<?php
/*
Soft Updater v5 (Flexible Edition)
POST + GET + JSON + Any Domain Allowed
*/

// ===============================
// Path & Config
// ===============================
$FR_PATH_HD = "../../../../";
require_once($FR_PATH_HD."frd-src/abc/frd-config.php");
require_once($FR_PATH_HD."frd-src/abc/frd-spider-function.php");
require_once($FR_PATH_HD."frd-src/abc/frd-this-function.php");

// ===============================
// CORS – allow any domain
// ===============================
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With");

// Preflight request
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
    http_response_code(200);
    exit;
}

// ===============================
// Always JSON response
// ===============================
header('Content-Type: application/json; charset=utf-8');

// ===============================
// Collect input (GET | POST | JSON)
// ===============================
$input = [];

// JSON body
$raw = file_get_contents("php://input");
if (!empty($raw) && ($json = json_decode($raw, true))) {
    $input = $json;
}

// POST fallback
if (!empty($_POST)) {
    $input = array_merge($input, $_POST);
}

// GET fallback
if (!empty($_GET)) {
    $input = array_merge($input, $_GET);
}

// ===============================
// API KEY check
// ===============================
$API_KEY_SECRET = '123456789'; // change this

if (!isset($input['API_KEY']) || $input['API_KEY'] !== $API_KEY_SECRET) {
    http_response_code(403);
    exit(json_encode([
        'status' => 0,
        'message' => 'Unauthorized API key'
    ]));
}

// ===============================
// Required vars check
// ===============================
if (!isset($FR_SOFT_VERSION, $FR_PATH_HD)) {
    exit(json_encode([
        'status' => 0,
        'message' => 'Server version or path not defined'
    ]));
}

// ===============================
// Client version
// ===============================
$clientVersion = isset($input['FRpost_LATEST_R_VERSION'])
    ? (int)$input['FRpost_LATEST_R_VERSION']
    : null;

if ($clientVersion !== null && $clientVersion === (int)$FR_SOFT_VERSION) {
    exit(json_encode([
        'status' => 1,
        'message' => "Already running latest version $FR_SOFT_VERSION",
        'runningVersion' => $FR_SOFT_VERSION
    ]));
}

// ===============================
// Target version
// ===============================
$nextVersion = $FR_SOFT_VERSION + 1;

$remoteZip = "https://spiderecommerce.com/ahost/released-version/V-3-$nextVersion-SPIDER_ECOMMERCE.zip";
$tmpDir    = $FR_PATH_HD . '__update_tmp/';
$tmpZip    = $tmpDir . "update_$nextVersion.zip";
$maintFlag = $FR_PATH_HD . 'maintenance.flag';

// ===============================
// Maintenance ON
// ===============================
@file_put_contents($maintFlag, 'updating');

// ===============================
// Prepare temp dir
// ===============================
if (!is_dir($tmpDir) && !mkdir($tmpDir, 0755, true)) {
    @unlink($maintFlag);
    exit(json_encode([
        'status' => 0,
        'message' => 'Failed to create temp directory'
    ]));
}

// ===============================
// Step 1: Check remote ZIP
// ===============================
$ch = curl_init($remoteZip);
curl_setopt_array($ch, [
    CURLOPT_NOBODY => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 10
]);
curl_exec($ch);
$info = curl_getinfo($ch);
curl_close($ch);

if (($info['http_code'] ?? 0) !== 200) {
    @unlink($maintFlag);
    exit(json_encode([
        'status' => 0,
        'message' => 'Remote ZIP not found'
    ]));
}

// ===============================
// Step 2: Download ZIP
// ===============================
$fp = fopen($tmpZip, 'w');
$ch = curl_init($remoteZip);
curl_setopt_array($ch, [
    CURLOPT_FILE => $fp,
    CURLOPT_TIMEOUT => 120,
    CURLOPT_FOLLOWLOCATION => true
]);
curl_exec($ch);
curl_close($ch);
fclose($fp);

if (!file_exists($tmpZip) || filesize($tmpZip) < 100) {
    @unlink($maintFlag);
    exit(json_encode([
        'status' => 0,
        'message' => 'ZIP download failed'
    ]));
}

// ===============================
// Step 3: Version validation
// ===============================
preg_match('/V-\d+-(\d+)-/i', basename($remoteZip), $m);
$fileVer = $m[1] ?? null;

if ((int)$fileVer !== (int)$nextVersion) {
    @unlink($maintFlag);
    exit(json_encode([
        'status' => 0,
        'message' => 'ZIP version mismatch'
    ]));
}

// ===============================
// Step 4: Extract
// ===============================
$zip = new ZipArchive();
if ($zip->open($tmpZip) !== true) {
    @unlink($maintFlag);
    exit(json_encode([
        'status' => 0,
        'message' => 'ZIP open failed'
    ]));
}
$zip->extractTo($tmpDir);
$zip->close();

// ===============================
// Step 5: Deploy files
// ===============================
function fr_copy($src, $dst) {
    if (is_dir($src)) {
        if (!is_dir($dst)) mkdir($dst, 0755, true);
        foreach (scandir($src) as $file) {
            if ($file === '.' || $file === '..') continue;
            fr_copy("$src/$file", "$dst/$file");
        }
    } else {
        @copy($src, $dst);
    }
}
fr_copy($tmpDir, $FR_PATH_HD);

// ===============================
// Step 6: DB alter
// ===============================
$tableUpdated = false;
$alterFile = $FR_PATH_HD . 'frd-src/frd-alter-table.php';
if (file_exists($alterFile)) {
    require_once $alterFile;
    $tableUpdated = true;
    @unlink($alterFile);
}

// ===============================
// Cleanup
// ===============================
@unlink($tmpZip);
@rmdir($tmpDir);
@unlink($maintFlag);

// ===============================
// SUCCESS
// ===============================
echo json_encode([
    'status' => 1,
    'message' => "Update completed to version $nextVersion",
    'runningVersion' => $nextVersion,
    'tableUpdated' => $tableUpdated
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);