<?php
declare(strict_types=1);
header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');
header('X-Content-Type-Options: nosniff');
const KCC_PAY_API = 'https://pay.kirovevents.eu/api';

function respond(array $data,int $status):never{http_response_code($status);echo json_encode($data,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);exit;}
function upstream(string $url,string $method,?array $body,string $token):never{
 $curl=curl_init($url);$headers=['Accept: application/json'];if($token!=='')$headers[]='Authorization: Bearer '.$token;if($body!==null)$headers[]='Content-Type: application/json';
 curl_setopt_array($curl,[CURLOPT_RETURNTRANSFER=>true,CURLOPT_CUSTOMREQUEST=>$method,CURLOPT_POSTFIELDS=>$body===null?null:json_encode($body,JSON_THROW_ON_ERROR),CURLOPT_HTTPHEADER=>$headers,CURLOPT_CONNECTTIMEOUT=>10,CURLOPT_TIMEOUT=>35]);
 $response=curl_exec($curl);$error=curl_error($curl);$status=(int)curl_getinfo($curl,CURLINFO_RESPONSE_CODE);curl_close($curl);
 if($response===false)respond(['message'=>'Payment connection failed.','detail'=>$error],502);http_response_code($status?:502);echo $response;exit;
}

$token=(string)getenv('KCC_PAYMENT_TOKEN');$siteOrigin=rtrim((string)getenv('KCC_SITE_ORIGIN'),'/');
if($token===''||filter_var($siteOrigin,FILTER_VALIDATE_URL)===false)respond(['message'=>'Payment proxy is not configured.'],503);
$action=(string)($_GET['action']??'');
try{
 if($action==='create'){
  if(($_SERVER['REQUEST_METHOD']??'')!=='POST')respond(['message'=>'Method not allowed.'],405);$input=json_decode((string)file_get_contents('php://input'),true);if(!is_array($input))respond(['message'=>'Invalid JSON.'],400);
  $returnUrl=(string)($input['return_url']??'');$returnOrigin=parse_url($returnUrl,PHP_URL_SCHEME).'://'.parse_url($returnUrl,PHP_URL_HOST);if(!hash_equals($siteOrigin,$returnOrigin))respond(['message'=>'Invalid return URL.'],422);
  $payload=['order_number'=>(string)($input['order_number']??''),'amount'=>(string)($input['amount']??''),'description'=>(string)($input['description']??''),'return_url'=>$returnUrl];
  // For dynamic prices, replace amount with a trusted server-side value.
  upstream(KCC_PAY_API.'?action=create','POST',$payload,$token);
 }
 if($action==='status'){
  if(($_SERVER['REQUEST_METHOD']??'')!=='GET')respond(['message'=>'Method not allowed.'],405);$paymentId=(string)($_GET['payment_id']??'');upstream(KCC_PAY_API.'?action=status&payment_id='.rawurlencode($paymentId),'GET',null,'');
 }
 respond(['message'=>'Endpoint not found.'],404);
}catch(Throwable $error){error_log('KCC payment proxy: '.$error->getMessage());respond(['message'=>'Payment service is temporarily unavailable.'],502);}