<?php
declare(strict_types=1);

require_once __DIR__ . '/config.php';

// En-têtes HTTP pour API REST JSON & CORS
header('Content-Type: application/json; charset=UTF-8');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With, X-API-KEY');

// Gestion des requêtes de pré-vérification OPTIONS (CORS)
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

/**
 * Réponse JSON standardisée
 */
function sendJson(int $statusCode, array $data): void
{
    http_response_code($statusCode);
    echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);
    exit;
}

/**
 * Récupère le corps de la requête (JSON ou FormData)
 */
function getBody(): array
{
    $raw = file_get_contents('php://input');
    if (!empty($raw)) {
        if (!mb_check_encoding($raw, 'UTF-8')) {
            $raw = mb_convert_encoding($raw, 'UTF-8', 'ISO-8859-1');
        }
        $decoded = json_decode($raw, true);
        if (is_array($decoded)) {
            return $decoded;
        }
    }
    return $_POST ?? [];
}

/**
 * Résolution du chemin de la requête
 */
function getPathSegments(): array
{
    if (!empty($_GET['route'])) {
        $path = trim($_GET['route'], '/');
        return $path === '' ? [] : explode('/', $path);
    }

    if (!empty($_SERVER['PATH_INFO'])) {
        $path = trim($_SERVER['PATH_INFO'], '/');
        return $path === '' ? [] : explode('/', $path);
    }

    $uri = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH);
    $scriptDir = dirname($_SERVER['SCRIPT_NAME'] ?? '');
    
    if ($scriptDir !== '/' && $scriptDir !== '\\' && strpos($uri, $scriptDir) === 0) {
        $uri = substr($uri, strlen($scriptDir));
    }

    $uri = preg_replace('#^/?index\.php#i', '', $uri);
    $path = trim($uri, '/');

    return $path === '' ? [] : explode('/', $path);
}

/**
 * Récupère le jeton Bearer depuis les en-têtes HTTP ou paramètre d'URL
 */
function getBearerToken(): ?string
{
    $authHeader = null;

    if (!empty($_SERVER['HTTP_AUTHORIZATION'])) {
        $authHeader = trim($_SERVER['HTTP_AUTHORIZATION']);
    } elseif (!empty($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])) {
        $authHeader = trim($_SERVER['REDIRECT_HTTP_AUTHORIZATION']);
    } elseif (!empty($_SERVER['HTTP_X_API_KEY'])) {
        return trim($_SERVER['HTTP_X_API_KEY']);
    } elseif (function_exists('apache_request_headers')) {
        $headers = apache_request_headers();
        foreach ($headers as $key => $val) {
            if (strcasecmp($key, 'Authorization') === 0) {
                $authHeader = trim($val);
                break;
            }
            if (strcasecmp($key, 'X-API-KEY') === 0) {
                return trim($val);
            }
        }
    }

    if ($authHeader !== null && preg_match('/Bearer\s+(\S+)/i', $authHeader, $matches)) {
        return $matches[1];
    }

    if (!empty($_GET['token'])) {
        return trim((string)$_GET['token']);
    }

    return null;
}

/**
 * Vérifie l'authentification et les droits de l'utilisateur
 */
function authenticate(PDO $db, bool $required = true, ?string $requiredRole = null): ?array
{
    $token = getBearerToken();

    if ($token === null) {
        if ($required) {
            sendJson(401, [
                'success' => false,
                'error'   => "Authentification requise. Veuillez fournir un jeton 'Authorization: Bearer <token>' ou 'X-API-KEY'."
            ]);
        }
        return null;
    }

    $stmt = $db->prepare('
        SELECT id, username, nom, role, api_token, token_expires_at 
        FROM users 
        WHERE api_token = ?
        LIMIT 1
    ');
    $stmt->execute([$token]);
    $user = $stmt->fetch();

    if (!$user) {
        sendJson(401, [
            'success' => false,
            'error'   => "Jeton d'authentification invalide. Veuillez vous reconnecter via POST /auth/login."
        ]);
    }

    // Vérifier l'expiration du jeton
    if (!empty($user['token_expires_at']) && strtotime($user['token_expires_at']) < time()) {
        sendJson(401, [
            'success' => false,
            'error'   => "Jeton d'authentification expiré. Veuillez vous reconnecter via POST /auth/login."
        ]);
    }

    // Vérifier le rôle requis (ex: 'admin')
    if ($requiredRole !== null && strtolower((string)$user['role']) !== strtolower($requiredRole)) {
        sendJson(403, [
            'success' => false,
            'error'   => "Accès refusé. Privilèges insuffisants (rôle '$requiredRole' requis, rôle actuel : '{$user['role']}')."
        ]);
    }

    return $user;
}

/**
 * Recherche d'une voiture par sa plaque d'immatriculation
 */
function findCarByPlate(PDO $db, string $plaque): void
{
    $clean = strtoupper(trim(urldecode($plaque)));
    $norm = str_replace(['-', ' ', '.', '_'], '', $clean);

