shooting-event/backend/handlers.go

package main

import (
	"errors"
	"fmt"
	"io"
	"math/rand"
	"net/http"
	"strconv"
	"strings"
	"time"

	"github.com/labstack/echo/v4"
)

func (a *App) handleHealth(c echo.Context) error {
	return c.JSON(http.StatusOK, map[string]string{"status": "ok"})
}

func (a *App) handleGetState(c echo.Context) error {
	state, err := a.readState(a.isAdminRequest(c))
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func (a *App) handleAdminLogin(c echo.Context) error {
	var req AdminLoginRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	if !a.verifyAdmin(req.Username, req.Password) {
		return writeError(c, http.StatusUnauthorized, "invalid credentials")
	}

	token, expiry, err := a.sessions.CreateToken()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to create session")
	}

	return c.JSON(http.StatusOK, map[string]any{
		"token":     token,
		"expiresAt": expiry.Format(time.RFC3339),
		"username":  a.cfg.AdminUser,
	})
}

func (a *App) handleAdminLogout(c echo.Context) error {
	token := strings.TrimSpace(strings.TrimPrefix(c.Request().Header.Get(echo.HeaderAuthorization), "Bearer "))
	a.sessions.DeleteToken(token)
	return c.JSON(http.StatusOK, map[string]bool{"ok": true})
}

func (a *App) handleUpdateAdminSettings(c echo.Context) error {
	var req AdminSettingsUpdateRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}
	if req.ViewProofInView == nil && req.LiveMode == nil {
		return writeError(c, http.StatusBadRequest, "at least one settings field is required")
	}

	if err := a.updateSettings(req); err != nil {
		if strings.Contains(err.Error(), "no settings to update") {
			return writeError(c, http.StatusBadRequest, err.Error())
		}
		return writeError(c, http.StatusInternalServerError, err.Error())
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func (a *App) handleStartCurrentStage(c echo.Context) error {
	var req StageControlStartRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	phase, ok := normalizeStagePhase(req.Phase)
	if !ok {
		return writeError(c, http.StatusBadRequest, "invalid phase")
	}
	groupKey, ok := normalizeStageGroup(phase, req.GroupKey)
	if !ok {
		return writeError(c, http.StatusBadRequest, "invalid group for selected phase")
	}
	round := normalizeStageRound(phase, req.Round)

	current, err := a.readCurrentStage()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	if current != nil {
		return writeError(c, http.StatusConflict, "there is already an active stage. end it first")
	}

	_, err = a.db.Exec(`
INSERT INTO stage_sessions(phase, group_key, round, started_at)
VALUES(?, ?, ?, CURRENT_TIMESTAMP)
`, phase, groupKey, round)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("start stage: %v", err))
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func (a *App) handleEndCurrentStage(c echo.Context) error {
	current, err := a.readCurrentStage()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	if current == nil {
		return writeError(c, http.StatusBadRequest, "no active stage to end")
	}

	_, err = a.db.Exec(`
UPDATE stage_sessions
SET ended_at = CURRENT_TIMESTAMP
WHERE id = ? AND ended_at IS NULL
`, current.ID)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("end stage: %v", err))
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func (a *App) handleGetStageHistory(c echo.Context) error {
	items, err := a.readStageHistory()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, map[string]any{
		"items": items,
	})
}

func (a *App) handleCreatePlayer(c echo.Context) error {
	var req PlayerCreateRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	nameAr := strings.TrimSpace(req.NameAr)
	nameEn := strings.TrimSpace(req.NameEn)
	group := normalizeGroup(req.GroupCode)
	if nameAr == "" || nameEn == "" {
		return writeError(c, http.StatusBadRequest, "both Arabic and English names are required")
	}

	tx, err := a.db.Begin()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to start transaction")
	}
	defer tx.Rollback()

	res, err := tx.Exec(`
INSERT INTO players(name_ar, name_en, group_code, image_data)
VALUES(?, ?, ?, '')
`, nameAr, nameEn, group)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("create player: %v", err))
	}

