<?php
/**
 * Single-file Bank API
 * Domain: https://omdormanahliya.united.sd/
 * Endpoints:
 *   POST /student/student-info
 *   POST /student/add-payment
 */

// ---------- Headers ----------
header("Content-Type: application/json; charset=UTF-8");
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With");

// Handle CORS preflight
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

// Only POST allowed
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(["success" => false, "message" => "Method Not Allowed. Please use POST."]);
    exit;
}

// ---------- Determine Endpoint ----------
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$endpoint = '';

// Try query string first (from .htaccess rewrite)
if (!empty($_GET['endpoint'])) {
    $endpoint = $_GET['endpoint'];
}
// Fallback to path matching
elseif (strpos($path, 'student-info') !== false) {
    $endpoint = 'student-info';
} elseif (strpos($path, 'add-payment') !== false) {
    $endpoint = 'add-payment';
}

if ($endpoint !== 'student-info' && $endpoint !== 'add-payment') {
    http_response_code(404);
    echo json_encode([
        "success" => false,
        "message" => "Endpoint not found. Use /student/student-info or /student/add-payment"
    ]);
    exit;
}

// ---------- Read JSON Body ----------
$raw   = file_get_contents('php://input');
$input = json_decode($raw, true);

if (json_last_error() !== JSON_ERROR_NONE || !is_array($input)) {
    http_response_code(400);
    echo json_encode(["success" => false, "message" => "Invalid JSON payload provided."]);
    exit;
}

// ---------- Call External API ----------
$external_url = "https://unimahadi.lovable.app/api/public/bank/" . $endpoint;

$ch = curl_init($external_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($input));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Accept: application/json',
]);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);

$response  = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$curl_err  = curl_error($ch);
curl_close($ch);

if ($curl_err) {
    http_response_code(500);
    echo json_encode(["success" => false, "message" => "cURL Error: " . $curl_err]);
    exit;
}

$data = json_decode($response, true);

// ---------- Response Handling ----------
if ($endpoint === 'add-payment') {
    // Custom success response
    if (isset($data['success']) && ($data['success'] === true || $data['success'] === 'true')) {
        http_response_code(200);
        echo json_encode([
            "success" => true,
            "data"    => "",
            "message" => "Payment has been added succssfully",
        ]);
        exit;
    }
    // Pass through failures as-is
    http_response_code($http_code ?: 200);
    echo $response;
    exit;
}

// student-info: pass through as-is
http_response_code($http_code ?: 200);
echo $response;
exit;