index.php

<?php
declare(strict_types=1);

use Kirby\Cms\Page;
use Kirby\Http\Response;

/**
 * CFfreelancer Kirby plugin (Tabler UI client portal)
 * Vendor/slug: cfx/cffreelancer
 *
 * - Helpers + vendor autoload
 * - Routes (dashboard, planner, messages, invoices, webhook, etc.)
 * - Project template packs API + apply route
 * - Threads API (+ create matches /cff/api/threads/{client})
 * - Hooks (auto-publish cf-task so planner shows items)
 * - Snippets + Blueprints
 */

/* -------------------------------------------------------------------------- */
/* Stripe secret helper                                                        */
/* -------------------------------------------------------------------------- */
if (!function_exists('cff_get_stripe_secret')) {
  function cff_get_stripe_secret(): ?string {
    $key = getenv('STRIPE_SECRET_KEY');
    if ($key && trim($key) !== '') return $key;

    // Backward-compat shim (deprecated)
    $legacy = getenv('STRIPE_SECRET');
    if ($legacy && trim($legacy) !== '') {
      if (function_exists('cff_log')) { cff_log('warning', 'Using legacy STRIPE_SECRET env var; please migrate to STRIPE_SECRET_KEY.'); }
      return $legacy;
    }
    return null;
  }
}

/* -------------------------------------------------------------------------- */
/* Optional vendor + helpers                                                   */
/* -------------------------------------------------------------------------- */
$autoload = __DIR__ . '/vendor/autoload.php';
if (is_file($autoload)) {
  require_once $autoload;
}

$libHelpers = __DIR__ . '/lib/helpers.php';
if (is_file($libHelpers)) {
  require_once $libHelpers;
}

/* Mailer helper library (preferred for all mail sends) */
require_once __DIR__ . '/lib/mailer.php';

/* NEW: magic-link + portal-gate + email helper used by routes */
require_once __DIR__ . '/lib/Magic.php';
require_once __DIR__ . '/lib/PortalGate.php';
require_once __DIR__ . '/lib/mailer.php';

/* -------------------------------------------------------------------------- */
/* Project template packs (helpers; defined only if not present elsewhere)     */
/* -------------------------------------------------------------------------- */

/**
 * Load project template packs from common locations.
 * Each pack file can be .yml or .yaml and should at least provide:
 *   id, label/name/title, and optional "tasks" array.
 */
if (!function_exists('cff_load_project_packs')) {
  function cff_load_project_packs(): array {
    $paths = [
      __DIR__ . '/packs',
      kirby()->root('site') . '/packs',
      kirby()->root('base') . '/packs',
    ];

    $packs = [];
    foreach ($paths as $dir) {
      if (!is_dir($dir)) continue;
      foreach (glob($dir . '/*.{yml,yaml,json}', GLOB_BRACE) ?: [] as $file) {
        $ext = strtolower(pathinfo($file, PATHINFO_EXTENSION));
        $data = [];
        try {
          if ($ext === 'json') {
            $data = json_decode((string)file_get_contents($file), true) ?: [];
          } else {
            $data = \Kirby\Data\Yaml::read($file) ?: [];
          }
        } catch (\Throwable $e) {
          continue;
        }

        // Normalize
        $id    = (string)($data['id']    ?? pathinfo($file, PATHINFO_FILENAME));
        $label = (string)($data['label'] ?? $data['name'] ?? $data['title'] ?? ucfirst(str_replace('-', ' ', $id)));
        $packs[] = [
          'id'   => $id,
          'label'=> $label,
          'data' => $data,
          'file' => $file,
        ];
      }
    }
    // de-dupe by id (last wins)
    $uniq = [];
    foreach ($packs as $p) $uniq[$p['id']] = $p;
    return array_values($uniq);
  }
}

/**
 * Apply a pack to a project.
 * Minimal schema supported:
 *   data['tasks'] = [
 *     ['title'=>'...', 'summary'=>'...', 'category'=>'...', 'dueDays'=>7, 'checklist'=>['A','B']],
 *     ...
 *   ]
 * Creates cf-task children and publishes them.
 */
if (!function_exists('cff_apply_pack_to_project')) {
  function cff_apply_pack_to_project(\Kirby\Cms\Page $project, array $data): array {
    $created = [];
    $tasks = (array)($data['tasks'] ?? []);
    foreach ($tasks as $i => $row) {
      if (!is_array($row)) continue;
      $title    = trim((string)($row['title']    ?? 'Task ' . ($i+1)));
      $summary  = (string)($row['summary']  ?? ($row['description'] ?? ''));
      $category = (string)($row['category'] ?? '');
      $dueDays  = (int)($row['dueDays']    ?? 0);
      $dueDate  = $dueDays ? date('Y-m-d', strtotime('+' . $dueDays . ' days')) : '';

      $slug = 'task-' . date('Ymd-His') . '-' . substr(sha1($title . microtime(true) . random_bytes(4)), 0, 6);

      try {
        $task = $project->createChild([
          'slug'     => $slug,
          'template' => 'cf-task',
          'content'  => [
            'title'    => $title,
            'summary'  => $summary,
            'category' => $category,
            'status'   => 'todo',
            'dueDate'  => $dueDate,
          ],
        ])->changeStatus('listed');

        // optional checklist (array of strings or objects {title,done})
        if (!empty($row['checklist'])) {
          $rows = [];
          foreach ((array)$row['checklist'] as $j => $ci) {
            if (is_string($ci)) {
              $rows[] = ['id'=>uniqid('i'), 'title'=>$ci, 'done'=>false];
            } elseif (is_array($ci)) {
              $rows[] = [
                'id'    => (string)($ci['id'] ?? uniqid('i')),
                'title' => (string)($ci['title'] ?? 'Item'),
                'done'  => (bool)($ci['done'] ?? false),
              ];
            }
          }
          if ($rows) $task->update(['checklist' => \Kirby\Data\Yaml::encode($rows)]);
        }

        $created[] = $task->id();
      } catch (\Throwable $e) {
        // continue with the rest
      }
    }
    return $created;
  }
}

/* -------------------------------------------------------------------------- */
/* Shared route helpers (from /routes/_helpers.php)                            */
/* -------------------------------------------------------------------------- */
$helpersFile    = __DIR__ . '/routes/_helpers.php';
$existingRoutes = [];

$baseRoutes = [];
$assetsRoutesFile = __DIR__ . '/assets/routes.php';
if (is_file($assetsRoutesFile)) {
  $maybeBase = require $assetsRoutesFile;
  if (is_array($maybeBase)) $baseRoutes = $maybeBase; // normal case: file returns an array
}

if (is_file($helpersFile)) {
  $maybeRoutes = require $helpersFile; // ok if it returns null/true/1
  if (is_array($maybeRoutes)) $existingRoutes = $maybeRoutes;
}

/* ----------------------------------------------------------------------------
   Local helper closures (kept private to avoid global symbol collisions)
---------------------------------------------------------------------------- */

/** Resolve a client page by slug or id (expects template cf-client). */
$__client = function (string $ref): ?Page {
  $ref = trim($ref, '/');

  // 1) direct id
  if ($ref !== '') {
    $p = page($ref);
    if ($p && $p->intendedTemplate()->name() === 'cf-client') return $p;
  }

  // 2) under /clients/{slug}
  if ($ref !== '') {
    $p = page('clients/' . $ref);
    if ($p && $p->intendedTemplate()->name() === 'cf-client') return $p;
  }

  // 3) project helper
  if (function_exists('cff_find_client')) {
    $p = cff_find_client($ref);
    if ($p && $p->intendedTemplate()->name() === 'cf-client') return $p;
  }
  return null;
};

/** Access gate for a client page; returns Response on deny, null on allow. */
$__guard = function (?Page $client) {
  if (!$client) return cff_error('Client not found', 404);

  // Global portal gate (clients & teammates allowed; admins allowed if enabled)
  if (!PortalGate::canEnter(kirby()->user())) {
    return cff_error('Forbidden', 403);
  }

  // Keep your existing per-client checks (owner/participant rules) if present
  if (function_exists('cff_require_client_access')) {
    cff_require_client_access($client);
  } elseif (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
    return cff_error('Forbidden', 403);
  }

  return null;
};

/** Render a named frontend template (Tabler UI) via the safe wrapper snippet. */
$__render = function (Page $client, string $template, ?string $title = null) {
  return snippet('render-template', [
    'template' => $template,
    'data' => [
      'client' => $client,
      'title'  => $title ?? (string)$client->title(),
    ],
  ], true);
};

/** Identify a conversation thread page. */
$__isThread = function (Page $p): bool {
  $tpl = $p->intendedTemplate()->name();
  return in_array($tpl, ['cf-thread','cff-thread','cf-ticket','ticket'], true);
};

/** Find owning cf-client for any page in the tree. */
$__clientFrom = function (Page $p): ?Page {
  $cur = $p;
  while ($cur) {
    if ($cur->intendedTemplate()->name() === 'cf-client') return $cur;
    $cur = $cur->parent();
  }
  return null;
};

