<?php
require_once __DIR__ . '/../app/init.php';
header('Content-Type: application/json; charset=utf-8');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); echo json_encode(['success'=>false,'message'=>'Method not allowed']); exit; }
csrf_check();
$pdo = db();
$cid = (int)$_SESSION['company_id'];
$full_name = trim($_POST['full_name'] ?? '');
if ($full_name === '') { http_response_code(422); echo json_encode(['success'=>false,'message'=>'اسم الموظف مطلوب']); exit; }
try {
  $st = $pdo->prepare("INSERT INTO employees (company_id, full_name, phone, email, job_title, hire_date, salary_monthly) VALUES (?,?,?,?,?,?,?)");
  $st->execute([$cid, $full_name, trim($_POST['phone'] ?? '') ?: null, trim($_POST['email'] ?? '') ?: null, trim($_POST['job_title'] ?? '') ?: null, trim($_POST['hire_date'] ?? '') ?: null, (float)($_POST['salary_monthly'] ?? 0)]);
  $id = (int)$pdo->lastInsertId();
  echo json_encode(['success'=>true,'item'=>['id'=>$id,'text'=>$full_name]]);
} catch (Throwable $e) { http_response_code(422); echo json_encode(['success'=>false,'message'=>$e->getMessage()]); }
