<?php
/**
 * Tier-B-Tool: SSL-/TLS-Checker  →  GET /api/v1/ssl.php?domain=example.com
 *
 * Baut eine TLS-Verbindung zu <domain>:443 auf und liest das Zertifikat aus
 * (Aussteller, Gültigkeit, Ablauf). Keine Fremd-API. 5 min Cache.
 *
 * @package SafeMyIdent\Api
 */

declare(strict_types=1);

require __DIR__ . '/../lib/bootstrap.php';

$domain = smi_valid_domain((string) ($_GET['domain'] ?? ''));
if ($domain === null) {
    smi_json_error('Bitte eine gültige Domain angeben (z. B. example.com).', 422);
}

$cacheKey  = hash('sha256', 'ssl|' . $domain);
$cacheFile = sys_get_temp_dir() . '/smi-cache-' . $cacheKey;
if (is_file($cacheFile)) {
    $raw = @file_get_contents($cacheFile);
    $data = $raw !== false ? json_decode($raw, true) : null;
    if (is_array($data) && ($data['exp'] ?? 0) >= time()) {
        smi_json_ok($data['val'] ?? [], true);
    }
    @unlink($cacheFile);
}

$ctx = stream_context_create([
    'ssl' => [
        'capture_peer_cert' => true,
        'verify_peer'       => false,
        'verify_peer_name'  => false,
        'SNI_enabled'       => true,
        'peer_name'         => $domain,
    ],
]);

$client = @stream_socket_client(
    'ssl://' . $domain . ':443',
    $errno,
    $errstr,
    8,
    STREAM_CLIENT_CONNECT,
    $ctx
);
if ($client === false) {
    smi_json_error('TLS-Verbindung fehlgeschlagen (Port 443 nicht erreichbar).', 502);
}

$params = stream_context_get_params($client);
fclose($client);
$cert = $params['options']['ssl']['peer_certificate'] ?? null;
if ($cert === null) {
    smi_json_error('Kein Zertifikat empfangen.', 502);
}

$info = openssl_x509_parse($cert);
if ($info === false) {
    smi_json_error('Zertifikat konnte nicht gelesen werden.', 502);
}

$validTo   = (int) ($info['validTo_time_t'] ?? 0);
$validFrom = (int) ($info['validFrom_time_t'] ?? 0);
$daysLeft  = $validTo > 0 ? (int) floor(($validTo - time()) / 86400) : null;

$out = [
    'host'        => $domain,
    'subject'     => $info['subject']['CN'] ?? $domain,
    'issuer'      => $info['issuer']['O'] ?? ($info['issuer']['CN'] ?? '—'),
    'valid_from'  => $validFrom ? gmdate('Y-m-d', $validFrom) : null,
    'valid_to'    => $validTo ? gmdate('Y-m-d', $validTo) : null,
    'days_left'   => $daysLeft,
    'protocol'    => 'TLS',
];

@file_put_contents($cacheFile, json_encode(['exp' => time() + 300, 'val' => $out]));
smi_json_ok($out, false);