<?php
require_once 'auth.php';
include 'db.php';
requireLogin($conn);

$action = $_GET['action'] ?? '';
$role = $_SESSION['role'] ?? 'user';
$user_department = currentUserDepartment($conn);

function buildDraftRecipientSummary($recipient_name, $recipient_organization, $attention_to) {
    $parts = [];
    $recipient_name = trim((string) $recipient_name);
    $recipient_organization = trim((string) $recipient_organization);
    $attention_to = trim((string) $attention_to);

    if ($recipient_organization !== '') {
        $parts[] = $recipient_organization;
    }
    if ($recipient_name !== '') {
        $parts[] = $recipient_name;
    }
    if ($attention_to !== '') {
        $parts[] = 'Perhatian: ' . $attention_to;
    }

    return !empty($parts) ? implode(' | ', $parts) : '-';
}

function normalizeMemoDisplayPositions($checked_values, $fallback_value = '') {
    $values = [];
    foreach ((array) $checked_values as $value) {
        $value = trim((string) $value);
        if ($value !== '' && !in_array($value, $values, true)) {
            $values[] = $value;
        }
    }

    $fallback_value = trim((string) $fallback_value);
    if (empty($values) && $fallback_value !== '') {
        $values[] = $fallback_value;
    }

    return implode("\n", $values);
}

function splitMemoDisplayPositions($value) {
    $items = preg_split('/\r\n|\r|\n/', (string) $value);
    $values = [];
    foreach ($items as $item) {
        $item = trim((string) $item);
        if ($item !== '' && !in_array($item, $values, true)) {
            $values[] = $item;
        }
    }
    return $values;
}

function sanitizeDraftLetterInlineStyle($style, $default_font_size = '16px') {
    $safe_styles = [];
    foreach (explode(';', (string) $style) as $declaration) {
        $parts = explode(':', $declaration, 2);
        if (count($parts) !== 2) {
            continue;
        }
        $property = strtolower(trim($parts[0]));
        $value = trim($parts[1]);
        if ($property === 'text-align' && preg_match('/^(left|center|right|justify)$/i', $value)) {
            $safe_styles[] = 'text-align: ' . strtolower($value);
        } elseif ($property === 'margin-left' && preg_match('/^(?:0|[0-9]+(?:\.[0-9]+)?(?:cm|mm|pt|px))$/i', $value)) {
            $safe_styles[] = 'margin-left: ' . strtolower($value);
        } elseif (in_array($property, ['height', 'min-height', 'width'], true) && preg_match('/^(?:0|[0-9]+(?:\.[0-9]+)?(?:cm|mm|pt|px))$/i', $value)) {
            $safe_styles[] = $property . ': ' . strtolower($value);
        } elseif ($property === 'display' && strtolower($value) === 'flex') {
            $safe_styles[] = 'display: flex';
        } elseif ($property === 'align-items' && strtolower($value) === 'center') {
            $safe_styles[] = 'align-items: center';
        } elseif ($property === 'justify-content' && in_array(strtolower($value), ['center', 'flex-start'], true)) {
            $safe_styles[] = 'justify-content: ' . strtolower($value);
        } elseif ($property === 'margin' && preg_match('/^(?:0|[0-9]+(?:\.[0-9]+)?(?:cm|mm|pt|px))$/i', $value)) {
            $safe_styles[] = 'margin: ' . strtolower($value);
        } elseif (in_array($property, ['line-height', 'font-size', 'font-family'], true)) {
            continue;
        }
    }

    $safe_styles[] = 'font-family: Arial, Helvetica, sans-serif';
    $safe_styles[] = 'font-size: ' . $default_font_size;
    $safe_styles[] = 'line-height: 1.5';

    return implode('; ', array_unique($safe_styles));
}

function applyDraftLetterBodyTypography($html, $default_font_size = '16px') {
    $html = trim((string) $html);
    if ($html === '') {
        return '';
    }

    return preg_replace_callback('/<(p|div|li|td|th|blockquote|h3|h4|span)(\s[^>]*)?>/i', function ($matches) use ($default_font_size) {
        $tag = $matches[1];
        $attrs = $matches[2] ?? '';

        if (preg_match('/style\s*=\s*(["\'])(.*?)\1/i', $attrs, $style_match)) {
            $quote = $style_match[1];
            $safe_style = sanitizeDraftLetterInlineStyle($style_match[2], $default_font_size);
            $attrs = preg_replace(
                '/style\s*=\s*(["\']).*?\1/i',
                'style=' . $quote . htmlspecialchars($safe_style, ENT_QUOTES) . $quote,
                $attrs,
                1
            );
        } else {
            $attrs .= ' style="font-family: Arial, Helvetica, sans-serif; font-size: ' . $default_font_size . '; line-height: 1.5"';
        }

        return '<' . $tag . $attrs . '>';
    }, $html);
}

function sanitizeDraftLetterBodyHtml($html, $default_font_size = '16px') {
    $html = trim((string) $html);
    if ($html === '') {
        return '';
    }

    $allowed_tags = '<p><br><strong><b><em><i><u><ol><ul><li><table><thead><tbody><tr><th><td><colgroup><col><blockquote><h3><h4><div><span><img>';
    $html = strip_tags($html, $allowed_tags);
    $html = preg_replace('/\s+on[a-z]+\s*=\s*(".*?"|\'.*?\'|[^\s>]+)/i', '', $html);
    $html = preg_replace_callback('/\s+style\s*=\s*(["\'])(.*?)\1/i', function ($matches) use ($default_font_size) {
        $safe_style = sanitizeDraftLetterInlineStyle($matches[2], $default_font_size);
        if (preg_match('/(?:^|;)\s*text-align\s*:\s*(left|center|right|justify)\s*(?:;|$)/i', $matches[2], $alignment)) {
            return ' align="' . strtolower($alignment[1]) . '"' . ' style="' . htmlspecialchars($safe_style, ENT_QUOTES) . '"';
        }
        return ' style="' . htmlspecialchars($safe_style, ENT_QUOTES) . '"';
    }, $html);
    $html = preg_replace('/\s+style\s*=\s*(?!["\'])[^\s>]+/i', '', $html);
    $html = preg_replace('/\s+(class|id)\s*=\s*(".*?"|\'.*?\'|[^\s>]+)/i', '', $html);
    $html = preg_replace('/javascript\s*:/i', '', $html);
    $html = preg_replace_callback('/<img\b[^>]*>/i', function ($matches) {
        $tag = $matches[0];
        if (!preg_match('/\s+src\s*=\s*(["\'])(.*?)\1/i', $tag, $src_match)) {
            return '';
        }

        $src = str_replace('\\', '/', trim(html_entity_decode($src_match[2], ENT_QUOTES)));
        if (!preg_match('#^uploads/signatures/[A-Za-z0-9._/-]+\.(?:png|jpe?g|gif|webp)$#i', $src)) {
            return '';
        }

        $full_path = __DIR__ . '/' . $src;
        if (!is_file($full_path)) {
            return '';
        }

        return '<img src="' . htmlspecialchars($src, ENT_QUOTES) . '" alt="Tandatangan Digital" style="max-width:150px;max-height:58px;object-fit:contain;">';
    }, $html);

    return applyDraftLetterBodyTypography(trim($html), $default_font_size);
}

function sanitizeDraftLetterPagesJson($json, $default_font_size = '16px') {
    $decoded = json_decode((string) $json, true);
    $pages = [];

    if (is_array($decoded)) {
        foreach ($decoded as $page) {
            $clean_page = sanitizeDraftLetterBodyHtml($page, $default_font_size);
            if (draftLetterBodyHasContent($clean_page)) {
                $pages[] = $clean_page;
            }
        }
    }

    return $pages;
}

function replaceSuratRasmiGeneratedReferenceLine($html, $reference_display) {
    $reference_display = htmlspecialchars(trim((string) $reference_display), ENT_QUOTES);
    if ($reference_display === '') {
        return $html;
    }

    return preg_replace_callback(
        '/(<p\b(?=[^>]*data-surat-rasmi-generated-line=(?:"ref"|\'ref\'))[^>]*>)(.*?)(<\/p>)/is',
        function ($matches) use ($reference_display) {
            return $matches[1] . $reference_display . $matches[3];
        },
        (string) $html
    );
}

function applySuratRasmiGeneratedReferenceToPages($pages, $reference_display) {
    $updated_pages = [];
    foreach ((array) $pages as $page) {
        $updated_pages[] = replaceSuratRasmiGeneratedReferenceLine($page, $reference_display);
    }
    return $updated_pages;
}

function sanitizeDraftApprovalRouteBodiesJson($json, $default_font_size = '16px') {
    $decoded = json_decode((string) $json, true);
    $bodies = [];

    if (is_array($decoded)) {
        foreach ($decoded as $key => $body) {
            $key = trim((string) $key);
            if ($key === '' || !preg_match('/^(?:user:\d+|position:.+)$/', $key)) {
                continue;
            }
            $bodies[$key] = sanitizeDraftLetterBodyHtml($body, $default_font_size);
        }
    }

    return json_encode($bodies, JSON_UNESCAPED_UNICODE);
}

function approvalRouteBodiesCoverRecipients($json, $recipients) {
    $bodies = json_decode((string) $json, true);
    if (!is_array($bodies) || empty($recipients)) {
        return false;
    }

    foreach ($recipients as $recipient) {
        $user_key = 'user:' . (int) ($recipient['id'] ?? $recipient['user_id'] ?? 0);
        $position_key = 'position:' . trim((string) ($recipient['routing_position'] ?? $recipient['position_label'] ?? ''));
        $body = $bodies[$user_key] ?? $bodies[$position_key] ?? '';
        if (!draftLetterBodyHasContent($body)) {
            return false;
        }
    }

    return true;
}

function sanitizeDraftLetterPageSignersJson($json, $page_count) {
    $decoded = json_decode((string) $json, true);
    $allowed = ['preparer', 'department_officer'];
    $page_count = max(1, (int) $page_count);
    $signers = [];

    for ($index = 0; $index < $page_count; $index++) {
        $value = is_array($decoded) ? (string) ($decoded[$index] ?? '') : '';
        $signers[] = in_array($value, $allowed, true) ? $value : ($index === 0 ? 'preparer' : '');
    }

    return json_encode($signers, JSON_UNESCAPED_UNICODE);
}

function draftLetterBodyHasContent($html) {
    $plain = html_entity_decode(strip_tags((string) $html), ENT_QUOTES | ENT_HTML5, 'UTF-8');
    $plain = preg_replace('/[\s\x{00A0}]+/u', '', $plain);

    return trim((string) $plain) !== '';
}

function stripSuratRasmiGeneratedLinesForContentCheck($html) {
    $html = (string) $html;
    $html = preg_replace('/<p\b(?=[^>]*data-surat-rasmi-generated-line=(?:"ref"|\'ref\'|"date"|\'date\'))[^>]*>.*?<\/p>/is', '', $html);
    return $html;
}

function suratRasmiBodyHasUserContent($html) {
    return draftLetterBodyHasContent(stripSuratRasmiGeneratedLinesForContentCheck($html));
}

function saveDraftSignatureUpload($input_name, $existing_path = '') {
    if (empty($_FILES[$input_name]) || !isset($_FILES[$input_name]['error']) || $_FILES[$input_name]['error'] === UPLOAD_ERR_NO_FILE) {
        return trim((string) $existing_path);
    }

    if ($_FILES[$input_name]['error'] !== UPLOAD_ERR_OK) {
        throw new Exception('Gagal memuat naik tandatangan digital.');
    }

    $tmp_name = $_FILES[$input_name]['tmp_name'] ?? '';
    $original_name = basename((string) ($_FILES[$input_name]['name'] ?? 'signature'));
    $extension = strtolower(pathinfo($original_name, PATHINFO_EXTENSION));
    $allowed = ['png', 'jpg', 'jpeg', 'webp'];

    if (!in_array($extension, $allowed, true)) {
        throw new Exception('Format tandatangan digital hanya PNG, JPG, JPEG atau WEBP.');
    }

    $upload_dir = 'uploads/signatures/';
    if (!is_dir($upload_dir)) {
        mkdir($upload_dir, 0775, true);
    }

    $filename = 'sign_' . date('YmdHis') . '_' . bin2hex(random_bytes(4)) . '.' . $extension;
    $target_path = $upload_dir . $filename;

    if (!move_uploaded_file($tmp_name, $target_path)) {
        throw new Exception('Gagal menyimpan fail tandatangan digital.');
    }

    return $target_path;
}

function getSupportUserById($conn, $support_user_id) {
    $support_user_id = (int) $support_user_id;
    if ($support_user_id <= 0) {
        return null;
    }

