<?php
require 'db.php';

$webhook_secret = 'polar_whs_KYMyAsLS4mUdh3HJS3B9aINXt3IdBoyq2XqG60zqk5X';

$smtp_host = 'ssl://smtp.hostinger.com';
$smtp_port = 465;
$smtp_user = 'team@zeroshoots.com';
$smtp_pass = 'L1i2f3e45%$$';
$from_email = 'team@zeroshoots.com';
$from_name = 'Zero Shoots';

function smtp_read($socket) {
    $response = '';
    while ($line = fgets($socket, 515)) {
        $response .= $line;
        if (isset($line[3]) && $line[3] === ' ') break;
    }
    return $response;
}

function smtp_cmd($socket, $cmd) {
    fwrite($socket, $cmd . "\r\n");
    return smtp_read($socket);
}

function send_smtp_email($to, $subject, $body) {
    global $smtp_host, $smtp_port, $smtp_user, $smtp_pass, $from_email, $from_name;

    $socket = fsockopen($smtp_host, $smtp_port, $errno, $errstr, 30);

    if (!$socket) {
        error_log("SMTP connection failed: $errno $errstr");
        return false;
    }

    smtp_read($socket);

    smtp_cmd($socket, "EHLO zeroshoots.com");
    smtp_cmd($socket, "AUTH LOGIN");
    smtp_cmd($socket, base64_encode($smtp_user));
    smtp_cmd($socket, base64_encode($smtp_pass));
    smtp_cmd($socket, "MAIL FROM:<$from_email>");
    smtp_cmd($socket, "RCPT TO:<$to>");
    smtp_cmd($socket, "DATA");

    $safe_subject = str_replace(["\r", "\n"], '', $subject);

    $message =
        "Subject: $safe_subject\r\n" .
        "From: $from_name <$from_email>\r\n" .
        "Reply-To: $from_email\r\n" .
        "MIME-Version: 1.0\r\n" .
        "Content-Type: text/plain; charset=UTF-8\r\n" .
        "\r\n" .
        $body . "\r\n.\r\n";

    fwrite($socket, $message);

    $result = smtp_read($socket);

    smtp_cmd($socket, "QUIT");

    fclose($socket);

    if (strpos($result, '250') === false) {
        error_log("SMTP send failed for $to. Response: $result");
        return false;
    }

    return true;
}

$raw = file_get_contents('php://input');
$msg_id = $_SERVER['HTTP_WEBHOOK_ID'] ?? '';
$msg_ts = $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '';
$msg_sig = $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '';

if (!$msg_id || !$msg_ts || !$msg_sig) {
    http_response_code(400);
    exit('Missing webhook headers');
}

$signed_content = "{$msg_id}.{$msg_ts}.{$raw}";
$expected_sig = base64_encode(hash_hmac('sha256', $signed_content, $webhook_secret, true));

$verified = false;
foreach (explode(' ', $msg_sig) as $sig) {
    $sig_value = preg_replace('/^v1,/', '', trim($sig));
    if (hash_equals($expected_sig, $sig_value)) {
        $verified = true;
        break;
    }
}

if (!$verified) {
    http_response_code(401);
    exit('Invalid signature');
}

$data = json_decode($raw, true);
$event = $data['type'] ?? '';
$order = $data['data'] ?? [];

if ($event === 'order.created') {
    $status = $order['status'] ?? '';
    if ($status !== 'paid') {
        http_response_code(200);
        exit('OK');
    }

    $email = strtolower(trim($order['customer']['email'] ?? ''));
    $product_id = $order['metadata']['product_id'] ?? (string)($order['product_id'] ?? 'unknown');

    if (!$email) {
        http_response_code(400);
        exit('No email');
    }

    $stmt = $pdo->prepare("SELECT * FROM customers WHERE email = ?");
    $stmt->execute([$email]);
    $existing = $stmt->fetch();

    if (!$existing) {
        $temp_pass = substr(str_shuffle('abcdefghjkmnpqrstuvwxyz23456789'), 0, 10);
        $pass_hash = password_hash($temp_pass, PASSWORD_DEFAULT);

        $pdo->prepare("INSERT INTO customers (email, password_hash, verified) VALUES (?, ?, 1)")
            ->execute([$email, $pass_hash]);

        $pdo->prepare("INSERT IGNORE INTO customer_products (email, product_id) VALUES (?, ?)")
            ->execute([$email, $product_id]);

        send_smtp_email(
            $email,
            'Your Zero Shoots Login Details',
            "Hi,\n\nYour purchase is confirmed.\n\nIMPORTANT: Do not use the Polar email to access your blueprint. That email is only your receipt/invoice.\n\nAccess your blueprint here:\nhttps://app.zeroshoots.com/login.php\n\nEmail: $email\nTemporary password: $temp_pass\n\nIf you have trouble logging in, contact team@zeroshoots.com or DM @zero.shoots on Instagram.\n\nZero Shoots"
        );
    } else {
        $pdo->prepare("INSERT IGNORE INTO customer_products (email, product_id) VALUES (?, ?)")
            ->execute([$email, $product_id]);

        send_smtp_email(
            $email,
            'New ebook added to your Zero Shoots library',
            "Hi,\n\nA new ebook has been added to your Zero Shoots library.\n\nLogin here:\nhttps://app.zeroshoots.com/login.php\n\nIMPORTANT: Do not use the Polar email to access your blueprint. That email is only your receipt/invoice.\n\nIf you need help, contact team@zeroshoots.com or DM @zero.shoots on Instagram.\n\nZero Shoots"
        );
    }
}

if ($event === 'order.refunded') {
    $email = strtolower(trim($order['customer']['email'] ?? ''));
    $product_id = $order['metadata']['product_id'] ?? (string)($order['product_id'] ?? '');

    if ($email && $product_id) {
        $pdo->prepare("DELETE FROM customer_products WHERE email = ? AND product_id = ?")
            ->execute([$email, $product_id]);

        $count = $pdo->prepare("SELECT COUNT(*) FROM customer_products WHERE email = ?");
        $count->execute([$email]);

        if ($count->fetchColumn() == 0) {
            $pdo->prepare("DELETE FROM customers WHERE email = ?")->execute([$email]);
        }
    }
}

http_response_code(200);
echo 'OK';