    $stmt = $db->prepare('
        SELECT c.*,
               (SELECT valeur FROM kilometrage WHERE car_id = c.id ORDER BY date_releve DESC, id DESC LIMIT 1) AS dernier_km
        FROM cars c
        WHERE UPPER(c.immatriculation) = :raw
           OR REPLACE(REPLACE(REPLACE(REPLACE(UPPER(c.immatriculation), "-", ""), " ", ""), ".", ""), "_", "") = :norm
        LIMIT 1
    ');
    $stmt->execute([':raw' => $clean, ':norm' => $norm]);
    $car = $stmt->fetch();

    if (!$car) {
        sendJson(404, [
            'success' => false,
            'error'   => "Aucune voiture trouvée avec l'immatriculation '$clean'"
        ]);
    }

    sendJson(200, [
        'success' => true,
        'data'    => $car
    ]);
}

try {
    $db = getDB();
    $method = strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET');
    $segments = getPathSegments();

    // Route racine: Documentation des points d'accès
    if (empty($segments)) {
        sendJson(200, [
            'success' => true,
            'message' => 'API Voitures avec Authentification opérationnelle',
            'database' => DB_NAME,
            'comptes_demo' => [
                'admin' => ['username' => 'admin', 'password' => 'adminpassword', 'token_fixe' => 'admin-token-secret-12345'],
                'user'  => ['username' => 'user',  'password' => 'userpassword',  'token_fixe' => 'user-token-secret-67890']
            ],
            'endpoints' => [
                'Authentification' => [
                    'POST /auth/login'                   => '[PUBLIC] Se connecter et obtenir un jeton (username, password)',
                    'POST /auth/register'                => '[PUBLIC] Créer un compte utilisateur (username, password, nom)',
                    'GET /auth/me'                       => '[AUTHENTIFIÉ] Obtenir le profil de l\'utilisateur connecté',
                    'POST /auth/logout'                  => '[AUTHENTIFIÉ] Révoquer le jeton de session'
                ],
                'Voitures' => [
                    'GET /cars'                          => '[PUBLIC] Liste des voitures (filtrable par ?immatriculation=...)',
                    'GET /cars/{id}'                     => '[PUBLIC] Détails d\'une voiture',
                    'GET /cars/immatriculation/{plaque}' => '[PUBLIC] Identifier une voiture par sa plaque',
                    'GET /cars/{id}/etat'                => '[AUTHENTIFIÉ] État complet (voiture, dernier km, entretiens, notes)',
                    'POST /cars'                         => '[AUTHENTIFIÉ] Créer une voiture (marque, modele, annee, dateAchat, VIN, immatriculation)',
                    'PUT /cars/{id}'                     => '[AUTHENTIFIÉ] Modifier les paramètres d\'une voiture',
                    'DELETE /cars/{id}'                  => '[ADMIN] Supprimer une voiture et toutes ses données associées'
                ],
                'Kilométrage' => [
                    'GET /cars/{id}/kilometrage'         => '[PUBLIC] Historique des relevés kilométriques',
                    'POST /cars/{id}/kilometrage'        => '[AUTHENTIFIÉ] Ajouter un relevé kilométrique (valeur, date_releve)',
                    'DELETE /kilometrage/{id}'           => '[ADMIN] Supprimer un relevé kilométrique'
                ],
                'Entretiens' => [
                    'GET /cars/{id}/maintenance'         => '[PUBLIC] Historique des entretiens d\'une voiture',
                    'GET /maintenance/{id}'              => '[PUBLIC] Détails d\'un entretien',
                    'POST /cars/{id}/maintenance'        => '[AUTHENTIFIÉ] Ajouter un entretien (type_entretien, date_evenement, kilometrage, ...)',
                    'PUT /maintenance/{id}'              => '[AUTHENTIFIÉ] Modifier un entretien',
                    'DELETE /maintenance/{id}'           => '[ADMIN] Supprimer un entretien'
                ],
                'Notes (Contenu interne)' => [
                    'GET /cars/{id}/notes'               => '[AUTHENTIFIÉ] Consulter les notes d\'une voiture',
                    'POST /cars/{id}/notes'              => '[AUTHENTIFIÉ] Ajouter une note (titre, contenu)',
                    'PUT /notes/{id}'                    => '[AUTHENTIFIÉ] Modifier une note',
                    'DELETE /notes/{id}'                 => '[AUTHENTIFIÉ] Supprimer une note'
                ]
            ]
        ]);
    }

    $resource = strtolower($segments[0]);

