notes.php

<?php

require_once __DIR__ . '/auth_middleware.php';
$currentUser = authenticate_user($pdo);

// Access the noteId extracted by the router regex, if it exists
$noteId = $GLOBALS['noteId'] ?? null;

switch ($method) {
    case 'GET':
        if ($noteId) {
            // 1. Fetch a single specific note belonging strictly to this user
            $stmt = $pdo->prepare("SELECT id, title, content, is_completed FROM notes WHERE id = :id AND user_id = :user_id");
            $stmt->execute([':id' => $noteId, ':user_id' => $currentUser['id']]);
            $note = $stmt->fetch();

            if (!$note) {
                http_response_code(404);
                echo json_encode(["error" => "Note not found or unauthorized"]);
                exit;
            }
            echo json_encode($note);
        } else {
            // Fetch all notes for this user
            $stmt = $pdo->prepare("SELECT id, title, content, is_completed FROM notes WHERE user_id = :user_id ORDER BY id ASC");
            $stmt->execute([':user_id' => $currentUser['id']]);
            echo json_encode($stmt->fetchAll());
        }
        break;

    case 'POST':
        $rawInput = file_get_contents('php://input');
        $data = json_decode($rawInput, true);

        $title   = isset($data['title']) ? trim($data['title']) : '';
        $content = isset($data['content']) ? trim($data['content']) : '';

        if (empty($title)) {
            http_response_code(400);
            echo json_encode(["error" => "Title field is required"]);
            exit;
        }

        // Explicitly include and bind false to the is_completed column
        $stmt = $pdo->prepare("INSERT INTO notes (title, content, user_id, is_completed) VALUES (:title, :content, :user_id, :is_completed) RETURNING id, is_completed");
        $stmt->execute([
            ':title'        => $title,
            ':content'      => $content,
            ':user_id'      => $currentUser['id'],
            ':is_completed' => 0
        ]);
        $meta = $stmt->fetch();

        http_response_code(201);
        echo json_encode([
            "id" => $meta['id'],
            "title" => $title,
            "content" => $content,
            "is_completed" => $meta['is_completed'], // Cast to strict boolean for JSON
            "user_id" => $currentUser['id']
        ]);
        break;

    case 'PATCH':
        if (!$noteId) {
            http_response_code(400);
            echo json_encode(["error" => "Note ID required for updates"]);
            exit;
        }

        // 2. Read input payload for partial updates
        $rawInput = file_get_contents('php://input');
        $data = json_decode($rawInput, true);

        // Verify the note exists and belongs to the user first
        $stmt = $pdo->prepare("SELECT id FROM notes WHERE id = :id AND user_id = :user_id");
        $stmt->execute([':id' => $noteId, ':user_id' => $currentUser['id']]);
        if (!$stmt->fetch()) {
            http_response_code(404);
            echo json_encode(["error" => "Note not found or unauthorized"]);
            exit;
        }

        // Dynamically build the assignment strings for the SQL patch operation
        $fields = [];
        $params = [':id' => $noteId, ':user_id' => $currentUser['id']];

        if (isset($data['title'])) {
            $fields[] = "title = :title";
            $params[':title'] = trim($data['title']);
        }
        if (isset($data['content'])) {
            $fields[] = "content = :content";
            $params[':content'] = trim($data['content']);
        }
        if (isset($data['is_completed'])) {
            $fields[] = "is_completed = :is_completed";
            $params[':is_completed'] = $data['is_completed'] ? 1 : 0; // Fixes PATCH for Postgres
        }

        if (empty($fields)) {
            http_response_code(400);
            echo json_encode(["error" => "No fields provided for update"]);
            exit;
        }

        // Compile and execute the dynamic patch query safely
        $sql = "UPDATE notes SET " . implode(', ', $fields) . " WHERE id = :id AND user_id = :user_id RETURNING id, title, content, is_completed";
        $stmt = $pdo->prepare($sql);
        $stmt->execute($params);
        
        echo json_encode($stmt->fetch());
        break;

    case 'DELETE':
        if (!$noteId) {
            http_response_code(400);
            echo json_encode(["error" => "Note ID required for deletion"]);
            exit;
        }

        // 3. Execute isolated delete operation
        $stmt = $pdo->prepare("DELETE FROM notes WHERE id = :id AND user_id = :user_id");
        $stmt->execute([':id' => $noteId, ':user_id' => $currentUser['id']]);

        // rowCount() tells us how many rows were affected by our query execution
        if ($stmt->rowCount() === 0) {
            http_response_code(404);
            echo json_encode(["error" => "Note not found or unauthorized"]);
            exit;
        }

        echo json_encode(["message" => "Note deleted successfully"]);
        break;

    default:
        http_response_code(405);
        echo json_encode(["error" => "Method Not Allowed"]);
        break;
}