<?php
declare(strict_types=1);

require_once __DIR__ . '/../src/Database.php';
require_once __DIR__ . '/../src/FirewallManager.php';
require_once __DIR__ . '/../src/AmiClient.php';
require_once __DIR__ . '/../src/ConfigGenerator.php';
require_once __DIR__ . '/../src/CdrManager.php';
require_once __DIR__ . '/../src/PhonebookManager.php';
require_once __DIR__ . '/../src/UcpAuth.php';
require_once __DIR__ . '/../src/UcpManager.php';

use App\Database;
use App\UcpAuth;
use App\UcpManager;

try {
    $db = Database::getConnection();

    if (!UcpAuth::isUcpEnabled($db)) {
        http_response_code(503);
        header('Content-Type: text/plain; charset=utf-8');
        echo "Le portail utilisateur UCP est actuellement désactivé.";
        exit;
    }

    $extId = (int)($_GET['ext_id'] ?? $_GET['line_id'] ?? 0);
    $uid   = (int)($_GET['uid'] ?? 0);
    $token = trim((string)($_GET['token'] ?? ''));

    $authorized = false;

    // 1. Authentification sans session par signature HMAC GET (utilisée par l'application GroundWire / Acrobits)
    if ($token !== '' && $extId > 0 && $uid > 0) {
        if (UcpManager::verifyGroundwireToken($db, $extId, $uid, $token)) {
            $allowed = UcpAuth::getAllowedExtensions($db, $uid);
            foreach ($allowed as $row) {
                if ((int)$row['id'] === $extId && (int)($row['groundwire_enabled'] ?? 0) === 1) {
                    $authorized = true;
                    break;
                }
            }
        }
    }

    // 2. Sinon : utilisateur UCP connecté en session et propriétaire de l'extension
    if (!$authorized && $extId > 0) {
        UcpAuth::startSession();
        $sessionUser = UcpAuth::getCurrentUser($db);
        if ($sessionUser !== null) {
            $allowed = UcpAuth::getAllowedExtensions($db, (int)$sessionUser['id']);
            foreach ($allowed as $row) {
                if ((int)$row['id'] === $extId && (int)($row['groundwire_enabled'] ?? 0) === 1) {
                    $authorized = true;
                    break;
                }
            }
        }
    }

    if (!$authorized) {
        http_response_code(403);
        header('Content-Type: text/plain; charset=utf-8');
        echo "Accès refusé ou lien de provisionnement invalide.";
        exit;
    }

    $bundle = UcpManager::buildGroundwireXml($db, $extId);
    $xmlContent = $bundle['xml'];

    while (ob_get_level()) {
        ob_end_clean();
    }

    header('Content-Type: application/xml; charset=utf-8');
    header('Content-Disposition: attachment; filename="' . $bundle['filename'] . '"');
    header('Content-Length: ' . strlen($xmlContent));
    header('Cache-Control: no-store, no-cache, must-revalidate');

    echo $xmlContent;
} catch (\InvalidArgumentException $e) {
    http_response_code(404);
    header('Content-Type: text/plain; charset=utf-8');
    echo $e->getMessage();
} catch (\Throwable $e) {
    http_response_code(500);
    header('Content-Type: text/plain; charset=utf-8');
    echo "Erreur interne lors de la génération du profil XML.";
}