<?php
header("Access-Control-Allow-Origin: *");
header("Content-Type: application/json; charset=UTF-8");
header("Access-Control-Allow-Methods: POST");
header("Access-Control-Max-Age: 3600");
header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With, X-API-Key");

// Endpoint publico (CORS *): exige la clave de API. Ver core/lib/ApiAuth.php
require_once __DIR__ . '/core/lib/ApiAuth.php';
ApiAuth::requireKey();

//include_once '../config/Database.php';
//include_once '../class/Items.php';

//$database = new Database();
//$db = $database->getConnection();
include "core/autoload.php";
include "core/app/model/ReportData.php";

//$items = new Items($db);

$data = json_decode(file_get_contents("php://input"));
// Escapa todo el payload ANTES de asignarlo a los modelos: sus add()
// interpolan en crudo y estos endpoints son publicos (CORS *).
if (is_object($data)) {
    $__con = Database::getCon();
    foreach (get_object_vars($data) as $__k => $__v) {
        if (is_string($__v)) { $data->$__k = $__con->real_escape_string($__v); }
    }
}

if (!empty($data->name)) {
    $product = new ReportData();
    $product->name = $data->name;
    $product->description = $data->description;
    $product->age = $data->age;
    $product->diagnosis = $data->diagnosis;
    $product->resp_id = $data->resp_id;
    $product->category_id = $data->category_id;
    $product->eval = $data->eval;
    $product->remark = $data->remark;
    $p = $product->add_a();
    echo $p[1];
    $p1 = ReportData::getById($p[1]);

    if ($p1) {
        http_response_code(201);
        echo json_encode(array("message" => "Report was created."));
    } else {
        http_response_code(503);
        echo json_encode(array("message" => "Unable to create report."));
    }
} else {
    http_response_code(400);
    echo json_encode(array("message" => "Unable to create report. Data is incomplete."));
}
?>