<?php
@ob_start();
date_default_timezone_set("Asia/Kolkata");

/* ================= DATABASE ================= */
 $db_host = "localhost";
 $db_user = "shreewinsmufeed_mufshreewin";
 $db_pass = "shreewinsmufeed_mufshreewin";
 $db_name = "shreewinsmufeed_mufshreewin";

 $conn = new mysqli($db_host, $db_user, $db_pass, $db_name);
if ($conn->connect_error) { die("DB ERROR"); }

/* ================= GATEWAY CONFIG (AllPay - INR / UPI) ================= */
 $MCH_ID        = "100818406";
 $SECRET_KEY    = "9915c55764a74be68f076631e81249ab";
 $GATEWAY_URL   = "https://payment.allapay.com/pay/web";
 $PAY_TYPE      = "104";        // India UPI
 $VERSION       = "1.0";
 $SIGN_TYPE     = "MD5";
 $CURRENCY      = "INR";
 $NOTIFY_URL    = "https://shreewins.vip/Pay/payment.php";   // AllPay server-to-server callback
 $RETURN_URL    = "https://shreewins.vip/#/wallet/RechargeHistory";
 $LOG_FILE      = __DIR__ . "/gateway.log";

/* ================= HELPERS ================= */
function glog($msg) {
    global $LOG_FILE;
    file_put_contents($LOG_FILE, date("Y-m-d H:i:s")." | ".$msg."\n", FILE_APPEND);
}

function formatAmount($a) {
    $a = preg_replace('/[^\d.]/', '', (string)$a);
    return number_format((float)$a, 2, '.', '');
}

/* AllPay signature: ksort + key=value& ... + key=<secret>, md5 lowercase */
function generateAllPaySignature(array $params, $secret_key) {
    ksort($params);
    $sign_string = "";
    foreach ($params as $key => $value) {
        if ($value !== "" && $value !== null && $key !== 'sign' && $key !== 'sign_type') {
            $sign_string .= $key . "=" . $value . "&";
        }
    }
    $sign_string .= "key=" . $secret_key;
    return strtolower(md5($sign_string));
}

function verifyAllPaySignature(array $params, $secret_key, $received_sign) {
    if (!$received_sign) return false;
    $expected = generateAllPaySignature($params, $secret_key);
    return hash_equals($expected, strtolower($received_sign));
}

/* Read a parameter from GET, POST or JSON body, supporting alias names */
function param(array $names, array $jsonBody) {
    foreach ($names as $n) {
        foreach ([$_GET, $_POST, $jsonBody] as $src) {
            if (isset($src[$n]) && trim((string)$src[$n]) !== '') {
                return trim((string)$src[$n]);
            }
        }
    }
    return null;
}

/* ===================================================
                CALLBACK HANDLER (AllPay -> your server)
   AllPay sends GET/POST params with sign = MD5(params + key)
=================================================== */
 $raw       = file_get_contents("php://input");
 $jsonBody  = [];
if (!empty($raw)) {
    $decoded = json_decode($raw, true);
    if (is_array($decoded)) { $jsonBody = $decoded; }
}

/* Merge all incoming params (GET + POST + JSON) for callback detection */
 $allParams = array_merge($_GET, $_POST, $jsonBody);

/* A callback from AllPay contains mch_order_no + sign */
 $isCallback = isset($allParams['mch_order_no']) && isset($allParams['sign']);

if ($isCallback) {
    $data = $allParams;
    $sig  = $data['sign'] ?? '';

    glog("CALLBACK: ".json_encode($data)." | sig=".$sig);

    /* Verify signature on the received params */
    if (!verifyAllPaySignature($data, $SECRET_KEY, $sig)) {
        glog("INVALID SIGNATURE");
        http_response_code(401);
        echo "FAIL";
        exit;
    }

    $merchantOrder = trim($data['mch_order_no'] ?? '');
    $gatewayTxId   = trim($data['trade_no'] ?? $data['transaction_id'] ?? '');
    $amount        = (float)($data['trade_amount'] ?? $data['amount'] ?? 0);
    $tradeResult   = strtoupper(trim($data['tradeResult'] ?? $data['trade_result'] ?? ''));
    $tradeStatus   = strtoupper(trim($data['tradeStatus'] ?? $data['status'] ?? ''));

    /* AllPay uses tradeResult=1 for success */
    $isSuccess = ($tradeResult === '1' || $tradeResult === 'TRADE_SUCCESS' || $tradeStatus === 'SUCCESS');

    if (!$isSuccess) {
        glog("STATUS NOT SUCCESS: tradeResult=".$tradeResult." tradeStatus=".$tradeStatus);
        echo "FAIL";
        exit;
    }

    $uid = null; $dbAmount = 0; $dbStatus = 0;
    $stmt = $conn->prepare("SELECT balakedara, motta, sthiti FROM thevani WHERE dharavahi = ? LIMIT 1");
    $stmt->bind_param("s", $merchantOrder);
    $stmt->execute();
    $stmt->bind_result($uid, $dbAmount, $dbStatus);
    $stmt->fetch();
    $stmt->close();

    if (!$uid) { glog("ORDER NOT FOUND ".$merchantOrder); echo "FAIL"; exit; }
    if ((int)$dbStatus === 1) { glog("ALREADY SUCCESS"); echo "SUCCESS"; exit; }
    if (abs($amount - (float)$dbAmount) > 1) { glog("AMOUNT MISMATCH db=$dbAmount cb=$amount"); echo "FAIL"; exit; }

