<?php
@ob_start();
date_default_timezone_set("Asia/Kolkata");

/* ================= DATABASE ================= */
$db_host = "localhost";
$db_user = "shreewinsmufeed_mufshreewin";
$db_pass = "shreewinsmufeed_mufshreewin";
$db_name = "shreewinsmufeed_mufshreewin";

$conn = new mysqli($db_host, $db_user, $db_pass, $db_name);
if ($conn->connect_error) { die("DB ERROR"); }

/* ================= GATEWAY CONFIG (INR only) ================= */
$API_URL          = "https://sunpaytm.quest/api/public/v1/payins";
$PAYIN_API_KEY    = "3404d4b016c978f16a5f7a13338bb590a371c2dc56fa1404";
$PAYIN_API_SECRET = "f901abb7b1b939ee84ff79a75ec8762330b057ab77edf8f6f9a8a8065e512fa9"; // request signing
$WEBHOOK_SECRET   = "6114fa75d5ac7f0908e5ca8691ecb78e480533739958954567a7cfb3589fcd78"; // webhook secret
$CURRENCY         = "INR";
$METHOD           = "upi";          // upi | bank | usdt
$NOTIFY_URL       = "https://shreewins.vip/Pay/payment.php";
$RETURN_URL       = "https://shreewins.vip/#/wallet/RechargeHistory";
$LOG_FILE         = __DIR__ . "/gateway.log";

/* ================= HELPERS ================= */
function glog($msg) {
    global $LOG_FILE;
    file_put_contents($LOG_FILE, date("Y-m-d H:i:s")." | ".$msg."\n", FILE_APPEND);
}
function formatAmount($a) {
    $a = preg_replace('/[^\d.]/', '', (string)$a);
    return number_format((float)$a, 2, '.', '');
}
function verifyCallbackSig($raw, $secret, $sig) {
    if (!$sig) return false;
    $expected = hash_hmac('sha256', $raw, $secret);
    return hash_equals($expected, $sig);
}

/* Read a parameter from GET, POST or JSON body, supporting alias names */
function param(array $names, array $jsonBody) {
    foreach ($names as $n) {
        foreach ([$_GET, $_POST, $jsonBody] as $src) {
            if (isset($src[$n]) && trim((string)$src[$n]) !== '') {
                return trim((string)$src[$n]);
            }
        }
    }
    return null;
}

/* ===================================================
                CALLBACK HANDLER (Sunpay -> your server)
   Header: x-signature = HMAC_SHA256(raw_body, WEBHOOK_SECRET)
=================================================== */
$raw       = file_get_contents("php://input");
$jsonBody  = [];
if (!empty($raw)) {
    $decoded = json_decode($raw, true);
    if (is_array($decoded)) { $jsonBody = $decoded; }
}

$isCallback = is_array($jsonBody)
    && isset($jsonBody['status'])
    && (isset($jsonBody['order_id']) || isset($jsonBody['order_no']));

if ($isCallback) {
    $sig  = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
    $data = $jsonBody;

    glog("CALLBACK: ".$raw." | sig=".$sig);

    if (!verifyCallbackSig($raw, $WEBHOOK_SECRET, $sig)) {
        glog("INVALID SIGNATURE");
        http_response_code(401);
        echo "INVALID_SIGNATURE";
        exit;
    }

    $status        = strtolower(trim($data['status']));
    $merchantOrder = trim($data['order_id'] ?? $data['order_no']);
    $gatewayTxId   = trim($data['transaction_id'] ?? '');
    $amount        = (float)($data['amount'] ?? 0);
    $currency      = strtoupper(trim($data['currency'] ?? 'INR'));

    if ($currency !== 'INR') { glog("WRONG CURRENCY: ".$currency); echo "FAIL"; exit; }

    $uid = null; $dbAmount = 0; $dbStatus = 0;
    $stmt = $conn->prepare("SELECT balakedara, motta, sthiti FROM thevani WHERE dharavahi = ? LIMIT 1");
    $stmt->bind_param("s", $merchantOrder);
    $stmt->execute();
    $stmt->bind_result($uid, $dbAmount, $dbStatus);
    $stmt->fetch();
    $stmt->close();

    if (!$uid) { glog("ORDER NOT FOUND ".$merchantOrder); echo "FAIL"; exit; }
    if ((int)$dbStatus === 1) { glog("ALREADY SUCCESS"); echo "SUCCESS"; exit; }
    if (abs($amount - (float)$dbAmount) > 1) { glog("AMOUNT MISMATCH"); echo "FAIL"; exit; }
    if (!in_array($status, ["success","paid","completed"], true)) {
        glog("STATUS NOT SUCCESS: ".$status); echo "FAIL"; exit;
    }

    $up = $conn->prepare("UPDATE thevani SET sthiti = 1, ullekha = ? WHERE dharavahi = ?");
    $up->bind_param("ss", $gatewayTxId, $merchantOrder);
    $up->execute();
    $up->close();

