<?php
/**
 * License Verification Endpoint
 * URL: https://tmitstore.com/license/check.php
 */

header('Content-Type: application/json; charset=utf-8');
header('X-Content-Type-Options: nosniff');

// Only accept POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    die(json_encode(['status' => 'error', 'message' => 'Method not allowed.']));
}

require_once __DIR__ . '/config.php';

// ---- Parse JSON body ----
$body  = file_get_contents('php://input');
$input = @json_decode($body, true);

if (!is_array($input)) {
    _fail('invalid_request', 'Invalid JSON body.');
}

$domain      = trim($input['domain']      ?? '');
$license_key = trim($input['license_key'] ?? '');
$product     = trim($input['product']     ?? '');
$timestamp   = (int)($input['timestamp']  ?? 0);
$sig         = trim($input['sig']         ?? '');

// ---- Validate all fields are present ----
if (!$domain || !$license_key || !$product || !$timestamp || !$sig) {
    _fail('invalid_request', 'Missing required parameters.');
}

// ---- Reject stale/future timestamps (replay attack prevention) ----
if (abs(time() - $timestamp) > LIC_TIMESTAMP_TOLERANCE) {
    _fail('invalid_request', 'Request timestamp is out of range. Sync your server clock.');
}

// ---- Verify HMAC request signature ----
$expected_sig = hash_hmac('sha256', $domain . $license_key . $product . $timestamp, LIC_HMAC_SECRET);
if (!hash_equals($expected_sig, $sig)) {
    _fail('invalid_sig', 'Request signature mismatch.');
}

// ---- Check product ----
if ($product !== LIC_PRODUCT) {
    _fail('invalid_product', 'Unknown product identifier.');
}

// ---- Database lookup ----
$stmt = $lic_pdo->prepare(
    "SELECT * FROM licenses WHERE license_key = ? AND domain = ? AND product = ? LIMIT 1"
);
$stmt->execute([$license_key, $domain, $product]);
$license = $stmt->fetch();

if (!$license) {
    _fail('not_found', 'License key not found or not registered for domain: ' . $domain);
}

// ---- Status checks ----
if ($license['status'] === 'suspended') {
    _fail('suspended', 'This license has been suspended. Contact tmitstore.com support.');
}

if ($license['status'] === 'expired') {
    _fail('expired', 'This license has expired. Contact tmitstore.com to renew.');
}

// Check expiry date (NULL = lifetime)
if ($license['expires_at'] !== null && strtotime($license['expires_at']) < mktime(0, 0, 0)) {
    // Auto-update status
    $lic_pdo->prepare("UPDATE licenses SET status = 'expired' WHERE id = ?")->execute([$license['id']]);
    _fail('expired', 'This license expired on ' . $license['expires_at'] . '. Contact support to renew.');
}

// ---- Update last_check timestamp ----
$lic_pdo->prepare("UPDATE licenses SET last_check = NOW() WHERE id = ?")->execute([$license['id']]);

// ---- Build signed success response ----
$expires_at  = $license['expires_at'] ?? 'lifetime';
$res_sig = hash_hmac(
    'sha256',
    'valid' . $domain . $expires_at . LIC_PRODUCT,
    LIC_HMAC_SECRET
);

echo json_encode([
    'status'     => 'valid',
    'domain'     => $domain,
    'expires_at' => $expires_at,
    'message'    => 'License verified.',
    'res_sig'    => $res_sig,
]);
exit;


// ---- Helper ----
function _fail(string $code, string $message): void
{
    http_response_code(403);
    echo json_encode(['status' => $code, 'message' => $message]);
    exit;
}