<?php
declare(strict_types=1);
require_once __DIR__ . '/includes/bootstrap.php';
require_once __DIR__ . '/includes/flash.php';
require_admin();
if (session_status() !== PHP_SESSION_ACTIVE) {
    session_start();
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && csrf_verify($_POST['csrf'] ?? null)) {
    $terms = (string)($_POST['terms_body'] ?? '');
    $priv = (string)($_POST['privacy_body'] ?? '');
    db()->prepare('INSERT INTO static_pages (slug, title, body) VALUES (?,?,?) ON DUPLICATE KEY UPDATE title=VALUES(title), body=VALUES(body)')->execute(['terms', 'Terms & Conditions', $terms]);
    db()->prepare('INSERT INTO static_pages (slug, title, body) VALUES (?,?,?) ON DUPLICATE KEY UPDATE title=VALUES(title), body=VALUES(body)')->execute(['privacy', 'Privacy Policy', $priv]);
    admin_flash_set('success', 'Legal pages updated.');
    header('Location: static-pages.php');
    exit;
}
$page = 'pages';
$pageTitle = 'Legal pages';
$pageSubtitle = 'HTML content for Terms & Conditions and Privacy Policy (linked in the site footer).';
$breadcrumbs = [['label' => 'Dashboard', 'href' => 'index.php'], ['label' => 'Legal pages', 'href' => null]];
$headerActions = '<a href="../terms.php" class="btn btn-outline-secondary btn-sm" target="_blank" rel="noopener">Terms</a>'
    . '<a href="../privacy.php" class="btn btn-outline-secondary btn-sm" target="_blank" rel="noopener">Privacy</a>';
require __DIR__ . '/includes/layout-header.php';
$t = static_page('terms');
$p = static_page('privacy');
?>
<form method="post">
  <input type="hidden" name="csrf" value="<?= h(csrf_token()) ?>">
  <div class="row g-4">
    <div class="col-lg-6">
      <div class="admin-card rounded h-100">
        <div class="card-header d-flex justify-content-between align-items-center">
          <span>Terms &amp; Conditions</span>
          <span class="badge bg-secondary">terms.php</span>
        </div>
        <div class="card-body">
          <textarea name="terms_body" class="form-control font-monospace small" rows="18" placeholder="<p>...</p>"><?= $t ? htmlspecialchars((string)$t['body'], ENT_QUOTES, 'UTF-8') : '' ?></textarea>
          <div class="form-text mt-2">Safe HTML only. Review on the live site after saving.</div>
        </div>
      </div>
    </div>
    <div class="col-lg-6">
      <div class="admin-card rounded h-100">
        <div class="card-header d-flex justify-content-between align-items-center">
          <span>Privacy Policy</span>
          <span class="badge bg-secondary">privacy.php</span>
        </div>
        <div class="card-body">
          <textarea name="privacy_body" class="form-control font-monospace small" rows="18"><?= $p ? htmlspecialchars((string)$p['body'], ENT_QUOTES, 'UTF-8') : '' ?></textarea>
        </div>
      </div>
    </div>
  </div>
  <div class="mt-4">
    <button type="submit" class="btn btn-primary btn-lg"><i class="bi bi-check-lg me-1"></i>Save both pages</button>
  </div>
</form>
<?php require __DIR__ . '/includes/layout-footer.php'; ?>
