---

<?php
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: Content-Type, Authorization');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    exit(0);
}

// Настройки подключения к базе данных
$host = 'web.edu';
$db   = '23095_testapi'; // Твоя база с твоего скриншота в Workbench
$user = 'твой_логин';
$pass = 'твой_пароль';
$charset = 'utf8mb4';

$dsn = "mysql:host=$host;dbname=$db;charset=$charset";
try {
    $pdo = new PDO($dsn, $user, $pass, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    ]);
} catch (\PDOException $e) {
    http_response_code(500);
    echo json_encode(['error' => 'Ошибка подключения к БД']);
    exit;
}

// Проверка Bearer-токена (Авторизация)
$auth = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
if ($auth !== 'Bearer secret-token-123') {
    http_response_code(401);
    echo json_encode(['error' => 'Unauthorized: Неверный токен']);
    exit;
}

$method = $_SERVER['REQUEST_METHOD'];

// Разбираем путь из URL (например, /api/users или /api/users/1)
$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$pathParts = explode('/', trim($uri, '/'));

$isUsersPath = (isset($pathParts[0]) && $pathParts[0] === 'api' && isset($pathParts[1]) && $pathParts[1] === 'users');
$id = $pathParts[2] ?? null; // Если передан ID в конце ссылки

if (!$isUsersPath) {
    http_response_code(404);
    echo json_encode(['error' => 'Эндпоинт не найден. Используйте /api/users']);
    exit;
}

$input = json_decode(file_get_contents('php://input'), true) ?? [];

// 1. POST /api/users — Создание пользователя[span_1](start_span)[span_1](end_span)
if ($method === 'POST') {
    $name = trim($input['name'] ?? '');
    $email = trim($input['email'] ?? '');
    $age = $input['age'] ?? null;

    if (empty($name) || strlen($name) > 255) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid name']);
        exit;
    }
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid email format']);
        exit;
    }
    if (!is_numeric($age) || $age < 0 || $age > 120) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid age']);
        exit;
    }

    $stmt = $pdo->prepare("INSERT INTO users (name, email, age) VALUES (?, ?, ?)");
    $stmt->execute([$name, $email, $age]);
    $newId = $pdo->lastInsertId();

    $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
    $stmt->execute([$newId]);
    
    http_response_code(201);
    echo json_encode($stmt->fetch(), JSON_UNESCAPED_UNICODE);
    exit;
}

// 2. GET /api/users или GET /api/users/{id} — Получение списка или одного[span_2](start_span)[span_2](end_span)
if ($method === 'GET') {
    if ($id) {
        $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
        $stmt->execute([$id]);
        $userObj = $stmt->fetch();
        if (!$userObj) {
            http_response_code(404);
            echo json_encode(['error' => 'User not found']);
        } else {
            http_response_code(200);
            echo json_encode($userObj, JSON_UNESCAPED_UNICODE);
        }
        exit;
    }

    $page = max(1, intval($_GET['page'] ?? 1));
    $pageSize = max(1, intval($_GET['pageSize'] ?? 10));
    $offset = ($page - 1) * $pageSize;

    $total = $pdo->query("SELECT COUNT(*) FROM users")->fetchColumn();
    
    $stmt = $pdo->prepare("SELECT * FROM users LIMIT ? OFFSET ?");
    $stmt->bindValue(1, $pageSize, PDO::PARAM_INT);
    $stmt->bindValue(2, $offset, PDO::PARAM_INT);
    $stmt->execute();
    
    http_response_code(200);
    echo json_encode([
        'page' => $page,
        'pageSize' => $pageSize,
        'total' => intval($total),
        'data' => $stmt->fetchAll()
    ], JSON_UNESCAPED_UNICODE);
    exit;
}

// 3. PUT /api/users/{id} — Обновление пользователя[span_3](start_span)[span_3](end_span)
if ($method === 'PUT' && $id) {
    $name = trim($input['name'] ?? '');
    $age = $input['age'] ?? null;

    $stmt = $pdo->prepare("UPDATE users SET name = ?, age = ? WHERE idusers = ?");
    $stmt->execute([$name, $age, $id]);

    $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
    $stmt->execute([$id]);
    $userObj = $stmt->fetch();
    
    if (!$userObj) {
        http_response_code(404);
        echo json_encode(['error' => 'User not found']);
    } else {
        http_response_code(200);
        echo json_encode($userObj, JSON_UNESCAPED_UNICODE);
    }
    exit;
}

// 4. DELETE /api/users/{id} — Удаление пользователя[span_4](start_span)[span_4](end_span)
if ($method === 'DELETE' && $id) {
    $stmt = $pdo->prepare("SELECT * FROM users WHERE idusers = ?");
    $stmt->execute([$id]);
    if (!$stmt->fetch()) {
        http_response_code(404);
        echo json_encode(['error' => 'User not found']);
        exit;
    }

    $stmt = $pdo->prepare("DELETE FROM users WHERE idusers = ?");
    $stmt->execute([$id]);
    http_response_code(204);
    exit;
}

http_response_code(400);
echo json_encode(['error' => 'Bad request']);