<?php
require 'db.php';

$lava_webhook_secret = 'NawpfYDXnTttXXkTQ30Ng93OCZkCkAp39WFDwrIB3ZgSgmfgZFwVMsUin5scdGvH';

$smtp_host = 'ssl://smtp.hostinger.com';
$smtp_port = 465;
$smtp_user = 'team@zeroshoots.com';
$smtp_pass = 'L1i2f3e45%$$';
$from_email = 'team@zeroshoots.com';
$from_name = 'Zero Shoots';

function smtp_read($socket) {
    $response = '';
    while ($line = fgets($socket, 515)) {
        $response .= $line;
        if (isset($line[3]) && $line[3] === ' ') break;
    }
    return $response;
}

function smtp_cmd($socket, $cmd) {
    fwrite($socket, $cmd . "\r\n");
    return smtp_read($socket);
}

function send_smtp_email($to, $subject, $body) {
    global $smtp_host, $smtp_port, $smtp_user, $smtp_pass, $from_email, $from_name;

    $socket = fsockopen($smtp_host, $smtp_port, $errno, $errstr, 30);

    if (!$socket) {
        error_log("SMTP connection failed: $errno $errstr");
        return false;
    }

    smtp_read($socket);

    smtp_cmd($socket, "EHLO zeroshoots.com");
    smtp_cmd($socket, "AUTH LOGIN");
    smtp_cmd($socket, base64_encode($smtp_user));
    smtp_cmd($socket, base64_encode($smtp_pass));
    smtp_cmd($socket, "MAIL FROM:<$from_email>");
    smtp_cmd($socket, "RCPT TO:<$to>");
    smtp_cmd($socket, "DATA");

    $safe_subject = str_replace(["\r", "\n"], '', $subject);

    $message =
        "Subject: $safe_subject\r\n" .
        "From: $from_name <$from_email>\r\n" .
        "Reply-To: $from_email\r\n" .
        "MIME-Version: 1.0\r\n" .
        "Content-Type: text/plain; charset=UTF-8\r\n" .
        "\r\n" .
        $body . "\r\n.\r\n";

    fwrite($socket, $message);

    $result = smtp_read($socket);

    smtp_cmd($socket, "QUIT");

    fclose($socket);

    if (strpos($result, '250') === false) {
        error_log("SMTP send failed for $to. Response: $result");
        return false;
    }

    return true;
}

$raw = file_get_contents('php://input');

$received_key = $_SERVER['HTTP_X_API_KEY'] ?? '';

if (!$received_key || !hash_equals($lava_webhook_secret, $received_key)) {
    http_response_code(401);
    exit('Unauthorized');
}

$data = json_decode($raw, true);

if (!is_array($data)) {
    http_response_code(400);
    exit('Invalid JSON');
}

// Temporary: log the first real Lava event so we can map its exact fields safely.
file_put_contents(
    __DIR__ . '/lava-events.log',
    date('c') . ' ' . $raw . PHP_EOL,
    FILE_APPEND | LOCK_EX
);

http_response_code(200);
echo 'OK';