<?php
require_once 'include/auth.php';

// Only admins can reorder tabs
if (!isAdmin()) {
    header('Content-Type: application/json');
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit;
}

$data = json_decode(file_get_contents('php://input'), true);

if (isset($data['tab_ids']) && is_array($data['tab_ids'])) {
    $tab_ids = $data['tab_ids'];

    try {
        $pdo->beginTransaction();

        $stmt = $pdo->prepare("UPDATE tabs SET sort_order = ? WHERE id = ?");

        foreach ($tab_ids as $index => $tab_id) {
            // Sort order is 1-based
            $sort_order = $index + 1;
            $stmt->execute([$sort_order, (int)$tab_id]);
        }

        $pdo->commit();

        header('Content-Type: application/json');
        echo json_encode(['success' => true]);
    } catch (Exception $e) {
        $pdo->rollBack();
        header('Content-Type: application/json');
        http_response_code(500);
        echo json_encode(['success' => false, 'message' => 'Database error: ' . $e->getMessage()]);
    }
} else {
    header('Content-Type: application/json');
    http_response_code(400);
    echo json_encode(['success' => false, 'message' => 'Invalid input']);
}