<?php
declare(strict_types=1);

$Callingg_2 = "SoftwareUpdate";
require_once 'frd1_whoami.php';

$FR_ptitle = "Software Update";
$p = "SoftwareUpdate";
$inn = "";

require_once 'frd-this-header.php';
require_once 'frd1_header.php';

/* ===============================
   RESPONSE HELPERS
================================ */
function updateFail(string $msg, array $extra = []): never {
    http_response_code(400);
    echo "<pre>";
    print_r(array_merge([
        "status"  => 0,
        "success" => false,
        "error"   => $msg
    ], $extra));
    echo "</pre>";
    exit;
}

function updateSuccess(array $data): void {
    http_response_code(200);
    echo "<pre>";
    print_r([
        "status"  => 1,
        "success" => true,
        "data"    => $data
    ]);
    echo "</pre>";
}


$NEXT_VERSION = $FR_SOFT_VERSION + 1;

echo "<h2 class='PT'>Software Update</h2>";

/* ===============================
   UPDATE PROCESS
================================ */
if (!empty($_FILES['f_software_file']['name'])) {

    $log = [];

    try {

        $file = $_FILES['f_software_file'];

        if ($file['error'] !== UPLOAD_ERR_OK) {
            updateFail("File upload error", ["php_error" => $file['error']]);
        }

        /* ========= FILE VALIDATION ========= */
        $original = $file['name'];
        $tmp      = $file['tmp_name'];

        if (!preg_match('/\-([0-9]+)\-SPIDER_ECOMMERCE\.zip$/i', $original, $m)) {
            updateFail("Invalid file name format");
        }

        $fileVersion = (int)$m[1];
        if ($fileVersion !== $NEXT_VERSION) {
            updateFail("Invalid update version", [
                "expected" => $NEXT_VERSION,
                "given"    => $fileVersion
            ]);
        }

        if (function_exists('finfo_open')) {
            $finfo = finfo_open(FILEINFO_MIME_TYPE);
            $mime  = finfo_file($finfo, $tmp);
            finfo_close($finfo);

            if (!in_array($mime, ['application/zip', 'application/x-zip-compressed'], true)) {
                updateFail("Invalid ZIP file");
            }
        }


        $log[] = "File & version validated";

        /* ========= STORE ZIP ========= */
        $zipPath = $FR_PATH_HD . "update-$fileVersion.zip";
        if (!move_uploaded_file($tmp, $zipPath)) {
            updateFail("Failed to store update file");
        }

        $log[] = "ZIP stored";

        /* ========= SAFE EXTRACTION ========= */
        $zip = new ZipArchive();
        if ($zip->open($zipPath) !== true) {
            updateFail("Unable to open ZIP");
        }

        $root = realpath($FR_PATH_HD);

        for ($i = 0; $i < $zip->numFiles; $i++) {
            $entry = $zip->getNameIndex($i);

            if (str_contains($entry, '../') || str_starts_with($entry, '/')) {
                $zip->close();
                updateFail("ZIP path traversal detected");
            }

            $fullPath = realpath(dirname($FR_PATH_HD . $entry)) ?: '';
            if ($fullPath && strpos($fullPath, $root) !== 0) {
                $zip->close();
                updateFail("ZIP extraction outside root");
            }
        }

        $zip->extractTo($FR_PATH_HD);
        $zip->close();

        $log[] = "ZIP extracted";

        /* ========= DB ALTER ========= */
        $alterFile = $FR_PATH_HD . "frd-src/frd-alter-table.php";
        if (!file_exists($alterFile)) {
            updateFail("Alter file missing");
        }

        require $alterFile;
        unlink($alterFile);

        $log[] = "Database updated";

        unlink($zipPath);
        $log[] = "ZIP removed";

        updateSuccess([
            "message" => "Software updated successfully",
            "version" => $fileVersion,
            "steps"   => $log
        ]);

    } catch (Throwable $e) {
        updateFail("Update failed", [
            "exception" => $e->getMessage()
        ]);
    }
}
?>

<!-- ===============================
     UPLOAD FORM
================================ -->
<h6 class="text-center">
    Current Version: <?= htmlspecialchars((string)$FR_SOFT_VERSION) ?>
</h6>
<hr>

<div class="container">
    <div class="row justify-content-center">
        <div class="col-md-4 jumbotron">
            <form method="post" enctype="multipart/form-data">
                <input type="file" name="f_software_file" class="form-control" required>
                <br>
                <button type="submit" class="btn btn-success btn-block">
                    Confirm & Update
                </button>
            </form>
        </div>
    </div>
</div>

<?php require_once 'frd1_footer.php'; ?>