<?php
require_once __DIR__ . '/db/mysql_bootstrap.php';

// OPTIONS preflight
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    header('Access-Control-Allow-Origin: https://www.broadwayworld.com');
    header('Access-Control-Allow-Methods: GET,POST,OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type');
    http_response_code(204);
    exit;
}

// CORS + cache headers
header('Access-Control-Allow-Origin: https://www.broadwayworld.com');
header('Access-Control-Allow-Methods: GET,POST,OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');
header('Expires: ' . gmdate('D, d M Y H:i:s') . ' GMT');

$action = isset($_GET['action']) ? $_GET['action'] : 'load';

// Read DB connection
$dsnRead  = 'mysql:host=amazonaurora.cluster-ro-cemzxojvmybt.us-east-1.rds.amazonaws.com;dbname=amazonrds;charset=utf8mb4';
$userRead = 'admin';
$passRead = 'xxatN6Lb8Kbwb9MiU1At';

// Write DB connection
$dsnWrite  = 'mysql:host=amazonaurora.cluster-cemzxojvmybt.us-east-1.rds.amazonaws.com;dbname=amazonrds;charset=utf8mb4';
$userWrite = 'admin';
$passWrite = 'xxatN6Lb8Kbwb9MiU1At';

// ---------- LOAD ----------
if ($action === 'load') {
    if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
        echo '<p>Invalid contest ID.</p>';
        exit;
    }
    $contestId = (int) $_GET['id'];

    $pdo = new PDO($dsnRead, $userRead, $passRead, mysqlPdoOptions([PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]));
    $stmt = $pdo->prepare("SELECT contestname, contesttext, contestends, includeaddress, includeentry, contestterms
                           FROM contestmain
                           WHERE id = :id AND contestends >= CURDATE()");
    $stmt->execute([':id' => $contestId]);
    $contest = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$contest) {
        echo '<p>Sorry, this contest has ended or does not exist.</p>';
        exit;
    }

    $contestEndsFormatted = date('F j, Y', strtotime($contest['contestends']));
    $contestName  = htmlspecialchars($contest['contestname'], ENT_QUOTES, 'UTF-8');
    $contestText  = $contest['contesttext']; // Already HTML content
    $hasTerms     = !empty(trim($contest['contestterms']));
    ?>
    <form id="contest-form" method="post">
      <h2 style="font-size:18px !important;font-weight:700;"><?= $contestName ?></h2>
      <div class="contesttext"><?= $contestText ?><p><strong>Contest Ends:</strong> <?= $contestEndsFormatted ?></p></div>

    <div class="form-row">
  <div class="form-group">
    <label>Name:<br><input type="text" name="name" required></label>
  </div>
  <div class="form-group">
    <label>Email:<br><input type="email" name="email" required></label>
  </div>
</div>

      <?php if ((int)$contest['includeaddress'] === 1): ?>
        <label>Address:<br><input type="text" name="address" required></label>
        <label>Zip Code:<br><input type="text" name="zipcode" required></label><br>
      <?php endif; ?>
      <?php if ((int)$contest['includeentry'] === 1): ?>
        <label>Entry:<br><input type="text" name="entry"></label><br>
      <?php endif; ?>

      <button type="submit">Enter Contest</button>

      <?php if ($hasTerms): ?>
        <br><br>
        <span class="contest-terms-link"><small>View Terms &amp; Conditions</small></span>
      <?php endif; ?>
    </form>
    <?php

// ---------- SUBMIT ----------
} elseif ($action === 'submit') {
    $name      = isset($_POST['name'])      ? $_POST['name']      : '';
    $email     = isset($_POST['email'])     ? $_POST['email']     : '';
    $address   = isset($_POST['address'])   ? $_POST['address']   : '';
    $zipcode   = isset($_POST['zipcode'])   ? $_POST['zipcode']   : '';
    $entry     = isset($_POST['entry'])     ? $_POST['entry']     : '';
    $source    = 'roswidget';

    if (!isset($_POST['contestid']) || !is_numeric($_POST['contestid'])) {
        echo '<p>Invalid contest ID.</p>';
        exit;
    }
    $contestId = (int) $_POST['contestid'];

    // Turnstile token
    $turnstileToken = isset($_POST['cf-turnstile-response']) ? $_POST['cf-turnstile-response'] : '';

    if (empty(trim($turnstileToken))) {
        echo '<p>Error: Please complete the verification challenge.</p>';
        exit;
    }