/**
 * Resolve a thread from a flexible ref (id path or slug) with client scoping.
 * Optional global lookup can be enabled via option:
 *   option('cfx.cffreelancer.allowGlobalThreadLookup', false)
 */
$__thread = function (string $ref) use ($__isThread, $__client): ?Page {
  $ref = urldecode(trim($ref, "/ \t\n\r\0\x0B"));
  if ($ref === '') return null;

  // 1) Try as full Kirby id
  $p = page($ref);
  if ($p && $__isThread($p)) return $p;

  // 2) If looks like clients/{client}/.../{threadSlug}, try to scope by client
  $parts = array_values(array_filter(explode('/', $ref)));
  $clientSlug = null;
  $threadSlug = null;

  if (!empty($parts)) {
    $i = array_search('clients', $parts, true);
    if ($i !== false && isset($parts[$i+1])) {
      $clientSlug = $parts[$i+1];
      $threadSlug = $parts[count($parts)-1]; // last segment
    } elseif (count($parts) === 1) {
      $threadSlug = $parts[0];
    }
  }

  if ($clientSlug && $threadSlug) {
    if ($client = $__client($clientSlug)) {
      $cand = $client->index()
        ->filter(fn(Page $pp) => $__isThread($pp))
        ->findBy('slug', $threadSlug);
      if ($cand) return $cand;
    }
  }

  // 3) Optional global fallback (off by default)
  if (option('cfx.cffreelancer.allowGlobalThreadLookup', false)) {
    $look = $threadSlug ?: $ref;
    $cands = site()->index()->filter(fn(Page $pp) =>
      $__isThread($pp) && $pp->slug() === $look
    );
    foreach ($cands as $cand) return $cand;
  }

  return null;
};

/** Serialize a thread */
$__threadJson = function (Page $t): array {
  $msgTpls = ['cf-message','message','cff-message'];
  $msgs    = $t->children()->filter(fn(Page $pp) => in_array($pp->intendedTemplate()->name(), $msgTpls, true));
  $last    = $msgs->sortBy('modified','desc')->first();
  return [
    'id'            => $t->id(),
    'slug'          => $t->slug(),
    'title'         => (string)$t->title(),
    'url'           => $t->url(),
    'messageCount'  => $msgs->count(),
    'lastMessageAt' => $last ? date('c', $last->modified()) : date('c', $t->modified()),
    'template'      => $t->intendedTemplate()->name(),
  ];
};

/** Serialize a message (no $GLOBALS) */
$__messageJson = function (Page $m): array {
  $read = function (Page $p, string $k): string {
    try {
      if ($p->content()->has($k)) {
        $f = $p->content()->get($k);
        return method_exists($f, 'value') ? (string)$f->value() : '';
      }
    } catch (\Throwable $e) {}
    return '';
  };

  $body   = $read($m, 'body') ?: $read($m, 'text') ?: $read($m, 'message');
  $author = $read($m, 'author');

  $files = [];
  foreach ($m->files() as $f) {
    $files[] = [
      'filename' => $f->filename(),
      'url'      => $f->url(),
      'type'     => $f->mime(),
      'size'     => $f->size(),
    ];
  }
  return [
    'id'       => $m->id(),
    'slug'     => $m->slug(),
    'title'    => (string)$m->title(),
    'body'     => $body,
    'author'   => $author,
    'created'  => date('c', $m->modified()),
   'files'    => $files,
    'template' => $m->intendedTemplate()->name(),
  ];
};

/* --- NEW: Request parsing + relaxed CSRF helpers -------------------------- */
$__readRequestData = function (): array {
  $req  = kirby()->request();
  $data = $req->data(); // JSON or x-www-form-urlencoded in Kirby 4/5
  if (empty($data)) {
    $raw = $req->body();
    if (is_string($raw) && $raw !== '') {
      $j = json_decode($raw, true);
      if (is_array($j)) return $j;
      parse_str($raw, $q);
      if (is_array($q)) return $q;
    }
  }
  return is_array($data) ? $data : [];
};

$__readCsrf = function (array $data = []): ?string {
  $headers = array_change_key_case((array)kirby()->request()->headers(), CASE_LOWER);
  return $data['csrf']
    ?? $headers['x-csrf']
    ?? $headers['x-csrf-token']
    ?? null;
};

$__verifyCsrf = function (?string $token): bool {
  if (kirby()->option('api.csrf', true) !== true) return true;
  try { return csrf($token); } catch (\Throwable $e) { return false; }
};

/* ----------------------------------------------------------------------------
   Core routes defined here (documents, portal views, APIs, webhook, etc.)
---------------------------------------------------------------------------- */
$routes = [];

/* Canonical client entry → dashboard */
$routes[] = [
  'pattern' => 'clientportal/clients/(:any)',
  'method'  => 'GET',
  'action'  => function (string $slug) use ($__client) {
    $client = $__client($slug);
    if (!$client) return Response::redirect(url('clients/' . $slug), 302);
    return Response::redirect(url('clientportal/clients/' . $client->slug() . '/dashboard'), 302);
  }
];

/* Public alias /clients/{slug} → canonical dashboard */
$routes[] = [
  'pattern' => 'clients/(:any)',
  'method'  => 'GET',
  'action'  => function (string $slug) {
    return Response::redirect(url('clientportal/clients/' . $slug . '/dashboard'), 302);
  }
];

/* Also allow /clients/{slug}/dashboard for compatibility */
$routes[] = [
  'pattern' => 'clients/(:any)/dashboard',
  'method'  => 'GET',
  'action'  => function (string $slug) {
    return Response::redirect(url('clientportal/clients/' . $slug . '/dashboard'), 302);
  }
];

/* Section routes that render your templates via the safe wrapper */
foreach ([
  ['dashboard', 'cff-dashboard', 'Dashboard'],
  ['planner',   'cff-planner',   'Planner'],
  ['projects',  'cff-projects',  'Projects'],
  ['billing',   'cff-billing',   'Billing'],
  ['messages',  'cff-messages',  'Messages'],
  ['settings',  'cff-settings',  'Settings'],
] as [$segment, $tpl, $title]) {
  $routes[] = [
    'pattern' => 'clientportal/clients/(:any)/' . $segment,
    'method'  => 'GET',
    'action'  => function (string $slug) use ($__client, $__guard, $__render, $tpl, $title) {
      $client = $__client($slug);
      if ($deny = $__guard($client)) return $deny;
      return $__render($client, $tpl, $title);
    }
  ];
}

/* Client-scoped Profile page (alias; retains your upload + username logic) */
$routes[] = [
  'pattern' => 'clientportal/clients/(:any)/profile',
  'method'  => 'GET|POST',
  'action'  => function (string $slug) use ($__client) {
    $kirby = kirby();
    $user  = function_exists('cff_current_user') ? cff_current_user() : $kirby->user();
    if (!$user) return Response::redirect(url('clientportal/login'));

    $client = $__client($slug); // used for header/nav context
    $error  = null;
    $notice = null;

    if ($kirby->request()->is('POST')) {
      cff_csrf_check();
      $updates = [];
      if (isset($_POST['name'])) $updates['name'] = (string)$_POST['name'];
      foreach (['company','phone','timezone'] as $k) {
        if (isset($_POST[$k])) $updates[$k] = (string)$_POST[$k];
      }
      if (array_key_exists('username', $_POST)) {
        $raw = (string)$_POST['username'];
        $uname = function_exists('cff_username_sanitize') ? cff_username_sanitize($raw) : $raw;
        if ($uname !== '') {
          if (strlen($uname) < 3)       $error = 'Username must be at least 3 characters.';
          elseif (!cff_username_is_unique($uname, $user)) $error = 'That username is already taken.';
          else $updates['username'] = $uname;
        } else {
          $updates['username'] = '';
        }
      }
      // Avatar upload
      if (isset($_FILES['avatarFile']) && is_array($_FILES['avatarFile'])
          && (int)($_FILES['avatarFile']['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_OK) {
        $valErr = cff_validate_upload(
          $_FILES['avatarFile'],
          ['png','jpg','jpeg','webp'],
          ['image/png','image/jpeg','image/webp'],
          8 * 1024 * 1024
        );
        if ($valErr) {
          $error = $error ?: $valErr;
        } else {
          try {
            $kirby->impersonate('kirby');
            $norm = function_exists('cff_image_normalize')
              ? cff_image_normalize((string)$_FILES['avatarFile']['tmp_name'], 'webp')
              : null;
            if (!$norm) { throw new \RuntimeException('Image normalization unavailable.'); }

            $file = $user->createFile([
              'source'   => $norm['path'],
              'template' => 'cff-avatar',
              'filename' => 'avatar.' . $norm['ext'],
            ]);

            $uploadedUrl = $file->url();
            if ($uploadedUrl !== '') {
              $emailKey = strtolower((string)$user->email() ?: '');
              if ($emailKey !== '') {
                $fileRef = method_exists($file, 'uuid') ? ('file://' . $file->uuid()) : $file->filename();
                cff_avatar_write($emailKey, $uploadedUrl, $fileRef);
              }
              $updates['avatar'] = $uploadedUrl;
            }
          } catch (\Throwable $e) {
            $error = $error ?: 'Could not save avatar file.';
          } finally {
            $kirby->impersonate(null);
          }
        }
      }

      if ($error === null) {
        try {
          $kirby->impersonate('kirby');
          $user->update($updates);
          $notice = 'Profile saved.';
        } catch (\Throwable $e) {
          $error = 'Could not save profile: ' . $e->getMessage();
        } finally {
          $kirby->impersonate(null);
        }
      }
    }

