingId <= 0) {
+    http_response_code(400);
+    echo json_encode(['success' => false, 'message' => 'ID prenotazione non valido']);
+    exit;
+}
+
+try {
+    // Conferma solo se davvero in pending
+    $stmt = $db->prepare(
+        "UPDATE bookingclass SET status = 'booked'
+         WHERE idbookingclass = :id AND status = 'pending'"
+    );
+    $stmt->execute([':id' => $bookingId]);
+
+    echo json_encode([
+        'success' => true,
+        'booking_id' => $bookingId,
+        'confirmed' => $stmt->rowCount(),
+    ], JSON_UNESCAPED_UNICODE);
+} catch (Throwable $ex) {
+    error_log('api_teacher_confirm_pending error: ' . $ex->getMessage());
+    http_response_code(500);
+    echo json_encode(['success' => false, 'message' => 'Errore conferma']);
+}