<?php
/*
|--------------------------------------------------------------------------
| ADMIN APPLICATION CONTROL UPGRADE
|--------------------------------------------------------------------------
| File:
| public_html/app/admin/application.php
|
| This adds:
|
| 1. Admin can progress a Draft application into Under Review
| 2. Admin can request documents even while application is Draft
| 3. Admin can permanently delete Draft applications
|
| Your existing application.php already has the later-stage progression
| workflow and document-request system. The additions below extend those
| controls to Draft applications.
|--------------------------------------------------------------------------
*/


/*
|--------------------------------------------------------------------------
| STEP 1
| ADD THIS BLOCK AFTER:
|
| function findApplicationForAction(...) { ... }
|
| AND BEFORE:
|
| START REVIEW
|--------------------------------------------------------------------------
*/


/*
|--------------------------------------------------------------------------
| ADMIN START / PROGRESS DRAFT APPLICATION
|--------------------------------------------------------------------------
*/

if (
    $_SERVER['REQUEST_METHOD'] === 'POST'
    && isset($_POST['admin_start_draft_review'])
) {

    $csrf =
        (string)(
            $_POST['csrf_token']
            ?? ''
        );


    if (
        $csrf === ''
        ||
        !hash_equals(
            $_SESSION['admin_csrf_token'],
            $csrf
        )
    ) {

        $errors[] =
            'Your session expired. Please refresh and try again.';
    }


    if (!$errors) {

        try {

            $application =
                findApplicationForAction(
                    $pdo,
                    $applicationId
                );


            if (!$application) {

                $errors[] =
                    'Application not found.';

            } elseif (
                (string)$application[
                    'application_status'
                ] !== 'draft'
            ) {

                $errors[] =
                    'Only Draft applications can be progressed using this action.';

            } else {

                $pdo->beginTransaction();


                changeApplicationStatus(
                    $pdo,
                    $applicationId,
                    'draft',
                    'under_review',
                    'UNISEARCH administrator accepted the draft application for review.',
                    $adminName
                );


                $pdo->commit();


                notifyStudentForApplicationStatus(
                    $pdo,
                    (int)$application['student_id'],
                    $applicationId,
                    'under_review',
                    'UNISEARCH has started reviewing your university application.'
                );


                $_SESSION[
                    'admin_flash_success'
                ] =
                    'Application progressed from Draft to Under Review.';


                header(
                    'Location: application.php?id='
                    .
                    $applicationId
                );

                exit;
            }

        } catch (Throwable $e) {

            if ($pdo->inTransaction()) {
                $pdo->rollBack();
            }


            error_log(
                'Admin draft progression error: '
                .
                $e->getMessage()
            );


            $errors[] =
                'We could not progress the draft application.';
        }
    }
}


/*
|--------------------------------------------------------------------------
| ADMIN DELETE DRAFT APPLICATION
|--------------------------------------------------------------------------
|
| Permanent deletion is intentionally restricted to Draft applications.
| This prevents accidental destruction of an application which already has
| university decisions, offers, CAS or visa history.
|--------------------------------------------------------------------------
*/

if (
    $_SERVER['REQUEST_METHOD'] === 'POST'
    && isset($_POST['delete_application'])
) {

    $csrf =
        (string)(
            $_POST['csrf_token']
            ?? ''
        );


    $confirmReference =
        trim(
            (string)(
                $_POST['confirm_reference']
                ?? ''
            )
        );


    if (
        $csrf === ''
        ||
        !hash_equals(
            $_SESSION['admin_csrf_token'],
            $csrf
        )
    ) {

        $errors[] =
            'Your session expired. Please refresh and try again.';
    }


    if (!$errors) {

        try {

            $application =
                findApplicationForAction(
                    $pdo,
                    $applicationId
                );


            if (!$application) {

                $errors[] =
                    'Application not found.';

            } elseif (
                (string)$application[
                    'application_status'
                ] !== 'draft'
            ) {