    // =========================================================================
    // RESSOURCE: AUTHENTIFICATION (/auth ...)
    // =========================================================================
    if ($resource === 'auth') {
        $action = strtolower($segments[1] ?? '');

        // POST /auth/login
        if ($action === 'login' && $method === 'POST') {
            $body = getBody();
            if (empty($body['username']) || empty($body['password'])) {
                sendJson(400, ['success' => false, 'error' => 'Champs username et password obligatoires']);
            }

            $stmt = $db->prepare('SELECT * FROM users WHERE username = ? LIMIT 1');
            $stmt->execute([trim((string)$body['username'])]);
            $user = $stmt->fetch();

            if (!$user || !password_verify((string)$body['password'], $user['password'])) {
                sendJson(401, ['success' => false, 'error' => 'Identifiants invalides (nom d\'utilisateur ou mot de passe incorrect)']);
            }

            // Génération d'un nouveau jeton valide 7 jours
            $token = bin2hex(random_bytes(32));
            $expiresAt = date('Y-m-d H:i:s', time() + (7 * 86400));

            $stmtUpdate = $db->prepare('UPDATE users SET api_token = ?, token_expires_at = ? WHERE id = ?');
            $stmtUpdate->execute([$token, $expiresAt, $user['id']]);

            sendJson(200, [
                'success' => true,
                'message' => 'Connexion réussie',
                'data'    => [
                    'user' => [
                        'id'       => (int)$user['id'],
                        'username' => $user['username'],
                        'nom'      => $user['nom'],
                        'role'     => $user['role']
                    ],
                    'token'      => $token,
                    'expires_at' => $expiresAt
                ]
            ]);
        }

        // POST /auth/register
        if ($action === 'register' && $method === 'POST') {
            $body = getBody();
            if (empty($body['username']) || empty($body['password'])) {
                sendJson(400, ['success' => false, 'error' => 'Champs username et password obligatoires']);
            }

            $username = trim((string)$body['username']);
            $nom = !empty($body['nom']) ? trim((string)$body['nom']) : null;
            $password = password_hash((string)$body['password'], PASSWORD_DEFAULT);

            // Vérifier existence
            $stmtCheck = $db->prepare('SELECT id FROM users WHERE username = ?');
            $stmtCheck->execute([$username]);
            if ($stmtCheck->fetch()) {
                sendJson(409, ['success' => false, 'error' => "Le nom d'utilisateur '$username' est déjà utilisé"]);
            }

            $token = bin2hex(random_bytes(32));
            $expiresAt = date('Y-m-d H:i:s', time() + (7 * 86400));

            $stmt = $db->prepare('INSERT INTO users (username, password, nom, role, api_token, token_expires_at) VALUES (?, ?, ?, ?, ?, ?)');
            $stmt->execute([$username, $password, $nom, 'user', $token, $expiresAt]);
            $newId = (int)$db->lastInsertId();

            sendJson(201, [
                'success' => true,
                'message' => 'Compte créé avec succès',
                'data'    => [
                    'user' => [
                        'id'       => $newId,
                        'username' => $username,
                        'nom'      => $nom,
                        'role'     => 'user'
                    ],
                    'token'      => $token,
                    'expires_at' => $expiresAt
                ]
            ]);
        }

        // GET /auth/me (Profil de l'utilisateur connecté)
        if ($action === 'me' && $method === 'GET') {
            $user = authenticate($db, true);
            sendJson(200, [
                'success' => true,
                'data'    => [
                    'id'               => (int)$user['id'],
                    'username'         => $user['username'],
                    'nom'              => $user['nom'],
                    'role'             => $user['role'],
                    'token_expires_at' => $user['token_expires_at']
                ]
            ]);
        }

        // POST /auth/logout (Révocation du jeton)
        if ($action === 'logout' && $method === 'POST') {
            $user = authenticate($db, true);
            $stmt = $db->prepare('UPDATE users SET api_token = NULL, token_expires_at = NULL WHERE id = ?');
            $stmt->execute([$user['id']]);
            sendJson(200, ['success' => true, 'message' => 'Déconnexion réussie, le jeton a été révoqué']);
        }

        sendJson(404, ['success' => false, 'error' => "Action d'authentification '$action' non reconnue"]);
    }

    // =========================================================================
    // ENDPOINT DIRECT: /immatriculation/{plaque}
    // =========================================================================
    if ($resource === 'immatriculation' && $method === 'GET') {
        $plaque = $segments[1] ?? null;
        if (empty($plaque)) {
            sendJson(400, ['success' => false, 'error' => 'Numéro d\'immatriculation manquant dans l\'URL']);
        }
        findCarByPlate($db, $plaque);
    }