    $stmt = mysqli_prepare($conn, "SELECT id, fullname, email, department, position, role FROM users WHERE id = ? AND status = 'approved' LIMIT 1");
    if (!$stmt) {
        return null;
    }
    mysqli_stmt_bind_param($stmt, "i", $support_user_id);
    mysqli_stmt_execute($stmt);
    $user = mysqli_fetch_assoc(mysqli_stmt_get_result($stmt));

    return $user ?: null;
}

function getApprovedUserById($conn, $user_id) {
    return getSupportUserById($conn, $user_id);
}

function applyDepartmentHeadSignatory(&$signatory_name, &$signatory_position, &$signatory_department, $department_head_user, $fallback_department = '') {
    if (!$department_head_user) {
        return;
    }

    $signatory_name = trim((string) ($department_head_user['fullname'] ?? $signatory_name));
    $signatory_department = trim((string) ($department_head_user['department'] ?? ($fallback_department ?: $signatory_department)));
    $signatory_position = getDisplayPositionForUser($department_head_user, $signatory_department) ?: trim((string) ($department_head_user['position'] ?? $signatory_position));
}

function normalizeMemoRoutingSelection($positions, $orders) {
    $selected = [];
    foreach ((array) $positions as $index => $position) {
        $position = trim((string) $position);
        if ($position === '' || isset($selected[$position])) {
            continue;
        }
        $order = max(1, (int) (($orders[$position] ?? 0) ?: ($index + 1)));
        $selected[$position] = [
            'position' => $position,
            'order' => $order,
            'index' => (int) $index,
        ];
    }
    uasort($selected, function ($left, $right) {
        return [$left['order'], $left['index']] <=> [$right['order'], $right['index']];
    });

    $normalized = [];
    $route_order = 1;
    foreach ($selected as $item) {
        $normalized[] = [
            'position' => $item['position'],
            'order' => $route_order++,
        ];
    }
    return $normalized;
}

function resolveMemoApprovalRecipients($conn, $kepada, $melalui, $routing_selection, $preparer_user_id, $excluded_user_ids = []) {
    $requested = [];
    $kepada_positions = splitMemoDisplayPositions($kepada);
    $melalui_positions = splitMemoDisplayPositions($melalui);
    $excluded_lookup = array_fill_keys(array_map('intval', (array) $excluded_user_ids), true);

    foreach ((array) $routing_selection as $item) {
        $position = trim((string) ($item['position'] ?? ''));
        if ($position !== '' && !isset($requested[$position])) {
            $requested[$position] = [
                'source_type' => in_array($position, $kepada_positions, true) ? 'kepada' : (in_array($position, $melalui_positions, true) ? 'melalui' : 'tambahan'),
                'route_order' => max(1, (int) ($item['order'] ?? 1)),
            ];
        }
    }

    $recipients = [];
    foreach (getMemoRoutingUsers($conn) as $user) {
        $routing_position = $user['routing_position'] ?? '';
        $user_id = (int) ($user['id'] ?? 0);
        if (!isset($requested[$routing_position]) || $user_id === (int) $preparer_user_id || isset($excluded_lookup[$user_id])) {
            continue;
        }
        $user['source_type'] = $requested[$routing_position]['source_type'];
        $user['route_order'] = $requested[$routing_position]['route_order'];
        $recipients[$user_id] = $user;
    }

    $recipients = array_values($recipients);
    usort($recipients, function ($left, $right) {
        return [(int) ($left['route_order'] ?? 1), (int) ($left['id'] ?? 0)]
            <=> [(int) ($right['route_order'] ?? 1), (int) ($right['id'] ?? 0)];
    });
    return $recipients;
}

function syncMemoApprovalRecipients($conn, $draft_id, $recipients, $activate_now) {
    $draft_id = (int) $draft_id;
    $delete_stmt = mysqli_prepare($conn, "DELETE FROM letter_approval_recipients WHERE draft_id = ?");
    mysqli_stmt_bind_param($delete_stmt, "i", $draft_id);
    mysqli_stmt_execute($delete_stmt);

    $insert_stmt = mysqli_prepare($conn, "INSERT INTO letter_approval_recipients
        (draft_id, user_id, position_label, source_type, route_order, status, requested_at)
        VALUES (?, ?, ?, ?, ?, ?, NULL)");
    if (!$insert_stmt) {
        throw new Exception(mysqli_error($conn));
    }

    foreach ($recipients as $recipient) {
        $user_id = (int) ($recipient['id'] ?? 0);
        $position_label = trim((string) ($recipient['routing_position'] ?? ''));
        $source_type = trim((string) ($recipient['source_type'] ?? 'tambahan'));
        $route_order = max(1, (int) ($recipient['route_order'] ?? 1));
        $status = 'belum_mula';
        mysqli_stmt_bind_param($insert_stmt, "iissis", $draft_id, $user_id, $position_label, $source_type, $route_order, $status);
        if (!mysqli_stmt_execute($insert_stmt)) {
            throw new Exception(mysqli_error($conn));
        }
    }
    if ($activate_now) {
        activateMemoApprovalRecipients($conn, $draft_id);
    }
}

function activateMemoApprovalRecipients($conn, $draft_id) {
    $order_stmt = mysqli_prepare($conn, "SELECT MIN(route_order) AS next_order
        FROM letter_approval_recipients
        WHERE draft_id = ? AND status = 'belum_mula'");
    mysqli_stmt_bind_param($order_stmt, "i", $draft_id);
    mysqli_stmt_execute($order_stmt);
    $next_order = (int) (mysqli_fetch_assoc(mysqli_stmt_get_result($order_stmt))['next_order'] ?? 0);
    if ($next_order <= 0) {
        return false;
    }

    $stmt = mysqli_prepare($conn, "UPDATE letter_approval_recipients
        SET status = 'menunggu', requested_at = NOW(), responded_at = NULL
        WHERE draft_id = ? AND route_order = ? AND status = 'belum_mula'");
    mysqli_stmt_bind_param($stmt, "ii", $draft_id, $next_order);
    return mysqli_stmt_execute($stmt);
}

function sendMemoApprovalRecipientEmails($conn, $draft_id, $draft) {
    foreach (getLetterApprovalRecipients($conn, $draft_id) as $recipient) {
        if (($recipient['status'] ?? '') !== 'menunggu' || empty($recipient['email'])) {
            continue;
        }
        sendDraftLetterSupportRequestEmail($recipient['email'], $recipient['fullname'] ?? '', $draft);
    }
}

function buildDraftApprovalRoute($conn, $preparer_user_id, $folder_department, $department_officer_user_id, $recipients) {
    $preparer = getApprovedUserById($conn, $preparer_user_id);
    if (!$preparer) {
        throw new Exception('validation');
    }

    $needs_department_officer = !isHeadOfficerPosition($preparer['position'] ?? '');
    $department_officer_user = $needs_department_officer ? getSupportUserById($conn, $department_officer_user_id) : null;

    if (empty($recipients)) {
        throw new Exception('approval_recipient_required');
    }

    if ($needs_department_officer) {
        if (!$department_officer_user) {
            throw new Exception('department_officer_required');
        }

        if (!isHeadOfficerPosition($department_officer_user['position'] ?? '')) {
            throw new Exception('department_officer_required');
        }

        if (!isSameDepartmentDb($conn, $department_officer_user['department'] ?? '', $folder_department)) {
            throw new Exception('department_officer_department');
        }
    }

    $selected_ids = array_map(function ($recipient) {
        return (int) ($recipient['id'] ?? 0);
    }, $recipients);
    if ($needs_department_officer) {
        $selected_ids[] = (int) ($department_officer_user['id'] ?? 0);
    }
    $selected_ids = array_filter($selected_ids);
    if (count($selected_ids) !== count(array_unique($selected_ids))) {
        throw new Exception('duplicate_approver');
    }

    $preparer_id = (int) ($preparer['id'] ?? 0);
    if ($needs_department_officer && (int) ($department_officer_user['id'] ?? 0) === $preparer_id) {
        throw new Exception('duplicate_approver');
    }

    if ($needs_department_officer) {
        return [
            'needs_department_officer' => true,
            'department_officer_user' => $department_officer_user,
            'current_user' => $department_officer_user,
            'approval_status' => 'menunggu_pegawai_bahagian',
            'approval_stage' => 1,
            'department_officer_status' => 'menunggu',
            'department_officer_requested_now' => true,
        ];
    }

    return [
        'needs_department_officer' => false,
        'department_officer_user' => null,
        'current_user' => $recipients[0],
        'approval_status' => 'menunggu_pelulus',
        'approval_stage' => 2,
        'department_officer_status' => 'tidak_perlu',
        'department_officer_requested_now' => false,
    ];
}

function resolveSuratRasmiFinalSigner($conn, $target, $management_signer_user_id, $other_department_head_user_id, $department_head_user, $fallback_department = '') {
    $target = in_array($target, ['management', 'other_department_head'], true) ? $target : 'department_head';

    if ($target === 'management') {
        $management_user = getSupportUserById($conn, (int) $management_signer_user_id);
        if (!$management_user || !isManagementApprovalUser($management_user)) {
            throw new Exception('signatory_required');
        }

        $management_user['routing_position'] = getDisplayPositionForUser($management_user) ?: ($management_user['position'] ?? 'Bahagian Pengurusan');
        $management_user['source_type'] = 'pengurusan';
        $management_user['route_order'] = 1;

        return [
            'target' => 'management',
            'signer_user' => $management_user,
            'recipients' => [$management_user],
            'signatory_name' => trim((string) ($management_user['fullname'] ?? '')),
            'signatory_position' => getDisplayPositionForUser($management_user) ?: trim((string) ($management_user['position'] ?? '')),
            'signatory_department' => normalizeDepartmentValue($management_user['department'] ?? 'Pengurusan'),
        ];
    }

    if ($target === 'other_department_head') {
        $other_head_user = getSupportUserById($conn, (int) $other_department_head_user_id);
        $other_department = normalizeDepartmentValue($other_head_user['department'] ?? '');
        if (
            !$other_head_user
            || !isHeadOfficerPosition($other_head_user['position'] ?? '')
            || $other_department === ''
            || $other_department === 'Pengurusan'
            || isSameDepartment($other_department, $fallback_department)
        ) {
            throw new Exception('signatory_required');
        }

        $other_head_user['routing_position'] = getDisplayPositionForUser($other_head_user, $other_department) ?: ($other_head_user['position'] ?? 'Ketua Bahagian');
        $other_head_user['source_type'] = 'ketua_bahagian_lain';
        $other_head_user['route_order'] = 1;

        return [
            'target' => 'other_department_head',
            'signer_user' => $other_head_user,
            'recipients' => [$other_head_user],
            'signatory_name' => trim((string) ($other_head_user['fullname'] ?? '')),
            'signatory_position' => getDisplayPositionForUser($other_head_user, $other_department) ?: trim((string) ($other_head_user['position'] ?? '')),
            'signatory_department' => $other_department,
        ];
    }

    if (!$department_head_user) {
        throw new Exception('department_officer_required');
    }

    return [
        'target' => 'department_head',
        'signer_user' => $department_head_user,
        'recipients' => [],
        'signatory_name' => trim((string) ($department_head_user['fullname'] ?? '')),
        'signatory_position' => getDisplayPositionForUser($department_head_user, $fallback_department) ?: trim((string) ($department_head_user['position'] ?? '')),
        'signatory_department' => trim((string) (($department_head_user['department'] ?? '') ?: $fallback_department)),
    ];
}

function buildSuratRasmiApprovalRoute($conn, $preparer_user_id, $folder_department, $department_officer_user_id, $recipients) {
    $preparer = getApprovedUserById($conn, $preparer_user_id);
    if (!$preparer) {
        throw new Exception('validation');
    }

    $needs_department_officer = !isHeadOfficerPosition($preparer['position'] ?? '');
    $department_officer_user = $needs_department_officer ? getSupportUserById($conn, $department_officer_user_id) : null;
    $has_final_recipient = !empty($recipients);

    if ($needs_department_officer) {
        if (!$department_officer_user || !isHeadOfficerPosition($department_officer_user['position'] ?? '')) {
            throw new Exception('department_officer_required');
        }
        if (!isSameDepartmentDb($conn, $department_officer_user['department'] ?? '', $folder_department)) {
            throw new Exception('department_officer_department');
        }
        if ((int) ($department_officer_user['id'] ?? 0) === (int) $preparer_user_id) {
            throw new Exception('duplicate_approver');
        }
    }

