<?php
header('Content-Type: application/json');


// === INPUT SANITIZATION ===
function weval_input($key, $type='string', $method='GET') {
    $src = $method === 'POST' ? INPUT_POST : INPUT_GET;
    $val = filter_input($src, $key, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
    if ($val === null || $val === false) {
        $val = ($method === 'POST') ? ($_POST[$key] ?? '') : ($_GET[$key] ?? '');
        $val = htmlspecialchars(strip_tags(trim($val)), ENT_QUOTES, 'UTF-8');
    }
    if ($type === 'int') return intval($val);
    if ($type === 'email') return filter_var($val, FILTER_SANITIZE_EMAIL);
    return $val;
}

header("Content-Type: application/json");
header("Access-Control-Allow-Origin: *");
$cat = isset($_GET["cat"]) ? $_GET["cat"] : "all";

if ($cat === "run") {
    $out = shell_exec("cd /opt/weval-nonreg && timeout 120 python3 nonreg-master.py 2>&1");
    echo json_encode(["ok"=>true,"output"=>$out]);
    exit;
}

$latest = "/var/www/html/api/nonreg-latest.json";
if (file_exists($latest)) {
    $data = json_decode(file_get_contents($latest), true);
    if (!isset($data['summary'])) {
        $data['summary'] = ['pass'=>$data['pass']??0,'fail'=>$data['fail']??0,'total'=>$data['total']??0,'score'=>$data['score']??0];
    }
    echo json_encode($data);
} else {
    echo json_encode(["ok"=>false,"error"=>"No NonReg results yet. Run: GET ?cat=run"]);
}