                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
<?php
require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../includes/functions.php';
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] != 'POST') { echo json_encode(['success'=>false,'message'=>'Invalid request']); exit; }
$name = cleanInput($_POST['name']);
$email = cleanInput($_POST['email']);
$phone = cleanInput($_POST['phone']);
$category_id = intval($_POST['category_id']);
$package_id = intval($_POST['package_id']);
$event_date = cleanInput($_POST['event_date']);
$start_time = cleanInput($_POST['start_time']);
$end_time = cleanInput($_POST['end_time']);
$venue = cleanInput($_POST['venue']);
$address = cleanInput($_POST['address'] ?? '');
$district = cleanInput($_POST['district']);
$color_theme = cleanInput($_POST['color_theme'] ?? '');
$special_notes = cleanInput($_POST['special_notes'] ?? '');
$customer_id = isLoggedIn() ? $_SESSION['customer_id'] : 0;
if (!$customer_id) {
    $stmt = $conn->prepare("SELECT id FROM customers WHERE email = ?");
    $stmt->bind_param("s", $email); $stmt->execute();
    $existing = $stmt->get_result()->fetch_assoc();
    if ($existing) { $customer_id = $existing['id']; } else {
        $hash = password_hash('temp'.time(), PASSWORD_DEFAULT);
        $stmt = $conn->prepare("INSERT INTO customers (name, email, phone, password) VALUES (?, ?, ?, ?)");
        $stmt->bind_param("ssss", $name, $email, $phone, $hash);
        $stmt->execute(); $customer_id = $conn->insert_id;
    }
    $_SESSION['customer_id'] = $customer_id;
    $_SESSION['customer_name'] = $name;
    $_SESSION['customer_email'] = $email;
}
$package = getPackage($package_id);
if (!$package) { echo json_encode(['success'=>false,'message'=>'Invalid package']); exit; }
if (!checkAvailability($event_date)) { echo json_encode(['success'=>false,'message'=>'Selected date is not available']); exit; }

$package_price = floatval($package['price']);
$latitude = isset($_POST['latitude']) && $_POST['latitude'] !== '' ? floatval($_POST['latitude']) : null;
$longitude = isset($_POST['longitude']) && $_POST['longitude'] !== '' ? floatval($_POST['longitude']) : null;
$distance = isset($_POST['distance']) ? floatval($_POST['distance']) : 0.0;

// Security check: calculate transport cost on server side
$cost_per_km = floatval(getSetting('transport_cost_per_km') ?: 100.00);
$transport_cost = $distance * $cost_per_km;

$total_price = $package_price + $transport_cost;
$advance_pct = floatval(getSetting('advance_percentage') ?: 50);
$advance_amount = $total_price * $advance_pct / 100;
$balance_amount = $total_price - $advance_amount;
$booking_id = generateBookingID();

$stmt = $conn->prepare("INSERT INTO bookings (booking_id, customer_id, package_id, category_id, event_date, start_time, end_time, venue, address, district, color_theme, special_notes, package_price, transport_cost, distance, latitude, longitude, total_price, advance_amount, balance_amount) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->bind_param("siiisssssssddddddddd", $booking_id, $customer_id, $package_id, $category_id, $event_date, $start_time, $end_time, $venue, $address, $district, $color_theme, $special_notes, $package_price, $transport_cost, $distance, $latitude, $longitude, $total_price, $advance_amount, $balance_amount);

if ($stmt->execute()) {
    $booking_id_insert = $conn->insert_id;
    $stmt2 = $conn->prepare("INSERT INTO booking_status (booking_id, status) VALUES (?, 'pending')");
    $stmt2->bind_param("i", $booking_id_insert); $stmt2->execute();
    $stmt3 = $conn->prepare("INSERT INTO invoices (invoice_no, booking_id, customer_id, total_amount, advance_paid, balance, invoice_date) VALUES (?, ?, ?, ?, ?, ?, CURDATE())");
    $inv_no = generateInvoiceNo();
    $stmt3->bind_param("siiddd", $inv_no, $booking_id_insert, $customer_id, $total_price, $advance_amount, $balance_amount);
    $stmt3->execute();
    addNotification('New Booking', 'New booking '.$booking_id.' received from '.$name, SITE_URL.'admin/booking-details.php?id='.$booking_id_insert, 'admin');
    echo json_encode(['success'=>true,'message'=>'Booking submitted successfully! Your booking ID is '.$booking_id.'. We will contact you soon.']);
} else {
    echo json_encode(['success'=>false,'message'=>'Booking failed. Please try again.']);
}