    $csrfToken = csrf();
    return snippet('cff-profile-page', [
      'client'    => $client,
      'title'     => 'My Profile',
      'error'     => $error,
      'notice'    => $notice,
      'user'      => $user,
      'csrfToken' => $csrfToken,
      'csrf'      => $csrfToken,
    ], true);
  }
];

/* Global Profile → redirect to client-scoped alias */
$routes[] = [
  'pattern' => 'clientportal/profile',
  'method'  => 'GET|POST',
  'action'  => function () {
    $auth  = function_exists('cff_portal_user') ? cff_portal_user() : null;
    $email = is_array($auth) ? strtolower((string)($auth['email'] ?? '')) : '';
    $client = null;

    if ($email && function_exists('cff_preferred_client_for_email')) {
      $client = cff_preferred_client_for_email($email);
    }
    if (!$client) {
      try {
        $all = site()->index()->filter(fn(Page $c) => $c->intendedTemplate()->name() === 'cf-client');
        foreach ($all as $c) {
          if (function_exists('cff_user_can_access_client') ? cff_user_can_access_client($c) : true) {
            $client = $c; break;
          }
        }
      } catch (\Throwable $e) {}
    }
    $slug = $client ? $client->slug() : '';
    return Response::redirect(url('clientportal/clients/' . $slug . '/profile'));
  }
];

/* Approve a quote -> create invoice (+ optional Stripe Payment Link) */
$routes[] = [
  'pattern' => 'clientportal/(:all)/quotes/(:any)/approve',
  'method'  => 'POST',
  'action'  => function (string $clientId, string $quoteSlug) {
    try {
      $actor = function_exists('cff_portal_actor_email')
        ? (cff_portal_actor_email() ?? (kirby()->user()?->email() ?? ($_SERVER['REMOTE_ADDR'] ?? 'anon')))
        : (kirby()->user()?->email() ?? ($_SERVER['REMOTE_ADDR'] ?? 'anon'));

      if (!cff_rate_limit('approve:' . strtolower((string)$actor), 10, 60)) {
        return cff_error('Too many requests, please try again shortly.', 429);
      }

      cff_csrf_check();

      $client = (function_exists('cff_find_client') ? cff_find_client($clientId) : null) ?? page($clientId);
      if (!$client) return cff_error('Client not found', 404);
      if (function_exists('cff_require_client_access')) cff_require_client_access($client);

      if (!cff_is_admin()) {
        $actorEmail = function_exists('cff_portal_actor_email') ? cff_portal_actor_email() : null;
        if (!$actorEmail || !cff_portal_can_manage($client, $actorEmail)) {
          return cff_error('Forbidden', 403);
        }
      }

      $quote = $client->index()
        ->filter(fn(Page $p) => in_array($p->intendedTemplate()->name(), ['cf-quote','quote','cff-quote'], true))
        ->findBy('slug',$quoteSlug);

      if (!$quote) return cff_error('Quote not found', 404);

      try { $quote->update(['status' => 'approved', 'approvedAt' => date('c')]); } catch (\Throwable $e) {}

      $invoices = $client->children()->filter(fn(Page $p) => in_array($p->intendedTemplate()->name(), ['cf-invoice','invoice','cff-invoice'], true));
      $number = str_pad((string)($invoices->count() + 1), 4, '0', STR_PAD_LEFT);
      $invoiceSlug = 'inv-' . date('Ymd') . '-' . $number;

      $currency    = (string)($quote->currency()->value() ?? 'EUR');
      $vatMode     = (string)($quote->vatMode()->value() ?? 'standard');
      $lineitems   = (string)($quote->lineitems()->value() ?? '');
      $amountCents = 0;
      try {
        if (method_exists($quote,'amountCents')) {
          $amountCents = (int)($quote->amountCents()->value() ?? 0);
        }
      } catch (\Throwable $e) {}

      $invoice = cff_create_listed($client, $invoiceSlug, 'cf-invoice', [
        'title'        => 'Invoice ' . $number,
        'status'       => 'unpaid',
        'currency'     => $currency,
        'amountCents'  => $amountCents,
        'lineitems'    => $lineitems,
        'quoteRef'     => $quote->id(),
        'issueDate'    => date('Y-m-d'),
        'dueDate'      => date('Y-m-d', strtotime('+14 days')),
        'vatMode'      => $vatMode,
      ]);

      $stripeUrl = null;
      try {
        if (class_exists(\Stripe\Stripe::class) && $amountCents > 0) {
          \Stripe\Stripe::setApiKey(cff_env('STRIPE_SECRET', '') ?: cff_get_stripe_secret());
          $pl = \Stripe\PaymentLink::create([
            'line_items' => [[
              'price_data' => [
                'currency'     => strtolower($currency),
                'product_data' => ['name' => (string)$invoice->title()],
                'unit_amount'  => $amountCents,
              ],
              'quantity' => 1,
            ]],
            'payment_intent_data' => ['metadata' => ['invoice_id' => $invoice->id()]],
            'metadata'            => ['invoice_id' => $invoice->id()],
          ]);
          $stripeUrl = $pl->url ?? null;
          if ($stripeUrl) $invoice->update(['stripeLink' => $stripeUrl]);
        }
      } catch (\Throwable $e) {
        cff_log('stripe create error', ['e'=>$e->getMessage()]);
      }

      return cff_json([
        'ok' => true,
        'invoice' => [
          'id'         => $invoice->id(),
          'url'        => $invoice->url(),
          'stripeLink' => $stripeUrl,
        ]
      ]);
    } catch (\Throwable $e) {
      cff_log('approve route error', ['e'=>$e->getMessage()]);
      return cff_error('Server error', 500);
    }
  }
];

/* -------------------------------------------------------------------------- */
/* Project Template Packs API + Apply                                         */
/* -------------------------------------------------------------------------- */

// Simple list for Panel select field (expects array of {id,label})
$routes[] = [
  'pattern' => 'clientportal/api/template-packs',
  'method'  => 'GET',
  'action'  => function () {
    $packs = function_exists('cff_load_project_packs') ? cff_load_project_packs() : [];
    // Return a flat array for Kirby select options: api + text/value mapping
    $items = array_map(fn($p) => ['id' => $p['id'], 'label' => $p['label']], $packs);
    return Response::json($items);
  }
];

// Alias (flat array) for legacy code
$routes[] = [
  'pattern' => 'cff/api/project-templates',
  'method'  => 'GET',
  'action'  => function () {
    $packs = function_exists('cff_load_project_packs') ? cff_load_project_packs() : [];
    $items = array_map(fn($p) => ['id' => $p['id'], 'label' => $p['label']], $packs);
    return Response::json($items);
  }
];

// Apply selected pack to a project
$routes[] = [
  'pattern' => 'cff/api/projects/(:all)/apply-template',
  'method'  => 'POST',
  'action'  => function (string $projectId) {
    if (function_exists('cff_csrf_check')) cff_csrf_check();

    $project = page($projectId);
    if (!$project || !in_array($project->intendedTemplate()->name(), ['cf-project','project','cff-project'], true)) {
      return cff_error('Project not found', 404);
    }

    // Find owning client and enforce access
    $client = $project;
    while ($client && $client->intendedTemplate()->name() !== 'cf-client') {
      $client = $client->parent();
    }
    if (!$client) return cff_error('Client scope required', 400);
    if (function_exists('cff_require_client_access')) cff_require_client_access($client);

    $packId = trim((string)(post('pack') ?? post('packId') ?? ''));
    if ($packId === '') return cff_error('Missing pack id', 422);

    $packs = function_exists('cff_load_project_packs') ? cff_load_project_packs() : [];
    $pack  = null;
    foreach ($packs as $p) { if ($p['id'] === $packId) { $pack = $p['data']; break; } }
    if (!$pack) return cff_error('Pack not found', 404);

    if (!function_exists('cff_apply_pack_to_project')) {
      return cff_error('Apply helper not available', 500);
    }

    $created = cff_apply_pack_to_project($project, $pack);
    return cff_json(['ok' => true, 'created' => $created]);
  }
];

/* -------------------------------------------------------------------------- */
/* Threads API                                                                 */
/* -------------------------------------------------------------------------- */

// List threads for a client
$routes[] = [
  'pattern' => 'cff/api/threads/(:all)',
  'method'  => 'GET',
  'action'  => function (string $clientRef) use ($__client, $__threadJson) {
    $client = $__client($clientRef);
    if (!$client) return cff_json(['ok'=>false,'error'=>'client_not_found'], 404);
    if (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
      return cff_json(['ok'=>false,'error'=>'forbidden'], 403);
    }

    $threads = $client->index()->filter(fn(Page $t) =>
      in_array($t->intendedTemplate()->name(), ['cf-thread','cff-thread','cf-ticket','ticket'], true)
    );

