المطلوب: إنشاء منصة بث احترافية شبيهة بنتفليكس لع...

php
<?php
/**
 * index.php — منصة بث احترافية شبيهة بنتفلكس (ملف واحد)
 * التقنية: PHP (Vanilla) + SQLite + HTML/CSS/JS — بدون Node.js
 * اللغة الافتراضية: العربية (RTL) مع دعم حقول إنجليزية للمحتوى
 * المطوّر: نموذج GPT-5 Thinking — 2025-09-14
 *
 * ملاحظات:
 * - يُنشئ هذا الملف تلقائياً المجلدات وقاعدة البيانات والجداول والبيانات العيّنية عند أول تشغيل.
 * - يدعم التوجيه الداخلي عبر ?route=... وأفعال JSON عبر ?action=...
 * - يتضمن لوحة تحكم للأدمن لإدارة الأفلام والمسلسلات والمواسم والحلقات والمصادر والجودة والمستخدمين والإشعارات.
 * - مشغل فيديو HTML5 بواجهـة مخصصة + استئناف المشاهدة + Auto-Next + دعم الروابط المتعددة للجودة.
 * - نظام إشعارات داخلي، تقييمات، تعليقات، قائمة مشاهدة، متابعة مسلسلات، سجل مشاهدات متعدد الأجهزة.
 * - أمان: PDO + Prepared + CSRF + password_hash + ترميز HTML وعناوين أمان أساسية.
 */

declare(strict_types=1);
session_start();

// تفعيل GZIP إن أمكن
if (function_exists('ob_gzhandler') && !ini_get('zlib.output_compression')) { @ob_start('ob_gzhandler'); }
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: sameorigin');
header('Referrer-Policy: no-referrer-when-downgrade');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');

// مسارات
define('BASE_DIR', __DIR__);
define('DB_DIR', BASE_DIR . '/db');
define('DB_FILE', DB_DIR . '/app.db');
define('MOVIES_DIR', BASE_DIR . '/movies');
define('UPLOADS_DIR', BASE_DIR . '/uploads');
define('MOVIES_JSON', MOVIES_DIR . '/movies.json');
define('APP_NAME', 'سينيمـا بلس');

// إنشاء المجلدات
@is_dir(DB_DIR) || @mkdir(DB_DIR, 0775, true);
@is_dir(MOVIES_DIR) || @mkdir(MOVIES_DIR, 0775, true);
@is_dir(UPLOADS_DIR) || @mkdir(UPLOADS_DIR, 0775, true);

// وظائف مساعدة
function e(string $v): string { return htmlspecialchars($v, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'); }
function now(): string { return (new DateTime('now', new DateTimeZone('UTC')))->format('Y-m-d H:i:s'); }
function json_out($data, int $code=200): void {
    http_response_code($code);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    exit;
}
function csrf_token(): string {
    $_SESSION['csrf'] = $_SESSION['csrf'] ?? bin2hex(random_bytes(32));
    return $_SESSION['csrf'];
}
function csrf_check(): void {
    $t = $_POST['csrf'] ?? $_GET['csrf'] ?? '';
    if (!$t || !isset($_SESSION['csrf']) || !hash_equals($_SESSION['csrf'], $t)) {
        json_out(['ok'=>false,'error'=>'CSRF'], 403);
    }
}

// اتصال قاعدة البيانات
function db(): PDO {
    static $pdo=null;
    if ($pdo) return $pdo;
    $pdo = new PDO('sqlite:' . DB_FILE, null, null, [
        PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE=>PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES=>false,
    ]);
    $pdo->exec('PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON; PRAGMA synchronous=NORMAL;');
    return $pdo;
}

// إنشاء الجداول عند أول تشغيل
function init_db(): void {
    $pdo = db();
    $pdo->exec("
    CREATE TABLE IF NOT EXISTS users (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        username TEXT UNIQUE,
        email TEXT UNIQUE,
        pass_hash TEXT,
        role TEXT DEFAULT 'User', -- Admin|Editor|Moderator|User
        status TEXT DEFAULT 'pending', -- pending|active|blocked
        block_reason TEXT,
        block_until TEXT,
        created_at TEXT
    );
    CREATE TABLE IF NOT EXISTS movies (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        type TEXT CHECK(type IN ('movie','series')) NOT NULL,
        title TEXT, title_en TEXT,
        description TEXT, description_en TEXT,
        genres TEXT, year INTEGER, duration INTEGER,
        poster TEXT, backdrop TEXT,
        quality_tags TEXT, language TEXT,
        is_published INTEGER DEFAULT 0,
        rating_cache REAL DEFAULT 0,
        created_at TEXT, updated_at TEXT
    );
    CREATE TABLE IF NOT EXISTS episodes (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        movie_id INTEGER REFERENCES movies(id) ON DELETE CASCADE,
        season INTEGER, episode INTEGER,
        title TEXT, duration INTEGER,
        mp4_src TEXT, -- اختياري/توافقي
        created_at TEXT
    );
    CREATE UNIQUE INDEX IF NOT EXISTS idx_ep_unique ON episodes(movie_id, season, episode);
    CREATE TABLE IF NOT EXISTS video_sources (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        movie_id INTEGER REFERENCES movies(id) ON DELETE CASCADE,
        episode_id INTEGER REFERENCES episodes(id) ON DELETE CASCADE,
        quality TEXT, -- 480p,720p,1080p,4K
        src TEXT
    );
    CREATE TABLE IF NOT EXISTS ratings (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
        movie_id INTEGER REFERENCES movies(id) ON DELETE CASCADE,
        rating INTEGER CHECK(rating BETWEEN 1 AND 5),
        created_at TEXT, updated_at TEXT,
        UNIQUE(user_id, movie_id)
    );
    CREATE TABLE IF NOT EXISTS comments (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
        movie_id INTEGER REFERENCES movies(id) ON DELETE CASCADE,
        comment TEXT,
        is_deleted INTEGER DEFAULT 0,
        created_at TEXT, updated_at TEXT
    );
    CREATE TABLE IF NOT EXISTS watchlist (
        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
        movie_id INTEGER REFERENCES movies(id) ON DELETE CASCADE,
        created_at TEXT,
        PRIMARY KEY(user_id,movie_id)
    );
    CREATE TABLE IF NOT EXISTS follows (
        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
        movie_id INTEGER REFERENCES movies(id) ON DELETE CASCADE,
        created_at TEXT,
        PRIMARY KEY(user_id,movie_id)
    );
    CREATE TABLE IF NOT EXISTS watch_history (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
        movie_id INTEGER REFERENCES movies(id) ON DELETE CASCADE,
        episode_id INTEGER REFERENCES episodes(id) ON DELETE SET NULL,
        position REAL DEFAULT 0,
        duration REAL DEFAULT 0,
        device TEXT,
        last_watched_at TEXT
    );
    CREATE INDEX IF NOT EXISTS idx_hist_user_movie ON watch_history(user_id,movie_id,episode_id);
    CREATE TABLE IF NOT EXISTS notifications (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER, -- null للبث العام
        message_ar TEXT, message_en TEXT,
        link TEXT, is_read INTEGER DEFAULT 0,
        created_at TEXT
    );
    CREATE INDEX IF NOT EXISTS idx_notif_user ON notifications(user_id,is_read);
    CREATE TABLE IF NOT EXISTS activity_log (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER,
        action TEXT, target_type TEXT, target_id INTEGER,
        meta_json TEXT, created_at TEXT
    );
    ");
    // ملف JSON عيّني
    if (!file_exists(MOVIES_JSON)) {
        $sample = [
            'samples'=>[
                ['type'=>'movie','title'=>'فيلم تجريبي','title_en'=>'Sample Movie','year'=>2024,'genres'=>['أكشن','دراما']],
                ['type'=>'series','title'=>'مسلسل تجريبي','title_en'=>'Sample Series','year'=>2025,'genres'=>['غموض','خيال']]
            ],
            'generated_at'=>now()
        ];
        @file_put_contents(MOVIES_JSON, json_encode($sample, JSON_UNESCAPED_UNICODE|JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES));
    }
}
init_db();

// مستخدم حالي
function user(): ?array {
    if (!isset($_SESSION['uid'])) return null;
    $stmt = db()->prepare("SELECT * FROM users WHERE id=?");
    $stmt->execute([intval($_SESSION['uid'])]);
    return $stmt->fetch() ?: null;
}
function require_login() {
    if (!user()) { header('Location: ?route=login'); exit; }
}
function is_role(string $r): bool { $u=user(); return $u && ($u['role']===$r || $u['role']==='Admin'); }
function is_admin(): bool { return is_role('Admin'); }
function is_editor(): bool { return is_role('Editor'); }
function is_moderator(): bool { return is_role('Moderator'); }
function can_manage_content(): bool { return is_admin() || is_editor(); }

// تسجيل نشاط
function log_activity(?int $uid, string $action, string $type, ?int $tid, array $meta=[]): void {
    $stmt = db()->prepare("INSERT INTO activity_log(user_id,action,target_type,target_id,meta_json,created_at) VALUES(?,?,?,?,?,?)");
    $stmt->execute([$uid, $action, $type, $tid, json_encode($meta, JSON_UNESCAPED_UNICODE), now()]);
}

// إشعارات
function notify(?int $uid, string $msg_ar, string $msg_en='', string $link='#'): void {
    $stmt = db()->prepare("INSERT INTO notifications(user_id,message_ar,message_en,link,is_read,created_at) VALUES(?,?,?,?,0,?)");
    $stmt->execute([$uid, $msg_ar, $msg_en, $link, now()]);
}

