<?php
/**
 * public_html/index.php
 * Production Front Controller
 */

declare(strict_types=1);

// -------------------------------
// Error handling (production-safe)
// -------------------------------
error_reporting(E_ALL);
ini_set('display_errors', '0');

// -------------------------------
// Session
// -------------------------------
if (session_status() !== PHP_SESSION_ACTIVE) {
    session_start();
}

// -------------------------------
// Base path
// -------------------------------
define('BASE_PATH', __DIR__);

// -------------------------------
// Load configs
// -------------------------------
require_once BASE_PATH . '/config/app.php';
require_once BASE_PATH . '/config/db.php';
require_once BASE_PATH . '/config/auth.php';

// -------------------------------
// Load core
// -------------------------------
require_once BASE_PATH . '/includes/functions.php';
require_once BASE_PATH . '/includes/auth.php';
require_once BASE_PATH . '/includes/router.php';

// -------------------------------
// Security headers
// -------------------------------
header('X-Frame-Options: SAMEORIGIN');
header('X-Content-Type-Options: nosniff');
header('X-XSS-Protection: 1; mode=block');
header('Referrer-Policy: strict-origin-when-cross-origin');

// -------------------------------
// URI parsing
// -------------------------------
$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$uri = trim((string)$uri, '/');
$uri = filter_var($uri, FILTER_SANITIZE_URL);

$page = ($uri === '' || $uri === 'index.php') ? 'home' : $uri;

// -------------------------------
// ADMIN ROUTING (SECURED)
// -------------------------------
if (str_starts_with($page, 'admin')) {

    if (!isAdminLoggedIn()) {
        $loginUrl = defined('BASE_URL') ? BASE_URL . '/login' : '/login';
        header('Location: ' . $loginUrl);
        exit;
    }

    $adminPage = trim(str_replace('admin', '', $page), '/');
    $adminPage = $adminPage === '' ? 'dashboard' : $adminPage;

    $adminFile = BASE_PATH . '/admin/' . basename($adminPage) . '.php';

    if (is_file($adminFile)) {
        require $adminFile;
    } else {
        error_log('Admin 404: ' . $adminPage, 3, BASE_PATH . '/logs/app.log');
        http_response_code(404);
        echo 'Admin page not found';
    }
    exit;
}

// -------------------------------
// API ROUTING (METHOD CONTROL)
// -------------------------------
if (str_starts_with($page, 'api')) {

    header('Content-Type: application/json; charset=utf-8');

    $allowedMethods = ['GET', 'POST'];
    if (!in_array($_SERVER['REQUEST_METHOD'], $allowedMethods, true)) {
        http_response_code(405);
        echo json_encode(['error' => 'Method Not Allowed']);
        exit;
    }

    $apiPage = trim(str_replace('api', '', $page), '/');
    $apiFile = BASE_PATH . '/api/' . basename($apiPage) . '.php';

    if (is_file($apiFile)) {
        require $apiFile;
    } else {
        error_log('API 404: ' . $apiPage, 3, BASE_PATH . '/logs/app.log');
        http_response_code(404);
        echo json_encode(['error' => 'API endpoint not found']);
    }
    exit;
}

// -------------------------------
// WEBSITE ROUTING
// -------------------------------
$pageFile = BASE_PATH . '/pages/' . basename($page) . '.php';

if (is_file($pageFile)) {
    require $pageFile;
} else {
    error_log('Web 404: ' . $page, 3, BASE_PATH . '/logs/app.log');
    http_response_code(404);
    echo 'Page not found';
}