<?php
header_remove('X-Powered-By');
// ============================================
// CORS HEADERS (API Functionality)
// ============================================
$allowed_origins = [
    'https://www.ismash.com',
    'https://ismash.com',
    'http://3.8.150.31',
    'https://3.8.150.31',
    'https://api-stage.ismash.com',
    'http://18.135.200.64'
];

$origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : '';

if (in_array($origin, $allowed_origins)) {
    header('Access-Control-Allow-Origin: ' . $origin);
    header('Access-Control-Allow-Credentials: true');
} else {
    // For development/testing, log rejected origins
    //error_log('Rejected CORS origin: ' . $origin);
}

header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");
header('Access-Control-Max-Age: 3600');
// ============================================
// SECURITY HEADERS
// ============================================
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
header('X-XSS-Protection: 1; mode=block'); //for legacy browsers
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), speaker=()');
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'");
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');
header('Expires: 0');
//header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload'); - Only enable when HTTPS is properly configured in production

//error_reporting(E_ALL); ini_set('display_errors', 1); // DEBUG PURPOSES
error_reporting(0);
ini_set('display_errors', 0);
ini_set('log_errors', 1);
ini_set('error_log', __DIR__ . '/logs/php_errors.log');

date_default_timezone_set('Europe/London');

// ============================================
// SECURE SESSION CONFIGURATION
// ============================================
ini_set('session.cookie_httponly', 1);  // Prevent JavaScript access to session cookie
ini_set('session.cookie_secure', 1);    // Only send cookie over HTTPS
ini_set('session.cookie_samesite', 'Strict'); // Prevent CSRF attacks
ini_set('session.use_only_cookies', 1); // Prevent session fixation via URL
ini_set('session.use_strict_mode', 1);  // Reject uninitialized session IDs

session_start();

// Regenerate session ID to prevent session fixation attacks
if (!isset($_SESSION['initiated'])) {
    session_regenerate_id(true);
    $_SESSION['initiated'] = true;
}

define('ABS_PATH', __DIR__);

// ============================================
// GLOBAL ERROR HANDLING
// ============================================

// Helper function to log errors
function logError($message, $context = []) {
    $logDir = __DIR__ . '/logs';
    if (!file_exists($logDir)) {
        @mkdir($logDir, 0755, true);
    }
    $logFile = $logDir . '/app_errors.log';
    $timestamp = date('Y-m-d H:i:s');
    $contextStr = !empty($context) ? ' | ' . json_encode($context) : '';
    @error_log("[{$timestamp}] {$message}{$contextStr}\n", 3, $logFile);
}

// Catch fatal errors during bootstrap
register_shutdown_function(function() {
    $error = error_get_last();
    if ($error && in_array($error['type'], [E_ERROR, E_PARSE, E_CORE_ERROR, E_COMPILE_ERROR])) {
        logError('FATAL ERROR: ' . $error['message'], [
            'file' => $error['file'],
            'line' => $error['line']
        ]);

        if (ob_get_level()) ob_clean();
        header('HTTP/1.1 500 Internal Server Error');
        header('Content-Type: application/json');
        echo json_encode([
            'error' => 'Internal Server Error',
            'message' => 'Service temporarily unavailable',
            'timestamp' => date('c')
        ]);
        exit;
    }
});

// Catch uncaught exceptions
set_exception_handler(function($e) {
    logError('EXCEPTION: ' . $e->getMessage(), [
        'file' => $e->getFile(),
        'line' => $e->getLine()
    ]);

    if (ob_get_level()) ob_clean();
    header('HTTP/1.1 500 Internal Server Error');
    header('Content-Type: application/json');
    echo json_encode([
        'error' => 'Internal Server Error',
        'message' => 'Service temporarily unavailable',
        'timestamp' => date('c')
    ]);
    exit;
});

require '../vendor/autoload.php';

$configuration = [
    'settings' => [
        'displayErrorDetails' => false,
        'addContentLengthHeader' => false,
    ],
];
$c = new \Slim\Container($configuration);

// Slim error handler
$c['errorHandler'] = function ($c) {
    return function ($request, $response, $exception) use ($c) {
        logError('FRAMEWORK ERROR: ' . $exception->getMessage(), [
            'file' => $exception->getFile(),
            'line' => $exception->getLine()
        ]);

        return $response->withStatus(500)
            ->withHeader('Content-Type', 'application/json')
            ->withJson([
                'error' => 'Internal Server Error',
                'message' => 'Service temporarily unavailable',
                'timestamp' => date('c')
            ]);
    };
};

$app = new \Slim\App($c);


//Configurations
foreach (glob("config/*.php") as $config){
    require_once $config;
}

//Functions
foreach (glob("lib/*.php") as $lib){
    require_once $lib;
}

//Load FileMaker Controllers
//App Breaks here because no Services class present
foreach (glob("controllers/*.php") as $controller){
    require_once $controller;
}

//Require Middlewares
foreach (glob("middlewares/*.php") as $middleware){
    require_once $middleware;
}

//Require Jobs
foreach (glob("jobs/*.php") as $job){
    require_once $job;
}

//Require Routes
foreach (glob("routes/*.php") as $route){
    require_once $route;
}

//Run application
$app->run();