	id64, err := res.LastInsertId()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to read new player id")
	}
	playerID := int(id64)

	for _, stage := range scoreStages {
		if _, err := tx.Exec(`INSERT OR IGNORE INTO scores(stage, player_id, score) VALUES(?, ?, 0)`, stage, playerID); err != nil {
			return writeError(c, http.StatusInternalServerError, fmt.Sprintf("create score row: %v", err))
		}
	}

	if err := tx.Commit(); err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to commit create player")
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}

	return c.JSON(http.StatusCreated, state)
}

func (a *App) handleUpdatePlayer(c echo.Context) error {
	playerID, err := strconv.Atoi(c.Param("id"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, "invalid player id")
	}

	var req PlayerUpdateRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	updates := []string{}
	args := []any{}

	if req.NameAr != nil {
		nameAr := strings.TrimSpace(*req.NameAr)
		if nameAr == "" {
			return writeError(c, http.StatusBadRequest, "arabic name cannot be empty")
		}
		updates = append(updates, "name_ar = ?")
		args = append(args, nameAr)
	}
	if req.NameEn != nil {
		nameEn := strings.TrimSpace(*req.NameEn)
		if nameEn == "" {
			return writeError(c, http.StatusBadRequest, "english name cannot be empty")
		}
		updates = append(updates, "name_en = ?")
		args = append(args, nameEn)
	}
	if req.GroupCode != nil {
		updates = append(updates, "group_code = ?")
		args = append(args, normalizeGroup(*req.GroupCode))
	}
	if req.ImageData != nil {
		img := strings.TrimSpace(*req.ImageData)
		if len(img) > 2_500_000 {
			return writeError(c, http.StatusBadRequest, "image payload too large")
		}
		updates = append(updates, "image_data = ?")
		args = append(args, img)
	}
	if req.ClearImage {
		updates = append(updates, "image_data = ''")
	}

	if len(updates) == 0 {
		return writeError(c, http.StatusBadRequest, "no fields to update")
	}

	updates = append(updates, "updated_at = CURRENT_TIMESTAMP")
	args = append(args, playerID)

	query := fmt.Sprintf("UPDATE players SET %s WHERE id = ?", strings.Join(updates, ", "))
	res, err := a.db.Exec(query, args...)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("update player: %v", err))
	}
	affected, err := res.RowsAffected()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to check update result")
	}
	if affected == 0 {
		return writeError(c, http.StatusNotFound, "player not found")
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}

	return c.JSON(http.StatusOK, state)
}

func (a *App) handleDeletePlayer(c echo.Context) error {
	playerID, err := strconv.Atoi(c.Param("id"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, "invalid player id")
	}

	res, err := a.db.Exec(`DELETE FROM players WHERE id = ?`, playerID)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("delete player: %v", err))
	}
	affected, err := res.RowsAffected()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to check delete result")
	}
	if affected == 0 {
		return writeError(c, http.StatusNotFound, "player not found")
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}

	return c.JSON(http.StatusOK, state)
}

func (a *App) handleAutoGroupPlayers(c echo.Context) error {
	var req AutoGroupPlayersRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	groups := normalizeGroups(req.Groups)
	if len(groups) == 0 {
		return writeError(c, http.StatusBadRequest, "at least one group is required")
	}

	rows, err := a.db.Query(`SELECT id FROM players ORDER BY id ASC`)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("query players: %v", err))
	}
	defer rows.Close()

	playerIDs := []int{}
	for rows.Next() {
		var id int
		if err := rows.Scan(&id); err != nil {
			return writeError(c, http.StatusInternalServerError, fmt.Sprintf("scan player: %v", err))
		}
		playerIDs = append(playerIDs, id)
	}
	if err := rows.Err(); err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("read players: %v", err))
	}