// -------------- أفعال JSON (API) --------------
$action = $_GET['action'] ?? '';
if ($action) {
    // معظم الأفعال تتطلب تسجيل الدخول + CSRF
    if (in_array($action, ['toggle_watchlist','rate','comment_add','comment_delete','saveProgress','follow_series','mark_notifs','admin_send_notif','admin_movie','admin_episode','admin_user','searchAdvanced'])) {
        // بعض الأفعال العامة لا تطلب POST (مثل searchAdvanced) — سنتحقق لكل حالة.
    }

    switch ($action) {
        case 'register':
            // أول حساب يصبح Admin تلقائياً
            $username = trim($_POST['username'] ?? '');
            $email    = trim($_POST['email'] ?? '');
            $pass     = $_POST['password'] ?? '';
            if (!$username || !$email || !$pass) json_out(['ok'=>false,'error'=>'جميع الحقول مطلوبة']);
            $pdo = db();
            $count = (int)$pdo->query("SELECT COUNT(*) FROM users")->fetchColumn();
            $role = $count===0 ? 'Admin' : 'User';
            $status = $count===0 ? 'active' : 'pending';
            $stmt=$pdo->prepare("INSERT INTO users(username,email,pass_hash,role,status,created_at) VALUES(?,?,?,?,?,?)");
            try{
                $stmt->execute([$username,$email,password_hash($pass,PASSWORD_DEFAULT),$role,$status,now()]);
            }catch(Exception $e){ json_out(['ok'=>false,'error'=>'اسم المستخدم/الإيميل مستخدم']); }
            $_SESSION['uid'] = (int)$pdo->lastInsertId();
            log_activity($_SESSION['uid'],'register','user',$_SESSION['uid']);
            json_out(['ok'=>true,'role'=>$role,'status'=>$status]);
        case 'login':
            $email = trim($_POST['email'] ?? '');
            $pass  = $_POST['password'] ?? '';
            $stmt = db()->prepare("SELECT * FROM users WHERE email=?");
            $stmt->execute([$email]); $u=$stmt->fetch();
            if (!$u || !password_verify($pass, $u['pass_hash'])) json_out(['ok'=>false,'error'=>'بيانات الدخول غير صحيحة']);
            if ($u['status']==='blocked') json_out(['ok'=>false,'error'=>'حسابك محظور: '.$u['block_reason']]);
            if ($u['status']==='pending') json_out(['ok'=>false,'error'=>'حسابك قيد المراجعة من الإدارة']);
            $_SESSION['uid'] = (int)$u['id'];
            json_out(['ok'=>true]);
        case 'logout':
            session_destroy();
            json_out(['ok'=>true]);

        case 'toggle_watchlist':
            require_login(); csrf_check();
            $mid = (int)($_POST['movie_id'] ?? 0);
            if(!$mid) json_out(['ok'=>false]);
            $pdo=db();
            $chk=$pdo->prepare("SELECT 1 FROM watchlist WHERE user_id=? AND movie_id=?");
            $chk->execute([user()['id'],$mid]);
            if($chk->fetch()){
                $pdo->prepare("DELETE FROM watchlist WHERE user_id=? AND movie_id=?")->execute([user()['id'],$mid]);
                json_out(['ok'=>true,'in_list'=>false]);
            } else {
                $pdo->prepare("INSERT INTO watchlist(user_id,movie_id,created_at) VALUES(?,?,?)")->execute([user()['id'],$mid,now()]);
                json_out(['ok'=>true,'in_list'=>true]);
            }

        case 'follow_series':
            require_login(); csrf_check();
            $mid=(int)($_POST['movie_id']??0);
            $pdo=db();
            $isSeries=(int)$pdo->query("SELECT COUNT(*) FROM movies WHERE id=$mid AND type='series'")->fetchColumn();
            if(!$isSeries) json_out(['ok'=>false,'error'=>'ليس مسلسلاً']);
            $chk=$pdo->prepare("SELECT 1 FROM follows WHERE user_id=? AND movie_id=?"); $chk->execute([user()['id'],$mid]);
            if($chk->fetch()){ $pdo->prepare("DELETE FROM follows WHERE user_id=? AND movie_id=?")->execute([user()['id'],$mid]); json_out(['ok'=>true,'following'=>false]);}
            $pdo->prepare("INSERT INTO follows(user_id,movie_id,created_at) VALUES(?,?,?)")->execute([user()['id'],$mid,now()]);
            json_out(['ok'=>true,'following'=>true]);

        case 'rate':
            require_login(); csrf_check();
            $mid=(int)($_POST['movie_id']??0); $rating=max(1,min(5,(int)($_POST['rating']??0)));
            $pdo=db();
            $pdo->prepare("INSERT INTO ratings(user_id,movie_id,rating,created_at,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(user_id,movie_id) DO UPDATE SET rating=excluded.rating,updated_at=excluded.updated_at")
            ->execute([user()['id'],$mid,$rating,now(),now()]);
            // تحديث المتوسط
            $avg=$pdo->query("SELECT AVG(rating) FROM ratings WHERE movie_id=$mid")->fetchColumn();
            $pdo->prepare("UPDATE movies SET rating_cache=? WHERE id=?")->execute([$avg,$mid]);
            json_out(['ok'=>true,'avg'=>round((float)$avg,2)]);

        case 'comment_add':
            require_login(); csrf_check();
            $mid=(int)($_POST['movie_id']??0); $txt=trim($_POST['comment']??'');
            if(!$txt) json_out(['ok'=>false,'error'=>'نص التعليق مطلوب']);
            $pdo=db();
            $pdo->prepare("INSERT INTO comments(user_id,movie_id,comment,created_at,updated_at) VALUES(?,?,?,?,?)")->execute([user()['id'],$mid,$txt,now(),now()]);
            json_out(['ok'=>true]);

        case 'comment_delete':
            require_login(); csrf_check();
            $cid=(int)($_POST['comment_id']??0);
            $pdo=db();
            $c=$pdo->prepare("SELECT * FROM comments WHERE id=?"); $c->execute([$cid]); $c=$c->fetch();
            if(!$c) json_out(['ok'=>false]);
            if(!is_admin() && !is_moderator() && (int)$c['user_id']!== (int)user()['id']) json_out(['ok'=>false,'error'=>'غير مسموح']);
            $pdo->prepare("UPDATE comments SET is_deleted=1, updated_at=? WHERE id=?")->execute([now(),$cid]);
            json_out(['ok'=>true]);

        case 'saveProgress':
            require_login();
            $mid=(int)($_POST['movie_id']??0);
            $eid=(int)($_POST['episode_id']??0) ?: null;
            $pos=(float)($_POST['position']??0);
            $dur=(float)($_POST['duration']??0);
            $dev=substr($_POST['device'] ?? 'web', 0, 64);
            $pdo=db();
            // upsert progress (نحتفظ بآخر صف)
            $pdo->prepare("INSERT INTO watch_history(user_id,movie_id,episode_id,position,duration,device,last_watched_at)
                           VALUES(?,?,?,?,?,?,?)
                           ")->execute([user()['id'],$mid,$eid,$pos,$dur,$dev,now()]);
            json_out(['ok'=>true]);

        case 'getProgress':
            require_login();
            $mid=(int)($_GET['movie_id']??0);
            $eid=(int)($_GET['episode_id']??0) ?: null;
            $stmt=db()->prepare("SELECT position,duration FROM watch_history WHERE user_id=? AND movie_id=? AND IFNULL(episode_id,0)=IFNULL(?,0) ORDER BY id DESC LIMIT 1");
            $stmt->execute([user()['id'],$mid,$eid]);
            $r=$stmt->fetch();
            json_out(['ok'=>true,'position'=> (float)($r['position']??0),'duration'=>(float)($r['duration']??0)]);

        case 'notifications':
            require_login();
            $rows=db()->prepare("SELECT * FROM notifications WHERE (user_id IS NULL OR user_id=?) ORDER BY id DESC LIMIT 20");
            $rows->execute([user()['id']]);
            json_out(['ok'=>true,'items'=>$rows->fetchAll()]);

        case 'mark_notifs':
            require_login(); csrf_check();
            db()->prepare("UPDATE notifications SET is_read=1 WHERE user_id=?")->execute([user()['id']]);
            json_out(['ok'=>true]);

        case 'admin_send_notif':
            require_login(); csrf_check();
            if(!is_admin()) json_out(['ok'=>false,'error'=>'Admin only']);
            $uid = ($_POST['user_id'] ?? '')!=='' ? (int)$_POST['user_id'] : null;
            $msg_ar = trim($_POST['message_ar'] ?? '');
            $msg_en = trim($_POST['message_en'] ?? '');
            $link = trim($_POST['link'] ?? '#');
            notify($uid, $msg_ar, $msg_en, $link);
            log_activity(user()['id'],'send_notification','notification',null,['to'=>$uid,'msg_ar'=>$msg_ar]);
            json_out(['ok'=>true]);

        case 'admin_movie': // add/edit/delete/publish
            require_login(); csrf_check();
            if(!can_manage_content()) json_out(['ok'=>false,'error'=>'غير مخوّل']);
            $op=$_POST['op']??'';
            $pdo=db();
            if($op==='add' || $op==='edit'){
                $id = (int)($_POST['id']??0);
                $data = [
                    'type'=> $_POST['type']??'movie',
                    'title'=> trim($_POST['title']??''),
                    'title_en'=> trim($_POST['title_en']??''),
                    'description'=> trim($_POST['description']??''),
                    'description_en'=> trim($_POST['description_en']??''),
                    'genres'=> trim($_POST['genres']??''),
                    'year'=> (int)($_POST['year']??0),
                    'duration'=> (int)($_POST['duration']??0),
                    'quality_tags'=> trim($_POST['quality_tags']??''),
                    'language'=> trim($_POST['language']??'ar'),
                ];
                // رفع الصور
                $posterPath=null; $backdropPath=null;
                foreach (['poster'=>'poster','backdrop'=>'backdrop'] as $fld=>$key){
                    if(!empty($_FILES[$fld]['name']) && is_uploaded_file($_FILES[$fld]['tmp_name'])){
                        $ext = strtolower(pathinfo($_FILES[$fld]['name'], PATHINFO_EXTENSION));
                        if(!in_array($ext,['jpg','jpeg','png','webp'])) json_out(['ok'=>false,'error'=>'نوع صورة غير مدعوم']);
                        $fname = $key.'_'.time().'_'.bin2hex(random_bytes(3)).'.'.$ext;
                        move_uploaded_file($_FILES[$fld]['tmp_name'], UPLOADS_DIR.'/'.$fname);
                        if($fld==='poster') $posterPath='uploads/'.$fname; else $backdropPath='uploads/'.$fname;
                    }
                }
                if($op==='add'){
                    $stmt=$pdo->prepare("INSERT INTO movies(type,title,title_en,description,description_en,genres,year,duration,poster,backdrop,quality_tags,language,is_published,rating_cache,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,0,0,?,?)");
                    $stmt->execute([$data['type'],$data['title'],$data['title_en'],$data['description'],$data['description_en'],$data['genres'],$data['year'],$data['duration'],$posterPath,$backdropPath,$data['quality_tags'],$data['language'],now(),now()]);
                    $mid=(int)$pdo->lastInsertId();
                    log_activity(user()['id'],'add','movie',$mid,$data);
                    json_out(['ok'=>true,'id'=>$mid]);
                } else {
                    $mid=$id;
                    $fields="type=:type,title=:title,title_en=:title_en,description=:description,description_en=:description_en,genres=:genres,year=:year,duration=:duration,quality_tags=:quality_tags,language=:language,updated_at=:updated_at";
                    if($posterPath) $fields.=",poster=:poster";
                    if($backdropPath) $fields.=",backdrop=:backdrop";
                    $stmt=$pdo->prepare("UPDATE movies SET $fields WHERE id=:id");
                    $bind=$data+['updated_at'=>now(),'id'=>$mid];
                    if($posterPath) $bind['poster']=$posterPath;
                    if($backdropPath) $bind['backdrop']=$backdropPath;
                    $stmt->execute($bind);
                    log_activity(user()['id'],'edit','movie',$mid,$data);
                    json_out(['ok'=>true,'id'=>$mid]);
                }
            } elseif($op==='delete'){
                $mid=(int)($_POST['id']??0);
                $pdo->prepare("DELETE FROM movies WHERE id=?")->execute([$mid]);
                log_activity(user()['id'],'delete','movie',$mid);
                json_out(['ok'=>true]);
            } elseif($op==='publish'){
                $mid=(int)($_POST['id']??0);
                $pub=(int)($_POST['is_published']??0);
                $pdo->prepare("UPDATE movies SET is_published=?, updated_at=? WHERE id=?")->execute([$pub,now(),$mid]);
                // إشعار عند نشر محتوى جديد
                if($pub===1){
                    notify(null,"تم إضافة ".(($pdo->query("SELECT type FROM movies WHERE id=$mid")->fetchColumn()==='series')?'مسلسل':'فيلم')." جديد","New title added","?route=details&id=".$mid);
                }
                log_activity(user()['id'],'publish','movie',$mid,['is_published'=>$pub]);
                json_out(['ok'=>true]);
            } elseif($op==='add_source'){
                $mid=(int)($_POST['movie_id']??0);
                $eid=(int)($_POST['episode_id']??0) ?: null;
                $quality=$_POST['quality'] ?? '720p';
                $src=trim($_POST['src']??'');
                db()->prepare("INSERT INTO video_sources(movie_id,episode_id,quality,src) VALUES(?,?,?,?)")->execute([$mid,$eid,$quality,$src]);
                log_activity(user()['id'],'add','video_source',$mid,['ep'=>$eid,'q'=>$quality]);
                json_out(['ok'=>true]);
            } else {
                json_out(['ok'=>false,'error'=>'عملية غير معروفة']);
            }