    $selected_ids = array_map(function ($recipient) {
        return (int) ($recipient['id'] ?? 0);
    }, $recipients);
    if ($needs_department_officer) {
        $selected_ids[] = (int) ($department_officer_user['id'] ?? 0);
    }
    $selected_ids = array_filter($selected_ids);
    if (count($selected_ids) !== count(array_unique($selected_ids))) {
        throw new Exception('duplicate_approver');
    }

    if ($needs_department_officer) {
        return [
            'needs_department_officer' => true,
            'department_officer_user' => $department_officer_user,
            'current_user' => $department_officer_user,
            'approval_status' => 'menunggu_pegawai_bahagian',
            'approval_stage' => 1,
            'department_officer_status' => 'menunggu',
            'department_officer_requested_now' => true,
        ];
    }

    if ($has_final_recipient) {
        return [
            'needs_department_officer' => false,
            'department_officer_user' => null,
            'current_user' => $recipients[0],
            'approval_status' => 'menunggu_pelulus',
            'approval_stage' => 2,
            'department_officer_status' => 'tidak_perlu',
            'department_officer_requested_now' => false,
        ];
    }

    return [
        'needs_department_officer' => false,
        'department_officer_user' => null,
        'current_user' => null,
        'approval_status' => 'lulus',
        'approval_stage' => 0,
        'department_officer_status' => 'tidak_perlu',
        'department_officer_requested_now' => false,
    ];
}

function redirectDraftSupportError($draft_id, $message = 'system') {
    $draft_id = (int) $draft_id;
    header("Location: draft_letter_print.php?id={$draft_id}&support_error=" . urlencode($message));
    exit();
}

function normalizeApprovalFlow($value) {
    return $value === 'two_level' ? 'two_level' : 'single';
}

function normalizeDraftDocumentType($doc_type) {
    $doc_type = trim((string) $doc_type);
    return $doc_type !== '' ? $doc_type : 'Memo Kelulusan';
}

function getDraftLetterFormPageByDocType($doc_type) {
    $doc_type = normalizeDraftDocumentType($doc_type);
    if ($doc_type === 'Memo') {
        return 'Memo.php';
    }
    if ($doc_type === 'Surat Rasmi') {
        return 'Surat_Rasmi.php';
    }
    return 'Memo_Kelulusan.php';
}

function redirectDraftFormByDocType($doc_type, $query = []) {
    $url = getDraftLetterFormPageByDocType($doc_type);
    if (!empty($query)) {
        $url .= '?' . http_build_query($query);
    }
    header('Location: ' . $url);
    exit();
}

function getDraftDocumentTypeById($conn, $draft_id) {
    $draft_id = (int) $draft_id;
    if ($draft_id <= 0) {
        return 'Memo Kelulusan';
    }
    $stmt = mysqli_prepare($conn, "SELECT doc_type FROM letter_drafts WHERE id = ? LIMIT 1");
    if (!$stmt) {
        return 'Memo Kelulusan';
    }
    mysqli_stmt_bind_param($stmt, "i", $draft_id);
    mysqli_stmt_execute($stmt);
    $row = mysqli_fetch_assoc(mysqli_stmt_get_result($stmt));
    return normalizeDraftDocumentType($row['doc_type'] ?? 'Memo Kelulusan');
}

function lockFolderForDocumentNumbering($conn, $folder_id) {
    $folder_id = (int) $folder_id;
    if ($folder_id <= 0) {
        return false;
    }

    $stmt = mysqli_prepare($conn, "SELECT id FROM folders WHERE id = ? AND deleted_at IS NULL LIMIT 1 FOR UPDATE");
    if (!$stmt) {
        return false;
    }

    mysqli_stmt_bind_param($stmt, "i", $folder_id);
    mysqli_stmt_execute($stmt);
    $row = mysqli_fetch_assoc(mysqli_stmt_get_result($stmt));

    return !empty($row);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'add') {
    if (!currentUserCan($conn, 'draft_letter', 'create')) {
        echo "<script>alert('Anda tidak mempunyai kebenaran untuk menyediakan surat.'); window.location='draft_letters.php';</script>";
        exit();
    }

    $folder_id = (int) ($_POST['folder_id'] ?? 0);
    $template_id = (int) ($_POST['template_id'] ?? 0);
    $subject = trim((string) ($_POST['subject'] ?? ''));
    $letter_date = trim((string) ($_POST['letter_date'] ?? ''));
    $doc_type = normalizeDraftDocumentType($_POST['doc_type'] ?? 'Memo Kelulusan');
    $is_surat_rasmi = strcasecmp($doc_type, 'Surat Rasmi') === 0;
    $recipient_name = trim((string) ($_POST['recipient_name'] ?? ''));
    $recipient_organization = normalizeMemoDisplayPositions($_POST['recipient_organization_checked'] ?? [], $_POST['recipient_organization'] ?? '');
    $recipient_address = '';
    $attention_to = normalizeMemoDisplayPositions($_POST['attention_to_checked'] ?? [], $_POST['attention_to'] ?? '');
    $default_body_font_size = $is_surat_rasmi ? '16px' : '12px';
    if (strcasecmp($doc_type, 'Memo') === 0 || $is_surat_rasmi) {
        $attention_to = '';
    }
    $routing_selection = normalizeMemoRoutingSelection($_POST['routing_positions'] ?? [], $_POST['routing_order'] ?? []);
    $routing_positions = array_column($routing_selection, 'position');
    $routing_positions_json = json_encode($routing_positions, JSON_UNESCAPED_UNICODE);
    $greeting = trim((string) ($_POST['greeting'] ?? ''));
    $letter_pages = sanitizeDraftLetterPagesJson($_POST['letter_pages'] ?? '', $default_body_font_size);
    $letter_body = $letter_pages[0] ?? sanitizeDraftLetterBodyHtml($_POST['letter_body'] ?? '', $default_body_font_size);
    $letter_pages_json = json_encode(!empty($letter_pages) ? $letter_pages : [$letter_body], JSON_UNESCAPED_UNICODE);
    $approval_page_body = sanitizeDraftLetterBodyHtml($_POST['approval_page_body'] ?? '', $default_body_font_size);
    $approval_page_subject = '';
    $approval_route_bodies_json = sanitizeDraftApprovalRouteBodiesJson($_POST['approval_route_bodies'] ?? '', $default_body_font_size);
    $letter_page_signers_json = sanitizeDraftLetterPageSignersJson('', count(!empty($letter_pages) ? $letter_pages : [$letter_body]));
    $page_number_position = in_array($_POST['page_number_position'] ?? '', ['none', 'bottom_center', 'bottom_right'], true)
        ? $_POST['page_number_position']
        : 'none';
    $page_header_text = sanitizeDraftLetterBodyHtml($_POST['page_header_text'] ?? '', $default_body_font_size);
    $page_footer_text = sanitizeDraftLetterBodyHtml($_POST['page_footer_text'] ?? '', $default_body_font_size);
    $closing_text = trim((string) ($_POST['closing_text'] ?? ''));
    $signatory_name = trim((string) ($_POST['signatory_name'] ?? ''));
    $signatory_position = trim((string) ($_POST['signatory_position'] ?? ''));
    $signatory_department = trim((string) ($_POST['signatory_department'] ?? ''));
    $posted_signatory_target = trim((string) ($_POST['signatory_target'] ?? 'department_head'));
    $signatory_target = in_array($posted_signatory_target, ['management', 'other_department_head'], true) ? $posted_signatory_target : 'department_head';
    $management_signer_user_id = (int) ($_POST['management_signer_user_id'] ?? 0);
    $other_department_head_user_id = (int) ($_POST['other_department_head_user_id'] ?? 0);
    $signatory_signature_path = '';
    $approval_flow = 'two_level';
    $department_officer_user_id = (int) ($_POST['department_officer_user_id'] ?? 0);
    $status = trim((string) ($_POST['status'] ?? 'draf'));
    $status = array_key_exists($status, getDraftLetterStatusList()) ? $status : 'draf';
    $is_ready_to_send = $status === 'siap';
    $uploaded_files = normalizeUploadedFiles('file_upload');
    $current_user_id = (int) ($_SESSION['user_id'] ?? 0);
    $preparer_signed = (string) ($_POST['preparer_signed'] ?? '') === '1';

    $body_has_user_content = $is_surat_rasmi ? suratRasmiBodyHasUserContent($letter_body) : draftLetterBodyHasContent($letter_body);
    if ($folder_id <= 0 || $subject === '' || $letter_date === '' || $doc_type === '' || (!$is_surat_rasmi && $recipient_organization === '') || !$body_has_user_content) {
        redirectDraftFormByDocType($doc_type, ['error' => 'validation']);
    }

    mysqli_begin_transaction($conn);

    try {
        $folder_stmt = mysqli_prepare($conn, "SELECT id, folder_name, folder_code, department, closed_at
            FROM folders
            WHERE id = ? AND deleted_at IS NULL AND COALESCE(folder_type, 'office') <> 'sendirian'
            LIMIT 1 FOR UPDATE");
        mysqli_stmt_bind_param($folder_stmt, "i", $folder_id);
        mysqli_stmt_execute($folder_stmt);
        $folder = mysqli_fetch_assoc(mysqli_stmt_get_result($folder_stmt));

        if (!$folder) {
            throw new Exception('folder');
        }

        if (!empty($folder['closed_at'])) {
            throw new Exception('folder_closed');
        }

        if (!isSameDepartmentDb($conn, $folder['department'] ?? '', $user_department)) {
            throw new Exception('unauthorized');
        }

        $department_head_user = getDepartmentHeadOfficerByDepartment($conn, $folder['department'] ?? '');
        if ($department_head_user && $department_officer_user_id <= 0) {
            $department_officer_user_id = (int) ($department_head_user['id'] ?? 0);
        }
        if ($is_surat_rasmi) {
            $surat_rasmi_signer = resolveSuratRasmiFinalSigner($conn, $signatory_target, $management_signer_user_id, $other_department_head_user_id, $department_head_user, $folder['department'] ?? '');
            $signatory_name = $surat_rasmi_signer['signatory_name'];
            $signatory_position = $surat_rasmi_signer['signatory_position'];
            $signatory_department = $surat_rasmi_signer['signatory_department'];
            $signatory_position = getDisplayPositionForUser($department_head_user, $folder['department'] ?? '')
                ?: $signatory_position;
        } else {
            applyDepartmentHeadSignatory($signatory_name, $signatory_position, $signatory_department, $department_head_user, $folder['department'] ?? '');
        }

        $approval_recipients = [];
        $route = [
            'needs_department_officer' => false,
            'department_officer_user' => null,
            'current_user' => null,
            'approval_status' => $is_surat_rasmi && $is_ready_to_send ? 'lulus' : 'draft',
            'approval_stage' => 0,
            'department_officer_status' => 'tidak_perlu',
            'department_officer_requested_now' => false,
        ];
        $support_user = null;
        $support_user_id = 0;
        $support_required = 0;
        $support_name = null;
        $support_email = null;
        $support_status = 'tidak_perlu';

        $excluded_approval_user_ids = $department_head_user ? [(int) ($department_head_user['id'] ?? 0)] : [];
        $approval_recipients = $is_surat_rasmi
            ? ($surat_rasmi_signer['recipients'] ?? [])
            : resolveMemoApprovalRecipients($conn, $recipient_organization, $attention_to, $routing_selection, $current_user_id, $excluded_approval_user_ids);

        if ($is_ready_to_send) {
            if (!$is_surat_rasmi && !approvalRouteBodiesCoverRecipients($approval_route_bodies_json, $approval_recipients)) {
                throw new Exception('approval_content_required');
            }
            if ($is_surat_rasmi) {
                $route = buildSuratRasmiApprovalRoute($conn, $current_user_id, $folder['department'] ?? '', $department_officer_user_id, $approval_recipients);
                $support_user = $route['current_user'];
                $support_user_id = (int) ($support_user['id'] ?? 0);
                $support_required = $support_user_id > 0 ? 1 : 0;
                $support_name = $support_user['fullname'] ?? null;
                $support_email = $support_user['email'] ?? null;
                $support_status = $support_required ? 'menunggu' : 'tidak_perlu';
            } else {
                $route = buildDraftApprovalRoute($conn, $current_user_id, $folder['department'] ?? '', $department_officer_user_id, $approval_recipients);
                $support_user = $route['current_user'];
                $support_user_id = (int) ($support_user['id'] ?? 0);
                $support_required = $support_user_id > 0 ? 1 : 0;
                $support_name = $support_user['fullname'] ?? null;
                $support_email = $support_user['email'] ?? null;
                $support_status = $support_required ? 'menunggu' : 'tidak_perlu';
                applyDepartmentHeadSignatory($signatory_name, $signatory_position, $signatory_department, $department_head_user, $folder['department'] ?? '');
            }
        }

        $ref_no = generateNextDocumentReference($folder['folder_code'] ?? '');
        if ($ref_no === '') {
            throw new Exception('Gagal menjana nombor rujukan surat.');
        }

        $file_numbering = $is_ready_to_send ? generateNextDocumentFileNumbering($conn, $folder_id) : 'X';
        if ($is_surat_rasmi) {
            $surat_rasmi_reference_display = formatDraftLetterReferenceDisplay($folder['department'] ?? '', $ref_no, $is_ready_to_send ? $file_numbering : 'X');
            $letter_pages = applySuratRasmiGeneratedReferenceToPages(!empty($letter_pages) ? $letter_pages : [$letter_body], $surat_rasmi_reference_display);
            $letter_body = $letter_pages[0] ?? $letter_body;
            $letter_pages_json = json_encode($letter_pages, JSON_UNESCAPED_UNICODE);
        }
        $submitted_at_sql = $is_ready_to_send ? "NOW(6)" : "NULL";

