<?php
/**
 * Tier-B-Tool: SPF/DKIM/DMARC-Checker  →  GET /api/v1/mail.php?domain=example.com&selector=default
 *
 * Prüft per DNS-TXT: SPF (Domain), DMARC (_dmarc.Domain), DKIM (<selector>._domainkey.Domain).
 * Keine Fremd-API. 5 min Cache.
 *
 * @package SafeMyIdent\Api
 */

declare(strict_types=1);

require __DIR__ . '/../lib/bootstrap.php';

$domain = smi_valid_domain((string) ($_GET['domain'] ?? ''));
if ($domain === null) {
    smi_json_error('Bitte eine gültige Domain angeben (z. B. deine-firma.de).', 422);
}
$selector = preg_replace('/[^a-z0-9._-]/i', '', (string) ($_GET['selector'] ?? ''));

$cacheKey  = hash('sha256', 'mail|' . $domain . '|' . $selector);
$cacheFile = sys_get_temp_dir() . '/smi-cache-' . $cacheKey;
if (is_file($cacheFile)) {
    $raw = @file_get_contents($cacheFile);
    $data = $raw !== false ? json_decode($raw, true) : null;
    if (is_array($data) && ($data['exp'] ?? 0) >= time()) {
        smi_json_ok($data['val'] ?? [], true);
    }
    @unlink($cacheFile);
}

/**
 * TXT-Record(s) eines Namens holen (zusammengesetzt).
 *
 * @param string $name Hostname.
 * @return string[]
 */
$txt = static function (string $name): array {
    $out = [];
    $recs = @dns_get_record($name, DNS_TXT);
    if (is_array($recs)) {
        foreach ($recs as $r) {
            if (!empty($r['txt'])) {
                $out[] = (string) $r['txt'];
            } elseif (!empty($r['entries']) && is_array($r['entries'])) {
                $out[] = implode('', $r['entries']);
            }
        }
    }
    return $out;
};

// SPF.
$spf = '';
foreach ($txt($domain) as $t) {
    if (stripos($t, 'v=spf1') === 0) {
        $spf = $t;
        break;
    }
}

// DMARC.
$dmarc = '';
foreach ($txt('_dmarc.' . $domain) as $t) {
    if (stripos($t, 'v=DMARC1') === 0) {
        $dmarc = $t;
        break;
    }
}
$policy = '';
if ($dmarc !== '' && preg_match('/\bp=([a-z]+)/i', $dmarc, $m)) {
    $policy = strtolower($m[1]);
}

// DKIM: eigener Selector + gängige Selector.
$selectors = array_values(array_filter(array_unique(array_merge(
    $selector !== '' ? [$selector] : [],
    ['default', 'google', 'selector1', 'selector2', 'k1', 'dkim', 'mail', 's1', 's2']
))));
$checked = [];
$found   = [];
foreach ($selectors as $s) {
    $checked[] = $s;
    $host = $s . '._domainkey.' . $domain;
    $hit  = false;
    foreach ($txt($host) as $t) {
        if (stripos($t, 'DKIM1') !== false || stripos($t, 'p=') !== false || stripos($t, 'k=') === 0) {
            $hit = true;
            break;
        }
    }
    if (!$hit) {
        // DKIM kann per CNAME delegiert sein.
        $cn = @dns_get_record($host, DNS_CNAME);
        if (is_array($cn) && count($cn) > 0) {
            $hit = true;
        }
    }
    if ($hit) {
        $found[] = $s;
    }
    if (count($checked) >= 10) {
        break;
    }
}

$out = [
    'domain' => $domain,
    'spf'    => ['present' => $spf !== '', 'record' => $spf],
    'dmarc'  => ['present' => $dmarc !== '', 'record' => $dmarc, 'policy' => $policy],
    'dkim'   => ['checked' => $checked, 'found' => $found],
];

@file_put_contents($cacheFile, json_encode(['exp' => time() + 300, 'val' => $out]));
smi_json_ok($out, false);