        case 'admin_episode':
            require_login(); csrf_check();
            if(!can_manage_content()) json_out(['ok'=>false,'error'=>'غير مخوّل']);
            $op=$_POST['op']??'';
            $pdo=db();
            if($op==='add' || $op==='edit'){
                $id=(int)($_POST['id']??0);
                $movie_id=(int)($_POST['movie_id']??0);
                $season=(int)($_POST['season']??1);
                $episode=(int)($_POST['episode']??1);
                $title=trim($_POST['title']??'');
                $duration=(int)($_POST['duration']??0);
                $mp4=trim($_POST['mp4_src']??'');
                if($op==='add'){
                    $pdo->prepare("INSERT INTO episodes(movie_id,season,episode,title,duration,mp4_src,created_at) VALUES(?,?,?,?,?,?,?)")
                        ->execute([$movie_id,$season,$episode,$title,$duration,$mp4,now()]);
                    $eid=(int)$pdo->lastInsertId();
                    // إشعار للمتابعين
                    $followers=$pdo->prepare("SELECT user_id FROM follows WHERE movie_id=?");
                    $followers->execute([$movie_id]);
                    foreach($followers->fetchAll(PDO::FETCH_COLUMN) as $uid){
                        notify((int)$uid,"تمت إضافة حلقة جديدة للمسلسل الذي تتابعه","New episode added","?route=watch&id=$movie_id&episode_id=$eid");
                    }
                    log_activity(user()['id'],'add','episode',$eid,['movie_id'=>$movie_id,'S'=>$season,'E'=>$episode]);
                    json_out(['ok'=>true,'id'=>$eid]);
                } else {
                    $pdo->prepare("UPDATE episodes SET season=?,episode=?,title=?,duration=?,mp4_src=? WHERE id=?")
                        ->execute([$season,$episode,$title,$duration,$mp4,$id]);
                    log_activity(user()['id'],'edit','episode',$id);
                    json_out(['ok'=>true,'id'=>$id]);
                }
            } elseif($op==='delete'){
                $id=(int)($_POST['id']??0);
                $pdo->prepare("DELETE FROM episodes WHERE id=?")->execute([$id]);
                log_activity(user()['id'],'delete','episode',$id);
                json_out(['ok'=>true]);
            } else {
                json_out(['ok'=>false,'error'=>'عملية غير معروفة']);
            }

        case 'admin_user':
            require_login(); csrf_check();
            if(!is_admin() && !is_moderator()) json_out(['ok'=>false,'error'=>'غير مخوّل']);
            $op=$_POST['op']??'';
            $uid=(int)($_POST['user_id']??0);
            $pdo=db();
            if($op==='approve'){
                $pdo->prepare("UPDATE users SET status='active' WHERE id=?")->execute([$uid]);
                notify($uid,'تمت الموافقة على حسابك','Your account has been approved','?route=home');
                log_activity(user()['id'],'approve','user',$uid);
                json_out(['ok'=>true]);
            } elseif($op==='reject'){
                $reason=trim($_POST['reason']??'');
                $pdo->prepare("UPDATE users SET status='blocked', block_reason=? WHERE id=?")->execute([$reason,$uid]);
                notify($uid,'تم رفض التسجيل: '.$reason,'Registration rejected','?route=home');
                log_activity(user()['id'],'reject','user',$uid,['reason'=>$reason]);
                json_out(['ok'=>true]);
            } elseif($op==='block'){
                $reason=trim($_POST['reason']??''); $until=trim($_POST['until']??'');
                $pdo->prepare("UPDATE users SET status='blocked', block_reason=?, block_until=? WHERE id=?")->execute([$reason,$until,$uid]);
                log_activity(user()['id'],'block','user',$uid,['reason'=>$reason,'until'=>$until]);
                json_out(['ok'=>true]);
            } elseif($op==='unblock'){
                $pdo->prepare("UPDATE users SET status='active', block_reason=NULL, block_until=NULL WHERE id=?")->execute([$uid]);
                log_activity(user()['id'],'unblock','user',$uid);
                json_out(['ok'=>true]);
            } else { json_out(['ok'=>false]); }

        case 'searchAdvanced':
            // لا يحتاج تسجيل دخول
            $q = trim($_GET['q'] ?? '');
            $type = $_GET['type'] ?? '';
            $year = (int)($_GET['year'] ?? 0);
            $minRating = (float)($_GET['minRating'] ?? 0);
            $order = $_GET['order'] ?? 'new';
            $lang = $_GET['lang'] ?? '';
            $quality = $_GET['quality'] ?? '';
            $where = ["is_published=1"];
            $bind = [];
            if ($q!==''){ $where[]="(title LIKE ? OR title_en LIKE ? OR description LIKE ?)"; $bind[]="%$q%"; $bind[]="%$q%"; $bind[]="%$q%"; }
            if ($type==='movie' || $type==='series'){ $where[]="type=?"; $bind[]=$type; }
            if ($year){ $where[]="year=?"; $bind[]=$year; }
            if ($lang!==''){ $where[]="language=?"; $bind[]=$lang; }
            if ($quality!==''){ $where[]="quality_tags LIKE ?"; $bind[]="%$quality%"; }
            if ($minRating>0){ $where[]="rating_cache>=?"; $bind[]=$minRating; }
            $orderSql = $order==='top' ? "rating_cache DESC" : "created_at DESC";
            $sql = "SELECT id,type,title,title_en,poster,year,rating_cache,quality_tags FROM movies WHERE ".implode(' AND ', $where)." ORDER BY $orderSql LIMIT 100";
            $stmt=db()->prepare($sql);
            $stmt->execute($bind);
            $rows=$stmt->fetchAll();
            json_out(['ok'=>true,'results'=>$rows]);

        case 'stream':
            // بث ملفات محلية مع دعم Range
            $src = $_GET['src'] ?? '';
            $path = realpath(BASE_DIR . '/' . ltrim($src, '/'));
            if (!$src || !$path || !str_starts_with($path, BASE_DIR) || !is_file($path)) {
                http_response_code(404); exit('Not found');
            }
            $size = filesize($path);
            $fp = fopen($path,'rb');
            $start = 0; $length = $size; $end = $size - 1;
            header('Content-Type: video/mp4');
            header('Accept-Ranges: bytes');
            if (isset($_SERVER['HTTP_RANGE'])) {
                if (preg_match('/bytes=(\d+)-(\d*)/', $_SERVER['HTTP_RANGE'], $m)) {
                    $start = (int)$m[1];
                    if ($m[2] !== '') { $end = (int)$m[2]; }
                    $length = $end - $start + 1;
                    http_response_code(206);
                    header("Content-Range: bytes $start-$end/$size");
                }
            }
            header('Content-Length: '.$length);
            fseek($fp,$start);
            $chunk = 8192*32;
            while(!feof($fp) && $length>0){
                $read = ($length>$chunk) ? $chunk : $length;
                echo fread($fp,$read);
                $length -= $read;
                @ob_flush(); flush();
            }
            fclose($fp);
            exit;

        default:
            json_out(['ok'=>false,'error'=>'Unknown action'], 400);
    }
}

// -------------- صفحات Router --------------
$route = $_GET['route'] ?? 'home';

// بيانات الواجهة
$u = user();
$rtl = true; // عربي افتراضياً (يمكن التوسع لاحقاً للغات أخرى)

