<?php
/**
 * Tier-B-Tool: HTTP-Header-Checker  →  GET /api/v1/http.php?url=https://example.com
 *
 * Liefert HTTP-Status, finale URL (nach Redirects) und Response-Header.
 * SSRF-Schutz: nur öffentliche Hosts, nur http/https. 60 s Cache.
 *
 * @package SafeMyIdent\Api
 */

declare(strict_types=1);

require __DIR__ . '/../lib/bootstrap.php';

$url = trim((string) ($_GET['url'] ?? ''));
if ($url === '') {
    smi_json_error('Bitte eine URL angeben.', 422);
}
if (!preg_match('#^https?://#i', $url)) {
    $url = 'https://' . $url;
}
$host = (string) parse_url($url, PHP_URL_HOST);
if (smi_valid_domain($host) === null) {
    smi_json_error('Bitte eine gültige öffentliche URL angeben.', 422);
}

// SSRF: Host darf nicht auf eine private/reservierte IP zeigen.
$ip = gethostbyname($host);
if ($ip !== $host && filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
    smi_json_error('Ziel nicht erlaubt.', 422);
}
if (!function_exists('curl_init')) {
    smi_json_error('HTTP-Prüfung serverseitig nicht verfügbar.', 501);
}

$cacheKey  = hash('sha256', 'http|' . $url);
$cacheFile = sys_get_temp_dir() . '/smi-cache-' . $cacheKey;
if (is_file($cacheFile)) {
    $raw = @file_get_contents($cacheFile);
    $data = $raw !== false ? json_decode($raw, true) : null;
    if (is_array($data) && ($data['exp'] ?? 0) >= time()) {
        smi_json_ok($data['val'] ?? [], true);
    }
    @unlink($cacheFile);
}

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER         => true,
    CURLOPT_NOBODY         => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_MAXREDIRS      => 5,
    CURLOPT_TIMEOUT        => 10,
    CURLOPT_CONNECTTIMEOUT => 5,
    CURLOPT_PROTOCOLS      => CURLPROTO_HTTP | CURLPROTO_HTTPS,
    CURLOPT_REDIR_PROTOCOLS => CURLPROTO_HTTP | CURLPROTO_HTTPS,
    CURLOPT_USERAGENT      => 'SafeMyIdent-HTTP-Checker/1.0 (+https://safemyident.de)',
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_SSL_VERIFYHOST => 2,
]);
$resp = curl_exec($ch);
if ($resp === false) {
    $err = curl_error($ch);
    curl_close($ch);
    smi_json_error('Abruf fehlgeschlagen: ' . $err, 502);
}

$status     = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
$final      = (string) curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
$headerSize = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
curl_close($ch);

$headerText = substr((string) $resp, 0, $headerSize);
$blocks     = preg_split("/\r\n\r\n/", trim($headerText)) ?: [];
$lastBlock  = (string) end($blocks);

$headers = [];
foreach (explode("\r\n", $lastBlock) as $line) {
    if (str_contains($line, ':')) {
        [$k, $v] = explode(':', $line, 2);
        $headers[trim($k)] = trim($v);
    }
}

$out = [
    'status'    => $status,
    'final_url' => $final,
    'headers'   => $headers,
];

@file_put_contents($cacheFile, json_encode(['exp' => time() + 60, 'val' => $out]));
smi_json_ok($out, false);