<?php
// WEVIA API Key Manager — Update keys via web + auto-test
header("Content-Type: application/json");
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: Content-Type");
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') exit;

$SECRETS = "/etc/weval/secrets.env";
$input = json_decode(file_get_contents("php://input"), true);
$action = $input['action'] ?? $_GET['action'] ?? 'status';

// Auth check (simple HMAC)
$auth_key = "WEVADS2026";
if (($input['key'] ?? $_GET['k'] ?? '') !== $auth_key) {
    echo json_encode(["error" => "unauthorized"]); exit;
}

if ($action === 'update_key') {
    $provider = $input['provider'] ?? '';
    $new_key = trim($input['new_key'] ?? '');
    if (!$provider || !$new_key || strlen($new_key) < 5) {
        echo json_encode(["error" => "invalid provider or key"]); exit;
    }
    
    // Read current secrets
    $env = file_get_contents($SECRETS);
    $key_name = strtoupper($provider);
    
    // Replace or add
    if (preg_match("/^{$key_name}=.*/m", $env)) {
        $env = preg_replace("/^{$key_name}=.*/m", "{$key_name}={$new_key}", $env);
    } else {
        $env .= "\n{$key_name}={$new_key}";
    }
    
    file_put_contents($SECRETS, $env);
    
    // Auto-test the new key
    $test = testProvider($key_name, $new_key);
    
    echo json_encode([
        "status" => "updated",
        "provider" => $key_name,
        "test" => $test,
        "ts" => date("c")
    ]);
    exit;
}

if ($action === 'github_app_token') {
    // Create GitHub App installation token (if app exists)
    $env = file_get_contents($SECRETS);
    if (preg_match("/GITHUB_APP_ID=(.+)/", $env, $m1) && preg_match("/GITHUB_APP_KEY=(.+)/", $env, $m2)) {
        echo json_encode(["status" => "github_app_configured"]);
    } else {
        echo json_encode([
            "status" => "no_github_app",
            "setup" => [
                "1" => "Go to github.com/settings/apps → New GitHub App",
                "2" => "Name: WEVIA-Bot, Permissions: repo(all), URL: https://weval-consulting.com",
                "3" => "Generate private key → save as GITHUB_APP_KEY",
                "4" => "Note App ID → save as GITHUB_APP_ID",
                "5" => "Install app on Yacineutt org → Note Installation ID"
            ],
            "alternative" => "Or just create a new PAT at github.com/settings/tokens/new with 'repo' scope, expiry 90 days"
        ]);
    }
    exit;
}

function testProvider($name, $key) {
    $tests = [
        "GITHUB_TOKEN" => ["GET", "https://api.github.com/user", null, ["User-Agent: WEVIA"]],
        "GROQ_KEY" => ["POST", "https://api.groq.com/openai/v1/chat/completions", '{"model":"llama-3.3-70b-versatile","messages":[{"role":"user","content":"hi"}],"max_tokens":5}'],
        "CEREBRAS_API_KEY" => ["POST", "https://api.cerebras.ai/v1/chat/completions", '{"model":"llama3.1-8b","messages":[{"role":"user","content":"hi"}],"max_tokens":5}'],
        "GEMINI_KEY" => ["POST", "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions", '{"model":"gemini-2.5-flash","messages":[{"role":"user","content":"hi"}],"max_tokens":5}'],
        "SAMBANOVA_KEY" => ["POST", "https://api.sambanova.ai/v1/chat/completions", '{"model":"DeepSeek-V3.2","messages":[{"role":"user","content":"hi"}],"max_tokens":5}'],
        "MISTRAL_KEY" => ["POST", "https://api.mistral.ai/v1/chat/completions", '{"model":"open-mistral-nemo","messages":[{"role":"user","content":"hi"}],"max_tokens":5}'],
        "DEEPSEEK_KEY" => ["POST", "https://api.deepseek.com/chat/completions", '{"model":"deepseek-chat","messages":[{"role":"user","content":"hi"}],"max_tokens":5}'],
        "OPENROUTER_KEY" => ["POST", "https://openrouter.ai/api/v1/chat/completions", '{"model":"meta-llama/llama-3.3-70b-instruct:free","messages":[{"role":"user","content":"hi"}],"max_tokens":5}'],
    ];
    
    if (!isset($tests[$name])) return ["status" => "unknown_provider"];
    $t = $tests[$name];
    $ch = curl_init($t[1]);
    $headers = ["Authorization: Bearer $key", "Content-Type: application/json"];
    if (isset($t[3])) $headers = array_merge($headers, $t[3]);
    $opts = [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $headers, CURLOPT_TIMEOUT => 10, CURLOPT_SSL_VERIFYPEER => false];
    if ($t[0] === "POST" && $t[2]) { $opts[CURLOPT_POST] = true; $opts[CURLOPT_POSTFIELDS] = $t[2]; }
    curl_setopt_array($ch, $opts);
    $r = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    return ["code" => $code, "ok" => $code === 200, "preview" => substr($r, 0, 100)];
}

// Default: status
echo json_encode(["action" => "status", "info" => "Use action=update_key with provider+new_key, or action=github_app_token"]);