        $signatory_signature_path = '';
        $surat_rasmi_has_final_recipient = $is_surat_rasmi && !empty($approval_recipients);
        if ($is_ready_to_send && empty($route['needs_department_officer']) && !$surat_rasmi_has_final_recipient) {
            if ($is_surat_rasmi) {
                if (!$preparer_signed) {
                    throw new Exception('preparer_signature_required');
                }
                $signatory_signature_path = $preparer_signed ? getUserSignaturePath($conn, $current_user_id) : '';
                if ($preparer_signed && $signatory_signature_path === '') {
                    throw new Exception('preparer_signature_missing');
                }
            } else {
                $signatory_signature_path = getUserSignaturePath($conn, $current_user_id);
                if (!$preparer_signed) {
                    throw new Exception('preparer_signature_required');
                }
                if ($signatory_signature_path === '') {
                    throw new Exception('preparer_signature_missing');
                }
            }
        }
        if (!$is_ready_to_send) {
            $signatory_signature_path = '';
        }

        $to_person = buildDraftRecipientSummary($recipient_name, $recipient_organization, $attention_to);
        $from_person = trim((string) ($folder['department'] ?? ''));
        $file_path = null;

        $insert_doc = mysqli_prepare($conn, "INSERT INTO documents (folder_id, ref_no, file_numbering, subject, doc_date, from_person, to_person, doc_type, file_path)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
        mysqli_stmt_bind_param($insert_doc, "issssssss", $folder_id, $ref_no, $file_numbering, $subject, $letter_date, $from_person, $to_person, $doc_type, $file_path);
        if (!mysqli_stmt_execute($insert_doc)) {
            throw new Exception(mysqli_error($conn));
        }

        $document_id = (int) mysqli_insert_id($conn);
        $attachment_result = saveDocumentAttachments($conn, $document_id, $folder_id, $uploaded_files);
        if (!empty($attachment_result['first_path'])) {
            $file_path = $attachment_result['first_path'];
            $update_primary = mysqli_prepare($conn, "UPDATE documents SET file_path = ? WHERE id = ?");
            mysqli_stmt_bind_param($update_primary, "si", $file_path, $document_id);
            mysqli_stmt_execute($update_primary);
        }

        $preparer_signed_value_sql = ($is_ready_to_send && empty($route['needs_department_officer']) && (!$is_surat_rasmi || $preparer_signed)) ? "NOW()" : "NULL";
        $insert_draft = mysqli_prepare($conn, "INSERT INTO letter_drafts
            (document_id, folder_id, department, ref_no, letter_date, subject, doc_type, recipient_name, recipient_organization, recipient_address, attention_to, routing_positions, greeting, letter_body, letter_pages, approval_page_body, approval_page_subject, approval_route_bodies, letter_page_signers, page_number_position, page_header_text, page_footer_text, closing_text, signatory_name, signatory_position, signatory_department, signatory_signature_path, preparer_signed_at, status, support_required, support_user_id, support_name, support_email, support_status, support_requested_at, created_by, updated_by)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, {$preparer_signed_value_sql}, ?, ?, ?, ?, ?, ?, " . ($support_required ? "NOW()" : "NULL") . ", ?, ?)");
        $insert_draft_types = 'ii' . str_repeat('s', 26) . 'iisssii';
        mysqli_stmt_bind_param(
            $insert_draft,
            $insert_draft_types,
            $document_id,
            $folder_id,
            $folder['department'],
            $ref_no,
            $letter_date,
            $subject,
            $doc_type,
            $recipient_name,
            $recipient_organization,
            $recipient_address,
            $attention_to,
            $routing_positions_json,
            $greeting,
            $letter_body,
            $letter_pages_json,
            $approval_page_body,
            $approval_page_subject,
            $approval_route_bodies_json,
            $letter_page_signers_json,
            $page_number_position,
            $page_header_text,
            $page_footer_text,
            $closing_text,
            $signatory_name,
            $signatory_position,
            $signatory_department,
            $signatory_signature_path,
            $status,
            $support_required,
            $support_user_id,
            $support_name,
            $support_email,
            $support_status,
            $current_user_id,
            $current_user_id
        );
        if (!mysqli_stmt_execute($insert_draft)) {
            throw new Exception(mysqli_error($conn));
        }

        $draft_id = (int) mysqli_insert_id($conn);
        if ($is_ready_to_send) {
            $submitted_update = mysqli_prepare($conn, "UPDATE letter_drafts SET submitted_at = {$submitted_at_sql} WHERE id = ?");
            mysqli_stmt_bind_param($submitted_update, "i", $draft_id);
            if (!mysqli_stmt_execute($submitted_update)) {
                throw new Exception(mysqli_error($conn));
            }
        }
        if ($template_id > 0) {
            $template_update = mysqli_prepare($conn, "UPDATE letter_drafts SET template_id = ? WHERE id = ?");
            mysqli_stmt_bind_param($template_update, "ii", $template_id, $draft_id);
            mysqli_stmt_execute($template_update);
        }
        $approval_status = $is_ready_to_send ? $route['approval_status'] : 'draft';
        $approval_stage = (int) $route['approval_stage'];
        $department_officer_user = $route['department_officer_user'];
        $department_officer_save_id = $is_ready_to_send
            ? ($route['needs_department_officer'] ? $department_officer_user_id : 0)
            : $department_officer_user_id;
        $department_officer_name = $is_ready_to_send ? ($department_officer_user['fullname'] ?? null) : null;
        $department_officer_email = $is_ready_to_send ? ($department_officer_user['email'] ?? null) : null;
        $department_officer_status = $is_ready_to_send ? $route['department_officer_status'] : 'tidak_perlu';
        $department_officer_requested_sql = ($is_ready_to_send && $route['department_officer_requested_now']) ? "NOW()" : "NULL";
        $approval_update = mysqli_prepare($conn, "UPDATE letter_drafts
            SET approval_flow = ?, approval_status = ?, approval_stage = ?,
                department_officer_user_id = ?, department_officer_name = ?, department_officer_email = ?, department_officer_status = ?, department_officer_requested_at = {$department_officer_requested_sql}
            WHERE id = ?");
        mysqli_stmt_bind_param(
            $approval_update,
            "ssiisssi",
            $approval_flow,
            $approval_status,
            $approval_stage,
            $department_officer_save_id,
            $department_officer_name,
            $department_officer_email,
            $department_officer_status,
            $draft_id
        );
        if (!mysqli_stmt_execute($approval_update)) {
            throw new Exception(mysqli_error($conn));
        }
        syncMemoApprovalRecipients($conn, $draft_id, $approval_recipients, $is_ready_to_send && !$route['needs_department_officer']);
        mysqli_commit($conn);

        logActivity($conn, $current_user_id, 'create_draft_letter', "Create draft letter: {$ref_no} - {$subject} (Draft ID: {$draft_id}, Document ID: {$document_id})");
        if ($is_ready_to_send && $route['needs_department_officer'] && $support_required && $support_email) {
            sendDraftLetterSupportRequestEmail($support_email, $support_name, [
                'id' => $draft_id,
                'ref_no' => $ref_no,
                'subject' => $subject,
            ]);
        } elseif ($is_ready_to_send && !$route['needs_department_officer'] && !empty($approval_recipients)) {
            sendMemoApprovalRecipientEmails($conn, $draft_id, [
                'id' => $draft_id,
                'ref_no' => $ref_no,
                'subject' => $subject,
            ]);
        }
        header("Location: draft_letter_print.php?id={$draft_id}&success=created");
        exit();
    } catch (Exception $e) {
        mysqli_rollback($conn);

        if ($e->getMessage() === 'folder') {
            redirectDraftFormByDocType($doc_type, ['error' => 'folder']);
        }

        if ($e->getMessage() === 'folder_closed') {
            redirectDraftFormByDocType($doc_type, ['error' => 'folder_closed']);
        }

        if ($e->getMessage() === 'unauthorized') {
            header("Location: draft_letters.php?error=unauthorized");
            exit();
        }

        if (in_array($e->getMessage(), ['validation', 'department_officer_required', 'department_officer_department', 'duplicate_approver', 'approval_recipient_required', 'approval_content_required', 'preparer_signature_required', 'preparer_signature_missing', 'signatory_required'], true)) {
            redirectDraftFormByDocType($doc_type, ['error' => 'validation', 'msg' => $e->getMessage()]);
        }

        redirectDraftFormByDocType($doc_type, ['error' => 'system', 'msg' => $e->getMessage()]);
    }
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'update') {
    if (!currentUserCan($conn, 'draft_letter', 'update')) {
        echo "<script>alert('Anda tidak mempunyai kebenaran untuk mengubah surat ini.'); window.location='draft_letters.php';</script>";
        exit();
    }

    $draft_id = (int) ($_POST['id'] ?? 0);
    $folder_id = (int) ($_POST['folder_id'] ?? 0);
    $template_id = (int) ($_POST['template_id'] ?? 0);
    $subject = trim((string) ($_POST['subject'] ?? ''));
    $letter_date = trim((string) ($_POST['letter_date'] ?? ''));
    $doc_type = normalizeDraftDocumentType($_POST['doc_type'] ?? 'Memo Kelulusan');
    $is_surat_rasmi = strcasecmp($doc_type, 'Surat Rasmi') === 0;
    $recipient_name = trim((string) ($_POST['recipient_name'] ?? ''));
    $recipient_organization = normalizeMemoDisplayPositions($_POST['recipient_organization_checked'] ?? [], $_POST['recipient_organization'] ?? '');
    $recipient_address = '';
    $attention_to = normalizeMemoDisplayPositions($_POST['attention_to_checked'] ?? [], $_POST['attention_to'] ?? '');
    $default_body_font_size = $is_surat_rasmi ? '16px' : '12px';
    if (strcasecmp($doc_type, 'Memo') === 0 || $is_surat_rasmi) {
        $attention_to = '';
    }
    $routing_selection = normalizeMemoRoutingSelection($_POST['routing_positions'] ?? [], $_POST['routing_order'] ?? []);
    $routing_positions = array_column($routing_selection, 'position');
    $routing_positions_json = json_encode($routing_positions, JSON_UNESCAPED_UNICODE);
    $greeting = trim((string) ($_POST['greeting'] ?? ''));
    $letter_pages = sanitizeDraftLetterPagesJson($_POST['letter_pages'] ?? '', $default_body_font_size);
    $letter_body = $letter_pages[0] ?? sanitizeDraftLetterBodyHtml($_POST['letter_body'] ?? '', $default_body_font_size);
    $letter_pages_json = json_encode(!empty($letter_pages) ? $letter_pages : [$letter_body], JSON_UNESCAPED_UNICODE);
    $approval_page_body = sanitizeDraftLetterBodyHtml($_POST['approval_page_body'] ?? '', $default_body_font_size);
    $approval_page_subject = '';
    $approval_route_bodies_json = sanitizeDraftApprovalRouteBodiesJson($_POST['approval_route_bodies'] ?? '', $default_body_font_size);
    $letter_page_signers_json = sanitizeDraftLetterPageSignersJson('', count(!empty($letter_pages) ? $letter_pages : [$letter_body]));
    $page_number_position = in_array($_POST['page_number_position'] ?? '', ['none', 'bottom_center', 'bottom_right'], true)
        ? $_POST['page_number_position']
        : 'none';
    $page_header_text = sanitizeDraftLetterBodyHtml($_POST['page_header_text'] ?? '', $default_body_font_size);
    $page_footer_text = sanitizeDraftLetterBodyHtml($_POST['page_footer_text'] ?? '', $default_body_font_size);
    $closing_text = trim((string) ($_POST['closing_text'] ?? ''));
    $signatory_name = trim((string) ($_POST['signatory_name'] ?? ''));
    $signatory_position = trim((string) ($_POST['signatory_position'] ?? ''));
    $signatory_department = trim((string) ($_POST['signatory_department'] ?? ''));
    $posted_signatory_target = trim((string) ($_POST['signatory_target'] ?? 'department_head'));
    $signatory_target = in_array($posted_signatory_target, ['management', 'other_department_head'], true) ? $posted_signatory_target : 'department_head';
    $management_signer_user_id = (int) ($_POST['management_signer_user_id'] ?? 0);
    $other_department_head_user_id = (int) ($_POST['other_department_head_user_id'] ?? 0);
    $approval_flow = 'two_level';
    $department_officer_user_id = (int) ($_POST['department_officer_user_id'] ?? 0);
    $status = trim((string) ($_POST['status'] ?? 'draf'));
    $status = array_key_exists($status, getDraftLetterStatusList()) ? $status : 'draf';
    $is_ready_to_send = $status === 'siap';
    $uploaded_files = normalizeUploadedFiles('file_upload');
    $current_user_id = (int) ($_SESSION['user_id'] ?? 0);
    $preparer_signed = (string) ($_POST['preparer_signed'] ?? '') === '1';