// دوال عرض
function render_header(string $title=''): void {
    global $u, $rtl;
    $csrf = csrf_token();
    $dir = $rtl ? 'rtl' : 'ltr';
    $lang = $rtl ? 'ar' : 'en';
    echo "<!DOCTYPE html><html lang='$lang' dir='$dir'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'>";
    echo "<title>".e(APP_NAME.($title?' • '.$title:''))."</title>";
    // نمط حديث + وضع ليلي افتراضي + متغيرات CSS
    ?>
    <style>
    :root {
        --bg:#0f1115; --bg2:#171a21; --fg:#e7ebf0; --muted:#a7b0c0;
        --brand:#e50914; --brand2:#b20710; --card:#13161d; --border:#242a36; --accent:#2dd4bf;
        --star:#ffb703; --chip:#1f2937;
    }
    :root.light {
        --bg:#f7f8fa; --bg2:#ffffff; --fg:#0b1020; --muted:#5a677b;
        --brand:#e50914; --brand2:#b20710; --card:#ffffff; --border:#e5e7eb; --accent:#06b6d4;
        --star:#f59e0b; --chip:#eef2f7;
    }
    *{box-sizing:border-box} body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.6 system-ui, -apple-system, Segoe UI, Roboto, "Noto Kufi Arabic", "Noto Sans Arabic", Arial}
    a{color:inherit;text-decoration:none}
    img{max-width:100%;display:block}
    .topbar{position:sticky;top:0;z-index:50;background:linear-gradient(180deg,var(--bg2),transparent);backdrop-filter: blur(8px);border-bottom:1px solid var(--border)}
    .container{max-width:1200px;margin:auto;padding:0 16px}
    .flex{display:flex;gap:12px;align-items:center}
    .spacer{flex:1}
    .brand{display:flex;align-items:center;gap:10px;font-weight:800}
    .logo{width:28px;height:28px;border-radius:6px;background:var(--brand);box-shadow:0 0 0 2px var(--brand2) inset}
    .btn{background:var(--brand);color:#fff;border:none;padding:10px 14px;border-radius:10px;cursor:pointer;font-weight:700}
    .btn.secondary{background:var(--accent);color:#001018}
    .btn.ghost{background:transparent;border:1px solid var(--border);color:var(--fg)}
    .btn.small{padding:6px 10px;border-radius:8px;font-size:13px}
    .input{background:var(--card);border:1px solid var(--border);color:var(--fg);padding:10px 12px;border-radius:10px;outline:none;width:100%}
    .search{position:relative;flex:1}
    .search input{padding-inline-start:40px}
    .search .ico{position:absolute;inset-inline-start:10px;top:50%;transform:translateY(-50%);opacity:.7}
    .chip{display:inline-flex;align-items:center;gap:8px;background:var(--chip);color:var(--fg);padding:6px 10px;border-radius:999px;font-size:12px}
    .grid{display:grid;gap:16px;grid-template-columns:repeat(auto-fill,minmax(150px,1fr))}
    .card{background:var(--card);border:1px solid var(--border);border-radius:14px;overflow:hidden;transition:transform .15s ease}
    .card:hover{transform:translateY(-3px)}
    .poster{aspect-ratio:2/3;object-fit:cover}
    .meta{padding:10px}
    .rating{color:var(--star);font-weight:700}
    .hdr{display:flex;align-items:center;justify-content:space-between;margin:18px 0}
    .sec-title{font-weight:800;font-size:22px}
    .bell{position:relative}
    .bell .count{position:absolute;top:-6px;<?php echo $rtl?'left':'right'; ?>:-6px;background:var(--brand);color:#fff;border-radius:999px;font-size:11px;padding:2px 6px}
    .dropdown{position:absolute;<?php echo $rtl?'left':'right'; ?>:0;top:120%;width:320px;background:var(--card);border:1px solid var(--border);border-radius:12px;display:none;max-height:60vh;overflow:auto}
    .dropdown.show{display:block}
    .notif{padding:10px;border-bottom:1px solid var(--border)}
    .row{display:flex;gap:12px;align-items:center}
    .table{width:100%;border-collapse:collapse}
    .table th,.table td{border-bottom:1px solid var(--border);padding:10px;text-align:<?php echo $rtl?'right':'left'; ?>;vertical-align:top}
    .tabs{display:flex;gap:8px;margin:12px 0}
    .tab{padding:8px 12px;border:1px solid var(--border);border-radius:999px;cursor:pointer}
    .tab.active{background:var(--brand);color:white;border-color:transparent}
    .pill{border:1px solid var(--border);padding:4px 8px;border-radius:999px;font-size:12px}
    .player-wrap{background:var(--card);border:1px solid var(--border);border-radius:12px;overflow:hidden}
    .player{position:relative;background:#000}
    video{width:100%;max-height:64vh;background:#000}
    .controls{position:absolute;inset:0;display:flex;flex-direction:column;justify-content:space-between;pointer-events:none}
    .controls .bar{display:flex;gap:8px;align-items:center;background:linear-gradient(180deg,transparent,rgba(0,0,0,.55));padding:8px;pointer-events:auto}
    .controls button,.controls input[type=range]{cursor:pointer}
    .time{font-variant-numeric:tabular-nums}
    .episodes{display:flex;gap:8px;overflow:auto;padding:8px;background:var(--bg)}
    .episode-item{min-width:180px;background:var(--card);border:1px solid var(--border);border-radius:10px;padding:8px}
    .cinema .player-wrap{max-width:100%;border-radius:0}
    .admin-grid{display:grid;gap:16px;grid-template-columns:1fr 1fr}
    .badge{background:var(--brand);color:#fff;padding:3px 8px;border-radius:8px;font-size:12px;margin-inline-start:6px}
    @media (max-width:900px){ .admin-grid{grid-template-columns:1fr} .episodes{gap:6px} }
    </style>
    <?php
    ?>
    <script>
    // وضع ليلي/نهاري — افتراضياً ليلي
    (function(){
        const pref = localStorage.getItem('theme') || 'dark';
        if (pref==='light') document.documentElement.classList.add('light');
    })();
    </script>
    </head><body>
    <div class="topbar">
      <div class="container flex" style="padding:10px 0">
        <a class="brand" href="?route=home"><span class="logo"></span><span><?=e(APP_NAME)?></span></a>
        <div class="search">
            <span class="ico">🔎</span>
            <input class="input" id="q" placeholder="ابحث عن فيلم/مسلسل..." onkeydown="if(event.key==='Enter'){location='?route=search&q='+encodeURIComponent(this.value)}">
        </div>
        <button class="btn ghost small" id="themeBtn" title="تبديل الوضع">🌙</button>
        <a class="btn ghost small" href="?route=watchlist">قائمتي</a>
        <?php if($u): ?>
          <div class="bell" id="bell">
            <button class="btn ghost small" onclick="toggleNotifs()">🔔</button>
            <span class="count" id="notifCount" style="display:none">0</span>
            <div class="dropdown" id="notifDrop"></div>
          </div>
          <?php if (can_manage_content() || is_admin() || is_moderator()): ?>
            <a class="btn secondary small" href="?route=admin">لوحة التحكم</a>
          <?php endif; ?>
          <form method="post" action="?action=logout" style="margin:0"><button class="btn small" type="submit">تسجيل خروج</button></form>
        <?php else: ?>
          <a class="btn ghost small" href="?route=login">دخول</a>
          <a class="btn small" href="?route=register">تسجيل</a>
        <?php endif; ?>
      </div>
    </div>
    <div class="container" style="padding:16px">
    <script>
      document.getElementById('themeBtn').onclick = ()=>{
        const root=document.documentElement;
        const isLight=root.classList.toggle('light');
        localStorage.setItem('theme', isLight?'light':'dark');
      };
      async function toggleNotifs(){
        const d=document.getElementById('notifDrop');
        d.classList.toggle('show');
        if(d.classList.contains('show')){
          const r = await fetch('?action=notifications').then(r=>r.json()).catch(()=>({ok:false}));
          if(r.ok){
            let html='';
            r.items.forEach(n=>{
                html+=`<div class="notif"><div>${n.message_ar||n.message_en||'إشعار'}</div><a class="pill" href="${n.link||'#'}">فتح</a> <span style="opacity:.6;font-size:12px"><?php echo e('⏱'); ?> ${n.created_at}</span></div>`;
            });
            d.innerHTML = html || '<div class="notif">لا إشعارات.</div>';
            document.getElementById('notifCount').style.display='none';
            // تعليم كمقروء
            fetch('?action=mark_notifs', {method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'csrf=<?=e($csrf)?>'});
          }
        }
      }
      // فحص إشعارات جديدة بشكل دوري (خفيف)
      <?php if($u): ?>
      setInterval(async ()=>{
        const r = await fetch('?action=notifications').then(r=>r.json()).catch(()=>({ok:false}));
        if(r.ok){
          const unread = r.items.filter(x=>x.is_read==0).length;
          const el = document.getElementById('notifCount');
          if (unread>0){el.textContent=unread;el.style.display='inline-block';}
        }
      }, 15000);
      <?php endif; ?>
    </script>
    <?php
}
function render_footer(): void {
    echo "</div></body></html>";
}

// مكونات
function card_movie(array $m): string {
    $poster = $m['poster'] ? e($m['poster']) : 'https://via.placeholder.com/300x450?text=Poster';
    $typeBadge = $m['type']==='series' ? '<span class="badge">مسلسل</span>' : '';
    return '<a class="card" href="?route=details&id='.$m['id'].'">
        <img class="poster" loading="lazy" src="'.$poster.'" alt="'.e($m['title']).'">
        <div class="meta">
            <div style="display:flex;align-items:center;justify-content:space-between;gap:6px">
                <div style="font-weight:700;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">'.e($m['title']).$typeBadge.'</div>
                <div class="rating">★ '.number_format((float)$m['rating_cache'],1).'</div>
            </div>
            <div style="opacity:.7;font-size:13px">'.e((string)$m['year']).' • '.e($m['quality_tags']??'').'</div>
        </div>
    </a>';
}

// صفحات
if ($route==='home') {
    render_header('الرئيسية');
    $pdo=db();
    // رائج الآن: أعلى مشاهدة (نقدّر عبر watch_history)
    $trending = $pdo->query("SELECT m.*,(SELECT COUNT(*) FROM watch_history h WHERE h.movie_id=m.id) AS views FROM movies m WHERE is_published=1 ORDER BY views DESC,created_at DESC LIMIT 12")->fetchAll();
    // مقترح لك: وفق التقييمات/المشاهدة/الأنواع
    $suggested = $pdo->query("SELECT * FROM movies WHERE is_published=1 ORDER BY rating_cache DESC, created_at DESC LIMIT 12")->fetchAll();
    // جديد: الأحدث
    $latest = $pdo->query("SELECT * FROM movies WHERE is_published=1 ORDER BY created_at DESC LIMIT 12")->fetchAll();
    ?>
    <div class="hdr"><div class="sec-title">رائج الآن</div><a class="pill" href="?route=search&order=top">الكل →</a></div>
    <div class="grid"><?php foreach($trending as $m) echo card_movie($m); ?></div>

    <div class="hdr"><div class="sec-title">مقترح لك</div><a class="pill" href="?route=search">الكل →</a></div>
    <div class="grid"><?php foreach($suggested as $m) echo card_movie($m); ?></div>