    $q = trim((string)get('q',''));
    if ($q !== '') {
      $threads = $threads->filter(fn(Page $t) => stripos((string)$t->title(), $q) !== false);
    }

    $out = array_values(array_map(
      fn($p) => $__threadJson($p),
      $threads->toArray(fn($p)=>$p)
    ));

    return cff_json(['ok'=>true, 'threads'=>$out]);
  }
];

/* -- NEW: create thread using POST /cff/api/threads/{clientSlug} ------------ */
$routes[] = [
  'pattern' => 'cff/api/threads/(:slug)',
  'method'  => 'POST',
  'action'  => function (string $clientSlug) use ($__client, $__readRequestData, $__readCsrf, $__verifyCsrf) {
    $client = $__client($clientSlug);
    if (!$client) return cff_json(['ok'=>false,'error'=>'client_not_found'], 404);

    // Access guard
    if (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
      return cff_json(['ok'=>false,'error'=>'forbidden'], 403);
    }

    // Read + validate CSRF (accept body or X-CSRF / X-CSRF-Token header)
    $data = $__readRequestData();
    $csrf = $__readCsrf($data);
    if (!$__verifyCsrf($csrf)) {
      return cff_json(['ok'=>false,'error'=>'csrf_invalid'], 403);
    }

    $title    = trim((string)($data['title'] ?? ''));
    $body     = trim((string)($data['body'] ?? ($data['message'] ?? '')));
    $category = trim((string)($data['category'] ?? 'general'));
    $type     = trim((string)($data['type'] ?? 'thread'));

    if ($title === '') {
      return cff_json(['ok'=>false,'error'=>'missing_title'], 422);
    }

    $slug = 'thread-' . date('Ymd-His') . '-' . substr(sha1($title . microtime(true) . random_bytes(4)), 0, 6);

    try {
      $thread = $client->createChild([
        'slug'     => $slug,
        'template' => 'cf-thread',
        'content'  => [
          'title'    => $title,
          'body'     => $body,
          'category' => $category,
          'type'     => $type,
          'pinned'   => 'false',
        ],
      ])->changeStatus('listed');

      return cff_json(['ok'=>true, 'thread'=>[
        'id'   => $thread->id(),
        'slug' => $thread->slug(),
        'url'  => $thread->url(),
        'title'=> (string)$thread->title(),
      ]], 201);
    } catch (\Throwable $e) {
      return cff_json(['ok'=>false,'error'=>'create_failed'], 500);
    }
  }
];

/* -- Keep legacy creator if used anywhere (POST /cff/api/thread/create) ----- */
$routes[] = [
  'pattern' => 'cff/api/thread/create',
  'method'  => 'POST',
  'action'  => function () use ($__client) {
    if (function_exists('cff_csrf_check')) cff_csrf_check();

    $clientRef = (string)(post('client') ?? '');
    $title     = trim((string)(post('title') ?? ''));
    if ($clientRef === '' || $title === '') return cff_error('client and title required', 422);

    $client = $__client($clientRef);
    if (!$client) return cff_error('Client not found', 404);
    if (function_exists('cff_require_client_access')) cff_require_client_access($client);

    $slug = 'thread-' . date('Ymd-His') . '-' . substr(sha1($title . microtime(true) . random_bytes(4)), 0, 6);

    try {
      $thread = $client->createChild([
        'slug'     => $slug,
        'template' => 'cf-thread',
        'content'  => ['title' => $title],
      ])->changeStatus('listed');

      return cff_json(['ok'=>true, 'thread'=>[
        'id'   => $thread->id(),
        'slug' => $thread->slug(),
        'url'  => $thread->url(),
        'title'=> (string)$thread->title(),
      ]], 201);
    } catch (\Throwable $e) {
      return cff_error('Could not create thread', 500);
    }
  }
];

/* -- NEW: pin/unpin a thread (POST|PATCH /cff/api/threads/{client}/{slug}/pin) */
$routes[] = [
  'pattern' => 'cff/api/threads/(:slug)/(:any)/pin',
  'method'  => 'POST|PATCH',
  'action'  => function (string $clientSlug, string $threadSlug) use ($__client, $__isThread, $__readRequestData, $__readCsrf, $__verifyCsrf) {
    $client = $__client($clientSlug);
    if (!$client) return cff_json(['ok'=>false,'error'=>'client_not_found'], 404);
    if (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
      return cff_json(['ok'=>false,'error'=>'forbidden'], 403);
    }

    $data = $__readRequestData();
    $csrf = $__readCsrf($data);
    if (!$__verifyCsrf($csrf)) {
      return cff_json(['ok'=>false,'error'=>'csrf_invalid'], 403);
    }

    // Resilient lookup: direct child, threads container, or any descendant
    $thread = ($client->children()->find($threadSlug)
            ?: $client->find('threads/' . $threadSlug)
            ?: $client->index()->filter(fn(Page $p)=>$__isThread($p))->findBy('slug',$threadSlug));

    if (!$thread) return cff_json(['ok'=>false,'error'=>'thread_not_found'], 404);

    $pinned = filter_var($data['pinned'] ?? true, FILTER_VALIDATE_BOOL);
    try {
      $thread->update(['pinned' => $pinned ? 'true' : 'false']);
      return cff_json(['ok'=>true,'pinned'=>$pinned]);
    } catch (\Throwable $e) {
      return cff_json(['ok'=>false,'error'=>'update_failed'], 500);
    }
  }
];

/* -- NEW: participants list (GET /cff/api/threads/{client}/{slug}/participants) */
$routes[] = [
  'pattern' => 'cff/api/threads/(:slug)/(:any)/participants',
  'method'  => 'GET',
  'action'  => function (string $clientSlug, string $threadSlug) use ($__client, $__isThread) {
    $kirby  = kirby();
    $client = $__client($clientSlug);
    if (!$client) return cff_json(['ok'=>false,'error'=>'client_not_found'], 404);
    if (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
      return cff_json(['ok'=>false,'error'=>'forbidden'], 403);
    }

    $thread = ($client->children()->find($threadSlug)
            ?: $client->find('threads/' . $threadSlug)
            ?: $client->index()->filter(fn(Page $p)=>$__isThread($p))->findBy('slug',$threadSlug));
    if (!$thread) return cff_json(['ok'=>false,'error'=>'thread_not_found'], 404);

    $ids = [];

    // Prefer users field "participants"
    try {
      if ($thread->content()->has('participants') && $thread->participants()->isNotEmpty()) {
        foreach ($thread->participants()->toUsers() as $u) $ids[] = $u->id();
      }
    } catch (\Throwable $e) {
      // legacy structure fallback: try emails
      try {
        foreach ($thread->participants()->toStructure() as $row) {
          if ($row->email()->isNotEmpty()) {
            $email = strtolower($row->email()->value());
            $u = $kirby->users()->findBy('email', $email);
            if ($u) $ids[] = $u->id();
          }
        }
      } catch (\Throwable $e2) {}
    }

    // Include message authors (author field may be id or email)
    $msgTpls = ['cf-message','message','cff-message'];
    foreach ($thread->children()->filter(fn(Page $p) => in_array($p->intendedTemplate()->name(), $msgTpls, true)) as $m) {
      try {
        if ($m->content()->has('author') && $m->author()->isNotEmpty()) {
          $val = (string)$m->author()->value();
          if ($val !== '') {
            // id direct
            if ($kirby->user($val)) { $ids[] = $val; continue; }
            // email → user
            $u = $kirby->users()->findBy('email', strtolower($val));
            if ($u) $ids[] = $u->id();
          }
        }
      } catch (\Throwable $e) {}
    }

    // Optionally include client owner (users field)
    try {
      if ($client->content()->has('owner') && $client->owner()->isNotEmpty()) {
        if ($u = $client->owner()->toUser()) $ids[] = $u->id();
      }
    } catch (\Throwable $e) {}

    // Clean, resolve, sort
    $ids = array_values(array_unique(array_filter(array_map('strval', $ids))));
    $items = [];
    foreach ($ids as $id) {
      if ($u = $kirby->user($id)) {
        $items[] = [
          'id'    => $u->id(),
          'name'  => (string)$u->name(),
          'email' => $u->email(),
          'role'  => $u->role()->name(),
        ];
      }
    }
    usort($items, fn($a,$b)=> strnatcasecmp($a['name'], $b['name']));

    return cff_json(['ok'=>true,'count'=>count($items),'items'=>$items]);
  }
];

/* -------------------- Planner API (projects → tasks) ----------------------- */

$plannerApi = function (string $slug, string $rest = '') {
  $json = function (array $data, int $status = 200) {
    return cff_json($data, $status);
  };

  $resolveClient = function (string $slug): ?\Kirby\Cms\Page {
    $p = page('clients/' . $slug);
    if ($p && in_array($p->intendedTemplate()->name(), ['cf-client','client','cff-client'], true)) return $p;
    $p = site()->index()->findBy('slug', $slug);
    if ($p && in_array($p->intendedTemplate()->name(), ['cf-client','client','cff-client'], true)) return $p;
    return null;
  };

