<?php
declare(strict_types=1);

require_once dirname(dirname(__DIR__)) . '/bootstrap.php';

if (!TaskCertRequest::isPost()) {
    TaskCertResponse::error('Methode nicht erlaubt', 405);
}

$auth = TaskCertAuthContext::fromGlobals();
if (!$auth->hasPermission('r-task-cert-admin')) {
    TaskCertResponse::error('Keine Berechtigung', 403);
}

TaskCertCsrf::assertValidFromRequest(true);

$taskId = TaskCertRequest::postInt('task_id', 0);
if ($taskId <= 0) {
    TaskCertResponse::error('Ungültige task_id', 400);
}

$confirmed = TaskCertRequest::postInt('confirm_hard_delete', 0) === 1;
if (!$confirmed) {
    TaskCertResponse::error('Bitte endgültiges Löschen bestätigen.', 400);
}

try {
    $services = task_cert_services();
    $impact = $services['taskDefinitionService']->hardDeleteTask($taskId);

    $redirectTo = TaskCertRequest::postString('redirect_to', '');
    if ($redirectTo !== '') {
        TaskCertResponse::redirect($redirectTo);
    }

    TaskCertResponse::json([
        'success' => true,
        'task_id' => $taskId,
        'deleted' => [
            'task' => 1,
            'methods' => (int) ($impact['methods'] ?? 0),
            'assignments' => (int) ($impact['assignments'] ?? 0),
            'submissions' => (int) ($impact['submissions'] ?? 0),
            'certificates' => (int) ($impact['certificates'] ?? 0),
            'escalation_events' => (int) ($impact['escalation_events'] ?? 0),
        ],
    ]);
} catch (Throwable $throwable) {
    TaskCertResponse::json([
        'success' => false,
        'error' => $throwable->getMessage(),
    ], 400);
}