<?php
/**
 * EmblemAVS Updater
 *
 * Usage: open this file in a browser/CLI. Optional: ?secret=YOUR_TOKEN
 * - Creates update/{timestamp}/ and downloads repo files there.
 * - Compares file sizes (and hashes) against local files.
 * - If different, backs up local originals to backup/ with .bak{TS}.php
 * - Atomically replaces local files with the downloaded ones.
 *
 * Requirements:
 * - PHP 7.4+ recommended
 * - cURL extension (preferred). Falls back to file_get_contents if allowed.
 */

// ---------------------- CONFIG ----------------------
$repoBase   = 'https://support.ghost.army/EmblemAVS/'; // trailing slash required
// If your repo hosts files as .php.txt, set suffix to '.txt'. If serving raw .php, set to ''.
$repoSuffix = '.txt';

$files = [
	'EmblemAVS.Class.php',
	'EmblemAVS.ElevatedX.php',
];

// (Optional) simple shared secret to prevent public triggering:
$requireSecret = true;
$secretParam   = 'secret';
$secretValue   = 'ghostarmy964116973';
// -------------------- END CONFIG --------------------

// ---------- Guard (optional) ----------
if ($requireSecret) {
	$got = $_GET[$secretParam] ?? $_SERVER['HTTP_X_UPDATE_SECRET'] ?? '';
	if (!hash_equals($secretValue, $got)) {
		http_response_code(403);
		exit("Forbidden: missing/invalid secret.\n");
	}
}

// ---------- Setup paths ----------
$baseDir   = __DIR__;
$updateDir = $baseDir . '/update';
$backupDir = $baseDir . '/backup';
$ts        = (string)time();
$tsDir     = $updateDir . '/' . $ts;

@mkdir($updateDir, 0755, true);
@mkdir($backupDir, 0755, true);
if (!@mkdir($tsDir, 0755, true) && !is_dir($tsDir)) {
	http_response_code(500);
	exit("Failed to create update dir: $tsDir\n");
}

// ---------- Helpers ----------
function http_get_file(string $url): array {
	// Returns [bool $ok, string $dataOrError, int $httpCode]
	if (function_exists('curl_init')) {
		$ch = curl_init($url);
		curl_setopt_array($ch, [
			CURLOPT_RETURNTRANSFER => true,
			CURLOPT_FOLLOWLOCATION => true,
			CURLOPT_CONNECTTIMEOUT => 10,
			CURLOPT_TIMEOUT        => 30,
			CURLOPT_SSL_VERIFYPEER => true,
			CURLOPT_SSL_VERIFYHOST => 2,
			CURLOPT_USERAGENT      => 'EmblemAVS-Updater/1.0',
		]);
		$data = curl_exec($ch);
		$err  = curl_error($ch);
		$code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
		curl_close($ch);
		if ($data === false) return [false, "cURL error: $err", $code ?: 0];
		if ($code < 200 || $code >= 300) return [false, "HTTP $code from $url", $code];
		return [true, $data, $code];
	} else {
		$ctx = stream_context_create([
			'http' => [
				'method'  => 'GET',
				'timeout' => 30,
				'header'  => "User-Agent: EmblemAVS-Updater/1.0\r\n",
			],
			'ssl' => [
				'verify_peer'      => true,
				'verify_peer_name' => true,
			],
		]);
		$data = @file_get_contents($url, false, $ctx);
		if ($data === false) {
			$err = error_get_last();
			return [false, "stream error: " . ($err['message'] ?? 'unknown'), 0];
		}
		// Best effort HTTP code via $http_response_header if available
		$code = 200;
		if (isset($http_response_header) && preg_match('#HTTP/\S+\s+(\d{3})#', implode(' ', $http_response_header), $m)) {
			$code = (int)$m[1];
			if ($code < 200 || $code >= 300) {
				return [false, "HTTP $code from $url", $code];
			}
		}
		return [true, $data, $code];
	}
}

function atomic_write(string $path, string $content): bool {
	$tmp = $path . '.tmp-' . bin2hex(random_bytes(6));
	if (@file_put_contents($tmp, $content) === false) return false;
	// preserve perms if file exists
	if (file_exists($path)) {
		@chmod($tmp, fileperms($path) & 0777);
	}
	return @rename($tmp, $path);
}

function file_hash(string $path): ?string {
	return file_exists($path) ? hash_file('sha256', $path) : null;
}

function bfmt(int $bytes): string {
	$u = ['B','KB','MB','GB'];
	$i = 0;
	while ($bytes >= 1024 && $i < count($u)-1) {$bytes/=1024;$i++;}
	return sprintf('%.2f %s', $bytes, $u[$i]);
}

// ---------- Process ----------
$report = [];
$report[] = "Updater started at " . gmdate('c') . " (UTC)";
$report[] = "Base dir: $baseDir";
$report[] = "Update dir: $tsDir";
$report[] = "Backup dir: $backupDir";
$report[] = "Repo base: $repoBase (suffix: '$repoSuffix')";
$report[] = str_repeat('-', 60);

foreach ($files as $fname) {
	$repoUrl = $repoBase . $fname . $repoSuffix;
	$local   = $baseDir . '/' . $fname;
	$dest    = $tsDir . '/' . $fname; // downloaded snapshot

	$report[] = "Fetching: $repoUrl";
	[$ok, $data, $code] = http_get_file($repoUrl);
	if (!$ok) {
		$report[] = "  ERROR: $data";
		continue;
	}

	// Save snapshot
	if (@file_put_contents($dest, $data) === false) {
		$report[] = "  ERROR: cannot write snapshot to $dest";
		continue;
	}

	$newSize = filesize($dest) ?: 0;
	$newHash = hash('sha256', $data);
	$oldSize = file_exists($local) ? (filesize($local) ?: 0) : 0;
	$oldHash = file_hash($local);

	$report[] = "  Downloaded: " . bfmt($newSize) . " (sha256 $newHash)";
	if (!file_exists($local)) {
		$report[] = "  Local file missing; will install fresh.";
		// No backup to make if not present
	} else {
		$report[] = "  Local: " . bfmt($oldSize) . " (sha256 $oldHash)";
	}

	// Your spec: compare filesizes. We'll also compare hash for safety.
	$different = ($newSize !== $oldSize) || ($oldHash !== $newHash);
	if (!$different) {
		$report[] = "  No change detected. Skipping.";
		continue;
	}

	// Backup existing file if present
	if (file_exists($local)) {
		$ext  = pathinfo($fname, PATHINFO_EXTENSION);        // php
		$base = basename($fname, '.' . $ext);                // EmblemAVS.Class
		$bak  = $backupDir . '/' . $base . '.bak' . $ts . '.' . $ext; // EmblemAVS.Class.bakTIMESTAMP.php

		if (!@copy($local, $bak)) {
			$report[] = "  ERROR: failed to create backup: $bak";
			// Fail safe: DO NOT proceed without backup when replacing
			continue;
		}
		$report[] = "  Backup created: $bak";
	}

	// Atomic replace
	if (!atomic_write($local, $data)) {
		$report[] = "  ERROR: failed to write new file to $local";
		continue;
	}
	// Ensure reasonable perms for web context (preserve if existed)
	@chmod($local, 0644);

	$report[] = "  Updated: $fname";
}

$report[] = str_repeat('-', 60);
$report[] = "Done.";

// ---------- Output ----------
header('Content-Type: text/plain; charset=UTF-8');
echo implode("\n", $report), "\n";