    // =========================================================================
    // RESSOURCE: CARS (/cars ...)
    // =========================================================================
    if ($resource === 'cars' || $resource === 'voitures') {
        // GET /cars/immatriculation/{plaque} (Public)
        if (isset($segments[1]) && strtolower($segments[1]) === 'immatriculation' && $method === 'GET') {
            $plaque = $segments[2] ?? null;
            if (empty($plaque)) {
                sendJson(400, ['success' => false, 'error' => 'Numéro d\'immatriculation manquant dans l\'URL']);
            }
            findCarByPlate($db, $plaque);
        }

        $carId = isset($segments[1]) && is_numeric($segments[1]) ? (int)$segments[1] : null;
        $subResource = $segments[2] ?? null;

        // 1. GET /cars/{id}/etat [CONTENU RESTREINT - AUTHENTIFICATION REQUISE]
        if ($carId && $subResource === 'etat' && $method === 'GET') {
            $currentUser = authenticate($db, true);

            try {
                $stmt = $db->prepare('CALL sp_getEtatVoiture(:id)');
                $stmt->execute([':id' => $carId]);

                $car = $stmt->fetch();
                if (!$car) {
                    sendJson(404, ['success' => false, 'error' => "Voiture #{$carId} introuvable"]);
                }

                $maintenances = [];
                if ($stmt->nextRowset()) {
                    $maintenances = $stmt->fetchAll();
                }

                $notes = [];
                if ($stmt->nextRowset()) {
                    $notes = $stmt->fetchAll();
                }
                $stmt->closeCursor();

                sendJson(200, [
                    'success' => true,
                    'consulted_by' => $currentUser['username'],
                    'data' => [
                        'voiture'      => $car,
                        'maintenances' => $maintenances,
                        'notes'        => $notes
                    ]
                ]);
            } catch (Exception $e) {
                $stmtCar = $db->prepare('
                    SELECT c.*,
                           (SELECT valeur FROM kilometrage WHERE car_id = c.id ORDER BY date_releve DESC, id DESC LIMIT 1) AS dernier_km
                    FROM cars c WHERE c.id = ?
                ');
                $stmtCar->execute([$carId]);
                $car = $stmtCar->fetch();
                if (!$car) {
                    sendJson(404, ['success' => false, 'error' => "Voiture #{$carId} introuvable"]);
                }

                $stmtMaint = $db->prepare('SELECT * FROM maintenance_logs WHERE car_id = ? ORDER BY date_evenement DESC');
                $stmtMaint->execute([$carId]);

                $stmtNotes = $db->prepare('SELECT * FROM notes WHERE car_id = ? ORDER BY date_creation DESC');
                $stmtNotes->execute([$carId]);

                sendJson(200, [
                    'success' => true,
                    'consulted_by' => $currentUser['username'],
                    'data' => [
                        'voiture'      => $car,
                        'maintenances' => $stmtMaint->fetchAll(),
                        'notes'        => $stmtNotes->fetchAll()
                    ]
                ]);
            }
        }

        // 2. /cars/{id}/kilometrage
        if ($carId && $subResource === 'kilometrage') {
            // GET: Public
            if ($method === 'GET') {
                $limit = isset($_GET['limit']) ? (int)$_GET['limit'] : 50;
                try {
                    $stmt = $db->prepare('CALL sp_getKilometrages(:id, :limit)');
                    $stmt->execute([':id' => $carId, ':limit' => $limit]);
                    $data = $stmt->fetchAll();
                    $stmt->closeCursor();
                } catch (Exception $e) {
                    $stmt = $db->prepare('SELECT * FROM kilometrage WHERE car_id = ? ORDER BY date_releve DESC, id DESC LIMIT ?');
                    $stmt->bindValue(1, $carId, PDO::PARAM_INT);
                    $stmt->bindValue(2, $limit, PDO::PARAM_INT);
                    $stmt->execute();
                    $data = $stmt->fetchAll();
                }
                sendJson(200, ['success' => true, 'data' => $data]);
            }

            // POST: [ACTION PROTÉGÉE - AUTHENTIFICATION REQUISE]
            if ($method === 'POST') {
                authenticate($db, true);

                $body = getBody();
                if (!isset($body['valeur'])) {
                    sendJson(400, ['success' => false, 'error' => 'Le champ valeur (kilométrage) est obligatoire']);
                }
                $dateReleve = $body['date_releve'] ?? date('Y-m-d');
                $valeur = (int)$body['valeur'];

                $stmt = $db->prepare('INSERT INTO kilometrage (car_id, date_releve, valeur) VALUES (?, ?, ?)');
                $stmt->execute([$carId, $dateReleve, $valeur]);
                $newId = (int)$db->lastInsertId();

                sendJson(201, [
                    'success' => true,
                    'message' => 'Relevé kilométrique enregistré',
                    'data'    => [
                        'id'          => $newId,
                        'car_id'      => $carId,
                        'date_releve' => $dateReleve,
                        'valeur'      => $valeur
                    ]
                ]);
            }

            sendJson(405, ['success' => false, 'error' => 'Méthode non autorisée pour cette sous-ressource']);
        }