	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
	rng.Shuffle(len(playerIDs), func(i, j int) {
		playerIDs[i], playerIDs[j] = playerIDs[j], playerIDs[i]
	})

	tx, err := a.db.Begin()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to start transaction")
	}
	defer tx.Rollback()

	for i, playerID := range playerIDs {
		groupCode := groups[i%len(groups)]
		if _, err := tx.Exec(`UPDATE players SET group_code = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?`, groupCode, playerID); err != nil {
			return writeError(c, http.StatusInternalServerError, fmt.Sprintf("assign player group: %v", err))
		}
	}

	if err := tx.Commit(); err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to commit group assignment")
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func (a *App) handleUpdatePositionBoard(c echo.Context) error {
	board, ok := normalizePositionBoard(c.Param("board"))
	if !ok {
		return writeError(c, http.StatusBadRequest, "invalid position board")
	}

	var req PositionBoardUpdateRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	seen := map[int]bool{}
	for _, slot := range req.Slots {
		if slot.PlayerID <= 0 {
			return writeError(c, http.StatusBadRequest, "invalid player id")
		}
		if seen[slot.PlayerID] {
			return writeError(c, http.StatusBadRequest, "duplicate player id in slots")
		}
		seen[slot.PlayerID] = true
		if strings.TrimSpace(slot.GroupKey) == "" {
			return writeError(c, http.StatusBadRequest, "groupKey is required")
		}
		if slot.Position <= 0 {
			return writeError(c, http.StatusBadRequest, "position must be positive")
		}
	}

	tx, err := a.db.Begin()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to start position transaction")
	}
	defer tx.Rollback()

	if _, err := tx.Exec(`DELETE FROM player_positions WHERE board = ?`, board); err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("clear board positions: %v", err))
	}

	for _, slot := range req.Slots {
		groupKey := normalizePositionGroupKey(board, slot.GroupKey, "")
		if _, err := tx.Exec(`
INSERT INTO player_positions(board, player_id, group_key, position, updated_at)
VALUES(?, ?, ?, ?, CURRENT_TIMESTAMP)
`, board, slot.PlayerID, groupKey, slot.Position); err != nil {
			return writeError(c, http.StatusInternalServerError, fmt.Sprintf("save board position: %v", err))
		}

		if board == positionBoardPreliminary {
			groupCode := strings.TrimSpace(groupKey)
			if strings.EqualFold(groupCode, positionBoardUnassigned) {
				groupCode = ""
			}
			if _, err := tx.Exec(`UPDATE players SET group_code = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?`, groupCode, slot.PlayerID); err != nil {
				return writeError(c, http.StatusInternalServerError, fmt.Sprintf("update player group from board: %v", err))
			}
		}
	}

	if err := tx.Commit(); err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to commit positions")
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func (a *App) handleUpdateScore(c echo.Context) error {
	stage, err := validateStage(c.Param("stage"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, err.Error())
	}

	playerID, err := strconv.Atoi(c.Param("id"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, "invalid player id")
	}

	var req ScoreUpdateRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}
	if req.Score < 0 || req.Score > 100 {
		return writeError(c, http.StatusBadRequest, "score must be between 0 and 100")
	}

	res, err := a.db.Exec(`
INSERT INTO scores(stage, player_id, score)
VALUES(?, ?, ?)
ON CONFLICT(stage, player_id) DO UPDATE SET score = excluded.score, updated_at = CURRENT_TIMESTAMP
`, stage, playerID, req.Score)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("update score: %v", err))
	}
	if _, err := res.RowsAffected(); err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to check score update")
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}

	return c.JSON(http.StatusOK, state)
}

func (a *App) handleResetStageScores(c echo.Context) error {
	targetStages, err := resolveResetStages(c.Param("stage"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, err.Error())
	}

	var req ResetStageRequest
	if err := c.Bind(&req); err != nil && !errors.Is(err, io.EOF) {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	tx, err := a.db.Begin()
	if err != nil {
		return writeError(c, http.StatusInternalServerError, "failed to start reset transaction")
	}
	defer tx.Rollback()

