---

<?php
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: Content-Type, Authorization');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    exit(0);
}

// Настройки подключения к серверу web.edu
$host = 'web.edu';
$db   = '23095_testapi'; // Твоя база с твоего скриншота
$user = 'твой_логин';
$pass = 'твой_пароль';
$charset = 'utf8mb4';

$dsn = "mysql:host=$host;dbname=$db;charset=$charset";
$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
];

try {
    $pdo = new PDO($dsn, $user, $pass, $options);
} catch (\PDOException $e) {
    http_response_code(500);
    echo json_encode(['error' => 'Не удалось подключиться к базе данных']);
    exit;
}

// Надежный перехват Bearer-токена для встроенного сервера PHP
$auth = '';
if (isset($_SERVER['HTTP_AUTHORIZATION'])) {
    $auth = trim($_SERVER['HTTP_AUTHORIZATION']);
} else {
    $headers = function_exists('getallheaders') ? getallheaders() : [];
    $auth = $headers['Authorization'] ?? $headers['authorization'] ?? '';
}

if ($auth !== 'Bearer secret-token-123') {
    http_response_code(401);
    echo json_encode(['error' => 'Unauthorized: Invalid or missing token']);
    exit;
}

$method = $_SERVER['REQUEST_METHOD'];
$id = $_GET['id'] ?? null;
$input = json_decode(file_get_contents('php://input'), true) ?? [];

// 1. POST - Создание пользователя
if ($method === 'POST') {
    $name = trim($input['name'] ?? '');
    $email = trim($input['email'] ?? '');
    $age = $input['age'] ?? null;

    if (empty($name) || strlen($name) > 255) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid name']);
        exit;
    }
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid email format']);
        exit;
    }
    if (!is_numeric($age) || $age < 0 || $age > 120) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid age']);
        exit;
    }

    $stmt = $pdo->prepare("INSERT INTO users (name, email, age) VALUES (?, ?, ?)");
    $stmt->execute([$name, $email, $age]);
    $newId = $pdo->lastInsertId();

    $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
    $stmt->execute([$newId]);
    
    http_response_code(201);
    echo json_encode($stmt->fetch(), JSON_UNESCAPED_UNICODE);
    exit;
}

// 2. GET - Получение списка или одного пользователя
if ($method === 'GET') {
    if ($id) {
        $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
        $stmt->execute([$id]);
        $userObj = $stmt->fetch();
        if (!$userObj) {
            http_response_code(404);
            echo json_encode(['error' => 'User not found']);
        } else {
            http_response_code(200);
            echo json_encode($userObj, JSON_UNESCAPED_UNICODE);
        }
        exit;
    }

    $page = max(1, intval($_GET['page'] ?? 1));
    $pageSize = max(1, intval($_GET['pageSize'] ?? 10));
    $offset = ($page - 1) * $pageSize;

    $total = $pdo->query("SELECT COUNT(*) FROM users")->fetchColumn();
    
    $stmt = $pdo->prepare("SELECT * FROM users LIMIT ? OFFSET ?");
    $stmt->bindValue(1, $pageSize, PDO::PARAM_INT);
    $stmt->bindValue(2, $offset, PDO::PARAM_INT);
    $stmt->execute();
    
    http_response_code(200);
    echo json_encode([
        'page' => $page,
        'pageSize' => $pageSize,
        'total' => intval($total),
        'data' => $stmt->fetchAll()
    ], JSON_UNESCAPED_UNICODE);
    exit;
}

// 3. PUT - Обновление пользователя
if ($method === 'PUT' && $id) {
    $name = trim($input['name'] ?? '');
    $age = $input['age'] ?? null;

    $stmt = $pdo->prepare("UPDATE users SET name = ?, age = ? WHERE idusers = ?");
    $stmt->execute([$name, $age, $id]);

    $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
    $stmt->execute([$id]);
    $userObj = $stmt->fetch();
    
    if (!$userObj) {
        http_response_code(404);
        echo json_encode(['error' => 'User not found']);
    } else {
        http_response_code(200);
        echo json_encode($userObj, JSON_UNESCAPED_UNICODE);
    }
    exit;
}

// 4. DELETE - Удаление пользователя
if ($method === 'DELETE' && $id) {
    $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
    $stmt->execute([$id]);
    if (!$stmt->fetch()) {
        http_response_code(404);
        echo json_encode(['error' => 'User not found']);
        exit;
    }

    $stmt = $pdo->prepare("DELETE FROM users WHERE idusers = ?");
    $stmt->execute([$id]);
    http_response_code(204);
    exit;
}

http_response_code(400);
echo json_encode(['error' => 'Bad request']);