        // 3. /cars/{id}/maintenance
        if ($carId && ($subResource === 'maintenance' || $subResource === 'entretiens')) {
            // GET: Public
            if ($method === 'GET') {
                $stmt = $db->prepare('SELECT * FROM maintenance_logs WHERE car_id = ? ORDER BY date_evenement DESC');
                $stmt->execute([$carId]);
                sendJson(200, ['success' => true, 'data' => $stmt->fetchAll()]);
            }

            // POST: [ACTION PROTÉGÉE - AUTHENTIFICATION REQUISE]
            if ($method === 'POST') {
                authenticate($db, true);

                $body = getBody();
                if (empty($body['type_entretien']) || empty($body['date_evenement']) || !isset($body['kilometrage'])) {
                    sendJson(400, [
                        'success' => false,
                        'error'   => 'Les champs type_entretien, date_evenement et kilometrage sont obligatoires'
                    ]);
                }

                $stmt = $db->prepare('
                    INSERT INTO maintenance_logs (car_id, type_entretien, date_evenement, kilometrage, description, prix)
                    VALUES (?, ?, ?, ?, ?, ?)
                ');
                $stmt->execute([
                    $carId,
                    trim((string)$body['type_entretien']),
                    (string)$body['date_evenement'],
                    (int)$body['kilometrage'],
                    isset($body['description']) ? trim((string)$body['description']) : null,
                    isset($body['prix']) ? (float)$body['prix'] : null
                ]);

                $newId = (int)$db->lastInsertId();
                $stmtGet = $db->prepare('SELECT * FROM maintenance_logs WHERE id = ?');
                $stmtGet->execute([$newId]);

                sendJson(201, [
                    'success' => true,
                    'message' => 'Entretien enregistré avec succès',
                    'data'    => $stmtGet->fetch()
                ]);
            }

            sendJson(405, ['success' => false, 'error' => 'Méthode non autorisée pour cette sous-ressource']);
        }

        // 4. /cars/{id}/notes [CONTENU RESTREINT - AUTHENTIFICATION REQUISE]
        if ($carId && $subResource === 'notes') {
            // GET: Protégé (Notes de suivi confidentielles)
            if ($method === 'GET') {
                authenticate($db, true);

                $stmt = $db->prepare('SELECT * FROM notes WHERE car_id = ? ORDER BY date_creation DESC');
                $stmt->execute([$carId]);
                sendJson(200, ['success' => true, 'data' => $stmt->fetchAll()]);
            }

            // POST: [ACTION PROTÉGÉE - AUTHENTIFICATION REQUISE]
            if ($method === 'POST') {
                authenticate($db, true);

                $body = getBody();
                if (empty($body['contenu'])) {
                    sendJson(400, ['success' => false, 'error' => 'Le champ contenu est obligatoire']);
                }

                $titre = isset($body['titre']) ? trim((string)$body['titre']) : null;
                $contenu = trim((string)$body['contenu']);

                $stmt = $db->prepare('INSERT INTO notes (car_id, titre, contenu) VALUES (?, ?, ?)');
                $stmt->execute([$carId, $titre, $contenu]);

                $newId = (int)$db->lastInsertId();
                $stmtGet = $db->prepare('SELECT * FROM notes WHERE id = ?');
                $stmtGet->execute([$newId]);

                sendJson(201, [
                    'success' => true,
                    'message' => 'Note enregistrée avec succès',
                    'data'    => $stmtGet->fetch()
                ]);
            }

            sendJson(405, ['success' => false, 'error' => 'Méthode non autorisée pour cette sous-ressource']);
        }

        // --- ACTIONS PRINCIPALES SUR LES VOITURES ---

        // GET /cars : Liste toutes les voitures (Public)
        if ($carId === null && $subResource === null && $method === 'GET') {
            if (!empty($_GET['immatriculation'])) {
                findCarByPlate($db, (string)$_GET['immatriculation']);
            }

            $sql = 'SELECT c.*,
                           (SELECT valeur FROM kilometrage WHERE car_id = c.id ORDER BY date_releve DESC, id DESC LIMIT 1) AS dernier_km
                    FROM cars c
                    ORDER BY c.id ASC';
            $stmt = $db->query($sql);
            sendJson(200, ['success' => true, 'data' => $stmt->fetchAll()]);
        }

        // GET /cars/{id} : Consulter une voiture (Public)
        if ($carId !== null && $subResource === null && $method === 'GET') {
            $stmt = $db->prepare('
                SELECT c.*,
                       (SELECT valeur FROM kilometrage WHERE car_id = c.id ORDER BY date_releve DESC, id DESC LIMIT 1) AS dernier_km
                FROM cars c
                WHERE c.id = ?
            ');
            $stmt->execute([$carId]);
            $car = $stmt->fetch();
            if (!$car) {
                sendJson(404, ['success' => false, 'error' => "Voiture #{$carId} introuvable"]);
            }
            sendJson(200, ['success' => true, 'data' => $car]);
        }