                $errors[] =
                    'Only Draft applications can be permanently deleted.';

            } elseif (
                $confirmReference
                !==
                (string)$application[
                    'reference_number'
                ]
            ) {

                $errors[] =
                    'The application reference entered does not match.';

            } else {

                $pdo->beginTransaction();


                /*
                |--------------------------------------------------------------------------
                | DELETE CHILD RECORDS FIRST
                |--------------------------------------------------------------------------
                */


                $deleteOfferResponses =
                    $pdo->prepare(
                        "
                        DELETE FROM application_offer_responses
                        WHERE application_id = ?
                        "
                    );

                $deleteOfferResponses->execute([
                    $applicationId
                ]);


                $deleteDocuments =
                    $pdo->prepare(
                        "
                        DELETE FROM documents
                        WHERE application_id = ?
                        "
                    );

                $deleteDocuments->execute([
                    $applicationId
                ]);


                $deleteConditions =
                    $pdo->prepare(
                        "
                        DELETE FROM application_conditions
                        WHERE application_id = ?
                        "
                    );

                $deleteConditions->execute([
                    $applicationId
                ]);


                $deleteOfferProgress =
                    $pdo->prepare(
                        "
                        DELETE FROM application_offer_progress
                        WHERE application_id = ?
                        "
                    );

                $deleteOfferProgress->execute([
                    $applicationId
                ]);


                $deleteCasRecords =
                    $pdo->prepare(
                        "
                        DELETE FROM application_cas_records
                        WHERE application_id = ?
                        "
                    );

                $deleteCasRecords->execute([
                    $applicationId
                ]);


                $deleteDocumentRequests =
                    $pdo->prepare(
                        "
                        DELETE FROM document_requests
                        WHERE application_id = ?
                        "
                    );

                $deleteDocumentRequests->execute([
                    $applicationId
                ]);


                $deleteStatusHistory =
                    $pdo->prepare(
                        "
                        DELETE FROM application_status_history
                        WHERE application_id = ?
                        "
                    );

                $deleteStatusHistory->execute([
                    $applicationId
                ]);


                /*
                |--------------------------------------------------------------------------
                | DELETE UNIVERSITY DECISIONS LAST
                |--------------------------------------------------------------------------
                */

                $deleteDecisions =
                    $pdo->prepare(
                        "
                        DELETE FROM application_decisions
                        WHERE application_id = ?
                        "
                    );

                $deleteDecisions->execute([
                    $applicationId
                ]);


                /*
                |--------------------------------------------------------------------------
                | DELETE APPLICATION
                |--------------------------------------------------------------------------
                */

                $deleteApplication =
                    $pdo->prepare(
                        "
                        DELETE FROM applications
                        WHERE id = ?
                          AND application_status = 'draft'
                        "
                    );


                $deleteApplication->execute([
                    $applicationId
                ]);


                if (
                    $deleteApplication->rowCount()
                    !== 1
                ) {

                    throw new RuntimeException(
                        'Application could not be deleted.'
                    );
                }


                $pdo->commit();


                $_SESSION[
                    'admin_flash_success'
                ] =
                    'Draft application deleted successfully.';


                header(
                    'Location: applications.php'
                );

                exit;
            }

        } catch (Throwable $e) {

            if ($pdo->inTransaction()) {
                $pdo->rollBack();
            }


            error_log(
                'Delete application error: '
                .
                $e->getMessage()
            );


            $errors[] =
                'We could not delete this application.';
        }
    }
}


/*
|--------------------------------------------------------------------------
| STEP 2
|
| FIND THIS EXISTING SECTION INSIDE THE REQUEST DOCUMENTS HANDLER:
|
| [
|     'submitted_to_unisearch',
|     'under_review',
|     'ready_for_university',
|     'submitted_to_university'
| ]
|
| REPLACE THAT ARRAY WITH THIS:
|--------------------------------------------------------------------------
*/

$documentRequestAllowedStatuses = [

    'draft',

    'submitted_to_unisearch',

    'under_review',

    'ready_for_university',

    'submitted_to_university'