    $credit = $conn->prepare("UPDATE shonu_kaichila SET motta = motta + ? WHERE balakedara = ?");
    $credit->bind_param("ds", $dbAmount, $uid);
    $credit->execute();
    $credit->close();

    glog("PAYMENT SUCCESS ".$merchantOrder." | INR ".$dbAmount." | UID: ".$uid);
    echo "SUCCESS";
    exit;
}

/* ===================================================
                ORDER CREATE (INR / UPI)
=================================================== */
$amountIn = param(["amount","money","rupee","price","recharge","total","amt"], $jsonBody);
$uidIn    = param(["uid","userid","user_id","userId","id","member_id","memberid"], $jsonBody);
$phoneIn  = param(["phone","mobile","customer_phone","duravani"], $jsonBody);
$emailIn  = param(["email","customer_email"], $jsonBody);

if ($amountIn === null || $uidIn === null) {
    glog("MISSING PARAMS | GET=".json_encode($_GET)." POST=".json_encode($_POST)." BODY=".$raw);
    http_response_code(400);
    die("Missing params: amount ".($amountIn === null ? "MISSING" : "OK").
        ", uid ".($uidIn === null ? "MISSING" : "OK").
        ". Call this page like payment.php?amount=100&uid=12345");
}

$amount = formatAmount($amountIn);
$uid    = (int)$uidIn;
if ((float)$amount < 1) { http_response_code(400); die("Invalid amount"); }
if ($uid <= 0)          { http_response_code(400); die("Invalid uid"); }

$order = "ORD_".time().rand(1000, 9999);

$body = [
    "order_id"       => $order,
    "amount"         => (float)$amount,
    "currency"       => $CURRENCY,
    "method"         => $METHOD,
    "customer_name"  => "User_".$uid,
    "customer_phone" => $phoneIn ?: "9999999999",
    "customer_email" => $emailIn ?: "user".$uid."@shreewins.vip",
    "notify_url"     => $NOTIFY_URL,
    "callback_url"   => $RETURN_URL,
    "metadata"       => ["uid" => (string)$uid],
];
$rawBody = json_encode($body, JSON_UNESCAPED_SLASHES);
$sign    = hash_hmac('sha256', $rawBody, $PAYIN_API_SECRET);

glog("CREATE ORDER ".$order." | INR ".$amount." | UID: ".$uid);

/* ================= CALL GATEWAY ================= */
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $API_URL,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'x-api-key: '.$PAYIN_API_KEY,
        'x-signature: '.$sign,
    ],
    CURLOPT_POSTFIELDS     => $rawBody,
    CURLOPT_CONNECTTIMEOUT => 15,
    CURLOPT_TIMEOUT        => 30,
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_SSL_VERIFYHOST => 2,
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$curlErr  = curl_error($ch);
curl_close($ch);

glog("API HTTP ".$httpCode." | ".$response);

if ($curlErr)         { die("Connection error: ".$curlErr); }
if (empty($response)) { die("Empty response from gateway."); }

$res = json_decode($response, true);
if (!is_array($res)) { die("Invalid gateway response."); }

if ($httpCode >= 400 || isset($res['error'])) {
    $errMsg = $res['detail'] ?? $res['error'] ?? 'Gateway error.';
    if (is_array($errMsg)) { $errMsg = json_encode($errMsg); }
    glog("GATEWAY ERROR: ".json_encode($res));
    die("Gateway error: ".$errMsg);
}

$payment_url  = $res['checkout_url'] ?? ($res['transaction']['gateway_payment_url'] ?? '');
$gatewayOrder = $res['id'] ?? ($res['transaction']['id'] ?? '');

if (empty($payment_url) || !filter_var($payment_url, FILTER_VALIDATE_URL)) {
    glog("NO PAYMENT URL | ".json_encode($res));
    die("Gateway did not return a valid payment URL.");
}

/* ================= SAVE ORDER ================= */
$stmt = $conn->prepare("INSERT INTO thevani
    (payid, balakedara, motta, dharavahi, mula, ullekha, duravani, ekikrtapavati, dinankavannuracisi, madari, pavatiaidi, sthiti)
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
$payid  = 2;
$uidStr = (string)$uid;
$amtNum = (float)$amount;
$mobile = $phoneIn ?: "N/A";
$upi    = "UPI";
$date   = date("Y-m-d H:i:s");
$ekik   = "1005"; $pav = 2; $sthiti = 0;
$stmt->bind_param("isdsssssssii", $payid, $uidStr, $amtNum, $order, $upi, $gatewayOrder, $mobile, $upi, $date, $ekik, $pav, $sthiti);
$stmt->execute();
$stmt->close();

glog("ORDER SAVED ".$order." | TxID: ".$gatewayOrder);

/* ================= DIRECT REDIRECT ================= */
header("Location: ".$payment_url);
exit;