✏ EDIT: booking_create.php

<?php
// Creates a new booking from the current cart. Customers book for
// themselves; administrators can create walk‑in bookings by passing
// customer_name, mobile and address via the request. After
// successfully creating a booking, the cart is cleared from the
// session.

require_once __DIR__ . '/bootstrap.php';

$user = require_login();

// Fetch cart
if (!isset($_SESSION['cart']) || empty($_SESSION['cart'])) {
    respond(null, 'Cart is empty');
}
$cart = $_SESSION['cart'];

$input = json_decode(file_get_contents('php://input'), true);
if (!$input) {
    $input = $_POST;
}

// Determine customer details and optional booking parameters
$customerId = null;
$customerName = '';
$mobile = '';
$address = '';
$createdByAdmin = null;

// Optional fields
$fromDate = null;
$toDate = null;
$discountInput = null;

if ($user['role'] === 'CUSTOMER') {
    $customerId = $user['id'];
    // Fetch extra details from database in case they changed since login
    $stmt = $pdo->prepare('SELECT name, mobile, address FROM users WHERE id = ?');
    $stmt->execute([$customerId]);
    $row = $stmt->fetch();
    $customerName = $row ? $row['name'] : $user['name'];
    $mobile = $row ? $row['mobile'] : '';
    $address = $row ? $row['address'] : '';
} else {
    // Admin walk‑in booking
    $customerName = trim($input['customer_name'] ?? 'Walk‑In Customer');
    $mobile = trim($input['mobile'] ?? '');
    $address = trim($input['address'] ?? '');
    $createdByAdmin = $user['id'];
    // Dates and discount provided by admin
    $fromDate = isset($input['from_date']) ? trim($input['from_date']) : null;
    $toDate = isset($input['to_date']) ? trim($input['to_date']) : null;
    $discountInput = isset($input['discount']) ? (float)$input['discount'] : null;
}

// Fetch item details and compute totals
try {
    $ids = array_keys($cart);
    $placeholders = implode(',', array_fill(0, count($ids), '?'));
    $stmt = $pdo->prepare("SELECT id, name, price_per_unit, available_qty FROM items WHERE id IN ($placeholders)");
    $stmt->execute($ids);
    $items = $stmt->fetchAll();
    if (!$items) {
        respond(null, 'No valid items in cart');
    }
    $subtotal = 0.0;
    $bookingItems = [];
    foreach ($items as $item) {
        $id = $item['id'];
        $qtyBooked = (int)$cart[$id];
        $price = (float)$item['price_per_unit'];
        $subtotal += $price * $qtyBooked;
        $bookingItems[] = [
            'item_id' => $id,
            'item_name_snapshot' => $item['name'],
            'price_per_unit_snapshot' => $price,
            'qty_booked' => $qtyBooked,
        ];
    }
    // Allow admin to pass discount; default to 0 if not provided
    $discount = $discountInput !== null ? (float)$discountInput : 0.0;
    $damageCharge = 0.0;
    $total = $subtotal - $discount + $damageCharge;
    // Insert booking. Try to include from/to dates if the database supports them.
    // The bookings table may or may not include from_date and to_date columns
    // so we attempt the full insert first. The prepared statement must
    // include one placeholder for every column (excluding created_at which is NOW()).
    try {
        $stmt = $pdo->prepare('INSERT INTO bookings (customer_id, customer_name, mobile, address, from_date, to_date, subtotal, discount, damage_charge, total_amount, booking_status, payment_status, return_status, created_by_admin_id, created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?, NOW())');
        $stmt->execute([
            $customerId,
            $customerName,
            $mobile,
            $address,
            $fromDate,
            $toDate,
            $subtotal,
            $discount,
            $damageCharge,
            $total,
            'DRAFT',
            'UNPAID',
            'NOT_RETURNED',
            $createdByAdmin,
        ]);
    } catch (PDOException $e) {
        // If the insert fails (e.g. unknown columns), fall back to legacy columns
        // Without from_date and to_date. This statement needs one placeholder per column.
        $stmt = $pdo->prepare('INSERT INTO bookings (customer_id, customer_name, mobile, address, subtotal, discount, damage_charge, total_amount, booking_status, payment_status, return_status, created_by_admin_id, created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?, NOW())');
        $stmt->execute([
            $customerId,
            $customerName,
            $mobile,
            $address,
            $subtotal,
            $discount,
            $damageCharge,
            $total,
            'DRAFT',
            'UNPAID',
            'NOT_RETURNED',
            $createdByAdmin,
        ]);
    }
    $bookingId = $pdo->lastInsertId();
    // Insert booking items
    $stmtItem = $pdo->prepare('INSERT INTO booking_items (booking_id, item_id, item_name_snapshot, price_per_unit_snapshot, qty_booked, qty_returned, damage_qty, damage_comment) VALUES (?,?,?,?,?,?,?,?)');
    foreach ($bookingItems as $bi) {
        $stmtItem->execute([
            $bookingId,
            $bi['item_id'],
            $bi['item_name_snapshot'],
            $bi['price_per_unit_snapshot'],
            $bi['qty_booked'],
            0,
            0,
            null,
        ]);
    }
    // Clear cart
    unset($_SESSION['cart']);
    respond(['id' => (int)$bookingId]);
} catch (PDOException $e) {
    respond(null, 'Database error');
}

[✗] CANCEL