<?php
declare(strict_types=1);

ini_set("display_errors", "0");
error_reporting(0);

require_once __DIR__ . "/includes/bootstrap.php";

// --- B2.1/B2.2: Block state-changing/destructive actions over GET (must be POST + CSRF) ---
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $q = $_GET;

    $verbs = [
        'delete','del','remove','destroy','trash',
        'disable','deactivate','ban','block','revoke',
        'reset','purge','clear','wipe',
        'enable','activate','toggle'
    ];

    $joined = strtolower(http_build_query($q));
    foreach ($verbs as $v) {
        if (array_key_exists($v, $q) || (strpos($joined, $v) !== false)) {
            http_response_code(405);
            echo "Method Not Allowed";
            exit;
        }
    }
}

// Auth guard helper (legacy-compatible)
function _op_auth_required(): void {
  global $authVar;
  if (!isset($_SESSION[$authVar])) {
    header('Location: index.php');
    exit;
  }
}

// CSRF required for any POST (state-changing)
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  require_csrf();
}

// Discover action key from POST flags (supports legacy submit names + B2.2 helper)
$knownActions = [
  'login',
  'dns-delete','adddns','updatedns',
  'notification-delete','addnotification','updatenotification',
  'message-delete','addmessage','updatemessage',
  'ad-delete','addad','updatead',
  'vpn-delete','addvpn','updatevpn',
  'updateprofile','updatepanelroot',
  'updateintro','updatefemto','updatesmarters','updatesmartersbackgrounds','updatetivi','updateimplayer',
  'updateltq','encryptltq','decryptltq',
  'updatexciptvplayer','updatexciptvinterface','updatexciptvapp',
  'updatesports','checkrewrites',
  'updatepurple','updatepurpleinterface'
];

$actionKey = null;
foreach ($knownActions as $k) {
  if (isset($_POST[$k])) { $actionKey = $k; break; }
}

if ($actionKey === null) {
  http_response_code(400);
  echo "No action specified";
  exit;
}

// Route to handler group
$map = [
  'login' => 'auth',
  'dns-delete' => 'dns', 'adddns' => 'dns', 'updatedns' => 'dns',
  'notification-delete' => 'notifications','addnotification' => 'notifications','updatenotification' => 'notifications',
  'message-delete' => 'messages','addmessage' => 'messages','updatemessage' => 'messages',
  'ad-delete' => 'ads','addad' => 'ads','updatead' => 'ads',
  'vpn-delete' => 'vpn','addvpn' => 'vpn','updatevpn' => 'vpn',
  'updateprofile' => 'settings','updatepanelroot' => 'settings',
  'updateintro' => 'apps','updatefemto' => 'apps','updatesmarters' => 'apps','updatesmartersbackgrounds' => 'apps',
  'updatetivi' => 'apps','updateimplayer' => 'apps','updatexciptvplayer' => 'apps','updatexciptvinterface' => 'apps','updatexciptvapp' => 'apps',
  'updatesports' => 'apps','updatepurple' => 'apps','updatepurpleinterface' => 'apps',
  'updateltq' => 'apps',
  'encryptltq' => 'tools','decryptltq' => 'tools','checkrewrites' => 'tools',
];

$group = $map[$actionKey] ?? null;
if ($group === null) {
  http_response_code(400);
  echo "Unknown action group";
  exit;
}

$handlerFile = __DIR__ . "/actions/" . $group . ".php";
require_once $handlerFile;

$fn = "op_handle_" . $group;
if (!function_exists($fn)) {
  http_response_code(500);
  echo "Handler missing";
  exit;
}

$fn($actionKey);