    <div class="hdr"><div class="sec-title">أضيف مؤخراً</div><a class="pill" href="?route=search&order=new">الكل →</a></div>
    <div class="grid"><?php foreach($latest as $m) echo card_movie($m); ?></div>
    <?php
    render_footer();
    exit;
}

if ($route==='search') {
    render_header('بحث متقدم');
    $q = trim($_GET['q'] ?? '');
    ?>
    <div class="hdr"><div class="sec-title">بحث متقدم</div></div>
    <form onsubmit="doAdvancedSearch(event)" class="row" style="flex-wrap:wrap">
      <input class="input" style="min-width:260px" name="q" id="adv_q" placeholder="كلمة بحث" value="<?=e($q)?>">
      <select class="input" style="max-width:160px" id="adv_type"><option value="">النوع</option><option value="movie">فيلم</option><option value="series">مسلسل</option></select>
      <input class="input" style="max-width:140px" id="adv_year" placeholder="السنة">
      <select class="input" style="max-width:160px" id="adv_quality"><option value="">الجودة</option><option>480p</option><option>720p</option><option>1080p</option><option>4K</option></select>
      <select class="input" style="max-width:160px" id="adv_order"><option value="new">الأحدث</option><option value="top">الأعلى تقييماً</option></select>
      <button class="btn">بحث</button>
    </form>
    <div id="results" style="margin-top:16px"></div>
    <script>
    async function doAdvancedSearch(ev){
        if(ev) ev.preventDefault();
        const params = new URLSearchParams({
            action:'searchAdvanced',
            q: document.getElementById('adv_q').value||'',
            type: document.getElementById('adv_type').value||'',
            year: document.getElementById('adv_year').value||'',
            quality: document.getElementById('adv_quality').value||'',
            order: document.getElementById('adv_order').value||'',
        });
        const r = await fetch('?'+params.toString()).then(r=>r.json());
        const box = document.getElementById('results');
        if(!r.ok){ box.innerHTML='<div>خطأ في البحث</div>'; return; }
        let html = '<div class="grid">';
        r.results.forEach(m=>{
            html += `<?=str_replace(['`',"\n"],['\`',''], card_movie(['poster'=>'${'${m.poster||""}'}','type'=>'${'${m.type}'}','id'=>0,'title'=>'${'${m.title}'}','rating_cache'=>0,'year'=>0,'quality_tags'=>'' ]))?>`.replaceAll('id=0','id='+m.id).replace('★ 0.0','★ '+(m.rating_cache?Number(m.rating_cache).toFixed(1):'0.0')).replace(' • ',' • '+(m.year||''));
        });
        html += '</div>';
        box.innerHTML = html;
    }
    doAdvancedSearch();
    </script>
    <?php
    render_footer(); exit;
}

if ($route==='details') {
    $id=(int)($_GET['id']??0);
    $stmt=db()->prepare("SELECT * FROM movies WHERE id=?"); $stmt->execute([$id]); $m=$stmt->fetch();
    if(!$m || ($m['is_published']==0 && !can_manage_content())){
        render_header('غير موجود'); echo "<div>العنصر غير موجود.</div>"; render_footer(); exit;
    }
    render_header($m['title']);
    $poster = $m['poster'] ? e($m['poster']) : 'https://via.placeholder.com/600x900?text=Poster';
    $backdrop = $m['backdrop'] ? "style=\"background-image:url('".e($m['backdrop'])."');background-size:cover;background-position:center\"" : '';
    ?>
    <div class="card" style="overflow:hidden;margin-bottom:16px">
      <div class="row" style="align-items:stretch">
        <div style="min-width:220px"><img src="<?=$poster?>" alt="<?=e($m['title'])?>" class="poster" loading="lazy"></div>
        <div class="spacer" <?=$backdrop?>>
          <div style="backdrop-filter:blur(0px);padding:16px;background:linear-gradient(90deg,rgba(0,0,0,.6),rgba(0,0,0,.2));min-height:100%">
            <h2 style="margin:0 0 8px 0"><?=e($m['title'])?> <?=$m['type']==='series'?'<span class="pill">مسلسل</span>':'<span class="pill">فيلم</span>'?></h2>
            <div class="row" style="gap:10px;color:#ffd166"><b>★ <?=number_format((float)$m['rating_cache'],1)?></b></div>
            <div style="opacity:.9;margin-top:8px"><?=nl2br(e($m['description']))?></div>
            <div style="margin-top:10px;display:flex;gap:8px;flex-wrap:wrap">
                <span class="chip">سنة: <?=e((string)$m['year'])?></span>
                <span class="chip">اللغة: <?=e($m['language'])?></span>
                <span class="chip">الجودة: <?=e($m['quality_tags'])?></span>
                <span class="chip">النوع: <?=e($m['genres'])?></span>
            </div>
            <div style="margin-top:12px;display:flex;gap:8px;flex-wrap:wrap">
                <?php $csrf=csrf_token(); ?>
                <?php if(user()): ?>
                    <form onsubmit="event.preventDefault();toggleWatchlist(<?=$m['id']?>)" style="margin:0"><input type="hidden" name="csrf" value="<?=$csrf?>"><button class="btn small ghost">+ قائمتي</button></form>
                    <?php if($m['type']==='series'): ?>
                      <form onsubmit="event.preventDefault();followSeries(<?=$m['id']?>)" style="margin:0"><input type="hidden" name="csrf" value="<?=$csrf?>"><button class="btn small ghost">🔔 متابعة</button></form>
                    <?php endif; ?>
                    <?php if(can_manage_content()): ?>
                      <a class="btn small secondary" href="?route=admin&tab=content&edit=<?=$m['id']?>">تعديل</a>
                    <?php endif; ?>
                <?php else: ?>
                    <a class="btn small secondary" href="?route=login">سجّل لتضيف إلى قائمتك</a>
                <?php endif; ?>
            </div>
          </div>
        </div>
      </div>
    </div>

    <?php if($m['type']==='movie'): ?>
      <div class="hdr"><div class="sec-title">المشاهدة</div></div>
      <div class="player-wrap"><div class="player"><?=render_player((int)$m['id'], null)?></div></div>
    <?php else: // مسلسل ?>
      <div class="hdr"><div class="sec-title">المواسم والحلقات</div></div>
      <div class="episodes">
        <?php
          $eps = db()->prepare("SELECT * FROM episodes WHERE movie_id=? ORDER BY season, episode");
          $eps->execute([$m['id']]); $list=$eps->fetchAll();
          $curS=0;
          foreach($list as $ep){
              if($ep['season']!==$curS){ $curS=$ep['season']; echo '<div class="chip" style="min-width:140px">الموسم '.$curS.'</div>'; }
              echo '<a class="episode-item" href="?route=watch&id='.$m['id'].'&episode_id='.$ep['id'].'">
                      <div style="font-weight:700">حلقة '.$ep['episode'].'</div>
                      <div style="opacity:.8">'.e($ep['title']).'</div>
                      <div class="pill" style="margin-top:6px">⏱ '.e((string)$ep['duration']).' د</div>
                    </a>';
          }
        ?>
      </div>
    <?php endif; ?>

    <div class="hdr"><div class="sec-title">التقييم والتعليقات</div></div>
    <div class="card" style="padding:12px">
      <div class="row" style="gap:10px;flex-wrap:wrap">
        <?php if(user()): ?>
          <form onsubmit="event.preventDefault();rateMovie(<?=$m['id']?>)" class="row" style="gap:8px">
            <input type="hidden" id="csrf_rate" value="<?=csrf_token()?>">
            <label>قيّم:</label>
            <select class="input" style="max-width:120px" id="rating">
              <option value="5">★★★★★</option><option value="4">★★★★☆</option><option value="3">★★★☆☆</option><option value="2">★★☆☆☆</option><option value="1">★☆☆☆☆</option>
            </select>
            <button class="btn small">إرسال</button>
          </form>
          <form onsubmit="event.preventDefault();addComment(<?=$m['id']?>)" class="row" style="gap:8px;flex:1">
            <input type="hidden" id="csrf_comment" value="<?=csrf_token()?>">
            <input class="input" id="comment_txt" placeholder="اكتب تعليقك...">
            <button class="btn small">نشر</button>
          </form>
        <?php else: ?>
          <div>سجّل دخولك للتقييم والتعليق.</div>
        <?php endif; ?>
      </div>
      <div id="comments" style="margin-top:10px">
        <?php
          $c=db()->prepare("SELECT c.*,u.username FROM comments c JOIN users u ON u.id=c.user_id WHERE c.movie_id=? AND c.is_deleted=0 ORDER BY c.id DESC LIMIT 50");
          $c->execute([$m['id']]);
          foreach($c->fetchAll() as $row){
              echo '<div style="border-bottom:1px solid var(--border);padding:8px 0"><b>'.e($row['username']).'</b> <span style="opacity:.6">'.e($row['created_at']).'</span>';
              if(user() && (is_admin()||is_moderator()|| (int)$row['user_id']===(int)user()['id'])){
                  echo ' <button class="btn ghost small" onclick="delComment('.$row['id'].')">حذف</button>';
              }
              echo '<div>'.nl2br(e($row['comment'])).'</div></div>';
          }
        ?>
      </div>
    </div>

    <script>
      async function toggleWatchlist(id){
        const body = new URLSearchParams({movie_id:id,csrf:'<?=e($csrf)?>'});
        const r = await fetch('?action=toggle_watchlist',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
        if(r.ok) alert(r.in_list?'تمت الإضافة إلى قائمتك':'تمت الإزالة من قائمتك');
      }
      async function followSeries(id){
        const body = new URLSearchParams({movie_id:id,csrf:'<?=e($csrf)?>'});
        const r = await fetch('?action=follow_series',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
        if(r.ok) alert(r.following?'تمت المتابعة ✅':'تم إلغاء المتابعة');
      }
      async function rateMovie(id){
        const rating=document.getElementById('rating').value;
        const body=new URLSearchParams({movie_id:id,rating,csrf:document.getElementById('csrf_rate').value});
        const r=await fetch('?action=rate',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
        if(r.ok) location.reload();
      }
      async function addComment(id){
        const txt=document.getElementById('comment_txt').value.trim();
        if(!txt) return;
        const body=new URLSearchParams({movie_id:id,comment:txt,csrf:document.getElementById('csrf_comment').value});
        const r=await fetch('?action=comment_add',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
        if(r.ok) location.reload();
      }
      async function delComment(cid){
        if(!confirm('حذف التعليق؟'))return;
        const body=new URLSearchParams({comment_id:cid,csrf:'<?=e(csrf_token())?>'});
        const r=await fetch('?action=comment_delete',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
        if(r.ok) location.reload();
      }
    </script>
    <?php
    render_footer(); exit;
}