    $body_has_user_content = $is_surat_rasmi ? suratRasmiBodyHasUserContent($letter_body) : draftLetterBodyHasContent($letter_body);
    if ($draft_id <= 0 || $folder_id <= 0 || $subject === '' || $letter_date === '' || $doc_type === '' || (!$is_surat_rasmi && $recipient_organization === '') || !$body_has_user_content) {
        redirectDraftFormByDocType($doc_type, ['id' => $draft_id, 'error' => 'validation']);
    }

    mysqli_begin_transaction($conn);

    try {
        $draft_stmt = mysqli_prepare($conn, "SELECT ld.*, f.folder_code, f.department AS folder_department
            FROM letter_drafts ld
            INNER JOIN folders f ON f.id = ld.folder_id
            WHERE ld.id = ? AND ld.deleted_at IS NULL
            LIMIT 1 FOR UPDATE");
        mysqli_stmt_bind_param($draft_stmt, "i", $draft_id);
        mysqli_stmt_execute($draft_stmt);
        $draft = mysqli_fetch_assoc(mysqli_stmt_get_result($draft_stmt));

        if (!$draft) {
            throw new Exception('not_found');
        }

        if (($draft['approval_status'] ?? '') === 'lulus') {
            throw new Exception('approved_locked');
        }

        $is_existing_private_draft = ($draft['status'] ?? 'draf') === 'draf' || ($draft['approval_status'] ?? 'draft') === 'draft';
        if ($is_existing_private_draft && (int) ($draft['created_by'] ?? 0) !== $current_user_id && $role !== 'superadmin') {
            throw new Exception('unauthorized');
        }

        if (!isSameDepartmentDb($conn, $draft['department'] ?? '', $user_department)) {
            throw new Exception('unauthorized');
        }

        $preparer_user_id = (int) ($draft['created_by'] ?? $current_user_id);
        $draft_department = $draft['folder_department'] ?? $draft['department'] ?? '';
        $department_head_user = getDepartmentHeadOfficerByDepartment($conn, $draft_department);
        if ($department_head_user && $department_officer_user_id <= 0) {
            $department_officer_user_id = (int) ($department_head_user['id'] ?? 0);
        }
        if ($is_surat_rasmi) {
            $surat_rasmi_signer = resolveSuratRasmiFinalSigner($conn, $signatory_target, $management_signer_user_id, $other_department_head_user_id, $department_head_user, $draft_department);
            $signatory_name = $surat_rasmi_signer['signatory_name'];
            $signatory_position = $surat_rasmi_signer['signatory_position'];
            $signatory_department = $surat_rasmi_signer['signatory_department'];
            $signatory_position = getDisplayPositionForUser($department_head_user, $draft_department)
                ?: $signatory_position;
        } else {
            applyDepartmentHeadSignatory($signatory_name, $signatory_position, $signatory_department, $department_head_user, $draft_department);
        }
        $approval_recipients = [];
        $route = [
            'needs_department_officer' => false,
            'department_officer_user' => null,
            'current_user' => null,
            'approval_status' => $is_surat_rasmi && $is_ready_to_send ? 'lulus' : 'draft',
            'approval_stage' => 0,
            'department_officer_status' => 'tidak_perlu',
            'department_officer_requested_now' => false,
        ];
        $support_user = null;
        $support_user_id = 0;
        $support_required = 0;
        $support_name = null;
        $support_email = null;

        $excluded_approval_user_ids = $department_head_user ? [(int) ($department_head_user['id'] ?? 0)] : [];
        $approval_recipients = $is_surat_rasmi
            ? ($surat_rasmi_signer['recipients'] ?? [])
            : resolveMemoApprovalRecipients($conn, $recipient_organization, $attention_to, $routing_selection, $preparer_user_id, $excluded_approval_user_ids);

        if ($is_ready_to_send) {
            if (!$is_surat_rasmi && !approvalRouteBodiesCoverRecipients($approval_route_bodies_json, $approval_recipients)) {
                throw new Exception('approval_content_required');
            }
            if ($is_surat_rasmi) {
                $route = buildSuratRasmiApprovalRoute($conn, $preparer_user_id, $draft_department, $department_officer_user_id, $approval_recipients);
                $support_user = $route['current_user'];
                $support_user_id = (int) ($support_user['id'] ?? 0);
                $support_required = $support_user_id > 0 ? 1 : 0;
                $support_name = $support_user['fullname'] ?? null;
                $support_email = $support_user['email'] ?? null;
            } else {
                $route = buildDraftApprovalRoute($conn, $preparer_user_id, $draft_department, $department_officer_user_id, $approval_recipients);
                $support_user = $route['current_user'];
                $support_user_id = (int) ($support_user['id'] ?? 0);
                $support_required = $support_user_id > 0 ? 1 : 0;
                $support_name = $support_user['fullname'] ?? null;
                $support_email = $support_user['email'] ?? null;
                applyDepartmentHeadSignatory($signatory_name, $signatory_position, $signatory_department, $department_head_user, $draft_department);
            }
        }

        $document_stmt = mysqli_prepare($conn, "SELECT id, file_numbering FROM documents WHERE id = ? AND deleted_at IS NULL LIMIT 1 FOR UPDATE");
        mysqli_stmt_bind_param($document_stmt, "i", $draft['document_id']);
        mysqli_stmt_execute($document_stmt);
        $document_exists = mysqli_fetch_assoc(mysqli_stmt_get_result($document_stmt));
        if (!$document_exists) {
            throw new Exception('document_missing');
        }

        $to_person = buildDraftRecipientSummary($recipient_name, $recipient_organization, $attention_to);
        $from_person = trim((string) ($draft['folder_department'] ?? $draft['department'] ?? ''));
        $ref_no = trim((string) ($draft['ref_no'] ?? ''));
        $file_numbering = trim((string) ($document_exists['file_numbering'] ?? ''));
        if ($is_ready_to_send && ($file_numbering === '' || strtoupper($file_numbering) === 'X' || $file_numbering === $ref_no)) {
            $numbering_folder_id = (int) ($draft['folder_id'] ?? $folder_id);
            if (!lockFolderForDocumentNumbering($conn, $numbering_folder_id)) {
                throw new Exception('folder');
            }
            $file_numbering = generateNextDocumentFileNumbering($conn, $numbering_folder_id);
        } elseif (!$is_ready_to_send) {
            $file_numbering = 'X';
        }
        if ($is_surat_rasmi) {
            $surat_rasmi_reference_display = formatDraftLetterReferenceDisplay($draft_department, $ref_no, $is_ready_to_send ? $file_numbering : 'X');
            $letter_pages = applySuratRasmiGeneratedReferenceToPages(!empty($letter_pages) ? $letter_pages : [$letter_body], $surat_rasmi_reference_display);
            $letter_body = $letter_pages[0] ?? $letter_body;
            $letter_pages_json = json_encode($letter_pages, JSON_UNESCAPED_UNICODE);
        }
        $signatory_signature_path = trim((string) ($draft['signatory_signature_path'] ?? ''));
        $surat_rasmi_has_final_recipient = $is_surat_rasmi && !empty($approval_recipients);
        if ($is_ready_to_send && empty($route['needs_department_officer']) && !$surat_rasmi_has_final_recipient) {
            if ($is_surat_rasmi) {
                if (!$preparer_signed) {
                    throw new Exception('preparer_signature_required');
                }
                $signatory_signature_path = $preparer_signed ? getUserSignaturePath($conn, $preparer_user_id) : '';
                if ($preparer_signed && $signatory_signature_path === '') {
                    throw new Exception('preparer_signature_missing');
                }
            } else {
                $signatory_signature_path = getUserSignaturePath($conn, $preparer_user_id);
                if (!$preparer_signed) {
                    throw new Exception('preparer_signature_required');
                }
                if ($signatory_signature_path === '') {
                    throw new Exception('preparer_signature_missing');
                }
            }
        } elseif ($is_ready_to_send && !empty($route['needs_department_officer']) && in_array($draft['approval_status'] ?? '', ['draft', 'ditolak'], true)) {
            $signatory_signature_path = '';
        }
        if (!$is_ready_to_send) {
            $signatory_signature_path = '';
        }
        $existing_routing_positions = decodeMemoRoutingPositions($draft['routing_positions'] ?? '');
        $new_routing_positions = $routing_positions;
        $support_changed = !$is_surat_rasmi && (($draft['approval_flow'] ?? 'single') !== $approval_flow
            || (int) ($draft['department_officer_user_id'] ?? 0) !== ($route['needs_department_officer'] ? $department_officer_user_id : 0)
            || $existing_routing_positions !== $new_routing_positions);
        if ($is_surat_rasmi) {
            $existing_recipient_ids = array_map(function ($recipient) {
                return (int) ($recipient['user_id'] ?? 0);
            }, getLetterApprovalRecipients($conn, $draft_id));
            $new_recipient_ids = array_map(function ($recipient) {
                return (int) ($recipient['id'] ?? 0);
            }, $approval_recipients);
            $support_changed = (int) ($draft['department_officer_user_id'] ?? 0) !== ($route['needs_department_officer'] ? $department_officer_user_id : 0)
                || $existing_recipient_ids !== $new_recipient_ids;
        }
        $is_rejected_resubmission = (($draft['approval_status'] ?? '') === 'ditolak'
            || ($draft['support_status'] ?? '') === 'ditolak');
        $is_draft_submission = $is_ready_to_send
            && ((($draft['status'] ?? 'draf') === 'draf') || (($draft['approval_status'] ?? 'draft') === 'draft'));
        $restart_approval = $support_changed || $is_rejected_resubmission || $is_draft_submission;
        if (!$restart_approval) {
            $support_user_id = (int) ($draft['support_user_id'] ?? 0);
            $support_required = (int) ($draft['support_required'] ?? ($support_user_id > 0 ? 1 : 0));
            $support_name = $draft['support_name'] ?? null;
            $support_email = $draft['support_email'] ?? null;
        }
        $support_status = $is_ready_to_send && $support_required
            ? ($restart_approval ? 'menunggu' : ($draft['support_status'] ?? 'menunggu'))
            : 'tidak_perlu';
        $preparer_signed_sql = ($is_ready_to_send && empty($route['needs_department_officer']) && (!$is_surat_rasmi || $preparer_signed))
            ? "IF(preparer_signed_at IS NULL, NOW(), preparer_signed_at)"
            : "NULL";
        $support_requested_sql = ($is_ready_to_send && $support_required && $restart_approval) ? "support_requested_at = NOW()," : (!$is_ready_to_send ? "support_requested_at = NULL," : "");
        $support_note_reset_sql = ($is_surat_rasmi || $restart_approval || !$is_ready_to_send) ? "support_note = NULL," : "";
        $submitted_at_sql = $is_ready_to_send
            ? "submitted_at = IF(submitted_at IS NULL, NOW(6), submitted_at),"
            : "submitted_at = NULL,";

        $update_doc = mysqli_prepare($conn, "UPDATE documents
            SET ref_no = ?, file_numbering = ?, subject = ?, doc_date = ?, from_person = ?, to_person = ?, doc_type = ?
            WHERE id = ? AND deleted_at IS NULL");
        mysqli_stmt_bind_param($update_doc, "sssssssi", $ref_no, $file_numbering, $subject, $letter_date, $from_person, $to_person, $doc_type, $draft['document_id']);
        if (!mysqli_stmt_execute($update_doc)) {
            throw new Exception(mysqli_error($conn));
        }

        $attachment_result = saveDocumentAttachments($conn, (int) $draft['document_id'], $folder_id, $uploaded_files);
        if (!empty($attachment_result['first_path'])) {
            syncDocumentPrimaryFilePath($conn, (int) $draft['document_id']);
        }

        $update_draft = mysqli_prepare($conn, "UPDATE letter_drafts
            SET letter_date = ?, subject = ?, doc_type = ?, recipient_name = ?, recipient_organization = ?, recipient_address = ?, attention_to = ?, routing_positions = ?, greeting = ?, letter_body = ?, letter_pages = ?, approval_page_body = ?, approval_page_subject = ?, approval_route_bodies = ?, letter_page_signers = ?, page_number_position = ?, page_header_text = ?, page_footer_text = ?, closing_text = ?, signatory_name = ?, signatory_position = ?, signatory_department = ?, signatory_signature_path = ?, preparer_signed_at = {$preparer_signed_sql}, status = ?, support_required = ?, support_user_id = ?, support_name = ?, support_email = ?, support_status = ?, {$support_requested_sql} {$support_note_reset_sql} {$submitted_at_sql} support_responded_at = IF(? IN ('tidak_perlu','menunggu'), NULL, support_responded_at), updated_by = ?, updated_at = CURRENT_TIMESTAMP
            WHERE id = ? AND deleted_at IS NULL");
        mysqli_stmt_bind_param(
            $update_draft,
            str_repeat('s', 24) . 'iissssii',
            $letter_date,
            $subject,
            $doc_type,
            $recipient_name,
            $recipient_organization,
            $recipient_address,
            $attention_to,
            $routing_positions_json,
            $greeting,
            $letter_body,
            $letter_pages_json,
            $approval_page_body,
            $approval_page_subject,
            $approval_route_bodies_json,
            $letter_page_signers_json,
            $page_number_position,
            $page_header_text,
            $page_footer_text,
            $closing_text,
            $signatory_name,
            $signatory_position,
            $signatory_department,
            $signatory_signature_path,
            $status,
            $support_required,
            $support_user_id,
            $support_name,
            $support_email,
            $support_status,
            $support_status,
            $current_user_id,
            $draft_id
        );
        if (!mysqli_stmt_execute($update_draft)) {
            throw new Exception(mysqli_error($conn));
        }
        if ($template_id > 0) {
            $template_update = mysqli_prepare($conn, "UPDATE letter_drafts SET template_id = ? WHERE id = ?");
            mysqli_stmt_bind_param($template_update, "ii", $template_id, $draft_id);
            mysqli_stmt_execute($template_update);
        }