        // POST /cars : Créer une voiture [ACTION PROTÉGÉE - AUTHENTIFICATION REQUISE]
        if ($carId === null && $method === 'POST') {
            authenticate($db, true);

            $body = getBody();
            $required = ['marque', 'modele', 'annee', 'dateAchat'];
            foreach ($required as $field) {
                if (empty($body[$field])) {
                    sendJson(400, ['success' => false, 'error' => "Le champ '$field' est obligatoire"]);
                }
            }

            $marque          = trim((string)$body['marque']);
            $modele          = trim((string)$body['modele']);
            $annee           = (int)$body['annee'];
            $dateAchat       = (string)$body['dateAchat'];
            $vin             = !empty($body['VIN']) ? trim((string)$body['VIN']) : null;
            $immatriculation = !empty($body['immatriculation']) ? strtoupper(trim((string)$body['immatriculation'])) : null;

            // Vérifier unicité de l'immatriculation
            if ($immatriculation !== null) {
                $normImmat = str_replace(['-', ' ', '.', '_'], '', $immatriculation);
                $stmtCheck = $db->prepare('
                    SELECT id FROM cars 
                    WHERE UPPER(immatriculation) = :raw 
                       OR REPLACE(REPLACE(REPLACE(REPLACE(UPPER(immatriculation), "-", ""), " ", ""), ".", ""), "_", "") = :norm
                ');
                $stmtCheck->execute([':raw' => $immatriculation, ':norm' => $normImmat]);
                if ($stmtCheck->fetch()) {
                    sendJson(409, [
                        'success' => false,
                        'error'   => "L'immatriculation '$immatriculation' est déjà utilisée pour un autre véhicule."
                    ]);
                }
            }

            // Appel de la procédure stockée sp_insertVoiture
            try {
                $stmt = $db->prepare('CALL sp_insertVoiture(:marque, :modele, :annee, :dateAchat, :vin, :immatriculation)');
                $stmt->execute([
                    ':marque'          => $marque,
                    ':modele'          => $modele,
                    ':annee'           => $annee,
                    ':dateAchat'       => $dateAchat,
                    ':vin'             => $vin,
                    ':immatriculation' => $immatriculation
                ]);
                $res = $stmt->fetch();
                $stmt->closeCursor();
                $newId = isset($res['new_id']) ? (int)$res['new_id'] : (int)$db->lastInsertId();
            } catch (Exception $e) {
                $stmt = $db->prepare('INSERT INTO cars (marque, modele, annee, dateAchat, VIN, immatriculation) VALUES (?, ?, ?, ?, ?, ?)');
                $stmt->execute([$marque, $modele, $annee, $dateAchat, $vin, $immatriculation]);
                $newId = (int)$db->lastInsertId();
            }

            if (!empty($body['kilometrage_initial'])) {
                $kmStmt = $db->prepare('INSERT INTO kilometrage (car_id, date_releve, valeur) VALUES (?, ?, ?)');
                $kmStmt->execute([$newId, $dateAchat, (int)$body['kilometrage_initial']]);
            }

            $stmtGet = $db->prepare('
                SELECT c.*,
                       (SELECT valeur FROM kilometrage WHERE car_id = c.id ORDER BY date_releve DESC, id DESC LIMIT 1) AS dernier_km
                FROM cars c
                WHERE c.id = ?
            ');
            $stmtGet->execute([$newId]);

            sendJson(201, [
                'success' => true,
                'message' => 'Voiture créée avec succès',
                'data'    => $stmtGet->fetch()
            ]);
        }

        // PUT / PATCH /cars/{id} : Mettre à jour les paramètres [ACTION PROTÉGÉE - AUTHENTIFICATION REQUISE]
        if ($carId !== null && $subResource === null && ($method === 'PUT' || $method === 'PATCH')) {
            authenticate($db, true);

            $check = $db->prepare('SELECT id FROM cars WHERE id = ?');
            $check->execute([$carId]);
            if (!$check->fetch()) {
                sendJson(404, ['success' => false, 'error' => "Voiture #{$carId} introuvable"]);
            }

