<?php
// /api/setup — one-shot configuration on first install. After the admin
// completes this form the API key becomes required for every /api/*
// route and the setup endpoint returns 403. Designed to be impossible
// to re-trigger without clearing `settings.setup_done` in the DB.

if (!defined('SUPPORT_RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }

if ($route === '/api/setup' && $method === 'POST') {
    if (!$isSetup) supportRelayJson(['error' => 'already configured'], 403);
    if (supportRelayRateLimited($db, 'setup', 10, 10)) supportRelayJson(['error' => 'too many attempts'], 429);

    $input = json_decode(file_get_contents('php://input'), true) ?: [];
    // Required fields
    $brand     = trim((string)($input['brand'] ?? 'Oumta Support'));
    $prefix    = strtoupper(preg_replace('/[^A-Z0-9]/i', '', (string)($input['issue_prefix'] ?? 'OUMTA')));
    $publicUrl = rtrim((string)($input['public_url'] ?? ''), '/');
    $footer    = trim((string)($input['mail_footer'] ?? ''));
    $smtpHost  = trim((string)($input['smtp_host'] ?? ''));
    $smtpPort  = (int)($input['smtp_port'] ?? 587);
    $smtpUser  = trim((string)($input['smtp_user'] ?? ''));
    $smtpPw    = (string)($input['smtp_password'] ?? '');
    $smtpFrom  = trim((string)($input['smtp_from'] ?? ''));
    $smtpFromN = trim((string)($input['smtp_from_name'] ?? $brand));
    $smtpEnc   = in_array($input['smtp_encryption'] ?? 'starttls', ['starttls', 'tls', 'none'], true)
                ? $input['smtp_encryption'] : 'starttls';

    if ($smtpHost === '')                                      supportRelayJson(['error' => 'SMTP host required'], 400);
    if (!filter_var($smtpFrom, FILTER_VALIDATE_EMAIL))          supportRelayJson(['error' => 'SMTP from must be a valid email'], 400);
    if ($prefix === '' || strlen($prefix) > 12)                 supportRelayJson(['error' => 'issue prefix 1-12 chars, letters/digits only'], 400);

    // Generate the API key now, show it back ONCE — admin copies it to
    // hyprcrd. A second request after setup can't re-read or rotate it
    // except through a re-install (clear setup_done). That's fine for a
    // single-user admin workflow.
    $apiKey = bin2hex(random_bytes(24));

    supportRelaySet($db, 'brand', $brand);
    supportRelaySet($db, 'issue_prefix', $prefix);
    if ($publicUrl !== '') supportRelaySet($db, 'public_url', $publicUrl);
    if ($footer !== '')    supportRelaySet($db, 'mail_footer', $footer);
    supportRelaySet($db, 'smtp_host', $smtpHost);
    supportRelaySet($db, 'smtp_port', (string)$smtpPort);
    supportRelaySet($db, 'smtp_user', $smtpUser);
    if ($smtpPw !== '') supportRelaySet($db, 'smtp_password', supportRelayEncrypt($smtpPw, $MASTER_KEY));
    supportRelaySet($db, 'smtp_from', $smtpFrom);
    supportRelaySet($db, 'smtp_from_name', $smtpFromN);
    supportRelaySet($db, 'smtp_encryption', $smtpEnc);
    supportRelaySet($db, 'api_key', $apiKey);
    supportRelaySet($db, 'setup_done', '1');

    supportRelayJson(['ok' => true, 'api_key' => $apiKey]);
}