        $approval_status = $is_ready_to_send
            ? ($restart_approval ? $route['approval_status'] : ($draft['approval_status'] ?? 'menunggu_pelulus'))
            : 'draft';
        $approval_stage = $is_ready_to_send
            ? ($restart_approval ? (int) $route['approval_stage'] : (int) ($draft['approval_stage'] ?? 1))
            : 0;
        $department_officer_user = $route['department_officer_user'];
        $department_officer_save_id = $is_ready_to_send
            ? ($route['needs_department_officer'] ? $department_officer_user_id : 0)
            : $department_officer_user_id;
        $department_officer_name = $is_ready_to_send ? ($department_officer_user['fullname'] ?? null) : null;
        $department_officer_email = $is_ready_to_send ? ($department_officer_user['email'] ?? null) : null;
        $department_officer_status = $is_ready_to_send
            ? ($restart_approval ? $route['department_officer_status'] : ($draft['department_officer_status'] ?? 'tidak_perlu'))
            : 'tidak_perlu';
        $approval_requested_sql = ($restart_approval || !$is_ready_to_send)
            ? "department_officer_decision = 'belum_diputuskan', department_officer_requested_at = " . ($route['department_officer_requested_now'] ? "NOW()" : "NULL") . ", department_officer_approved_at = NULL, department_officer_responded_at = NULL, department_officer_signature_path = NULL, department_officer_note = NULL,"
            : "";
        $approval_update = mysqli_prepare($conn, "UPDATE letter_drafts
            SET approval_flow = ?, approval_status = ?, approval_stage = ?,
                department_officer_user_id = ?, department_officer_name = ?, department_officer_email = ?, department_officer_status = ?,
                {$approval_requested_sql} updated_by = ?, updated_at = CURRENT_TIMESTAMP
            WHERE id = ? AND deleted_at IS NULL");
        mysqli_stmt_bind_param(
            $approval_update,
            "ssiisssii",
            $approval_flow,
            $approval_status,
            $approval_stage,
            $department_officer_save_id,
            $department_officer_name,
            $department_officer_email,
            $department_officer_status,
            $current_user_id,
            $draft_id
        );
        if (!mysqli_stmt_execute($approval_update)) {
            throw new Exception(mysqli_error($conn));
        }
        if ($is_surat_rasmi) {
            if ($restart_approval || !$is_ready_to_send) {
                syncMemoApprovalRecipients($conn, $draft_id, $approval_recipients, $is_ready_to_send && !$route['needs_department_officer']);
            }
        } elseif ($restart_approval || !$is_ready_to_send) {
            syncMemoApprovalRecipients($conn, $draft_id, $approval_recipients, $is_ready_to_send && !$route['needs_department_officer']);
        }

        mysqli_commit($conn);
        logActivity($conn, $current_user_id, 'update_draft_letter', "Update draft letter: {$ref_no} - {$subject} (Draft ID: {$draft_id})");
        if ($is_ready_to_send && $restart_approval && $route['needs_department_officer'] && $support_required && $support_email) {
            sendDraftLetterSupportRequestEmail($support_email, $support_name, [
                'id' => $draft_id,
                'ref_no' => $ref_no,
                'subject' => $subject,
            ]);
        } elseif ($is_ready_to_send && $restart_approval && !$route['needs_department_officer'] && !empty($approval_recipients)) {
            sendMemoApprovalRecipientEmails($conn, $draft_id, [
                'id' => $draft_id,
                'ref_no' => $ref_no,
                'subject' => $subject,
            ]);
        }
        header("Location: draft_letter_print.php?id={$draft_id}&success=updated");
        exit();
    } catch (Exception $e) {
        mysqli_rollback($conn);

        if ($e->getMessage() === 'not_found') {
            header("Location: draft_letters.php?error=not_found");
            exit();
        }
        if ($e->getMessage() === 'unauthorized') {
            header("Location: draft_letters.php?error=unauthorized");
            exit();
        }
        if ($e->getMessage() === 'approved_locked') {
            echo "<script>alert('Surat yang telah lulus tidak boleh diubah.'); window.location='draft_letter_print.php?id={$draft_id}';</script>";
            exit();
        }
        if ($e->getMessage() === 'document_missing') {
            redirectDraftFormByDocType($doc_type, ['id' => $draft_id, 'error' => 'document_missing']);
        }
        if (in_array($e->getMessage(), ['validation', 'department_officer_required', 'department_officer_department', 'duplicate_approver', 'approval_recipient_required', 'approval_content_required', 'preparer_signature_required', 'preparer_signature_missing', 'signatory_required'], true)) {
            redirectDraftFormByDocType($doc_type, ['id' => $draft_id, 'error' => 'validation', 'msg' => $e->getMessage()]);
        }

        redirectDraftFormByDocType($doc_type, ['id' => $draft_id, 'error' => 'system', 'msg' => $e->getMessage()]);
    }
}

if ($action === 'delete' && isset($_GET['id'])) {
    if (!currentUserCan($conn, 'draft_letter', 'delete')) {
        echo "<script>alert('Anda tidak mempunyai kebenaran untuk memadam surat ini.'); window.location='draft_letters.php';</script>";
        exit();
    }

    $draft_id = (int) $_GET['id'];
    $draft_stmt = mysqli_prepare($conn, "SELECT id, document_id, ref_no, subject, department, created_by FROM letter_drafts WHERE id = ? AND deleted_at IS NULL LIMIT 1");
    mysqli_stmt_bind_param($draft_stmt, "i", $draft_id);
    mysqli_stmt_execute($draft_stmt);
    $draft = mysqli_fetch_assoc(mysqli_stmt_get_result($draft_stmt));

    if (!$draft) {
        header("Location: draft_letters.php?error=not_found");
        exit();
    }

    $current_user_id = (int) ($_SESSION['user_id'] ?? 0);
    if ((int) ($draft['created_by'] ?? 0) !== $current_user_id
        && !isSameDepartmentDb($conn, $draft['department'] ?? '', $user_department)) {
        header("Location: draft_letters.php?error=unauthorized");
        exit();
    }

    mysqli_begin_transaction($conn);
    try {
        $delete_stmt = mysqli_prepare($conn, "UPDATE letter_drafts SET deleted_at = NOW(), deleted_by = ? WHERE id = ? AND deleted_at IS NULL");
        mysqli_stmt_bind_param($delete_stmt, "ii", $current_user_id, $draft_id);
        if (!mysqli_stmt_execute($delete_stmt)) {
            throw new Exception(mysqli_error($conn));
        }

        $document_id = (int) ($draft['document_id'] ?? 0);
        if ($document_id > 0) {
            $document_stmt = mysqli_prepare($conn, "SELECT id, subject FROM documents WHERE id = ? AND deleted_at IS NULL LIMIT 1 FOR UPDATE");
            mysqli_stmt_bind_param($document_stmt, "i", $document_id);
            mysqli_stmt_execute($document_stmt);
            $document = mysqli_fetch_assoc(mysqli_stmt_get_result($document_stmt));

            if ($document) {
                $delete_doc_stmt = mysqli_prepare($conn, "UPDATE documents SET deleted_at = NOW(), deleted_by = ? WHERE id = ? AND deleted_at IS NULL");
                mysqli_stmt_bind_param($delete_doc_stmt, "ii", $current_user_id, $document_id);
                if (!mysqli_stmt_execute($delete_doc_stmt)) {
                    throw new Exception(mysqli_error($conn));
                }

                $delete_log = mysqli_prepare($conn, "INSERT INTO document_delete_log (document_id, document_subject, deleted_by, deleted_at, reason) VALUES (?, ?, ?, NOW(), ?)");
                if ($delete_log) {
                    $delete_reason = 'Dipadam bersama surat';
                    $document_subject = $document['subject'] ?? $draft['subject'];
                    mysqli_stmt_bind_param($delete_log, "isis", $document_id, $document_subject, $current_user_id, $delete_reason);
                    mysqli_stmt_execute($delete_log);
                }
            }
        }

        mysqli_commit($conn);
    } catch (Exception $e) {
        mysqli_rollback($conn);
        header("Location: draft_letters.php?error=delete_failed");
        exit();
    }

    logActivity($conn, $current_user_id, 'delete_draft_letter', "Delete draft letter view: {$draft['ref_no']} - {$draft['subject']} (Draft ID: {$draft_id})");
    header("Location: draft_letters.php?success=deleted");
    exit();
}

if ($action === 'delete_attachment' && isset($_GET['id'], $_GET['attachment_id'])) {
    if (!currentUserCan($conn, 'draft_letter', 'update')) {
        echo "<script>alert('Anda tidak mempunyai kebenaran untuk memadam lampiran sokongan.'); window.location='draft_letters.php';</script>";
        exit();
    }

    $draft_id = (int) $_GET['id'];
    $attachment_id = (int) $_GET['attachment_id'];
    $current_user_id = (int) ($_SESSION['user_id'] ?? 0);

    $attachment_stmt = mysqli_prepare($conn, "SELECT a.id, a.document_id, a.file_path, a.original_name,
            ld.ref_no, ld.subject, ld.doc_type, ld.department, ld.created_by
        FROM document_attachments a
        INNER JOIN letter_drafts ld ON ld.document_id = a.document_id
        WHERE ld.id = ? AND a.id = ? AND ld.deleted_at IS NULL
        LIMIT 1");
    mysqli_stmt_bind_param($attachment_stmt, "ii", $draft_id, $attachment_id);
    mysqli_stmt_execute($attachment_stmt);
    $attachment = mysqli_fetch_assoc(mysqli_stmt_get_result($attachment_stmt));

    if (!$attachment) {
        redirectDraftFormByDocType(getDraftDocumentTypeById($conn, $draft_id), ['id' => $draft_id, 'error' => 'attachment_not_found']);
    }
    $attachment_doc_type = $attachment['doc_type'] ?? 'Memo Kelulusan';

    if ((int) ($attachment['created_by'] ?? 0) !== $current_user_id
        && !isSameDepartmentDb($conn, $attachment['department'] ?? '', $user_department)) {
        redirectDraftFormByDocType($attachment_doc_type, ['id' => $draft_id, 'error' => 'unauthorized']);
    }

    mysqli_begin_transaction($conn);
    try {
        $delete_stmt = mysqli_prepare($conn, "DELETE FROM document_attachments WHERE id = ?");
        mysqli_stmt_bind_param($delete_stmt, "i", $attachment_id);
        if (!mysqli_stmt_execute($delete_stmt)) {
            throw new Exception('Gagal memadam lampiran sokongan.');
        }

        if (!syncDocumentPrimaryFilePath($conn, (int) ($attachment['document_id'] ?? 0))) {
            throw new Exception('Gagal mengemaskini lampiran utama.');
        }

        mysqli_commit($conn);
    } catch (Exception $e) {
        mysqli_rollback($conn);
        redirectDraftFormByDocType($attachment_doc_type, ['id' => $draft_id, 'error' => 'attachment_delete_failed']);
    }

    $file_path = trim((string) ($attachment['file_path'] ?? ''));
    if ($file_path !== '' && file_exists($file_path)) {
        unlink($file_path);
    }

    $attachment_name = $attachment['original_name'] ?: basename($file_path);
    logActivity($conn, $current_user_id, 'delete_draft_attachment', "Delete draft attachment: {$attachment_name} for {$attachment['ref_no']} - {$attachment['subject']} (Draft ID: {$draft_id})");
    redirectDraftFormByDocType($attachment_doc_type, ['id' => $draft_id, 'success' => 'attachment_deleted']);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'support') {
    $draft_id = (int) ($_POST['id'] ?? 0);
    $decision = trim((string) ($_POST['decision'] ?? ''));
    $support_note = trim((string) ($_POST['support_note'] ?? ''));
    $auto_sign = isset($_POST['auto_sign']) && (string) $_POST['auto_sign'] === '1' && in_array($decision, ['disokong', 'ditolak'], true);
    $current_user_id = (int) ($_SESSION['user_id'] ?? 0);

    if ($draft_id <= 0 || !in_array($decision, ['disokong', 'ditolak', 'tandatangan'], true)) {
        redirectDraftSupportError($draft_id, 'validation');
    }
    if ($decision === 'ditolak' && $support_note === '') {
        redirectDraftSupportError($draft_id, 'note_required');
    }

