<?php
/**
 * HTMX handler: persist the new drag-and-drop sort order for form help blocks.
 *
 * Expects POST fields:
 *   csrf_token   — standard admin CSRF token
 *   block[]      — ordered list of block keys (one hidden input per block, submitted by
 *                  Sortable+htmx via the form's `end` event trigger)
 *
 * Returns a 204 No Content on success (htmx will not swap anything).
 * On error, returns a 400 with a plain-text message.
 */
require_once __DIR__ . '/../../../bootstrap.php';
require_once __DIR__ . '/../../../src/AdminAuth.php';
AdminAuth::requireLogin();

if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
    http_response_code(403);
    echo 'Token invalide.';
    exit;
}

$keys = $_POST['block'] ?? [];
if (!is_array($keys) || empty($keys)) {
    http_response_code(400);
    echo 'Paramètre block[] manquant.';
    exit;
}

// Sanitise: keep only scalar strings, deduplicate.
$keys = array_values(array_unique(array_filter($keys, 'is_string')));

require_once APP_ROOT . '/src/Database.php';
$db = new Database();

try {
    $db->reorderFormHelpBlocks($keys);
} catch (Exception $e) {
    error_log('form-help-reorder error: ' . $e->getMessage());
    http_response_code(500);
    echo 'Erreur lors de la sauvegarde.';
    exit;
}

http_response_code(204);
exit;