  $field = function($p, string $key, $fallback = '') {
    try {
      if (!$p) return $fallback;
      if (method_exists($p, $key) && method_exists($p->$key(), 'isNotEmpty') && $p->$key()->isNotEmpty()) {
        try { return (string)$p->$key()->value(); } catch (\Throwable $e) { return (string)$p->$key(); }
      }
      if ($p->content()->has($key)) return (string)($p->content()->get($key)->value() ?? $fallback);
    } catch (\Throwable $e) {}
    return $fallback;
  };

  $parseChecklist = function($p): array {
    try {
      if ($p->content()->has('checklist')) {
        $f = $p->content()->get('checklist');
        if (method_exists($f, 'toStructure')) {
          $out = [];
          foreach ($f->toStructure() as $i => $it) {
            $out[] = [
              'id'    => (string)($it->id()->or((string)$i)->value()),
              'title' => (string)$it->title()->or('')->value(),
              'done'  => (bool)($it->done()->toBool()),
            ];
          }
          return $out;
        }
        $arr = \Kirby\Data\Yaml::decode((string)$f->value() ?? '') ?: [];
        $out = [];
        foreach ($arr as $i => $it) {
          if (is_string($it))       $out[] = ['id'=>(string)$i, 'title'=>$it, 'done'=>false];
          elseif (is_array($it))    $out[] = ['id'=>(string)($it['id']??$i), 'title'=>(string)($it['title']??'Item'), 'done'=>(bool)($it['done']??false)];
        }
        return $out;
      }
    } catch (\Throwable $e) {}
    return [];
  };

  $saveChecklist = function(\Kirby\Cms\Page $p, array $rows): void {
    $clean = array_map(function($r){
      return ['id'=>(string)($r['id'] ?? uniqid('i')), 'title'=>(string)($r['title'] ?? 'Item'), 'done'=>(bool)($r['done'] ?? false)];
    }, $rows);
    $p->update(['checklist' => \Kirby\Data\Yaml::encode($clean)]);
  };

  $notesGet = function($p): array {
    try {
      if ($p->content()->has('notes')) {
        $raw = (string)$p->content()->get('notes')->value();
        $arr = \Kirby\Data\Yaml::decode($raw) ?: [];
        return array_map(fn($n)=>[
          'text'=>(string)($n['text']??''),
          'by'  =>(string)($n['by']??''),
          'ts'  =>(string)($n['ts']??''),
        ], $arr);
      }
    } catch (\Throwable $e) {}
    return [];
  };

  $notesAppend = function(\Kirby\Cms\Page $p, array $note): void {
    $read = function($pp) {
      try { return \Kirby\Data\Yaml::decode((string)$pp->content()->get('notes')->value() ?? '') ?: []; }
      catch (\Throwable $e) { return []; }
    };
    $list = $read($p);
    $list[] = [
      'text' => (string)($note['text'] ?? ''),
      'by'   => (string)($note['by']  ?? ''),
      'ts'   => (string)($note['ts']  ?? date('c')),
    ];
    $p->update(['notes' => \Kirby\Data\Yaml::encode($list)]);
  };

  $assigneesGet = function($p): array {
    try {
      if ($p->content()->has('assignees')) {
        $raw = (string)$p->content()->get('assignees')->value();
        $arr = \Kirby\Data\Yaml::decode($raw) ?: [];
        return array_values(array_filter(array_map('strval', $arr)));
      }
    } catch (\Throwable $e) {}
    return [];
  };

  $assigneesSave = function(\Kirby\Cms\Page $p, array $emails): void {
    $clean = array_values(array_unique(array_filter(array_map('strval', $emails))));
    $p->update(['assignees' => \Kirby\Data\Yaml::encode($clean)]);
  };

  $statusOf = function($p): string {
    $s = strtolower(trim((string)$p->content()->get('statusValue')->or($p->content()->get('status'))->value() ?? ''));
    return $s ?: 'todo';
  };

  // --- MESSAGES BRIDGE (thread per task) -----------------------------------
  $findTaskThread = function(\Kirby\Cms\Page $client, \Kirby\Cms\Page $task): ?\Kirby\Cms\Page {
    $slug = 'task-' . $task->slug();
    foreach ($client->children() as $child) {
      if (in_array($child->intendedTemplate()->name(), ['cf-thread','cff-thread','cf-ticket','ticket'], true)
          && $child->slug() === $slug) return $child;
    }
    $cand = $client->index()
      ->filter(fn(Page $p) => in_array($p->intendedTemplate()->name(), ['cf-thread','cff-thread','cf-ticket','ticket'], true))
      ->findBy('slug',$slug);
    return $cand ?: null;
  };

  $ensureTaskThread = function(\Kirby\Cms\Page $client, \Kirby\Cms\Page $task) use ($findTaskThread): \Kirby\Cms\Page {
    $existing = $findTaskThread($client, $task);
    if ($existing) return $existing;

    $parent = $client; // could be a dedicated /threads container
    $slug   = 'task-' . $task->slug();
    $title  = 'Task: ' . (string)$task->title();
    try {
      $t = $parent->createChild([
        'slug'     => $slug,
        'template' => 'cf-thread',
        'content'  => ['title' => $title],
      ])->changeStatus('listed');
      return $t;
    } catch (\Throwable $e) {
      return $findTaskThread($client, $task) ?? $parent;
    }
  };

  $threadMessages = function(\Kirby\Cms\Page $thread): array {
    $tpls = ['cf-message','message','cff-message'];
    $msgs = $thread->children()->filter(fn(Page $p) => in_array($p->intendedTemplate()->name(), $tpls, true))->sortBy('modified','asc');
    $out = [];
    foreach ($msgs as $m) {
      $body = '';
      try {
        $body = (string)(
          $m->content()->get('body')->value()
          ?? $m->content()->get('text')->value()
          ?? $m->content()->get('message')->value()
          ?? ''
        );
      } catch (\Throwable $e) {}
      $by = '';
      try { $by = (string)($m->content()->get('author')->value() ?? ''); } catch (\Throwable $e) {}
      $out[] = ['text'=>$body, 'by'=>$by, 'ts'=>date('c', $m->modified())];
    }
    return $out;
  };

  $appendThreadMessage = function(\Kirby\Cms\Page $thread, string $text, string $author = '') {
    $slug = 'msg-' . date('Ymd-His') . '-' . substr(sha1(random_bytes(8)), 0, 6);
    try {
      return $thread->createChild([
        'slug'     => $slug,
        'template' => 'cf-message',
        'content'  => [
          'title'  => 'Message ' . date('Y-m-d H:i'),
          'author' => $author,
          'body'   => $text,
        ],
      ])->changeStatus('listed');
    } catch (\Throwable $e) { return null; }
  };

  $serializeTask = function(\Kirby\Cms\Page $t, \Kirby\Cms\Page $client) use ($field, $parseChecklist, $notesGet, $statusOf, $assigneesGet, $findTaskThread, $threadMessages) {
    $par = $t->parent();
    $checklist = $parseChecklist($t);
    $done = array_reduce($checklist, fn($a,$b)=>$a + (!empty($b['done'])?1:0), 0);
    $progress = $checklist ? (int)round($done * 100 / count($checklist)) : 0;

    $thread = $findTaskThread($client, $t);
    $notes  = $notesGet($t);
    if ($thread) {
      $msgs = $threadMessages($thread);
      $notes = array_values(array_merge($notes, $msgs));
    }

    return [
      'id'        => $t->id(),
      'slug'      => $t->slug(),
      'title'     => (string)$t->title(),
      'status'    => $statusOf($t),
      'start'     => $field($t, 'startDate') ?: $field($t, 'date'),
      'due'       => $field($t, 'due') ?: $field($t, 'dueDate') ?: $field($t, 'endDate'),
      'category'  => $field($t, 'category'),
      'summary'   => $field($t, 'summary') ?: $field($t, 'description'),
      'project'   => $par ? (string)$par->title() : 'General',
      'projectId' => $par ? $par->id() : '',
      'url'       => $t->url(),
      'updated'   => date('c', $t->modified()),
      'checklist' => $checklist,
      'notes'     => $notes,
      'progress'  => $progress,
      'assignees' => $assigneesGet($t),
      'threadUrl' => $thread ? $thread->url() : '',
    ];
  };

  $resolveProject = function(\Kirby\Cms\Page $client, string $ref): ?\Kirby\Cms\Page {
    if ($ref === '') return null;
    $p = page($ref);
    if ($p && in_array($p->intendedTemplate()->name(), ['cf-project','project','cff-project'], true)) return $p;
    foreach ($client->index()->filter(fn(Page $pp) => in_array($pp->intendedTemplate()->name(), ['cf-project','project','cff-project'], true)) as $proj) {
      if ($proj->slug() === $ref) return $proj;
    }
    return null;
  };

  $csrfCheck = function() {
    $token = $_POST['csrf'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
    try { return $token && hash_equals((string)csrf(), (string)$token); }
    catch (\Throwable $e) { return false; }
  };

  // -------------------------------------------------------------------------
  $client = $resolveClient($slug);
  if (!$client) return $json(['ok'=>false,'msg'=>'Client not found'], 404);

