<?php
/**
 * switch_branch.php — Switch the active company for the current session.
 *
 * action: 'read'   → return list of companies the user belongs to
 * action: 'update' → switch to target_company_id
 *
 * The target is read from target_company_id, not company_id: every request
 * carries company_id = the CURRENT company (prepare_form_data in custom.js),
 * so reading it made a switch silently re-select the company already active.
 */
session_start();
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/UserManager.php';

$action = $data['action'] ?? '';
$um = new UserManager($pdo1, $company_id, $user_id);

if ($action === 'read') {
    $answer['success'] = 1;
    $answer['output']  = $um->getCompanyList();
    $answer['current'] = (int)$_SESSION['login_company_id'];
    exit(json_encode($answer));
}

if ($action === 'update') {
    $target_company_id = (int)($data['target_company_id'] ?? 0);

    if (!$target_company_id) {
        $answer['message'] = 'Invalid company.';
        http_response_code(400);
        exit(json_encode($answer));
    }

    $target_map = $um->getCompanyAccess($target_company_id);

    if (!$target_map) {
        $answer['message'] = 'You do not have access to this company.';
        http_response_code(403);
        exit(json_encode($answer));
    }

    $_SESSION['login_company_id'] = $target_company_id;
    $_SESSION['login_role']       = $target_map['role'] ?? 'viewer';

    if (($_SESSION['login_license'] ?? 'user') === 'owner') {
        $_SESSION['login_app_access'] = $target_map['user_app_access'] ?? 'wms';
    } else {
        $_SESSION['login_app_access'] = $target_map['app_access'] ?? 'wms';
    }

    $answer['success'] = 1;
    $answer['message'] = 'Switched successfully.';
    exit(json_encode($answer));
}

$answer['message'] = 'Invalid action.';
http_response_code(400);
exit(json_encode($answer));
?>