	for _, stage := range targetStages {
		if _, err := tx.Exec(`UPDATE scores SET score = 0, updated_at = CURRENT_TIMESTAMP WHERE stage = ?`, stage); err != nil {
			return writeError(c, http.StatusInternalServerError, fmt.Sprintf("reset stage scores: %v", err))
		}
		if req.ResetProofs {
			if _, err := tx.Exec(`DELETE FROM score_attachments WHERE stage = ?`, stage); err != nil {
				return writeError(c, http.StatusInternalServerError, fmt.Sprintf("reset stage proofs: %v", err))
			}
		}
	}
	if err := tx.Commit(); err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("commit stage reset: %v", err))
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}

	return c.JSON(http.StatusOK, state)
}

func resolveResetStages(stage string) ([]string, error) {
	switch strings.ToLower(strings.TrimSpace(stage)) {
	case "preliminary":
		return append([]string{}, preliminaryRoundStages...), nil
	case "final":
		return append([]string{}, finalRoundStages...), nil
	case "prelim_tiebreak", "final_tiebreak":
		normalized, err := validateStage(stage)
		if err != nil {
			return nil, err
		}
		return []string{normalized}, nil
	default:
		return nil, fmt.Errorf("invalid stage")
	}
}

func (a *App) handleUpdateScoreProof(c echo.Context) error {
	stage, err := validateStage(c.Param("stage"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, err.Error())
	}

	playerID, err := strconv.Atoi(c.Param("id"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, "invalid player id")
	}

	var req ScoreProofUpdateRequest
	if err := c.Bind(&req); err != nil {
		return writeError(c, http.StatusBadRequest, "invalid request body")
	}

	imageData := strings.TrimSpace(req.ImageData)
	if imageData == "" {
		return writeError(c, http.StatusBadRequest, "imageData is required")
	}
	if len(imageData) > 5_000_000 {
		return writeError(c, http.StatusBadRequest, "image payload too large")
	}

	if _, err := a.db.Exec(`
INSERT INTO score_attachments(stage, player_id, image_data)
VALUES(?, ?, ?)
ON CONFLICT(stage, player_id) DO UPDATE SET image_data = excluded.image_data, updated_at = CURRENT_TIMESTAMP
`, stage, playerID, imageData); err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("update score proof: %v", err))
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func (a *App) handleDeleteScoreProof(c echo.Context) error {
	stage, err := validateStage(c.Param("stage"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, err.Error())
	}

	playerID, err := strconv.Atoi(c.Param("id"))
	if err != nil {
		return writeError(c, http.StatusBadRequest, "invalid player id")
	}

	if _, err := a.db.Exec(`DELETE FROM score_attachments WHERE stage = ? AND player_id = ?`, stage, playerID); err != nil {
		return writeError(c, http.StatusInternalServerError, fmt.Sprintf("delete score proof: %v", err))
	}

	a.events.Broadcast()

	state, err := a.readState(true)
	if err != nil {
		return writeError(c, http.StatusInternalServerError, err.Error())
	}
	return c.JSON(http.StatusOK, state)
}

func validateStage(stage string) (string, error) {
	normalized := strings.ToLower(strings.TrimSpace(stage))
	for _, allowed := range scoreStages {
		if normalized == allowed {
			return normalized, nil
		}
	}
	return "", fmt.Errorf("invalid stage")
}

func normalizeGroup(group string) string {
	return strings.TrimSpace(group)
}

func normalizeGroups(groups []string) []string {
	seen := map[string]bool{}
	out := []string{}
	for _, group := range groups {
		normalized := normalizeGroup(group)
		if normalized == "" || seen[normalized] {
			continue
		}
		seen[normalized] = true
		out = append(out, normalized)
	}
	return out
}

func writeError(c echo.Context, status int, message string) error {
	return c.JSON(status, map[string]string{"message": message})
}