  $path   = trim((string)$rest, '/');
  $method = strtoupper(kirby()->request()->method() ?? 'GET');

  // FEED
  if ($method === 'GET' && ($path === '' || $path === 'api')) {
    $projectTpls = ['cf-project','project','cff-project'];
    $taskTpls    = ['cf-task','task','cff-task'];

    $projects = $client->index()->filter(fn(Page $p) =>
      in_array($p->intendedTemplate()->name(), $projectTpls, true)
    );

    $tasks = $client->index()->filter(function(Page $p) use ($taskTpls, $projectTpls) {
      if (!in_array($p->intendedTemplate()->name(), $taskTpls, true)) return false;
      $par = $p->parent();
      return $par && in_array($par->intendedTemplate()->name(), $projectTpls, true);
    })->sortBy('dueDate', 'asc', 'startDate', 'asc', 'title', 'asc');

    return $json([
      'ok'       => true,
      'now'      => date('c'),
      'projects' => array_values(array_map(fn($p)=>['id'=>$p->id(),'slug'=>$p->slug(),'title'=>(string)$p->title()], $projects->toArray(fn($p)=>$p))),
      'tasks'    => array_values(array_map(fn($p)=> $serializeTask($p, $client), $tasks->toArray(fn($p)=>$p))),
      'calls'    => [],
      'activity' => [],
    ]);
  }

  // CSRF
  if ($method === 'GET' && ($path === 'csrf' || $path === 'api/csrf')) {
    return $json(['ok'=>true, 'token'=>csrf()]);
  }

  // Mutations
  if ($method !== 'POST') return $json(['ok'=>false,'msg'=>'Method not allowed'], 405);
  if (!$csrfCheck())     return $json(['ok'=>false,'msg'=>'CSRF token invalid'], 403);

  // CREATE
  if ($path === 'api/task/create') {
    $title      = trim((string)($_POST['title'] ?? ''));
    $due        = (string)($_POST['due'] ?? '');
    $category   = (string)($_POST['category'] ?? '');
    $projectRef = (string)($_POST['project'] ?? '');
    $summary    = (string)($_POST['summary'] ?? '');
    $checkline  = (string)($_POST['checklist'] ?? '');
    $assigneesS = (string)($_POST['assignees'] ?? '');
    $status     = 'todo';

    if ($title === '') return $json(['ok'=>false,'msg'=>'Title is required'], 400);
    $project = $resolveProject($client, $projectRef);
    if (!$project) return $json(['ok'=>false,'msg'=>'Project is required'], 400);

    $slugTask = 'task-' . date('Ymd-His') . '-' . substr(sha1(random_bytes(6)), 0, 6);
    $data = [
      'title'     => $title,
      'status'    => $status,
      'dueDate'   => $due,
      'category'  => $category,
      'summary'   => $summary,
    ];

    try {
      $task = $project->createChild([
        'slug'     => $slugTask,
        'template' => 'cf-task',
        'content'  => $data,
      ])->changeStatus('listed');

      // checklist
      $items = array_values(array_filter(array_map('trim', preg_split('/,/', $checkline) ?: [])));
      if ($items) {
        $rows = array_map(fn($t)=>['id'=>uniqid('i'),'title'=>$t,'done'=>false], $items);
        $task->update(['checklist' => \Kirby\Data\Yaml::encode($rows)]);
      }
      // assignees
      $ass = array_values(array_filter(array_map('trim', preg_split('/,/', $assigneesS) ?: [])));
      if ($ass) $assigneesSave($task, $ass);

      return $json(['ok'=>true, 'item'=>$serializeTask($task, $client)], 201);
    } catch (\Throwable $e) {
      return $json(['ok'=>false,'msg'=>'Create failed'], 500);
    }
  }

  // MOVE (status)
  if ($path === 'api/task/move') {
    $taskId = (string)($_POST['taskId'] ?? '');
    $status = (string)($_POST['status'] ?? '');
    if ($taskId === '' || $status === '') return $json(['ok'=>false,'msg'=>'Missing data'], 400);
    $t = page($taskId);
    if (!$t) return $json(['ok'=>false,'msg'=>'Task not found'], 404);

    try {
      if ($t->content()->has('statusValue')) $t->update(['statusValue'=>$status]);
      else                                   $t->update(['status'=>$status]);
      return $json(['ok'=>true]);
    } catch (\Throwable $e) {
      return $json(['ok'=>false,'msg'=>'Update failed'], 500);
    }
  }

  // NOTE (also mirror to messages thread)
  if ($path === 'api/task/note') {
    $taskId = (string)($_POST['taskId'] ?? '');
    $note   = trim((string)($_POST['note'] ?? ''));
    if ($taskId === '' || $note === '') return $json(['ok'=>false,'msg'=>'Missing data'], 400);
    $t = page($taskId);
    if (!$t) return $json(['ok'=>false,'msg'=>'Task not found'], 404);

    try {
      $by = (kirby()->user()?->email() ?: 'client');
      // 1) Task notes YAML
      $notesAppend($t, ['text'=>$note, 'by'=>$by, 'ts'=>date('c')]);
      // 2) Thread message mirror (create thread if needed)
      $thread = $ensureTaskThread($client, $t);
      if ($thread) $appendThreadMessage($thread, $note, $by);
      return $json(['ok'=>true]);
    } catch (\Throwable $e) {
      return $json(['ok'=>false,'msg'=>'Could not add note'], 500);
    }
  }

  // SUBTASK ADD
  if ($path === 'api/task/subtask/add') {
    $taskId = (string)($_POST['taskId'] ?? '');
    $title  = trim((string)($_POST['title']  ?? ''));
    if ($taskId === '' || $title === '') return $json(['ok'=>false,'msg'=>'Missing data'], 400);
    $t = page($taskId);
    if (!$t) return $json(['ok'=>false,'msg'=>'Task not found'], 404);

    try {
      $rows = $parseChecklist($t);
      $id   = uniqid('i');
      $rows[] = ['id'=>$id, 'title'=>$title, 'done'=>false];
      $saveChecklist($t, $rows);
      return $json(['ok'=>true, 'subtaskId'=>$id]);
    } catch (\Throwable $e) {
      return $json(['ok'=>false,'msg'=>'Could not add subtask'], 500);
    }
  }

  // SUBTASK TOGGLE
  if ($path === 'api/task/subtask/toggle') {
    $taskId = (string)($_POST['taskId'] ?? '');
    $subId  = (string)($_POST['subtaskId'] ?? '');
    $done   = ((string)($_POST['done'] ?? '0')) === '1';
    if ($taskId === '' || $subId === '') return $json(['ok'=>false,'msg'=>'Missing data'], 400);
    $t = page($taskId);
    if (!$t) return $json(['ok'=>false,'msg'=>'Task not found'], 404);

    try {
      $rows = $parseChecklist($t);
      if (ctype_digit($subId) && isset($rows[(int)$subId])) {
        $rows[(int)$subId]['done'] = $done;
      } else {
        foreach ($rows as &$r) if ((string)($r['id'] ?? '') === $subId) { $r['done'] = $done; break; }
      }
      $saveChecklist($t, $rows);
      return $json(['ok'=>true]);
    } catch (\Throwable $e) {
      return $json(['ok'=>false,'msg'=>'Could not update subtask'], 500);
    }
  }

  // TEAMMATE ADD
  if ($path === 'api/task/teammate/add') {
    $taskId = (string)($_POST['taskId'] ?? '');
    $email  = strtolower(trim((string)($_POST['email'] ?? '')));
    if ($taskId === '' || $email === '') return $json(['ok'=>false,'msg'=>'Missing data'], 400);
    $t = page($taskId);
    if (!$t) return $json(['ok'=>false,'msg'=>'Task not found'], 404);

    try {
      $list = $assigneesGet($t);
      $list[] = $email;
      $assigneesSave($t, $list);
      return $json(['ok'=>true]);
    } catch (\Throwable $e) {
      return $json(['ok'=>false,'msg'=>'Could not add teammate'], 500);
    }
  }

  // TEAMMATE REMOVE
  if ($path === 'api/task/teammate/remove') {
    $taskId = (string)($_POST['taskId'] ?? '');
    $email  = strtolower(trim((string)($_POST['email'] ?? '')));
    if ($taskId === '' || $email === '') return $json(['ok'=>false,'msg'=>'Missing data'], 400);
    $t = page($taskId);
    if (!$t) return $json(['ok'=>false,'msg'=>'Task not found'], 404);

    try {
      $list = array_filter($assigneesGet($t), fn($e)=> strtolower((string)$e) !== $email);
      $assigneesSave($t, $list);
      return $json(['ok'=>true]);
    } catch (\Throwable $e) {
      return $json(['ok'=>false,'msg'=>'Could not remove teammate'], 500);
    }
  }

  return $json(['ok'=>false,'msg'=>'Not found'], 404);
};

// Exact planner route (no tail)
$routes[] = [
  'pattern' => 'clientportal/clients/(:any)/planner/api',
  'method'  => 'GET|POST',
  'action'  => function (string $slug) use ($plannerApi) {
    return $plannerApi($slug, '');
  }
];

