<?php
/**
 * SAFE DEPLOY API — Pre-validated file deployment
 * POST: file content + target → validate → deploy → update gold
 * GET: ?action=status|validate|gold_refresh
 */
header('Content-Type: application/json');
error_reporting(0);

$VAULT = '/opt/wevads/vault';
$LIVE = '/opt/wevads/public';
$VALIDATOR = '/opt/wevads/scripts/deploy-validator.sh';

$action = $_GET['action'] ?? $_POST['action'] ?? 'status';

switch($action) {
    case 'status':
        $status = json_decode(file_get_contents('/opt/wevads/logs/html-guardian-status.json'), true) ?: [];
        $gold_count = count(glob("$VAULT/*.gold"));
        $live_count = count(glob("$LIVE/*.html"));
        echo json_encode(['ok'=>true, 'guardian'=>$status, 'gold_files'=>$gold_count, 'live_screens'=>$live_count]);
        break;
        
    case 'validate':
        $file = $_POST['file'] ?? '';
        if (!$file || !file_exists($file)) {
            echo json_encode(['ok'=>false, 'error'=>'File not found']);
            break;
        }
        $result = shell_exec("bash $VALIDATOR " . escapeshellarg($file) . " 2>&1");
        echo $result;
        break;
        
    case 'deploy':
        $content = $_POST['content'] ?? '';
        $filename = $_POST['filename'] ?? '';
        $target = $_POST['target'] ?? $LIVE;
        
        if (!$content || !$filename) {
            echo json_encode(['ok'=>false, 'error'=>'Missing content or filename']);
            break;
        }
        
        // Write to temp
        $tmp = "/tmp/deploy_" . md5($filename) . "_" . basename($filename);
        file_put_contents($tmp, $content);
        
        // Validate
        $validation = shell_exec("bash $VALIDATOR " . escapeshellarg($tmp) . " " . escapeshellarg($target) . " 2>&1");
        $vResult = json_decode($validation, true);
        
        if (!$vResult || !$vResult['ok']) {
            unlink($tmp);
            echo json_encode(['ok'=>false, 'error'=>'Validation failed', 'validation'=>$vResult]);
            break;
        }
        
        // Deploy
        $targetFile = "$target/$filename";
        
        // Backup current
        if (file_exists($targetFile)) {
            copy($targetFile, "$targetFile.bak-" . date('YmdHis'));
        }
        
        // Copy to live + arsenal
        copy($tmp, $targetFile);
        copy($tmp, "/opt/wevads-arsenal/public/$filename");
        
        // Update gold
        copy($tmp, "$VAULT/$filename.gold");
        
        // Update checksum
        $md5 = md5_file($tmp);
        file_put_contents("$VAULT/checksums.md5", "$md5  $filename.gold\n", FILE_APPEND);
        
        unlink($tmp);
        
        echo json_encode([
            'ok'=>true, 
            'file'=>$filename, 
            'size'=>filesize($targetFile),
            'gold_updated'=>true,
            'backed_up'=>true
        ]);
        break;
        
    case 'scan':
        $result = shell_exec("sudo bash /opt/wevads/scripts/html-guardian.sh 2>&1");
        $status = json_decode(file_get_contents('/opt/wevads/logs/html-guardian-status.json'), true) ?: [];
        echo json_encode(['ok'=>true, 'result'=>trim($result), 'status'=>$status]);
        break;
        
    case 'gold_refresh':
        $count = 0;
        foreach(glob("$LIVE/*.html") as $f) {
            $size = filesize($f);
            if ($size < 500) continue;
            copy($f, "$VAULT/" . basename($f) . ".gold");
            $count++;
        }
        // Regenerate checksums
        shell_exec("cd $VAULT && md5sum *.gold > checksums.md5 2>/dev/null");
        echo json_encode(['ok'=>true, 'refreshed'=>$count]);
        break;
        
    default:
        echo json_encode(['ok'=>false, 'error'=>'Unknown action: '.$action]);
}