<?php
require_once __DIR__ . '/../helpers.php';
runAuth();

try {
    $data = readJsonBody();
    $tabID = (int) ($data['TabID'] ?? 0);
    $userID = (int) ($data['UserID'] ?? 0);

    if ($tabID === 0) apiAbort(['OK' => false, 'ERROR' => 'missing_TabID']);
    if ($userID === 0) apiAbort(['OK' => false, 'ERROR' => 'missing_UserID']);

    $qTab = queryOne("SELECT OwnerUserID FROM Tabs WHERE ID = ? LIMIT 1", [$tabID]);
    if (!$qTab) apiAbort(['OK' => false, 'ERROR' => 'tab_not_found']);
    if ((int) $qTab['OwnerUserID'] !== $userID) apiAbort(['OK' => false, 'ERROR' => 'not_owner']);

    $qPending = queryTimed("
        SELECT tbo.OrderID, tbo.UserID, tbo.SubtotalCents, tbo.TaxCents, tbo.AddedOn,
               u.FirstName, u.LastName
        FROM TabOrders tbo JOIN Users u ON u.ID = tbo.UserID
        WHERE tbo.TabID = ? AND tbo.ApprovalStatus = 'pending'
        ORDER BY tbo.AddedOn
    ", [$tabID]);

    $orders = [];
    foreach ($qPending as $row) {
        $qItems = queryTimed("
            SELECT oli.ID, oli.ItemID, oli.Price, oli.Quantity, oli.Remark,
                   i.Name AS ItemName
            FROM OrderLineItems oli JOIN Items i ON i.ID = oli.ItemID
            WHERE oli.OrderID = ? AND oli.IsDeleted = 0 AND oli.ParentOrderLineItemID = 0
        ", [$row['OrderID']]);

        $items = [];
        foreach ($qItems as $item) {
            $items[] = [
                'Name' => $item['ItemName'],
                'Price' => (float) $item['Price'],
                'Quantity' => (int) $item['Quantity'],
                'Remark' => $item['Remark'] ?? '',
            ];
        }

        $orders[] = [
            'OrderID' => (int) $row['OrderID'],
            'UserID' => (int) $row['UserID'],
            'UserName' => $row['FirstName'] . ' ' . $row['LastName'],
            'SubtotalCents' => (int) $row['SubtotalCents'],
            'TaxCents' => (int) $row['TaxCents'],
            'AddedOn' => toISO8601($row['AddedOn']),
            'Items' => $items,
        ];
    }

    jsonResponse(['OK' => true, 'PENDING_ORDERS' => $orders]);

} catch (Exception $e) {
    jsonResponse(['OK' => false, 'ERROR' => 'server_error', 'MESSAGE' => $e->getMessage()]);
}