<?php
/**
 * EmblemAVS Installer (no renaming)
 * - Downloads *.php.txt from repo, saves as *.php locally (same base name).
 * - Backs up existing files to ./backup/{name}.bak{TIMESTAMP}.php
 * - Atomic writes, size+hash compare, optional secret.
 */

// ---------------------- CONFIG ----------------------
$repoBase   = 'https://support.ghost.army/EmblemAVS/'; // trailing slash required
$repoSuffix = '.txt';                                   // remote files are *.php.txt

$targets = [
	'EmblemAVS.Class.php',
	'EmblemAVS.Config.php',
	'EmblemAVS.ElevatedX.php',
	'EmblemAVS.Template.php',
	'EmblemAVS.Updater.php',
	'EmblemAVS.Overrider.php',
	'EmblemAVS.PSSO_Rewriter.php',
];

// (Optional) simple shared secret:
$requireSecret = true;
$secretParam   = 'secret';
$secretValue   = 'ghostarmy964116973';

// Stop on first error?
$failFast = false;
// -------------------- END CONFIG --------------------


// ---------- Guard ----------
if ($requireSecret) {
	$got = $_GET[$secretParam] ?? $_SERVER['HTTP_X_UPDATE_SECRET'] ?? '';
	if (!hash_equals($secretValue, $got)) {
		http_response_code(403);
		exit("Forbidden: missing/invalid secret.\n");
	}
}

// ---------- Paths ----------
$baseDir   = __DIR__;
$backupDir = $baseDir . '/backup';
@mkdir($backupDir, 0755, true);
$ts = (string) time();

// ---------- Helpers ----------
function http_get_file(string $url): array {
	if (function_exists('curl_init')) {
		$ch = curl_init($url);
		curl_setopt_array($ch, [
			CURLOPT_RETURNTRANSFER => true,
			CURLOPT_FOLLOWLOCATION => true,
			CURLOPT_CONNECTTIMEOUT => 10,
			CURLOPT_TIMEOUT        => 30,
			CURLOPT_SSL_VERIFYPEER => true,
			CURLOPT_SSL_VERIFYHOST => 2,
			CURLOPT_USERAGENT      => 'EmblemAVS-Installer/1.0',
		]);
		$data = curl_exec($ch);
		$err  = curl_error($ch);
		$code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
		curl_close($ch);
		if ($data === false) return [false, "cURL error: $err", $code ?: 0];
		if ($code < 200 || $code >= 300) return [false, "HTTP $code from $url", $code];
		return [true, $data, $code];
	} else {
		$ctx = stream_context_create([
			'http' => ['method' => 'GET','timeout' => 30,'header' => "User-Agent: EmblemAVS-Installer/1.0\r\n"],
			'ssl'  => ['verify_peer' => true,'verify_peer_name' => true],
		]);
		$data = @file_get_contents($url, false, $ctx);
		if ($data === false) {
			$err = error_get_last();
			return [false, "stream error: " . ($err['message'] ?? 'unknown'), 0];
		}
		$code = 200;
		if (isset($http_response_header) && preg_match('#HTTP/\S+\s+(\d{3})#', implode(' ', $http_response_header), $m)) {
			$code = (int) $m[1];
			if ($code < 200 || $code >= 300) return [false, "HTTP $code from $url", $code];
		}
		return [true, $data, $code];
	}
}

function atomic_write(string $path, string $content): bool {
	$tmp = $path . '.tmp-' . bin2hex(random_bytes(6));
	if (@file_put_contents($tmp, $content) === false) return false;
	if (file_exists($path)) @chmod($tmp, fileperms($path) & 0777); else @chmod($tmp, 0644);
	return @rename($tmp, $path);
}

function file_hash(string $path): ?string { return file_exists($path) ? @hash_file('sha256', $path) : null; }
function bfmt(int $bytes): string { $u=['B','KB','MB','GB'];$i=0;while($bytes>=1024&&$i<count($u)-1){$bytes/=1024;$i++;}return sprintf('%.2f %s',$bytes,$u[$i]); }

// ---------- Process ----------
$report = [];
$report[] = "Installer started at " . gmdate('c') . " (UTC)";
$report[] = "Base dir: $baseDir";
$report[] = "Backup dir: $backupDir";
$report[] = "Repo base: $repoBase (suffix: '$repoSuffix')";
$report[] = str_repeat('-', 60);

foreach ($targets as $targetName) {
	// Remote: *.php.txt  | Local: *.php (same name as repo base)
	$repoUrl = $repoBase . $targetName . $repoSuffix;
	$local   = $baseDir . '/' . $targetName;

	$report[] = "Fetching: $repoUrl";
	[$ok, $data, $code] = http_get_file($repoUrl);
	if (!$ok) { $report[] = "  ERROR: $data"; if ($failFast) break; else continue; }

	$newHash = hash('sha256', $data);
	$newSize = strlen($data);
	$report[] = "  Downloaded: " . bfmt($newSize) . " (sha256 $newHash)";

	if (file_exists($local)) {
		$oldHash = file_hash($local);
		$oldSize = filesize($local) ?: 0;
		$report[] = "  Local exists: " . bfmt($oldSize) . " (sha256 $oldHash)";

		if ($oldHash === $newHash && $oldSize === $newSize) {
			$report[] = "  No change detected. Skipping.";
			continue;
		}

		$ext  = pathinfo($targetName, PATHINFO_EXTENSION);  // php
		$base = basename($targetName, '.' . $ext);
		$bak  = $backupDir . '/' . $base . '.bak' . $ts . '.' . $ext;

		if (!@copy($local, $bak)) { $report[] = "  ERROR: failed to create backup: $bak"; if ($failFast) break; else continue; }
		$report[] = "  Backup created: $bak";
	} else {
		$report[] = "  Local missing; will install fresh.";
	}

	if (!atomic_write($local, $data)) { $report[] = "  ERROR: failed to write $local"; if ($failFast) break; else continue; }
	@chmod($local, 0644);
	$report[] = "  Wrote: $targetName";
}

$report[] = str_repeat('-', 60);
$report[] = "Done.";

header('Content-Type: text/plain; charset=UTF-8');
echo implode("\n", $report), "\n";