<?php
header('Content-Type: application/json; charset=utf-8');
require_once 'auth_helper.php';

$db = mysqli_connect('localhost', 'sooraapps_warqauser', 'YTR#,;_h4WU!Ey~R', 'sooraapps_warqa');
if (!$db) {
    echo json_encode(["status" => "error", "message" => "dbConnectionFailed"]);
    exit;
}
mysqli_set_charset($db, "utf8mb4");

$classid   = trim($_POST['classid'] ?? '');
$studentid = trim($_POST['studentid'] ?? '');
$page      = trim($_POST['page'] ?? '');
$token     = getRequestToken();

if ($classid === '' || $studentid === '' || $page === '') {
    echo json_encode(["status" => "error", "message" => "missingParams"]);
    exit;
}

$authorized = false;
if (verifyStudentToken($db, $studentid, $token) && verifyStudentInClass($db, $studentid, $classid)) {
    $authorized = true;
}
if (!$authorized && $token !== '') {
    $stmt = $db->prepare("SELECT u.id FROM users u INNER JOIN classes c ON c.teacherid = u.id WHERE c.id = ? AND u.token = ? AND u.role = 'teacher' LIMIT 1");
    $cid = (int)$classid;
    $stmt->bind_param("is", $cid, $token);
    $stmt->execute();
    $res = $stmt->get_result();
    if ($res && $res->num_rows > 0) $authorized = true;
    $stmt->close();
}
if (!$authorized) denyAccess();

$stmt = $db->prepare("SELECT id FROM notes WHERE classid = ? AND studentid = ? AND page = ? AND color = '4' LIMIT 1");
$stmt->bind_param("sss", $classid, $studentid, $page);
$stmt->execute();
$res = $stmt->get_result();
$reviewed = ($res && $res->num_rows > 0);
$stmt->close();

echo json_encode(["status" => "success", "reviewed" => $reviewed]);
$db->close();
?>