    $up = $conn->prepare("UPDATE thevani SET sthiti = 1, ullekha = ? WHERE dharavahi = ?");
    $up->bind_param("ss", $gatewayTxId, $merchantOrder);
    $up->execute();
    $up->close();

    $credit = $conn->prepare("UPDATE shonu_kaichila SET motta = motta + ? WHERE balakedara = ?");
    $credit->bind_param("ds", $dbAmount, $uid);
    $credit->execute();
    $credit->close();

    glog("PAYMENT SUCCESS ".$merchantOrder." | INR ".$dbAmount." | UID: ".$uid);
    echo "SUCCESS";
    exit;
}

/* ===================================================
                ORDER CREATE (INR / UPI)
=================================================== */
 $amountIn = param(["amount","money","rupee","price","recharge","total","amt","trade_amount"], $jsonBody);
 $uidIn    = param(["uid","userid","user_id","userId","id","member_id","memberid"], $jsonBody);
 $phoneIn  = param(["phone","mobile","customer_phone","duravani"], $jsonBody);
 $emailIn  = param(["email","customer_email"], $jsonBody);

if ($amountIn === null || $uidIn === null) {
    glog("MISSING PARAMS | GET=".json_encode($_GET)." POST=".json_encode($_POST)." BODY=".$raw);
    http_response_code(400);
    die("Missing params: amount ".($amountIn === null ? "MISSING" : "OK").
        ", uid ".($uidIn === null ? "MISSING" : "OK").
        ". Call this page like payment.php?amount=100&uid=12345");
}

 $amount = formatAmount($amountIn);
 $uid    = (int)$uidIn;
if ((float)$amount < 1) { http_response_code(400); die("Invalid amount"); }
if ($uid <= 0)          { http_response_code(400); die("Invalid uid"); }

 $order     = "IN" . date("YmdHis") . rand(1000, 9999);
 $orderDate = date("Y-m-d H:i:s");

/* ================= BUILD ALLPAY API PARAMS ================= */
 $api_params = [
    'mch_id'        => $MCH_ID,
    'mch_order_no'  => $order,
    'pay_type'      => $PAY_TYPE,
    'trade_amount'  => (float)$amount,
    'order_date'    => $orderDate,
    'goods_name'    => 'Deposit_' . $uid,
    'notify_url'    => $NOTIFY_URL,
    'version'       => $VERSION,
    'sign_type'     => $SIGN_TYPE,
];
 $api_params['sign'] = generateAllPaySignature($api_params, $SECRET_KEY);

glog("CREATE ORDER ".$order." | INR ".$amount." | UID: ".$uid);

/* ================= CALL GATEWAY ================= */
 $ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $GATEWAY_URL,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($api_params),
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/x-www-form-urlencoded',
    ],
    CURLOPT_CONNECTTIMEOUT => 15,
    CURLOPT_TIMEOUT        => 30,
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_SSL_VERIFYHOST => 2,
]);
 $response = curl_exec($ch);
 $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
 $curlErr  = curl_error($ch);
curl_close($ch);

glog("API HTTP ".$httpCode." | ".$response);

if ($curlErr)         { die("Connection error: ".$curlErr); }
if (empty($response)) { die("Empty response from gateway."); }

 $res = json_decode($response, true);
if (!is_array($res)) { die("Invalid gateway response."); }

/* AllPay success indicator: respCode === 'SUCCESS' and payInfo present */
 $respCode = $res['respCode'] ?? ($res['code'] ?? '');
if ($respCode !== 'SUCCESS' || empty($res['payInfo'])) {
    $errMsg = $res['tradeMsg'] ?? ($res['msg'] ?? 'Gateway error.');
    if (is_array($errMsg)) { $errMsg = json_encode($errMsg); }
    glog("GATEWAY ERROR: ".json_encode($res));
    die("Gateway error: ".$errMsg);
}

 $payment_url  = $res['payInfo'];
 $gatewayOrder = $res['tradeNo'] ?? ($res['orderNo'] ?? $order);

if (!filter_var($payment_url, FILTER_VALIDATE_URL)) {
    glog("NO PAYMENT URL | ".json_encode($res));
    die("Gateway did not return a valid payment URL.");
}

/* ================= SAVE ORDER ================= */
 $stmt = $conn->prepare("INSERT INTO thevani
    (payid, balakedara, motta, dharavahi, mula, ullekha, duravani, ekikrtapavati, dinankavannuracisi, madari, pavatiaidi, sthiti)
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
 $payid  = 2;
 $uidStr = (string)$uid;
 $amtNum = (float)$amount;
 $mobile = $phoneIn ?: "N/A";
 $upi    = "UPI";
 $date   = date("Y-m-d H:i:s");
 $ekik   = "1005"; $pav = 2; $sthiti = 0;
 $stmt->bind_param("isdsssssssii", $payid, $uidStr, $amtNum, $order, $upi, $gatewayOrder, $mobile, $upi, $date, $ekik, $pav, $sthiti);
 $stmt->execute();
 $stmt->close();

glog("ORDER SAVED ".$order." | TxID: ".$gatewayOrder);

/* ================= DIRECT REDIRECT ================= */
header("Location: ".$payment_url);
exit;