<?php
// =============================================================
//  GET /api/v1/system_settings/list
//
//  Mirrors app/system_settings.php's own fetch — every row in the
//  `settings` table, gated on the 'system_settings' permission
//  (Admin-only, per role_permissions). Unlike the desktop page, this
//  does NOT filter to a hardcoded category allowlist: system_settings.php
//  only ever renders categories present in its own $category_meta array
//  (general/security/assessment/uploads/notice_board), which silently
//  excludes the real 'mobile' category (firebase_enabled) that
//  include/notification_queue.php actually reads and enforces before
//  every push notification is queued — a genuine gap in the desktop
//  admin UI, not intentional scoping. This endpoint returns every row
//  regardless of category so nothing configurable-and-enforced is
//  invisible to whichever admin surface is used to manage it.
// =============================================================

require_once __DIR__ . '/../_bootstrap.php';

if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    Api::error(405, 'MethodNotAllowed', 'Use GET');
}

api_authenticate();
api_require_permission('system_settings');

if (!settingsTableExists($conn)) {
    Api::success(['settings' => [], 'table_ready' => false]);
}

$result = $conn->query("
    SELECT s.id, s.setting_key, s.value, s.category, s.data_type,
           s.label, s.description, s.updated_at,
           CONCAT(u.firstname, ' ', u.surname) AS updated_by_name
    FROM settings s
    LEFT JOIN users u ON u.id = s.updated_by
    ORDER BY s.category, s.id
");
$settings = $result->fetch_all(MYSQLI_ASSOC);

Api::success(['settings' => $settings, 'table_ready' => true]);