            $body = getBody();
            $allowedFields = ['marque', 'modele', 'annee', 'dateAchat', 'VIN', 'immatriculation'];
            $updates = [];
            $params = [];

            if (!empty($body['immatriculation'])) {
                $immat = strtoupper(trim((string)$body['immatriculation']));
                $body['immatriculation'] = $immat;
                $normImmat = str_replace(['-', ' ', '.', '_'], '', $immat);
                $stmtCheck = $db->prepare('
                    SELECT id FROM cars 
                    WHERE (UPPER(immatriculation) = :raw 
                       OR REPLACE(REPLACE(REPLACE(REPLACE(UPPER(immatriculation), "-", ""), " ", ""), ".", ""), "_", "") = :norm)
                      AND id != :id
                ');
                $stmtCheck->execute([':raw' => $immat, ':norm' => $normImmat, ':id' => $carId]);
                if ($stmtCheck->fetch()) {
                    sendJson(409, [
                        'success' => false,
                        'error'   => "L'immatriculation '$immat' est déjà utilisée pour un autre véhicule."
                    ]);
                }
            }

            foreach ($allowedFields as $field) {
                if (array_key_exists($field, $body)) {
                    $updates[] = "`$field` = ?";
                    $params[] = $body[$field];
                }
            }

            if (empty($updates)) {
                sendJson(400, ['success' => false, 'error' => 'Aucun paramètre valide à mettre à jour']);
            }

            $params[] = $carId;
            $sql = 'UPDATE cars SET ' . implode(', ', $updates) . ' WHERE id = ?';
            $stmt = $db->prepare($sql);
            $stmt->execute($params);

            $stmtGet = $db->prepare('
                SELECT c.*,
                       (SELECT valeur FROM kilometrage WHERE car_id = c.id ORDER BY date_releve DESC, id DESC LIMIT 1) AS dernier_km
                FROM cars c
                WHERE c.id = ?
            ');
            $stmtGet->execute([$carId]);

            sendJson(200, [
                'success' => true,
                'message' => 'Paramètres de la voiture mis à jour avec succès',
                'data'    => $stmtGet->fetch()
            ]);
        }

        // DELETE /cars/{id} : Supprimer une voiture [ACTION PROTÉGÉE - RÔLE ADMIN REQUIS]
        if ($carId !== null && $subResource === null && $method === 'DELETE') {
            authenticate($db, true, 'admin');

            $check = $db->prepare('SELECT id FROM cars WHERE id = ?');
            $check->execute([$carId]);
            if (!$check->fetch()) {
                sendJson(404, ['success' => false, 'error' => "Voiture #{$carId} introuvable"]);
            }

            try {
                $stmt = $db->prepare('CALL sp_deleteVoiture(:id)');
                $stmt->execute([':id' => $carId]);
                $stmt->closeCursor();
            } catch (Exception $e) {
                $stmt = $db->prepare('DELETE FROM cars WHERE id = ?');
                $stmt->execute([$carId]);
            }

            sendJson(200, [
                'success' => true,
                'message' => "Voiture #{$carId} ainsi que toutes ses données associées ont été supprimées avec succès"
            ]);
        }

        sendJson(405, ['success' => false, 'error' => "Méthode HTTP non autorisée pour cette URL"]);
    }

    // =========================================================================
    // RESSOURCE: KILOMETRAGE DIRECT (/kilometrage/{id})
    // =========================================================================
    if ($resource === 'kilometrage') {
        $kmId = isset($segments[1]) && is_numeric($segments[1]) ? (int)$segments[1] : null;

        // DELETE: [ACTION PROTÉGÉE - RÔLE ADMIN REQUIS]
        if ($kmId && $method === 'DELETE') {
            authenticate($db, true, 'admin');

            $stmt = $db->prepare('DELETE FROM kilometrage WHERE id = ?');
            $stmt->execute([$kmId]);
            if ($stmt->rowCount() === 0) {
                sendJson(404, ['success' => false, 'error' => "Relevé kilométrique #{$kmId} introuvable"]);
            }
            sendJson(200, ['success' => true, 'message' => "Relevé kilométrique #{$kmId} supprimé"]);
        }

        sendJson(405, ['success' => false, 'error' => "Méthode non autorisée sur /kilometrage"]);
    }

    // =========================================================================
    // RESSOURCE: ENTRETIENS DIRECT (/maintenance/{id})
    // =========================================================================
    if ($resource === 'maintenance' || $resource === 'entretiens') {
        $maintId = isset($segments[1]) && is_numeric($segments[1]) ? (int)$segments[1] : null;

        if (!$maintId) {
            sendJson(400, ['success' => false, 'error' => 'Identifiant d\'entretien requis']);
        }

        // GET: Public
        if ($method === 'GET') {
            $stmt = $db->prepare('SELECT * FROM maintenance_logs WHERE id = ?');
            $stmt->execute([$maintId]);
            $item = $stmt->fetch();
            if (!$item) {
                sendJson(404, ['success' => false, 'error' => "Entretien #{$maintId} introuvable"]);
            }
            sendJson(200, ['success' => true, 'data' => $item]);
        }

