<?php
/**
 * Vollständige DNS-Analyse einer Domain → GET /api/v1/dnsx.php?domain=example.com
 *
 * A/AAAA/CNAME/MX/NS/TXT/SOA + SPF/DMARC + TTLs + Reverse/FCrDNS der A-Records.
 *
 * @package SafeMyIdent\Api
 */

declare(strict_types=1);

require __DIR__ . '/../lib/boot2.php';

if (!smi_module_on('dns')) {
    smi_json_error('DNS-Modul ist deaktiviert.', 403);
}

$domain = smi_valid_domain((string) ($_GET['domain'] ?? ''));
if ($domain === null) {
    smi_json_error('Bitte eine gültige Domain angeben.', 422);
}

$cacheKey = 'dnsx|' . $domain;
$hit = smi_cache_get($cacheKey);
if ($hit !== null) {
    smi_json_ok($hit, true);
}

/**
 * TXT-Records eines Namens (zusammengesetzt).
 *
 * @param string $name Name.
 * @return string[]
 */
$txtStrings = static function ($recs): array {
    $out = [];
    foreach ((array) $recs as $r) {
        if (!empty($r['txt'])) { $out[] = (string) $r['txt']; }
        elseif (!empty($r['entries']) && is_array($r['entries'])) { $out[] = implode('', $r['entries']); }
    }
    return $out;
};

// Alle Record-Typen in EINEM Batch (Gateway) bzw. einzeln direkt auflösen.
$res = smi_dns_many([
    ['name' => $domain, 'type' => 'A'], ['name' => $domain, 'type' => 'AAAA'], ['name' => $domain, 'type' => 'CNAME'],
    ['name' => $domain, 'type' => 'MX'], ['name' => $domain, 'type' => 'NS'], ['name' => $domain, 'type' => 'SOA'],
    ['name' => $domain, 'type' => 'TXT'], ['name' => '_dmarc.' . $domain, 'type' => 'TXT'],
]);
[$rA, $rAAAA, $rCNAME, $rMX, $rNS, $rSOA, $rTXT, $rDMARC] = array_pad($res, 8, []);

$records = ['A' => [], 'AAAA' => [], 'CNAME' => [], 'MX' => [], 'NS' => [], 'TXT' => [], 'SOA' => []];
foreach ((array) $rA as $r)     { $records['A'][]    = ['value' => $r['ip'] ?? '', 'ttl' => $r['ttl'] ?? null]; }
foreach ((array) $rAAAA as $r)  { $records['AAAA'][] = ['value' => $r['ipv6'] ?? '', 'ttl' => $r['ttl'] ?? null]; }
foreach ((array) $rCNAME as $r) { if (!empty($r['target'])) { $records['CNAME'][] = ['value' => $r['target'], 'ttl' => $r['ttl'] ?? null]; } }
foreach ((array) $rMX as $r)    { $records['MX'][]   = ['value' => ($r['pri'] ?? '') . ' ' . ($r['target'] ?? ''), 'host' => $r['target'] ?? '', 'pri' => $r['pri'] ?? null, 'ttl' => $r['ttl'] ?? null]; }
foreach ((array) $rNS as $r)    { if (!empty($r['target'])) { $records['NS'][] = ['value' => $r['target'], 'ttl' => $r['ttl'] ?? null]; } }
foreach ($txtStrings($rTXT) as $t) { $records['TXT'][] = ['value' => $t]; }
foreach ((array) $rSOA as $r) {
    $records['SOA'][] = [
        'primary' => $r['mname'] ?? '', 'email' => $r['rname'] ?? '', 'serial' => $r['serial'] ?? null,
        'refresh' => $r['refresh'] ?? null, 'retry' => $r['retry'] ?? null, 'expiry' => $r['expiry'] ?? null,
        'minimum' => $r['minimum-ttl'] ?? null, 'ttl' => $r['ttl'] ?? null,
    ];
}

// SPF / DMARC.
$spf = '';
foreach ($records['TXT'] as $t) {
    if (stripos($t['value'], 'v=spf1') === 0) { $spf = $t['value']; break; }
}
$dmarc = '';
foreach ($txtStrings($rDMARC) as $t) {
    if (stripos($t, 'v=DMARC1') === 0) { $dmarc = $t; break; }
}

// Reverse/FCrDNS der A-Records.
$fcrdns = [];
foreach ($records['A'] as $a) {
    $ip = $a['value'];
    if ($ip === '' || !smi_ip_is_public($ip)) { continue; }
    $ptr = smi_reverse_dns($ip);
    $confirmed = null;
    if ($ptr !== '') {
        $fwd = smi_resolve_public_ips($ptr);
        $confirmed = in_array($ip, $fwd['all'], true);
    }
    $fcrdns[] = ['ip' => $ip, 'ptr' => $ptr, 'confirmed' => $confirmed];
}

$out = [
    'domain'  => $domain,
    'records' => $records,
    'counts'  => array_map('count', $records),
    'spf'     => $spf,
    'dmarc'   => $dmarc,
    'fcrdns'  => $fcrdns,
];
smi_cache_set($cacheKey, $out, (int) ($smi_cfg['cache_ttl'] ?? 900));
smi_json_ok($out);