if ($route==='watch') {
    $mid=(int)($_GET['id']??0);
    $eid = isset($_GET['episode_id']) ? (int)$_GET['episode_id'] : null;
    $pdo=db();
    $m=$pdo->prepare("SELECT * FROM movies WHERE id=?"); $m->execute([$mid]); $m=$m->fetch();
    if(!$m || ($m['is_published']==0 && !can_manage_content())){ render_header('غير متاح'); echo "غير متاح"; render_footer(); exit; }
    $episode=null;
    if($m['type']==='series'){
        if($eid){
            $stmt=$pdo->prepare("SELECT * FROM episodes WHERE id=? AND movie_id=?");
            $stmt->execute([$eid,$mid]); $episode=$stmt->fetch();
        } else {
            $stmt=$pdo->prepare("SELECT * FROM episodes WHERE movie_id=? ORDER BY season,episode LIMIT 1");
            $stmt->execute([$mid]); $episode=$stmt->fetch();
        }
    }
    $title = $m['title'].($episode?' — S'.$episode['season'].'E'.$episode['episode']:'');
    render_header('مشاهدة: '.$title);
    ?>
    <div class="player-wrap" id="cinemaWrap">
      <div class="player" id="playerBox">
        <?=render_player($mid, $episode ? (int)$episode['id'] : null)?>
      </div>
    </div>
    <?php if($m['type']==='series'): ?>
      <div class="hdr"><div class="sec-title">الحلقات</div></div>
      <div class="episodes" id="epsList">
        <?php
        $eps=$pdo->prepare("SELECT * FROM episodes WHERE movie_id=? ORDER BY season, episode"); $eps->execute([$mid]);
        $arr=$eps->fetchAll();
        foreach($arr as $ep){
            echo '<a class="episode-item" href="?route=watch&id='.$mid.'&episode_id='.$ep['id'].'">
                    <div><b>الموسم '.$ep['season'].'</b> — حلقة '.$ep['episode'].'</div>
                    <div>'.e($ep['title']).'</div>
                  </a>';
        }
        ?>
      </div>
    <?php endif; ?>
    <script>
    // عناصر التحكم المخصصة + استئناف + Auto-Next
    const video = document.querySelector('video');
    const qs =(s)=>document.querySelector(s);
    const btnPlay=qs('#btnPlay'), btnFS=qs('#btnFS'), btnCin=qs('#btnCinema'), speedSel=qs('#speed'), rng=qs('#rng'), vol=qs('#vol'), tCur=qs('#tCur'), tDur=qs('#tDur'), qSel=qs('#quality');
    function fmt(t){ t=Math.floor(t); const m=String(Math.floor(t/60)).padStart(2,'0'); const s=String(Math.floor(t%60)).padStart(2,'0'); return m+':'+s; }
    video.addEventListener('loadedmetadata', ()=>{ tDur.textContent=fmt(video.duration||0); rng.max=video.duration||0; });
    video.addEventListener('timeupdate', ()=>{ rng.value=video.currentTime; tCur.textContent=fmt(video.currentTime); throttleSave(); });
    rng.oninput=()=>{ video.currentTime=rng.value; };
    btnPlay.onclick=()=>{ if(video.paused) video.play(); else video.pause(); };
    btnFS.onclick=()=>{ video.requestFullscreen?.(); };
    btnCin.onclick=()=>{ document.getElementById('cinemaWrap').classList.toggle('cinema'); };
    speedSel.onchange=()=>{ video.playbackRate=parseFloat(speedSel.value); };
    vol.oninput=()=>{ video.volume=vol.value; };
    qSel?.addEventListener('change', ()=>{ const url=qSel.value; if(url){ const t=video.currentTime; video.src=url; video.play().then(()=>{ video.currentTime=t; }); }});
    // استئناف تلقائي
    (async ()=>{
        const r=await fetch('?action=getProgress&movie_id=<?=$mid?>&episode_id=<?= $episode? (int)$episode['id'] : 0 ?>').then(r=>r.json()).catch(()=>({ok:false}));
        if(r.ok && r.position>5){ video.currentTime=r.position; }
    })();
    // حفظ تقدّم
    let saveTimer=0;
    function throttleSave(){
        clearTimeout(saveTimer);
        saveTimer=setTimeout(()=>{
            const fd=new FormData();
            fd.append('movie_id','<?=$mid?>');
            fd.append('episode_id','<?= $episode? (int)$episode['id'] : '' ?>');
            fd.append('position', String(video.currentTime||0));
            fd.append('duration', String(video.duration||0));
            fd.append('device', navigator.userAgent.slice(0,64));
            fetch('?action=saveProgress', {method:'POST', body:fd});
        }, 1200);
    }
    // Auto-next للحلقة التالية
    video.addEventListener('ended', ()=>{
        <?php if($m['type']==='series'): ?>
        const currentId = <?= $episode? (int)$episode['id'] : 0 ?>;
        const links = [...document.querySelectorAll('#epsList a')];
        const idx = links.findIndex(a=>a.href.includes('episode_id='+currentId));
        if(idx>-1 && links[idx+1]) location = links[idx+1].href;
        <?php endif; ?>
    });
    </script>
    <?php
    render_footer(); exit;
}

if ($route==='watchlist') {
    require_login();
    render_header('قائمة المشاهدة');
    $rows=db()->prepare("SELECT m.* FROM watchlist w JOIN movies m ON m.id=w.movie_id WHERE w.user_id=? ORDER BY w.created_at DESC");
    $rows->execute([user()['id']]);
    echo '<div class="grid">'; foreach($rows->fetchAll() as $m) echo card_movie($m); echo '</div>';
    render_footer(); exit;
}

if ($route==='login') {
    render_header('تسجيل الدخول');
    ?>
    <div class="card" style="max-width:480px;margin:auto;padding:16px">
      <h2>تسجيل الدخول</h2>
      <form id="loginForm" onsubmit="doLogin(event)">
        <input class="input" name="email" placeholder="الإيميل">
        <input class="input" name="password" type="password" placeholder="كلمة المرور">
        <button class="btn" style="width:100%">دخول</button>
      </form>
      <div style="margin-top:10px">ليس لديك حساب؟ <a class="pill" href="?route=register">تسجيل</a></div>
    </div>
    <script>
      async function doLogin(ev){
        ev.preventDefault();
        const fd=new FormData(ev.target);
        const r=await fetch('?action=login',{method:'POST',body:fd}).then(r=>r.json());
        if(r.ok) location='?route=home'; else alert(r.error||'فشل');
      }
    </script>
    <?php
    render_footer(); exit;
}

if ($route==='register') {
    render_header('تسجيل حساب');
    ?>
    <div class="card" style="max-width:520px;margin:auto;padding:16px">
      <h2>تسجيل حساب جديد</h2>
      <p>ملاحظة: أول حساب يُسجّل يصبح <b>مدير (Admin)</b> تلقائياً. باقي الحسابات تتطلب موافقة الإدارة.</p>
      <form id="regForm" onsubmit="doReg(event)">
        <input class="input" name="username" placeholder="اسم المستخدم">
        <input class="input" name="email" placeholder="الإيميل">
        <input class="input" name="password" type="password" placeholder="كلمة المرور">
        <button class="btn" style="width:100%">تسجيل</button>
      </form>
      <div style="margin-top:10px">لديك حساب؟ <a class="pill" href="?route=login">دخول</a></div>
    </div>
    <script>
      async function doReg(ev){
        ev.preventDefault();
        const fd=new FormData(ev.target);
        const r=await fetch('?action=register',{method:'POST',body:fd}).then(r=>r.json());
        if(r.ok){
            if(r.status==='active') location='?route=home';
            else alert('تم استلام طلبك، بانتظار موافقة الإدارة.');
        } else alert(r.error||'فشل');
      }
    </script>
    <?php
    render_footer(); exit;
}

if ($route==='mystats') {
    require_login();
    render_header('إحصاءاتي');
    $uid=user()['id'];
    $pdo=db();
    $hours=(float)$pdo->query("SELECT COALESCE(SUM(duration)/3600.0,0) FROM watch_history WHERE user_id=$uid")->fetchColumn();
    $favGenres=$pdo->query("SELECT group_concat(genres,'|') FROM movies WHERE id IN (SELECT DISTINCT movie_id FROM watch_history WHERE user_id=$uid)")->fetchColumn();
    $counts=[];
    foreach(array_filter(array_map('trim', preg_split('/[,|]+/',$favGenres??''))) as $g){ $counts[$g]=($counts[$g]??0)+1; }
    arsort($counts); $top=array_slice($counts,0,6,true);
    ?>
    <h2>إحصاءاتي</h2>
    <div class="row" style="gap:12px;flex-wrap:wrap">
      <div class="card" style="padding:12px"><div class="sec-title">ساعات المشاهدة</div><div style="font-size:28px;font-weight:800"><?=number_format($hours,1)?> ساعة</div></div>
      <div class="card" style="padding:12px"><div class="sec-title">التصنيفات المفضلة</div>
        <?php if($top): foreach($top as $g=>$n) echo '<div class="chip" style="margin:4px 4px 0 0">'.e($g).' <b>'.$n.'</b></div>'; else echo '<div>لا بيانات كافية.</div>'; endif; ?>
      </div>
    </div>
    <canvas id="chart" width="800" height="260" style="margin-top:16px;background:var(--card);border:1px solid var(--border);border-radius:12px"></canvas>
    <script>
      // رسم بسيط بالكانفاس لآخر 10 أيام مشاهدة
      (async ()=>{
        const data = <?=json_encode(collect_daily($uid,10))?>;
        const c=document.getElementById('chart'),ctx=c.getContext('2d');
        const pad=30, W=c.width, H=c.height, max=Math.max(1,...data.map(x=>x.hours));
        ctx.fillStyle=getComputedStyle(document.documentElement).getPropertyValue('--fg');
        ctx.font='12px system-ui';
        data.forEach((d,i)=>{
          const x=pad + i*( (W-pad*2)/(data.length-1) );
          const h=(H-pad*2) * (d.hours/max);
          ctx.fillRect(x-10, H-pad-h, 20, h);
          ctx.fillText(d.day, x-14, H-pad+14);
        });
        ctx.fillText('ساعات',5,15);
      })();
      function getComputedStyleProp(n){ return getComputedStyle(document.documentElement).getPropertyValue(n); }
    </script>
    <?php
    render_footer(); exit;
}
function collect_daily(int $uid, int $days): array {
    $pdo=db(); $out=[];
    $start=(new DateTime('-'.($days-1).' days', new DateTimeZone('UTC')));
    for($i=0;$i<$days;$i++){
        $d=(clone $start)->modify("+$i day")->format('Y-m-d');
        $s=$pdo->prepare("SELECT COALESCE(SUM(duration)/3600.0,0) FROM watch_history WHERE user_id=? AND substr(last_watched_at,1,10)=?");
        $s->execute([$uid,$d]);
        $out[]=['day'=>substr($d,5),'hours'=>round((float)$s->fetchColumn(),2)];
    }
    return $out;
}