// Tail planner route (/…)
$routes[] = [
  'pattern' => 'clientportal/clients/(:any)/planner/api/(:all)',
  'method'  => 'GET|POST',
  'action'  => function (string $slug, string $rest) use ($plannerApi) {
    return $plannerApi($slug, $rest);
  }
];

/* ----- Conversations API (messages list + create in path form) ------------- */

// GET /cff/api/messages (query style) and POST create
$routes[] = [
  'pattern' => 'cff/api/messages',
  'method'  => 'GET|POST',
  'action'  => function () use ($__clientFrom, $__messageJson, $__thread) {
    $req    = kirby()->request();
    $method = strtoupper($req->method() ?? 'GET');

    // Message creator (with attachments)
    $createMessage = function (Page $thread, string $body) use ($__messageJson) {
      $actor = function_exists('cff_portal_actor_email')
        ? (cff_portal_actor_email() ?? (kirby()->user()?->email() ?? ''))
        : (kirby()->user()?->email() ?? '');
      $slug  = 'msg-' . date('Ymd-His') . '-' . substr(sha1(random_bytes(8)), 0, 6);

      try {
        $msg = cff_create_listed($thread, $slug, 'cf-message', [
          'title'  => 'Message ' . date('Y-m-d H:i'),
          'author' => $actor,
          'body'   => $body,
        ]);
      } catch (\Throwable $e) {
        cff_log('message create error', ['e'=>$e->getMessage()]);
        return [null, cff_json(['ok'=>false,'error'=>'create_failed'], 500)];
      }

      // Attachments: validate, normalize, strip EXIF
      $allowedExts  = ['png','jpg','jpeg','webp','pdf'];
      $allowedMimes = ['image/png','image/jpeg','image/webp','application/pdf'];
      $maxSize      = 20 * 1024 * 1024;

      $saveFile = function (string $tmp, string $name) use ($msg) {
        $ext  = strtolower(pathinfo($name, PATHINFO_EXTENSION) ?: 'bin');
        $base = preg_replace('~[^a-z0-9._-]+~i', '-', pathinfo($name, PATHINFO_FILENAME));
        $base = trim($base, '-_.') ?: 'file';
        $fn   = $base . '-' . date('YmdHis') . '.' . $ext;
        return $msg->createFile(['source' => $tmp, 'filename' => $fn]);
      };

      $filesList = [];
      foreach (($_FILES ?? []) as $spec) {
        if (is_array($spec['name'] ?? null)) {
          $count = count($spec['name']);
          for ($i=0; $i<$count; $i++) {
            $filesList[] = [
              'name'     => (string)$spec['name'][$i],
              'type'     => (string)$spec['type'][$i],
              'tmp_name' => (string)$spec['tmp_name'][$i],
              'error'    => (int)$spec['error'][$i],
              'size'     => (int)$spec['size'][$i],
            ];
          }
        } else {
          $filesList[] = [
            'name'     => (string)($spec['name'] ?? ''),
            'type'     => (string)($spec['type'] ?? ''),
            'tmp_name' => (string)($spec['tmp_name'] ?? ''),
            'error'    => (int)($spec['error'] ?? UPLOAD_ERR_NO_FILE),
            'size'     => (int)($spec['size'] ?? 0),
          ];
        }
      }

      foreach ($filesList as $f) {
        if (($f['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) continue;

        if (function_exists('cff_validate_upload')) {
          $err = cff_validate_upload($f, $allowedExts, $allowedMimes, $maxSize);
          if ($err) { cff_log('message file rejected', ['err'=>$err,'name'=>$f['name']]); continue; }
        } else {
          $ext = strtolower(pathinfo($f['name'], PATHINFO_EXTENSION) ?: '');
          if (!in_array($ext, $allowedExts, true)) continue;
          if (($f['size'] ?? 0) > $maxSize) continue;
        }

        $isImage = str_starts_with(strtolower((string)$f['type']), 'image/');
        $tmpPath = $f['tmp_name'];

        if ($isImage && function_exists('cff_image_normalize')) {
          $norm = cff_image_normalize($tmpPath, 'webp');
          if (!$norm) $norm = cff_image_normalize($tmpPath, 'jpg');
          if ($norm && is_file($norm['path'])) {
            try { $saveFile($norm['path'], preg_replace('~\.[^.]+$~', '.' . $norm['ext'], $f['name'])); }
            catch (\Throwable $e) { @unlink($norm['path']); }
            continue;
          }
        }

        try { $saveFile($tmpPath, $f['name']); } catch (\Throwable $e) {}
      }

      return [$msg, null];
    };

    if ($method === 'GET') {
      $threadRef = (string)(get('thread', '') ?: get('id', '') ?: get('slug', ''));
      $thread    = $__thread($threadRef);
      if (!$thread) return cff_json(['ok'=>false,'error'=>'thread_not_found'], 404);

      $client = $__clientFrom($thread);
      if (!$client) return cff_json(['ok'=>false,'error'=>'client_missing'], 400);
      if (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
        return cff_json(['ok'=>false,'error'=>'forbidden'], 403);
      }

      $msgTpls = ['cf-message','message','cff-message'];
      $msgs = $thread->children()
        ->filter(fn(Page $p) => in_array($p->intendedTemplate()->name(), $msgTpls, true))
        ->sortBy('modified','asc');

      $out = array_values(array_map(
        fn($p) => $__messageJson($p),
        $msgs->toArray(fn($p)=>$p)
      ));
      return cff_json(['ok'=>true,'messages'=>$out]);
    }

    // POST (create)
    cff_csrf_check();

    $json  = function_exists('cff_request_json') ? cff_request_json() : [];
    $input = array_merge($_POST ?? [], is_array($json) ? $json : []);

    $threadRef = (string)($input['thread'] ?? $input['id'] ?? $input['slug'] ?? '');
    $body      = trim((string)($input['body'] ?? $input['text'] ?? ''));

    if ($threadRef === '') return cff_json(['ok'=>false,'error'=>'thread_required'], 400);
    if ($body === '' && empty($_FILES)) return cff_json(['ok'=>false,'error'=>'message_empty'], 400);

    $thread = $__thread($threadRef);
    if (!$thread) return cff_json(['ok'=>false,'error'=>'thread_not_found'], 404);

    $client = $__clientFrom($thread);
    if (!$client) return cff_json(['ok'=>false,'error'=>'client_missing'], 400);
    if (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
      return cff_json(['ok'=>false,'error'=>'forbidden'], 403);
    }

    [$msg, $resp] = $createMessage($thread, $body);
    if ($resp) return $resp;

    return cff_json(['ok'=>true,'message'=>$__messageJson($msg)], 201);
  }
];

// GET /cff/api/messages/{idOrSlug} (path-style alias)
$routes[] = [
  'pattern' => 'cff/api/messages/(:all)',
  'method'  => 'GET',
  'action'  => function (string $threadRef) use ($__thread, $__clientFrom, $__messageJson) {
    $thread = $__thread($threadRef);
    if (!$thread) return cff_json(['ok'=>false,'error'=>'thread_not_found'], 404);

    $client = $__clientFrom($thread);
    if (!$client) return cff_json(['ok'=>false,'error'=>'client_missing'], 400);
    if (function_exists('cff_user_can_access_client') && !cff_user_can_access_client($client)) {
      return cff_json(['ok'=>false,'error'=>'forbidden'], 403);
    }

    $msgTpls = ['cf-message','message','cff-message'];
    $msgs = $thread->children()
      ->filter(fn(Page $p) => in_array($p->intendedTemplate()->name(), $msgTpls, true))
      ->sortBy('modified','asc');

    $out = array_values(array_map(
      fn($p) => $__messageJson($p),
      $msgs->toArray(fn($p)=>$p)
    ));
    return cff_json(['ok'=>true,'messages'=>$out]);
  }
];

/* Base /clientportal → send to preferred client’s dashboard or login */
$routes[] = [
  'pattern' => 'clientportal',
  'method'  => 'GET',
  'action'  => function () {
    $auth  = function_exists('cff_portal_user') ? cff_portal_user() : null;
    $email = is_array($auth) ? strtolower((string)($auth['email'] ?? '')) : '';

    if ($email && function_exists('cff_preferred_client_for_email')) {
      if ($client = cff_preferred_client_for_email($email)) {
        return Response::redirect(url('clientportal/clients/' . $client->slug() . '/dashboard'));
      }
    }

    $useLogin = (bool) option('cfx.cffreelancer.enableBuiltinLogin', false);
    $dest = $useLogin ? url('clientportal/login') : (function_exists('cff_portal_home') ? cff_portal_home() : url());
    return Response::redirect($dest);
  }
];

/* Load aggregated route modules from /routes (auth/login/invites live there) */
$moduleRoutes = [];
$routesIndex  = __DIR__ . '/routes/index.php';
if (is_file($routesIndex)) {
  $maybeModules = require $routesIndex;   // returns a flat array of routes
  if (is_array($maybeModules)) $moduleRoutes = $maybeModules;
}