    $draft_stmt = mysqli_prepare($conn, "SELECT * FROM letter_drafts WHERE id = ? AND deleted_at IS NULL LIMIT 1 FOR UPDATE");
    mysqli_begin_transaction($conn);
    mysqli_stmt_bind_param($draft_stmt, "i", $draft_id);
    mysqli_stmt_execute($draft_stmt);
    $draft = mysqli_fetch_assoc(mysqli_stmt_get_result($draft_stmt));

    if (!$draft) {
        mysqli_rollback($conn);
        header("Location: draft_letters.php?error=not_found");
        exit();
    }

    $is_surat_rasmi = strcasecmp(trim((string) ($draft['doc_type'] ?? '')), 'Surat Rasmi') === 0;
    $all_approval_recipients = getLetterApprovalRecipients($conn, $draft_id);
    $surat_rasmi_has_final_recipient = $is_surat_rasmi && !empty($all_approval_recipients);
    $stage = (int) ($draft['approval_stage'] ?? 1);
    $approval_status = $draft['approval_status'] ?? 'menunggu_pelulus';
    $department_officer_status = $draft['department_officer_status'] ?? '';
    $is_department_officer = $stage === 1
        && (int) ($draft['department_officer_user_id'] ?? 0) === $current_user_id
        && in_array($department_officer_status, ['menunggu', 'menunggu_tandatangan'], true);
    $recipient_rows = getLetterApprovalRecipients($conn, $draft_id, $current_user_id);
    $recipient_row = $recipient_rows[0] ?? null;
    $recipient_action_status = $recipient_row['status'] ?? '';
    $is_routing_recipient = $stage >= 2
        && $recipient_row
        && in_array($recipient_action_status, ['menunggu', 'menunggu_tandatangan'], true);
    if (!$is_department_officer && !$is_routing_recipient) {
        mysqli_rollback($conn);
        redirectDraftSupportError($draft_id, 'unauthorized');
    }

    if (!in_array($approval_status, ['menunggu_pegawai_bahagian', 'menunggu_pelulus'], true)) {
        mysqli_rollback($conn);
        redirectDraftSupportError($draft_id, 'not_pending');
    }

    $should_email_next = false;
    try {
        if ($is_department_officer) {
            if ($decision === 'disokong') {
                if ($department_officer_status !== 'menunggu') {
                    throw new Exception('not_pending');
                }
                if ($is_surat_rasmi && $surat_rasmi_has_final_recipient) {
                    activateMemoApprovalRecipients($conn, $draft_id);
                    $should_email_next = true;
                    $next_recipient_rows = getLetterApprovalRecipients($conn, $draft_id);
                    $next_recipient = $next_recipient_rows[0] ?? null;
                    $next_user_id = (int) ($next_recipient['user_id'] ?? 0);
                    $next_name = $next_recipient['fullname'] ?? null;
                    $next_email = $next_recipient['email'] ?? null;
                    $next_status = 'menunggu_pelulus';
                    $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                        SET approval_status = ?, approval_stage = 2,
                            department_officer_status = 'lulus',
                            department_officer_decision = 'lulus',
                            department_officer_note = ?, department_officer_approved_at = NOW(),
                            department_officer_responded_at = NOW(),
                            support_user_id = ?, support_name = ?, support_email = ?,
                            support_status = 'menunggu', support_note = ?, support_responded_at = NULL,
                            updated_by = ?, updated_at = CURRENT_TIMESTAMP
                        WHERE id = ? AND deleted_at IS NULL");
                    mysqli_stmt_bind_param($update_stmt, "ssisssii", $next_status, $support_note, $next_user_id, $next_name, $next_email, $support_note, $current_user_id, $draft_id);
                } elseif ($is_surat_rasmi && !$surat_rasmi_has_final_recipient) {
                    $signature_path = getUserSignaturePath($conn, $current_user_id);
                    if ($signature_path === '') {
                        throw new Exception('signature_required');
                    }
                    $officer_user = getApprovedUserById($conn, $current_user_id);
                    $officer_name = trim((string) ($officer_user['fullname'] ?? ($draft['department_officer_name'] ?? '')));
                    $officer_position = getDisplayPositionForUser($officer_user, $draft['department'] ?? '') ?: trim((string) ($officer_user['position'] ?? 'Ketua Pegawai'));
                    $officer_department = trim((string) ($officer_user['department'] ?? ($draft['department'] ?? '')));
                    $next_status = 'lulus';
                    $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                        SET approval_status = ?, approval_stage = 0,
                            department_officer_status = 'lulus',
                            department_officer_decision = 'lulus',
                            department_officer_note = ?, department_officer_approved_at = NOW(),
                            department_officer_signature_path = ?, department_officer_responded_at = NOW(),
                            signatory_signature_path = ?, signatory_name = ?, signatory_position = ?, signatory_department = ?,
                            preparer_signed_at = IF(preparer_signed_at IS NULL, NOW(), preparer_signed_at),
                            support_user_id = 0, support_name = NULL, support_email = NULL,
                            support_status = 'tidak_perlu', support_note = ?, support_responded_at = NOW(),
                            updated_by = ?, updated_at = CURRENT_TIMESTAMP
                        WHERE id = ? AND deleted_at IS NULL");
                    mysqli_stmt_bind_param($update_stmt, "ssssssssii", $next_status, $support_note, $signature_path, $signature_path, $officer_name, $officer_position, $officer_department, $support_note, $current_user_id, $draft_id);
                } elseif ($auto_sign) {
                    $signature_path = getUserSignaturePath($conn, $current_user_id);
                    if ($signature_path === '') {
                        throw new Exception('signature_required');
                    }
                    $officer_user = getApprovedUserById($conn, $current_user_id);
                    $officer_name = trim((string) ($officer_user['fullname'] ?? ($draft['department_officer_name'] ?? '')));
                    $officer_position = trim((string) ($officer_user['position'] ?? 'Ketua Pegawai'));
                    $officer_department = trim((string) ($officer_user['department'] ?? ($draft['department'] ?? '')));
                    activateMemoApprovalRecipients($conn, $draft_id);
                    $should_email_next = true;
                    $next_recipient_rows = getLetterApprovalRecipients($conn, $draft_id);
                    $next_recipient = $next_recipient_rows[0] ?? null;
                    $next_status = 'menunggu_pelulus';
                    $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                        SET approval_status = ?, approval_stage = 2,
                            department_officer_status = 'lulus',
                            department_officer_decision = 'lulus',
                            department_officer_note = ?, department_officer_approved_at = NOW(),
                            department_officer_signature_path = ?, department_officer_responded_at = NOW(),
                            signatory_signature_path = ?, signatory_name = ?, signatory_position = ?, signatory_department = ?,
                            preparer_signed_at = IF(preparer_signed_at IS NULL, NOW(), preparer_signed_at),
                            support_user_id = ?, support_name = ?, support_email = ?,
                            support_status = 'menunggu', support_note = ?, support_responded_at = NULL,
                            updated_by = ?, updated_at = CURRENT_TIMESTAMP
                        WHERE id = ? AND deleted_at IS NULL");
                    $next_user_id = (int) ($next_recipient['user_id'] ?? 0);
                    $next_name = $next_recipient['fullname'] ?? null;
                    $next_email = $next_recipient['email'] ?? null;
                    mysqli_stmt_bind_param($update_stmt, "sssssssisssii", $next_status, $support_note, $signature_path, $signature_path, $officer_name, $officer_position, $officer_department, $next_user_id, $next_name, $next_email, $support_note, $current_user_id, $draft_id);
                } else {
                    $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                        SET department_officer_status = 'menunggu_tandatangan',
                            department_officer_decision = 'lulus',
                            department_officer_note = ?, department_officer_approved_at = NOW(),
                            support_note = ?, updated_by = ?, updated_at = CURRENT_TIMESTAMP
                        WHERE id = ? AND deleted_at IS NULL");
                    mysqli_stmt_bind_param($update_stmt, "ssii", $support_note, $support_note, $current_user_id, $draft_id);
                }
            } elseif ($decision === 'tandatangan') {
                if ($department_officer_status !== 'menunggu_tandatangan') {
                    throw new Exception('not_pending');
                }
                $signature_path = getUserSignaturePath($conn, $current_user_id);
                if ($signature_path === '') {
                    throw new Exception('signature_required');
                }

                if (($draft['department_officer_decision'] ?? 'lulus') === 'ditolak') {
                    $preparer_user = getApprovedUserById($conn, (int) ($draft['created_by'] ?? 0));
                    $preparer_user_id = (int) ($preparer_user['id'] ?? ($draft['created_by'] ?? 0));
                    $preparer_name = $preparer_user['fullname'] ?? null;
                    $preparer_email = $preparer_user['email'] ?? null;
                    $next_status = 'ditolak';
                    $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                        SET approval_status = ?, department_officer_status = 'ditolak',
                            department_officer_signature_path = ?, department_officer_responded_at = NOW(),
                            support_status = 'ditolak', support_responded_at = NOW(),
                            support_user_id = ?, support_name = ?, support_email = ?,
                            updated_by = ?, updated_at = CURRENT_TIMESTAMP
                        WHERE id = ? AND deleted_at IS NULL");
                    mysqli_stmt_bind_param($update_stmt, "ssissii", $next_status, $signature_path, $preparer_user_id, $preparer_name, $preparer_email, $current_user_id, $draft_id);
                } else {
                    $officer_user = getApprovedUserById($conn, $current_user_id);
                    $officer_name = trim((string) ($officer_user['fullname'] ?? ($draft['department_officer_name'] ?? '')));
                    $officer_position = trim((string) ($officer_user['position'] ?? 'Ketua Pegawai'));
                    $officer_department = trim((string) ($officer_user['department'] ?? ($draft['department'] ?? '')));
                    activateMemoApprovalRecipients($conn, $draft_id);
                    $should_email_next = true;
                    $next_recipient_rows = getLetterApprovalRecipients($conn, $draft_id);
                    $next_recipient = $next_recipient_rows[0] ?? null;
                    $next_status = 'menunggu_pelulus';
                    $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                        SET approval_status = ?, approval_stage = 2,
                            department_officer_status = 'lulus', department_officer_signature_path = ?, department_officer_responded_at = NOW(),
                            signatory_signature_path = ?, signatory_name = ?, signatory_position = ?, signatory_department = ?,
                            preparer_signed_at = IF(preparer_signed_at IS NULL, NOW(), preparer_signed_at),
                            support_user_id = ?, support_name = ?, support_email = ?,
                            support_status = 'menunggu', support_responded_at = NULL,
                            updated_by = ?, updated_at = CURRENT_TIMESTAMP
                        WHERE id = ? AND deleted_at IS NULL");
                    $next_user_id = (int) ($next_recipient['user_id'] ?? 0);
                    $next_name = $next_recipient['fullname'] ?? null;
                    $next_email = $next_recipient['email'] ?? null;
                    mysqli_stmt_bind_param($update_stmt, "ssssssissii", $next_status, $signature_path, $signature_path, $officer_name, $officer_position, $officer_department, $next_user_id, $next_name, $next_email, $current_user_id, $draft_id);
                }
            } else {
                $signature_path = '';
                if ($auto_sign) {
                    $signature_path = getUserSignaturePath($conn, $current_user_id);
                    if ($signature_path === '') {
                        throw new Exception('signature_required');
                    }
                }
                $preparer_user = getApprovedUserById($conn, (int) ($draft['created_by'] ?? 0));
                $preparer_user_id = (int) ($preparer_user['id'] ?? ($draft['created_by'] ?? 0));
                $preparer_name = $preparer_user['fullname'] ?? null;
                $preparer_email = $preparer_user['email'] ?? null;
                $next_status = 'ditolak';
                $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                    SET approval_status = ?, department_officer_status = 'ditolak',
                        department_officer_decision = 'ditolak',
                        department_officer_note = ?, department_officer_approved_at = NOW(),
                        department_officer_signature_path = ?, department_officer_responded_at = NOW(),
                        support_status = 'ditolak', support_note = ?, support_responded_at = NOW(),
                        support_user_id = ?, support_name = ?, support_email = ?,
                        updated_by = ?, updated_at = CURRENT_TIMESTAMP
                    WHERE id = ? AND deleted_at IS NULL");
                mysqli_stmt_bind_param($update_stmt, "ssssissii", $next_status, $support_note, $signature_path, $support_note, $preparer_user_id, $preparer_name, $preparer_email, $current_user_id, $draft_id);
            }
        } elseif ($is_routing_recipient) {
            if ($decision === 'disokong') {
                if ($recipient_action_status !== 'menunggu') {
                    throw new Exception('not_pending');
                }
                $signature_path = '';
                if ($auto_sign) {
                    $signature_path = getUserSignaturePath($conn, $current_user_id);
                    if ($signature_path === '') {
                        throw new Exception('signature_required');
                    }
                    $recipient_update = mysqli_prepare($conn, "UPDATE letter_approval_recipients
                        SET status = 'lulus', decision = 'lulus', note = ?, approved_at = NOW(), signature_path = ?, responded_at = NOW()
                        WHERE id = ? AND draft_id = ?");
                } else {
                    $recipient_update = mysqli_prepare($conn, "UPDATE letter_approval_recipients
                        SET status = 'menunggu_tandatangan', decision = 'lulus', note = ?, approved_at = NOW(), responded_at = NULL
                        WHERE id = ? AND draft_id = ?");
                }
                $recipient_id = (int) $recipient_row['id'];
                if ($auto_sign) {
                    mysqli_stmt_bind_param($recipient_update, "ssii", $support_note, $signature_path, $recipient_id, $draft_id);
                } else {
                    mysqli_stmt_bind_param($recipient_update, "sii", $support_note, $recipient_id, $draft_id);
                }
            } elseif ($decision === 'tandatangan') {
                if ($recipient_action_status !== 'menunggu_tandatangan') {
                    throw new Exception('not_pending');
                }
                $signature_path = getUserSignaturePath($conn, $current_user_id);
                if ($signature_path === '') {
                    throw new Exception('signature_required');
                }
                $final_recipient_status = (($recipient_row['decision'] ?? 'lulus') === 'ditolak') ? 'ditolak' : 'lulus';
                $recipient_update = mysqli_prepare($conn, "UPDATE letter_approval_recipients
                    SET status = ?, signature_path = ?, responded_at = NOW()
                    WHERE id = ? AND draft_id = ?");
                $recipient_id = (int) $recipient_row['id'];
                mysqli_stmt_bind_param($recipient_update, "ssii", $final_recipient_status, $signature_path, $recipient_id, $draft_id);
            } else {
                $signature_path = '';
                if ($auto_sign) {
                    $signature_path = getUserSignaturePath($conn, $current_user_id);
                    if ($signature_path === '') {
                        throw new Exception('signature_required');
                    }
                    $recipient_update = mysqli_prepare($conn, "UPDATE letter_approval_recipients
                        SET status = 'ditolak', decision = 'ditolak', note = ?, approved_at = NOW(), signature_path = ?, responded_at = NOW()
                        WHERE id = ? AND draft_id = ?");
                } else {
                    $recipient_update = mysqli_prepare($conn, "UPDATE letter_approval_recipients
                        SET status = 'menunggu_tandatangan', decision = 'ditolak', note = ?, approved_at = NOW(), responded_at = NULL
                        WHERE id = ? AND draft_id = ?");
                }
                $recipient_id = (int) $recipient_row['id'];
                if ($auto_sign) {
                    mysqli_stmt_bind_param($recipient_update, "ssii", $support_note, $signature_path, $recipient_id, $draft_id);
                } else {
                    mysqli_stmt_bind_param($recipient_update, "sii", $support_note, $recipient_id, $draft_id);
                }
            }
            if (!mysqli_stmt_execute($recipient_update)) {
                throw new Exception('system');
            }