if ($route==='admin') {
    require_login();
    if(!is_admin() && !is_editor() && !is_moderator()){ render_header('ممنوع'); echo "غير مخوّل"; render_footer(); exit; }
    $tab=$_GET['tab'] ?? 'content';
    $pdo=db();
    render_header('لوحة التحكم');
    ?>
    <div class="tabs">
      <a class="tab <?=$tab==='content'?'active':''?>" href="?route=admin&tab=content">المحتوى</a>
      <a class="tab <?=$tab==='episodes'?'active':''?>" href="?route=admin&tab=episodes">الحلقات</a>
      <a class="tab <?=$tab==='sources'?'active':''?>" href="?route=admin&tab=sources">الجودات/المصادر</a>
      <a class="tab <?=$tab==='users'?'active':''?>" href="?route=admin&tab=users">المستخدمون</a>
      <a class="tab <?=$tab==='notifs'?'active':''?>" href="?route=admin&tab=notifs">الإشعارات</a>
      <a class="tab <?=$tab==='analytics'?'active':''?>" href="?route=admin&tab=analytics">الإحصاءات</a>
      <a class="tab <?=$tab==='logs'?'active':''?>" href="?route=admin&tab=logs">السجل</a>
    </div>
    <?php
    if($tab==='content' && can_manage_content()){
        $editId = isset($_GET['edit']) ? (int)$_GET['edit'] : 0;
        $edit=null;
        if($editId){ $s=$pdo->prepare("SELECT * FROM movies WHERE id=?"); $s->execute([$editId]); $edit=$s->fetch(); }
        ?>
        <div class="admin-grid">
          <div class="card" style="padding:12px">
            <h3><?=$edit?'تعديل محتوى':'إضافة محتوى'?></h3>
            <form id="movieForm" enctype="multipart/form-data" onsubmit="saveMovie(event)">
              <input type="hidden" name="id" value="<?=e((string)($edit['id']??''))?>">
              <div class="row"><label class="pill">النوع</label>
                <select class="input" name="type"><option value="movie" <?=isset($edit)&&$edit['type']==='movie'?'selected':''?>>فيلم</option><option value="series" <?=isset($edit)&&$edit['type']==='series'?'selected':''?>>مسلسل</option></select></div>
              <input class="input" name="title" placeholder="العنوان" value="<?=e($edit['title']??'')?>">
              <input class="input" name="title_en" placeholder="العنوان (EN)" value="<?=e($edit['title_en']??'')?>">
              <textarea class="input" name="description" placeholder="الوصف" rows="4"><?=e($edit['description']??'')?></textarea>
              <textarea class="input" name="description_en" placeholder="الوصف (EN)" rows="3"><?=e($edit['description_en']??'')?></textarea>
              <input class="input" name="genres" placeholder="التصنيفات (مفصولة بفواصل)" value="<?=e($edit['genres']??'')?>">
              <div class="row">
                <input class="input" name="year" placeholder="السنة" value="<?=e((string)($edit['year']??''))?>" style="max-width:140px">
                <input class="input" name="duration" placeholder="المدة بالدقائق" value="<?=e((string)($edit['duration']??''))?>" style="max-width:180px">
                <input class="input" name="language" placeholder="اللغة (ar/en/...)" value="<?=e($edit['language']??'ar')?>" style="max-width:140px">
              </div>
              <input class="input" name="quality_tags" placeholder="شارات الجودة (مثال: 720p,1080p,4K)" value="<?=e($edit['quality_tags']??'')?>">
              <div class="row">
                <label class="pill">بوستر</label><input class="input" type="file" name="poster" accept=".jpg,.jpeg,.png,.webp">
              </div>
              <div class="row">
                <label class="pill">خلفية</label><input class="input" type="file" name="backdrop" accept=".jpg,.jpeg,.png,.webp">
              </div>
              <input type="hidden" name="csrf" value="<?=e(csrf_token())?>">
              <div class="row" style="justify-content:space-between">
                <button class="btn" type="submit"><?=$edit?'حفظ التعديلات':'إضافة'?></button>
                <?php if($edit): ?>
                  <button class="btn ghost" onclick="publishMovie(<?=$edit['id']?>, <?= $edit['is_published']?0:1 ?>);return false;"><?= $edit['is_published']?'إلغاء النشر':'نشر' ?></button>
                  <button class="btn ghost" onclick="deleteMovie(<?=$edit['id']?>);return false;">حذف</button>
                <?php endif; ?>
              </div>
            </form>
            <small>🔒 ملاحظة: يستطيع الأدمن/المحرر تعديل المحتوى قبل وبعد النشر أو حذفه.</small>
          </div>
          <div class="card" style="padding:12px">
            <h3>المحتوى المنشور/المسودات</h3>
            <table class="table">
              <tr><th>#</th><th>العنوان</th><th>النوع</th><th>الحالة</th><th>تحكم</th></tr>
              <?php
              foreach($pdo->query("SELECT id,title,type,is_published,created_at FROM movies ORDER BY created_at DESC LIMIT 100") as $row){
                echo '<tr><td>'.$row['id'].'</td><td>'.e($row['title']).'</td><td>'.($row['type']==='series'?'مسلسل':'فيلم').'</td><td>'.($row['is_published']?'منشور':'مسودة').'</td><td><a class="pill" href="?route=admin&tab=content&edit='.$row['id'].'">تعديل</a> <a class="pill" href="?route=details&id='.$row['id'].'">عرض</a></td></tr>';
              }
              ?>
            </table>
          </div>
        </div>
        <script>
          async function saveMovie(ev){
            ev.preventDefault();
            const fd=new FormData(document.getElementById('movieForm'));
            fd.append('csrf','<?=e(csrf_token())?>');
            fd.append('op','<?= isset($edit)?'edit':'add' ?>');
            const r=await fetch('?action=admin_movie',{method:'POST',body:fd}).then(r=>r.json());
            if(r.ok) location='?route=admin&tab=content&edit='+(r.id || fd.get('id')); else alert(r.error||'فشل');
          }
          async function publishMovie(id, pub){
            if(!confirm(pub? 'نشر الآن؟':'إلغاء النشر؟')) return;
            const body=new URLSearchParams({op:'publish',id, is_published:String(pub), csrf:'<?=e(csrf_token())?>'});
            const r=await fetch('?action=admin_movie',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
            if(r.ok) location.reload();
          }
          async function deleteMovie(id){
            if(!confirm('حذف المحتوى نهائياً؟')) return;
            const body=new URLSearchParams({op:'delete',id,csrf:'<?=e(csrf_token())?>'});
            const r=await fetch('?action=admin_movie',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
            if(r.ok) location='?route=admin&tab=content';
          }
        </script>
        <?php
    } elseif ($tab==='episodes' && can_manage_content()) {
        ?>
        <div class="card" style="padding:12px">
          <h3>إدارة الحلقات</h3>
          <form id="epForm" onsubmit="saveEp(event)">
            <div class="row" style="flex-wrap:wrap">
              <input class="input" name="movie_id" placeholder="ID المسلسل">
              <input class="input" name="season" placeholder="الموسم">
              <input class="input" name="episode" placeholder="الحلقة">
              <input class="input" name="title" placeholder="عنوان الحلقة">
              <input class="input" name="duration" placeholder="المدة بالدقائق">
              <input class="input" name="mp4_src" placeholder="مصدر افتراضي (اختياري)">
              <input type="hidden" name="csrf" value="<?=e(csrf_token())?>">
              <button class="btn">إضافة حلقة</button>
            </div>
          </form>
          <h4 style="margin-top:16px">آخر 50 حلقة</h4>
          <table class="table">
            <tr><th>ID</th><th>المسلسل</th><th>الموسم</th><th>الحلقة</th><th>عنوان</th><th>تحكم</th></tr>
            <?php
            foreach(db()->query("SELECT e.*, m.title mt FROM episodes e JOIN movies m ON m.id=e.movie_id ORDER BY e.id DESC LIMIT 50") as $ep){
                echo '<tr><td>'.$ep['id'].'</td><td>'.e($ep['mt']).'</td><td>'.$ep['season'].'</td><td>'.$ep['episode'].'</td><td>'.e($ep['title']).'</td><td>
                <button class="btn small ghost" onclick="delEp('.$ep['id'].')">حذف</button></td></tr>';
            }
            ?>
          </table>
        </div>
        <script>
          async function saveEp(ev){
            ev.preventDefault();
            const fd=new FormData(document.getElementById('epForm'));
            fd.append('op','add');
            const r=await fetch('?action=admin_episode',{method:'POST',body:fd}).then(r=>r.json());
            if(r.ok) location.reload(); else alert(r.error||'فشل');
          }
          async function delEp(id){
            if(!confirm('حذف الحلقة؟')) return;
            const body=new URLSearchParams({op:'delete',id,csrf:'<?=e(csrf_token())?>'});
            const r=await fetch('?action=admin_episode',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
            if(r.ok) location.reload();
          }
        </script>
        <?php
    } elseif ($tab==='sources' && can_manage_content()) {
        ?>
        <div class="card" style="padding:12px">
          <h3>إضافة مصدر/جودة</h3>
          <form id="srcForm" onsubmit="addSrc(event)">
            <div class="row" style="flex-wrap:wrap">
              <input class="input" name="movie_id" placeholder="ID الفيلم/المسلسل">
              <input class="input" name="episode_id" placeholder="ID الحلقة (اختياري)">
              <select class="input" name="quality"><option>480p</option><option selected>720p</option><option>1080p</option><option>4K</option></select>
              <input class="input" name="src" placeholder="رابط الفيديو (محلي أو خارجي)">
              <input type="hidden" name="csrf" value="<?=e(csrf_token())?>">
              <button class="btn">إضافة</button>
            </div>
          </form>
          <h4 style="margin-top:16px">آخر 50 مصدر</h4>
          <table class="table">
            <tr><th>ID</th><th>Movie</th><th>Episode</th><th>Quality</th><th>Src</th></tr>
            <?php foreach(db()->query("SELECT * FROM video_sources ORDER BY id DESC LIMIT 50") as $s){
                echo '<tr><td>'.$s['id'].'</td><td>'.$s['movie_id'].'</td><td>'.($s['episode_id']?:'-').'</td><td>'.$s['quality'].'</td><td style="max-width:360px;word-break:break-all">'.e($s['src']).'</td></tr>';
            } ?>
          </table>
        </div>
        <script>
          async function addSrc(ev){
            ev.preventDefault();
            const fd=new FormData(document.getElementById('srcForm'));
            fd.append('op','add_source');
            const r=await fetch('?action=admin_movie',{method:'POST',body:fd}).then(r=>r.json());
            if(r.ok) location.reload(); else alert(r.error||'فشل');
          }
        </script>
        <?php
    } elseif ($tab==='users') {
        if(!is_admin() && !is_moderator()){ echo "<div class='card' style='padding:12px'>غير مخوّل</div>"; }
        else {
            ?>
            <div class="card" style="padding:12px">
              <h3>طلبات التسجيل المعلّقة</h3>
              <table class="table">
                <tr><th>ID</th><th>المستخدم</th><th>البريد</th><th>الدور</th><th>الحالة</th><th>تحكم</th></tr>
                <?php foreach(db()->query("SELECT * FROM users WHERE status='pending' ORDER BY created_at") as $uu){
                    echo '<tr><td>'.$uu['id'].'</td><td>'.e($uu['username']).'</td><td>'.e($uu['email']).'</td><td>'.e($uu['role']).'</td><td>'.e($uu['status']).'</td><td>
                    <button class="btn small" onclick="userApprove('.$uu['id'].')">موافقة</button>
                    <button class="btn small ghost" onclick="userReject('.$uu['id'].')">رفض</button></td></tr>';
                } ?>
              </table>
            </div>
            <div class="card" style="padding:12px;margin-top:12px">
              <h3>كل المستخدمين</h3>
              <table class="table">
                <tr><th>ID</th><th>اسم</th><th>إيميل</th><th>دور</th><th>حالة</th><th>تحكم</th></tr>
                <?php foreach(db()->query("SELECT * FROM users ORDER BY id DESC LIMIT 200") as $uu){
                    echo '<tr><td>'.$uu['id'].'</td><td>'.e($uu['username']).'</td><td>'.e($uu['email']).'</td><td>'.e($uu['role']).'</td><td>'.e($uu['status']).'</td><td>
                    <button class="btn small ghost" onclick="userBlock('.$uu['id'].')">حظر</button>
                    <button class="btn small ghost" onclick="userUnblock('.$uu['id'].')">فك الحظر</button></td></tr>';
                } ?>
              </table>
            </div>
            <script>
              async function userApprove(id){
                const body=new URLSearchParams({op:'approve',user_id:id,csrf:'<?=e(csrf_token())?>'});
                const r=await fetch('?action=admin_user',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
                if(r.ok) location.reload();
              }
              async function userReject(id){
                const reason=prompt('سبب الرفض؟')||'';
                const body=new URLSearchParams({op:'reject',user_id:id,reason,csrf:'<?=e(csrf_token())?>'});
                const r=await fetch('?action=admin_user',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
                if(r.ok) location.reload();
              }
              async function userBlock(id){
                const reason=prompt('سبب الحظر؟')||'مخالفة الشروط';
                const until=prompt('حتى تاريخ (اختياري YYYY-MM-DD)?')||'';
                const body=new URLSearchParams({op:'block',user_id:id,reason,until,csrf:'<?=e(csrf_token())?>'});
                const r=await fetch('?action=admin_user',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
                if(r.ok) location.reload();
              }
              async function userUnblock(id){
                const body=new URLSearchParams({op:'unblock',user_id:id,csrf:'<?=e(csrf_token())?>'});
                const r=await fetch('?action=admin_user',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body}).then(r=>r.json());
                if(r.ok) location.reload();
              }
            </script>
            <?php
        }
    } elseif ($tab==='notifs') {
        if(!is_admin()){ echo "<div class='card' style='padding:12px'>الأمر يتطلب صلاحيات Admin.</div>"; }
        else {
            ?>
            <div class="card" style="padding:12px">
              <h3>إرسال إشعار</h3>
              <form id="nf" onsubmit="sendNf(event)">
                <input class="input" name="user_id" placeholder="User ID (اترك فارغاً للإرسال للجميع)">
                <input class="input" name="message_ar" placeholder="النص (AR)">
                <input class="input" name="message_en" placeholder="Text (EN)">
                <input class="input" name="link" placeholder="رابط">
                <input type="hidden" name="csrf" value="<?=e(csrf_token())?>">
                <button class="btn">إرسال</button>
              </form>
            </div>
            <script>
              async function sendNf(ev){
                ev.preventDefault();
                const fd=new FormData(document.getElementById('nf'));
                const r=await fetch('?action=admin_send_notif',{method:'POST',body:fd}).then(r=>r.json());
                alert(r.ok?'تم الإرسال':'فشل');
              }
            </script>
            <?php
        }
    } elseif ($tab==='analytics') {
        ?>
        <div class="card" style="padding:12px">
          <h3>تحليلات عامة</h3>
          <div class="row" style="flex-wrap:wrap">
            <div class="chip">أكثر المحتوى مشاهدة:
              <b>
              <?php $r=db()->query("SELECT m.title, COUNT(*) c FROM watch_history h JOIN movies m ON m.id=h.movie_id GROUP BY h.movie_id ORDER BY c DESC LIMIT 1")->fetch();
                echo e($r['title']??'—'); ?>
              </b>
            </div>
            <div class="chip">أوقات الذروة:
              <b><?php
                $peak=db()->query("SELECT substr(last_watched_at,12,2) h, COUNT(*) c FROM watch_history GROUP BY h ORDER BY c DESC LIMIT 1")->fetch();
                echo $peak ? $peak['h'].':00' : '—';
              ?></b>
            </div>
            <div class="chip">نشاط المستخدمين: <b><?=(int)db()->query("SELECT COUNT(*) FROM watch_history WHERE last_watched_at>=datetime('now','-24 hours')")->fetchColumn()?> مشاهدة/24س</b></div>
          </div>
        </div>
        <div class="card" style="padding:12px;margin-top:12px">
          <h3>روابط قد تكون معطوبة (مصادر لا تستجيب)</h3>
          <p>⚠️ فحص تلقائي عميق يتطلب خدمة خارجية أو Cron. هنا عرض لعدد الروابط فقط.</p>
          <div>عدد المصادر: <b><?=(int)db()->query("SELECT COUNT(*) FROM video_sources")->fetchColumn()?></b></div>
        </div>
        <?php
    } elseif ($tab==='logs') {
        ?>
        <div class="card" style="padding:12px">
          <h3>سجل النشاطات</h3>
          <table class="table">
            <tr><th>الوقت</th><th>المستخدم</th><th>العملية</th><th>هدف</th><th>تفاصيل</th></tr>
            <?php foreach(db()->query("SELECT * FROM activity_log ORDER BY id DESC LIMIT 100") as $l){
                echo '<tr><td>'.$l['created_at'].'</td><td>'.e((string)$l['user_id']).'</td><td>'.e($l['action']).'</td><td>'.e($l['target_type']).' #'.e((string)$l['target_id']).'</td><td style="max-width:420px;word-break:break-all">'.e($l['meta_json']).'</td></tr>';
            } ?>
          </table>
        </div>
        <?php
    }
    render_footer(); exit;
}