];


/*
|--------------------------------------------------------------------------
| THEN CHANGE THE EXISTING VALIDATION TO:
|--------------------------------------------------------------------------
*/

if (
    !in_array(
        $oldStatus,
        $documentRequestAllowedStatuses,
        true
    )
) {

    $errors[] =
        'Additional documents cannot be requested at the current application stage.';
}


/*
|--------------------------------------------------------------------------
| STEP 3
|
| GO TO:
|
| <section class="card rail-card">
| <div class="rail-section-label">Current Workflow</div>
| <h2>Case Actions</h2>
|
| DIRECTLY AFTER <h2>Case Actions</h2>
| PASTE EVERYTHING BELOW.
|--------------------------------------------------------------------------
*/


?>

<?php if ($status === 'draft'): ?>


<div class="action-box">

<h3>
Progress Application
</h3>


<p>

This application is currently saved as Draft.

If UNISEARCH is ready to take control of the case,
move it directly into formal review.

</p>


<form
    method="POST"
    onsubmit="
        return confirm(
            'Move this Draft application to Under Review?'
        );
    "
>


<input
    type="hidden"
    name="csrf_token"
    value="<?= htmlspecialchars(
        $_SESSION['admin_csrf_token']
    ) ?>"
>


<input
    type="hidden"
    name="application_id"
    value="<?= (int)$applicationId ?>"
>


<button
    class="btn btn-green"
    type="submit"
    name="admin_start_draft_review"
    value="1"
>

Start Application Review

</button>


</form>

</div>


<div class="action-box">


<h3>
Request Documents
</h3>


<p>

Ask the student to upload missing documents
before or during the formal application review.

</p>


<form method="POST">


<input
    type="hidden"
    name="csrf_token"
    value="<?= htmlspecialchars(
        $_SESSION['admin_csrf_token']
    ) ?>"
>


<input
    type="hidden"
    name="application_id"
    value="<?= (int)$applicationId ?>"
>


<textarea
    name="request_message"
    required
    placeholder="Example: Please upload your passport, academic transcript and degree certificate."
></textarea>


<button
    class="btn btn-gold"
    type="submit"
    name="request_documents"
    value="1"
>

Send Document Request

</button>


</form>


</div>


<div
    class="action-box"
    style="
        border-color:#fecaca;
        background:#fff7f7;
    "
>


<h3
    style="
        color:#991b1b;
    "
>

Delete Application

</h3>


<p>

Permanently delete this Draft application.

This action cannot be undone.

To confirm deletion,
enter the application reference:

</p>


<div
    style="
        margin-bottom:10px;
        padding:8px 10px;
        border-radius:6px;
        background:#fff;
        border:1px solid #fecaca;
        font-weight:800;
        color:#991b1b;
    "
>

<?= htmlspecialchars(
    (string)$application[
        'reference_number'
    ]
) ?>

</div>


<form
    method="POST"
    onsubmit="
        return confirm(
            'WARNING: This will permanently delete this application. Continue?'
        );
    "
>


<input
    type="hidden"
    name="csrf_token"
    value="<?= htmlspecialchars(
        $_SESSION['admin_csrf_token']
    ) ?>"
>


<input
    type="hidden"
    name="application_id"
    value="<?= (int)$applicationId ?>"
>


<input
    type="text"
    name="confirm_reference"
    required
    autocomplete="off"
    placeholder="Enter application reference"
    style="
        width:100%;
        padding:10px 11px;
        border:1px solid #fca5a5;
        border-radius:7px;
        margin-bottom:10px;
    "
>


<button
    type="submit"
    name="delete_application"
    value="1"
    style="
        width:100%;
        border:0;
        border-radius:7px;
        padding:11px 13px;
        background:#b91c1c;
        color:#fff;
        font-weight:800;
        cursor:pointer;
    "
>

Delete Application Permanently

</button>


</form>


</div>


<?php endif; ?>