            if (in_array($decision, ['disokong', 'ditolak'], true) && !$auto_sign) {
                $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                    SET support_note = ?, updated_by = ?, updated_at = CURRENT_TIMESTAMP
                    WHERE id = ? AND deleted_at IS NULL");
                mysqli_stmt_bind_param($update_stmt, "sii", $support_note, $current_user_id, $draft_id);
                if (!mysqli_stmt_execute($update_stmt)) {
                    throw new Exception('system');
                }
                mysqli_commit($conn);
                logActivity($conn, $current_user_id, 'decide_draft_letter', "Decision {$decision} pending signature: {$draft['ref_no']} - {$draft['subject']} (Draft ID: {$draft_id})");
                $success_key = $decision === 'ditolak' ? 'rejected_pending_signature' : 'approved';
                header("Location: draft_letter_print.php?id={$draft_id}&support_success={$success_key}");
                exit();
            }

            $summary_stmt = mysqli_prepare($conn, "SELECT
                    SUM(status = 'ditolak') AS rejected_count,
                    SUM(status IN ('menunggu','menunggu_tandatangan')) AS waiting_count,
                    SUM(status = 'belum_mula') AS queued_count
                FROM letter_approval_recipients
                WHERE draft_id = ?");
            mysqli_stmt_bind_param($summary_stmt, "i", $draft_id);
            mysqli_stmt_execute($summary_stmt);
            $summary = mysqli_fetch_assoc(mysqli_stmt_get_result($summary_stmt));
            $rejected_count = (int) ($summary['rejected_count'] ?? 0);
            $waiting_count = (int) ($summary['waiting_count'] ?? 0);
            $queued_count = (int) ($summary['queued_count'] ?? 0);

            if (($decision === 'tandatangan' || $auto_sign) && $rejected_count === 0 && $waiting_count === 0 && $queued_count > 0) {
                activateMemoApprovalRecipients($conn, $draft_id);
                $should_email_next = true;
            }

            $next_recipient_rows = getLetterApprovalRecipients($conn, $draft_id);
            $next_recipient = null;
            foreach ($next_recipient_rows as $candidate) {
                if (($candidate['status'] ?? '') === 'menunggu') {
                    $next_recipient = $candidate;
                    break;
                }
            }
            $still_pending = $next_recipient !== null;
            $next_status = $rejected_count > 0 ? 'ditolak' : ($still_pending ? 'menunggu_pelulus' : 'lulus');
            $support_status = $rejected_count > 0 ? 'ditolak' : ($still_pending ? 'menunggu' : 'disokong');
            $draft_support_note = $support_note;
            if ($decision === 'tandatangan') {
                $draft_support_note = trim((string) ($recipient_row['note'] ?? ''));
            }
            if ($rejected_count > 0) {
                $preparer_user = getApprovedUserById($conn, (int) ($draft['created_by'] ?? 0));
                $next_user_id = (int) ($preparer_user['id'] ?? ($draft['created_by'] ?? 0));
                $next_name = $preparer_user['fullname'] ?? null;
                $next_email = $preparer_user['email'] ?? null;
            } else {
                $next_user_id = (int) ($next_recipient['user_id'] ?? 0);
                $next_name = $next_recipient['fullname'] ?? null;
                $next_email = $next_recipient['email'] ?? null;
            }
            $update_stmt = mysqli_prepare($conn, "UPDATE letter_drafts
                SET approval_status = ?, support_status = ?, support_note = ?,
                    support_user_id = ?, support_name = ?, support_email = ?,
                    support_responded_at = IF(? IN ('disokong','ditolak'), NOW(), NULL),
                    updated_by = ?, updated_at = CURRENT_TIMESTAMP
                WHERE id = ? AND deleted_at IS NULL");
            mysqli_stmt_bind_param($update_stmt, "sssisssii", $next_status, $support_status, $draft_support_note, $next_user_id, $next_name, $next_email, $support_status, $current_user_id, $draft_id);
        }

        if (!mysqli_stmt_execute($update_stmt)) {
            throw new Exception('system');
        }

        if ($is_surat_rasmi && $is_routing_recipient && isset($next_status) && $next_status === 'lulus' && !empty($signature_path)) {
            $final_signer_user = getApprovedUserById($conn, $current_user_id);
            $final_signer_name = trim((string) ($final_signer_user['fullname'] ?? ($draft['signatory_name'] ?? '')));
            $final_signer_position = trim((string) ($draft['signatory_position'] ?? ''));
            $final_signer_department = trim((string) ($final_signer_user['department'] ?? ($draft['signatory_department'] ?? '')));
            $final_sign_update = mysqli_prepare($conn, "UPDATE letter_drafts
                SET signatory_signature_path = ?, signatory_name = ?, signatory_position = ?, signatory_department = ?,
                    preparer_signed_at = IF(preparer_signed_at IS NULL, NOW(), preparer_signed_at)
                WHERE id = ? AND deleted_at IS NULL");
            mysqli_stmt_bind_param($final_sign_update, "ssssi", $signature_path, $final_signer_name, $final_signer_position, $final_signer_department, $draft_id);
            if (!mysqli_stmt_execute($final_sign_update)) {
                throw new Exception('system');
            }
        }

        mysqli_commit($conn);
    } catch (Exception $e) {
        mysqli_rollback($conn);
        redirectDraftSupportError($draft_id, $e->getMessage());
    }

    logActivity($conn, $current_user_id, 'support_draft_letter', "Support decision {$decision}: {$draft['ref_no']} - {$draft['subject']} (Draft ID: {$draft_id})");
    $signature_completed_now = $decision === 'tandatangan' || $auto_sign;
    if ($signature_completed_now && $is_department_officer && $should_email_next) {
        sendMemoApprovalRecipientEmails($conn, $draft_id, [
            'id' => $draft_id,
            'ref_no' => $draft['ref_no'] ?? '',
            'subject' => $draft['subject'] ?? '',
        ]);
    } elseif ($signature_completed_now && $is_routing_recipient && $should_email_next) {
        sendMemoApprovalRecipientEmails($conn, $draft_id, [
            'id' => $draft_id,
            'ref_no' => $draft['ref_no'] ?? '',
            'subject' => $draft['subject'] ?? '',
        ]);
    }
    $success_decision = $signature_completed_now ? 'tandatangan' : $decision;
    header("Location: draft_letter_print.php?id={$draft_id}&support_success={$success_decision}");
    exit();
}

if ($action === 'restore' && isset($_GET['id'])) {
    if (!currentUserCan($conn, 'deleted_item', 'restore')) {
        echo "<script>alert('Anda tidak mempunyai kebenaran untuk memulihkan data dipadam.'); window.location='deleted_items.php';</script>";
        exit();
    }

    $draft_id = (int) $_GET['id'];
    $draft_stmt = mysqli_prepare($conn, "SELECT ld.id, ld.document_id, ld.ref_no, ld.subject, ld.department,
            d.folder_id AS document_folder_id, d.ref_no AS document_ref_no, d.deleted_at AS document_deleted_at,
            f.id AS folder_exists, f.deleted_at AS folder_deleted_at
        FROM letter_drafts ld
        LEFT JOIN documents d ON d.id = ld.document_id
        LEFT JOIN folders f ON f.id = ld.folder_id
        WHERE ld.id = ? AND ld.deleted_at IS NOT NULL
        LIMIT 1");
    mysqli_stmt_bind_param($draft_stmt, "i", $draft_id);
    mysqli_stmt_execute($draft_stmt);
    $draft = mysqli_fetch_assoc(mysqli_stmt_get_result($draft_stmt));

    if (!$draft) {
        header("Location: deleted_items.php?error=draft_not_found");
        exit();
    }

    if ($role !== 'superadmin' && !isSameDepartmentDb($conn, $draft['department'] ?? '', $user_department)) {
        header("Location: deleted_items.php?error=restore_failed");
        exit();
    }

    if (empty($draft['folder_exists'])) {
        header("Location: deleted_items.php?error=folder_missing");
        exit();
    }

    if (!empty($draft['folder_deleted_at'])) {
        header("Location: deleted_items.php?error=restore_folder_first");
        exit();
    }

    mysqli_begin_transaction($conn);
    try {
        $document_id = (int) ($draft['document_id'] ?? 0);
        if ($document_id > 0 && !empty($draft['document_deleted_at'])) {
            $conflict = mysqli_prepare($conn, "SELECT id FROM documents WHERE folder_id = ? AND ref_no = ? AND deleted_at IS NULL LIMIT 1");
            $document_folder_id = (int) ($draft['document_folder_id'] ?? 0);
            $document_ref_no = trim((string) ($draft['document_ref_no'] ?? $draft['ref_no'] ?? ''));
            mysqli_stmt_bind_param($conflict, "is", $document_folder_id, $document_ref_no);
            mysqli_stmt_execute($conflict);
            $conflict_row = mysqli_fetch_assoc(mysqli_stmt_get_result($conflict));
            if ($conflict_row) {
                throw new Exception('duplicate_ref_conflict');
            }

            $restore_document_stmt = mysqli_prepare($conn, "UPDATE documents SET deleted_at = NULL, deleted_by = NULL WHERE id = ? AND deleted_at IS NOT NULL");
            mysqli_stmt_bind_param($restore_document_stmt, "i", $document_id);
            if (!mysqli_stmt_execute($restore_document_stmt)) {
                throw new Exception('restore_failed');
            }
        }

        $restore_stmt = mysqli_prepare($conn, "UPDATE letter_drafts SET deleted_at = NULL, deleted_by = NULL WHERE id = ? AND deleted_at IS NOT NULL");
        mysqli_stmt_bind_param($restore_stmt, "i", $draft_id);
        if (!mysqli_stmt_execute($restore_stmt)) {
            throw new Exception('restore_failed');
        }

        mysqli_commit($conn);
        logActivity($conn, (int) ($_SESSION['user_id'] ?? 0), 'restore_draft_letter', "Restore draft letter: {$draft['ref_no']} - {$draft['subject']} (Draft ID: {$draft_id})");
        header("Location: deleted_items.php?success=draft_restored");
        exit();
    } catch (Exception $e) {
        mysqli_rollback($conn);
        if ($e->getMessage() === 'duplicate_ref_conflict') {
            header("Location: deleted_items.php?error=duplicate_ref_conflict");
            exit();
        }
    }

    header("Location: deleted_items.php?error=restore_failed");
    exit();
}

header("Location: draft_letters.php");
exit();