// دالة توليد مشغل الفيديو + المصادر
function render_player(int $movie_id, ?int $episode_id): string {
    $pdo=db();
    if($episode_id){
        $srcs = $pdo->prepare("SELECT * FROM video_sources WHERE movie_id=? AND episode_id=? ORDER BY CASE quality WHEN '4K' THEN 4 WHEN '1080p' THEN 3 WHEN '720p' THEN 2 WHEN '480p' THEN 1 ELSE 0 END DESC");
        $srcs->execute([$movie_id,$episode_id]);
        $fallback = $pdo->prepare("SELECT mp4_src FROM episodes WHERE id=?"); $fallback->execute([$episode_id]);
        $fallback = trim((string)$fallback->fetchColumn());
    } else {
        $srcs = $pdo->prepare("SELECT * FROM video_sources WHERE movie_id=? AND episode_id IS NULL ORDER BY CASE quality WHEN '4K' THEN 4 WHEN '1080p' THEN 3 WHEN '720p' THEN 2 WHEN '480p' THEN 1 ELSE 0 END DESC");
        $srcs->execute([$movie_id]);
        $fallback='';
    }
    $rows=$srcs->fetchAll();
    // إنشاء قائمة الجودة
    $opts = '';
    foreach($rows as $r){
        $url = prepare_media_url($r['src']);
        $opts .= '<option value="'.e($url).'">'.e($r['quality']).'</option>';
    }
    if(!$opts && $fallback){
        $url = prepare_media_url($fallback);
        $opts = '<option value="'.e($url).'">افتراضي</option>';
        $rows = [['quality'=>'default','src'=>$url]];
    }
    // إذا كان المصدر محلي (ملف داخل uploads) استخدم route=stream لدعم Range
    $first = $rows[0]['src'] ?? '';
    $firstUrl = $first ? prepare_media_url($first) : '';
    $eidAttr = $episode_id ? ' data-episode="'.$episode_id.'"' : '';
    return '
    <div class="controls">
      <div class="bar" style="justify-content:space-between">
        <button id="btnPlay" class="btn small">▶︎/⏸</button>
        <div class="row" style="gap:10px">
          <span class="pill">جودة</span>
          <select id="quality" class="input" style="max-width:120px">'.($opts ?: '<option>لا مصادر</option>').'</select>
          <span class="pill">السرعة</span>
          <select id="speed" class="input" style="max-width:120px"><option>0.5</option><option>0.75</option><option selected>1</option><option>1.25</option><option>1.5</option><option>2</option></select>
          <button id="btnCinema" class="btn small ghost">🎬 وضع السينما</button>
          <button id="btnFS" class="btn small ghost">⛶ ملء الشاشة</button>
        </div>
      </div>
      <div class="bar" style="align-items:center">
        <span class="pill">🔊</span><input id="vol" type="range" min="0" max="1" step="0.05" value="1">
        <span class="pill time" id="tCur">00:00</span>
        <input id="rng" type="range" min="0" max="0" step="0.1" style="flex:1">
        <span class="pill time" id="tDur">00:00</span>
      </div>
    </div>
    <video id="video" src="'.e($firstUrl).'" controlslist="nodownload" playsinline preload="metadata"'.$eidAttr.'></video>
    ';
}
function prepare_media_url(string $src): string {
    $s=trim($src);
    if (preg_match('#^https?://#i',$s)) return $s; // رابط خارجي
    // ملف محلي داخل uploads
    $s = ltrim($s,'/');
    if (str_starts_with($s,'uploads/')) {
        return '?action=stream&src='.rawurlencode($s);
    }
    // حالة: مسار محلي آخر
    return '?action=stream&src='.rawurlencode('uploads/'.basename($s));
}

if ($route==='404' || !in_array($route, ['home','search','details','watch','watchlist','login','register','admin','mystats'])) {
    render_header('غير موجود'); echo "<div>الصفحة غير موجودة.</div>"; render_footer(); exit;
}
?>