/* -------------------------------------------------------------------------- */
/* Plugin registration                                                         */
/* -------------------------------------------------------------------------- */
Kirby::plugin('cfx/cffreelancer', [

  /* ---------------- Hooks ---------------- */
  'hooks' => [
    // Auto-publish chat pages + TASKS; mention logging
    'page.create:after' => [
      function (Page $page) {
        $tpl = $page->intendedTemplate()->name();
        // IMPORTANT: publish cf-task so planner can see them without Panel auth
        if (in_array($tpl, ['cf-ticket','cf-thread','cf-message','cf-task'], true)) {
          try { if ($page->isDraft()) $page->changeStatus('listed'); } catch (\Throwable $e) {}
        }
      },
      function (Page $page) {
        $tpl = $page->intendedTemplate()->name();
        if (in_array($tpl, ['cf-message','message','cff-message'], true)) {
          if (function_exists('cff_log_mentions_for_page')) cff_log_mentions_for_page($page, 'message');
        } elseif (in_array($tpl, ['cf-task','task','cff-task','cf-planner-item'], true)) {
          if (function_exists('cff_log_mentions_for_page')) cff_log_mentions_for_page($page, 'task');
        } else {
          if (function_exists('cff_log_mentions_for_page')) cff_log_mentions_for_page($page, 'note');
        }
      },
      // Auto-send portal access when a cf-client is created with a valid email (24h, one-time)
      function (Page $page) {
        if ($page->intendedTemplate()->name() !== 'cf-client') return;
        if (!cff_rate_limit('auto-invite:' . $page->id(), 1, 60)) return;

        $email = strtolower($page->clientEmail()->or('')->value());
        if (!cff_is_email($email)) return;

        // Prefer new Magic flow (24h TTL); falls back to legacy if class missing
        try {
          if (class_exists('\\Magic')) {
            $ttl   = 24 * 3600;
            $user  = kirby()->users()->findBy('email', $email);
            if (!$user) {
              $user = kirby()->users()->create([
                'email'   => $email,
                'role'    => 'client-teammate',
                'name'    => $email,
                'content' => ['clientId' => $page->id()]
              ]);
            } else {
              if (!in_array($user->role()->name(), ['client','client-teammate'], true)) {
                $user->changeRole('client-teammate');
              }
              if ($user->content()->get('clientId')->value() !== $page->id()) {
                $user->update(['clientId' => $page->id()]);
              }
            }

            $claims = [
              'purpose'  => 'portal-login',
              'sub'      => $user->id(),
              'email'    => $user->email(),
              'clientId' => $page->id(),
            ];
            $token = \Magic::issue($claims, $ttl);
            sendMagicEmail($user, $page, $token);
            return; // done using new flow
          }
        } catch (\Throwable $e) {
          // fall through to legacy
        }

        // Legacy fallback (kept for compatibility)
        [$jti, $tok] = cff_magic_generate();
        $hash = cff_magic_hash($tok);
        $iat  = time();
        $exp  = $iat + 24*3600;

        $dir  = cff_magic_client_dir($page->id());
        cff_magic_ensure_dir($dir);
        $file = $dir . '/' . $jti . '.json';
        $record = [
          'clientId' => $page->id(),
          'email'    => $email,
          'jti'      => $jti,
          'hash'     => $hash,
          'iat'      => $iat,
          'exp'      => $exp,
          'status'   => 'active',
          'meta'     => ['type' => 'portal-access', 'role' => 'client'],
        ];
        @file_put_contents($file, json_encode($record, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES));

        $opaque = cff_magic_pack_link($jti, $tok);
        // Keep legacy accept path for backwards compat; our accept route 301s to canonical
        $link   = url('clientportal/accept') . '?token=' . rawurlencode($opaque);

        $brand = kirby()->option('cff.brand', 'Client Flow');
        $html  = '<p>Hi,</p><p>Your Client Portal is ready:</p>'
               . '<p><a href="' . html($link) . '">Open portal</a></p>'
               . '<p>This link expires in 24 hours and can be used only once.</p>';

        if (function_exists('cff_mail_portal_notice')) {
          try { cff_mail_portal_notice($email, "Access your Client Portal · {$brand}", strip_tags($html)); } catch (\Throwable $e) {}
        } else if (function_exists('cff_send_email')) {
          try { cff_send_email($email, "Access your Client Portal · {$brand}", $html); } catch (\Throwable $e) {}
        } else {
          try { kirby()->email(['to'=>$email,'subject'=>"Access your Client Portal · {$brand}",'body'=>$link]); } catch (\Throwable $e) {}
        }
      },
    ],

    'page.update:after' => function (Page $newPage, Page $oldPage) {
      $tpl = $newPage->intendedTemplate()->name();
      if (in_array($tpl, ['cf-message','message','cff-message'], true)) {
        if (function_exists('cff_log_mentions_for_page')) cff_log_mentions_for_page($newPage, 'message');
      } elseif (in_array($tpl, ['cf-task','task','cff-task','cf-planner-item'], true)) {
        if (function_exists('cff_log_mentions_for_page')) cff_log_mentions_for_page($newPage, 'task');
      } else {
        if (function_exists('cff_log_mentions_for_page')) cff_log_mentions_for_page($newPage, 'note');
      }
    },

    // Enforce single avatar per parent + stable file name
    'file.create:after' => function (Kirby\Cms\File $file) {
      if ($file->template() !== 'cff-avatar') return;
      $parent = $file->parent();
      if (!$parent) return;
      foreach ($parent->files()->template('cff-avatar')->not($file) as $other) {
        try { $other->delete(); } catch (\Throwable $e) {}
      }
      if ($file->name() !== 'avatar') {
        try { $file->changeName('avatar'); } catch (\Throwable $e) {}
      }
    },
    'file.replace:after' => function (Kirby\Cms\File $file) {
      if ($file->template() !== 'cff-avatar') return;
      $parent = $file->parent();
      if ($parent) {
        foreach ($parent->files()->template('cff-avatar')->not($file) as $other) {
          try { $other->delete(); } catch (\Throwable $e) {}
        }
        if ($file->name() !== 'avatar') {
          try { $file->changeName('avatar'); } catch (\Throwable $e) {}
        }
      }
    },
  ],

  /* ---------------- Routes ---------------- */
  // Order matters: keep modern $routes first, then modules, then legacy base/helpers
  'routes' => array_values(array_merge($routes, $moduleRoutes ?? [], $baseRoutes ?? [], $existingRoutes ?? [])),

  /* ---------------- Snippets ---------------- */
  'snippets' => [
    'render-template'               => __DIR__ . '/snippets/render-template.php',
    'cff-settings-billing-profile'  => __DIR__ . '/snippets/cff-settings-billing-profile.php',
    'cff-settings-branding'         => __DIR__ . '/snippets/cff-settings-branding.php',
    'cff-settings-files'            => __DIR__ . '/snippets/cff-settings-files.php',
    'cff-settings-notifications'    => __DIR__ . '/snippets/cff-settings-notifications.php',
    'cff-profile-page'              => __DIR__ . '/snippets/cff-profile-page.php',
    'cff-client-avatar-control'     => __DIR__ . '/snippets/cff-client-avatar-control.php',
    'cff-settings-team'             => __DIR__ . '/snippets/cff-settings-team.php',
    'cff-tabler-head'               => __DIR__ . '/snippets/cff-tabler-head.php',
    'cff-tabler-foot'               => __DIR__ . '/snippets/cff-tabler-foot.php',
    'cff-onboard-claim'             => __DIR__ . '/snippets/cff-onboard-claim.php',
  ],

  /* ---------------- Blueprints ---------------- */
  'blueprints' => [
    'pages/clients'         => __DIR__ . '/blueprints/pages/clients.yml',
    'pages/cf-client'       => __DIR__ . '/blueprints/pages/cf-client.yml',
    'pages/cf-thread'       => __DIR__ . '/blueprints/pages/cf-thread.yml',
    'pages/cf-message'      => __DIR__ . '/blueprints/pages/cf-message.yml',
    'pages/cf-invoice'      => __DIR__ . '/blueprints/pages/cf-invoice.yml',
    'pages/cf-task'         => __DIR__ . '/blueprints/pages/cf-task.yml',
    'pages/cf-quote'        => __DIR__ . '/blueprints/pages/cf-quote.yml',
    'pages/cf-ticket'       => __DIR__ . '/blueprints/pages/cf-ticket.yml',
    'pages/cf-project'      => __DIR__ . '/blueprints/pages/cf-project.yml',
    'pages/cf-teammate'     => __DIR__ . '/blueprints/pages/cf-teammate.yml',
    'pages/cf-planner'      => __DIR__ . '/blueprints/pages/cf-planner.yml',
    'users/admin'           => __DIR__ . '/blueprints/users/admin.yml',
    'users/client'          => __DIR__ . '/blueprints/users/client.yml',
    'users/client-teammate' => __DIR__ . '/blueprints/users/client-teammate.yml',
    'files/cff-avatar'      => __DIR__ . '/blueprints/files/cff-avatar.yml',
    'fields/cff-avatar'     => __DIR__ . '/blueprints/fields/cff-avatar.yml',
  ],
]);