<?php
// ── hyprcrd support-relay ──
//
// Standalone PHP service. Hosts the public support form, queues incoming
// tickets, and exposes an API that the hyprcrd "support" plugin polls +
// pushes replies through. SMTP (confirmation + outbound replies) lives
// here because the relay is the network-facing component; hyprcrd stays
// private. Single-tenant by design — one admin, one API key.

define('SUPPORT_RELAY_BOOTSTRAPPED', true);

require_once __DIR__ . '/inc/bootstrap.php';
require_once __DIR__ . '/inc/SmtpClient.php';
require_once __DIR__ . '/inc/auth.php';

$route = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$base = dirname($_SERVER['SCRIPT_NAME']);
if ($base !== '/') $route = substr($route, strlen($base));
$route = '/' . ltrim($route ?: '/', '/');
$method = $_SERVER['REQUEST_METHOD'];

$isSetup = !supportRelaySetupDone($db);

// Security headers for every response
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: no-referrer');
if (!empty($_SERVER['HTTPS']) || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https') {
    header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
}

// API endpoints
if (str_starts_with($route, '/api/')) {
    header('Content-Type: application/json');

    // Payload size caps. Form body is small; reply pushes from hyprcrd can
    // contain a full markdown answer.
    $contentLength = (int)($_SERVER['CONTENT_LENGTH'] ?? 0);
    if ($contentLength > 524288) { http_response_code(413); echo json_encode(['error' => 'payload too large']); exit; }

    require __DIR__ . '/inc/routes/setup.php';
    require __DIR__ . '/inc/routes/public.php';
    require __DIR__ . '/inc/routes/api.php';

    http_response_code(404);
    echo json_encode(['error' => 'not found']);
    exit;
}

// Setup UI (only while not yet configured)
if ($isSetup) {
    require __DIR__ . '/ui/setup.php';
    exit;
}

// Public form + ticket status
require __DIR__ . '/inc/routes/public_html.php';

// Fallback: 404
http_response_code(404);
require __DIR__ . '/ui/notfound.php';