        // PUT/PATCH: [ACTION PROTÉGÉE - AUTHENTIFICATION REQUISE]
        if ($method === 'PUT' || $method === 'PATCH') {
            authenticate($db, true);

            $body = getBody();
            $allowed = ['type_entretien', 'date_evenement', 'kilometrage', 'description', 'prix'];
            $updates = [];
            $params = [];

            foreach ($allowed as $f) {
                if (array_key_exists($f, $body)) {
                    $updates[] = "`$f` = ?";
                    $params[] = $body[$f];
                }
            }

            if (empty($updates)) {
                sendJson(400, ['success' => false, 'error' => 'Aucun paramètre à modifier']);
            }

            $params[] = $maintId;
            $stmt = $db->prepare('UPDATE maintenance_logs SET ' . implode(', ', $updates) . ' WHERE id = ?');
            $stmt->execute($params);

            $stmtGet = $db->prepare('SELECT * FROM maintenance_logs WHERE id = ?');
            $stmtGet->execute([$maintId]);
            sendJson(200, [
                'success' => true,
                'message' => 'Entretien mis à jour avec succès',
                'data'    => $stmtGet->fetch()
            ]);
        }

        // DELETE: [ACTION PROTÉGÉE - RÔLE ADMIN REQUIS]
        if ($method === 'DELETE') {
            authenticate($db, true, 'admin');

            $stmt = $db->prepare('DELETE FROM maintenance_logs WHERE id = ?');
            $stmt->execute([$maintId]);
            if ($stmt->rowCount() === 0) {
                sendJson(404, ['success' => false, 'error' => "Entretien #{$maintId} introuvable"]);
            }
            sendJson(200, ['success' => true, 'message' => "Entretien #{$maintId} supprimé avec succès"]);
        }

        sendJson(405, ['success' => false, 'error' => "Méthode non autorisée sur /maintenance/{id}"]);
    }

    // =========================================================================
    // RESSOURCE: NOTES DIRECT (/notes/{id}) [CONTENU RESTREINT - AUTHENTIFICATION REQUISE]
    // =========================================================================
    if ($resource === 'notes') {
        $noteId = isset($segments[1]) && is_numeric($segments[1]) ? (int)$segments[1] : null;

        if (!$noteId) {
            sendJson(400, ['success' => false, 'error' => 'Identifiant de note requis']);
        }

        // GET: Authentifié
        if ($method === 'GET') {
            authenticate($db, true);

            $stmt = $db->prepare('SELECT * FROM notes WHERE id = ?');
            $stmt->execute([$noteId]);
            $item = $stmt->fetch();
            if (!$item) {
                sendJson(404, ['success' => false, 'error' => "Note #{$noteId} introuvable"]);
            }
            sendJson(200, ['success' => true, 'data' => $item]);
        }

        // PUT/PATCH: Authentifié
        if ($method === 'PUT' || $method === 'PATCH') {
            authenticate($db, true);

            $body = getBody();
            $allowed = ['titre', 'contenu'];
            $updates = [];
            $params = [];

            foreach ($allowed as $f) {
                if (array_key_exists($f, $body)) {
                    $updates[] = "`$f` = ?";
                    $params[] = $body[$f];
                }
            }

            if (empty($updates)) {
                sendJson(400, ['success' => false, 'error' => 'Aucun paramètre à modifier']);
            }

            $params[] = $noteId;
            $stmt = $db->prepare('UPDATE notes SET ' . implode(', ', $updates) . ' WHERE id = ?');
            $stmt->execute($params);

            $stmtGet = $db->prepare('SELECT * FROM notes WHERE id = ?');
            $stmtGet->execute([$noteId]);
            sendJson(200, [
                'success' => true,
                'message' => 'Note mise à jour avec succès',
                'data'    => $stmtGet->fetch()
            ]);
        }

        // DELETE: Authentifié
        if ($method === 'DELETE') {
            authenticate($db, true);

            $stmt = $db->prepare('DELETE FROM notes WHERE id = ?');
            $stmt->execute([$noteId]);
            if ($stmt->rowCount() === 0) {
                sendJson(404, ['success' => false, 'error' => "Note #{$noteId} introuvable"]);
            }
            sendJson(200, ['success' => true, 'message' => "Note #{$noteId} supprimée avec succès"]);
        }

        sendJson(405, ['success' => false, 'error' => "Méthode non autorisée sur /notes/{id}"]);
    }

    sendJson(404, [
        'success' => false,
        'error'   => "Ressource '/$resource' non reconnue. Consultez la racine '/' pour la documentation des routes."
    ]);

} catch (PDOException $e) {
    sendJson(500, ['success' => false, 'error' => 'Erreur SQL: ' . $e->getMessage()]);
} catch (Throwable $e) {
    sendJson(500, ['success' => false, 'error' => 'Erreur serveur: ' . $e->getMessage()]);
}