    // Verify Turnstile token with Cloudflare
    $ch = curl_init('https://challenges.cloudflare.com/turnstile/v0/siteverify');
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
        'secret'   => '0x4AAAAAAAxc6tm7uTX4sZYFQHNrZgFR4xI',
        'response' => $turnstileToken,
    ]));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $turnstileResultBody = curl_exec($ch);
    $turnstileHttpCode   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($turnstileHttpCode === 200) {
        $turnstileResponse = json_decode($turnstileResultBody, true);
        if (!isset($turnstileResponse['success']) || !$turnstileResponse['success']) {
            echo '<p>Error: Verification failed. Please try again.</p>';
            exit;
        }
    } else {
        echo '<p>Error: Verification service unavailable. Please try again later.</p>';
        exit;
    }

    // Validate email
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        echo '<p>Error: Invalid email address.</p>';
        exit;
    }

    // Insert into contestmaster (source always "roswidget")
    $pdoWrite = new PDO($dsnWrite, $userWrite, $passWrite, mysqlPdoOptions([PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]));

    $sql = "INSERT INTO contestmaster (name, entry, address, email, contestid, currentdatetime, zipcode, source)
            VALUES (:name, :entry, :address, :email, :contestid, :currentdatetime, :zipcode, :source)";
    $stmt = $pdoWrite->prepare($sql);
    $stmt->execute([
        ':name'            => $name,
        ':entry'           => $entry,
        ':address'         => $address,
        ':email'           => $email,
        ':contestid'       => $contestId,
        ':currentdatetime' => date('Y-m-d H:i:s'),
        ':zipcode'         => $zipcode,
        ':source'          => 'roswidget',
    ]);

    // Get article info for sharing
    $pdoRead = new PDO($dsnRead, $userRead, $passRead, mysqlPdoOptions([PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]));
    $stmt = $pdoRead->prepare("SELECT ct.title, ct.seo_friendly, ct.blurb
                               FROM bway_bww.columntable ct
                               INNER JOIN contestmain cm ON ct.id = cm.articleid
                               WHERE cm.id = :id");
    $stmt->execute([':id' => $contestId]);
    $contestInfo = $stmt->fetch(PDO::FETCH_ASSOC);

    $pageUrl       = 'https://www.broadwayworld.com/article/' . $contestInfo['seo_friendly'];
    $encodedUrl    = urlencode($pageUrl);
    $encodedTitle  = urlencode($contestInfo['title']);
    $titleHtml     = htmlspecialchars($contestInfo['title'], ENT_QUOTES, 'UTF-8');
    ?>
    <div class="contest-confirmation">
      <strong style="color:darkred;"><?= $titleHtml ?></strong>
      <br><br><strong>&#10004;&#65039; Thank you, your entry was received.</strong>
      <br><br><p>Share the contest with your friends:</p>

      <div class="contest-share-buttons" style="display: flex; gap: 10px; align-items: center; flex-wrap: wrap; margin-top: 20px;">
        <!-- Facebook (Dialog-based) -->
        <a href="https://www.facebook.com/dialog/share?app_id=120130098017418&amp;display=popup&amp;href=<?= $encodedUrl ?>&amp;redirect_uri=https://www.broadwayworld.com"
           target="_blank"
           style="background-color: #1877f2; color: #fff; padding: 10px 16px; border-radius: 6px; text-decoration: none; font-weight: bold; font-size: 14px;">
          Share on Facebook
        </a>

        <!-- Twitter -->
        <a href="https://twitter.com/intent/tweet?text=<?= $encodedTitle ?>&amp;url=<?= $encodedUrl ?>"
           target="_blank"
           style="background-color: #1DA1F2; color: #fff; padding: 10px 16px; border-radius: 6px; text-decoration: none; font-weight: bold; font-size: 14px;">
          Tweet
        </a>

        <!-- Threads -->
        <a href="https://threads.net/intent/post?text=<?= $encodedTitle ?>%20<?= $encodedUrl ?>"
           target="_blank"
           style="background-color: #8A2BE2; color: #fff; padding: 10px 16px; border-radius: 6px; text-decoration: none; font-weight: bold; font-size: 14px;">
          Share on Threads
        </a>
      </div>
    </div>
    <?php

// ---------- TERMS ----------
} elseif ($action === 'terms') {
    if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
        echo 'Invalid contest ID.';
        exit;
    }
    $contestId = (int) $_GET['id'];

    $pdo = new PDO($dsnRead, $userRead, $passRead, mysqlPdoOptions([PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]));
    $stmt = $pdo->prepare("SELECT contestterms FROM contestmain
                           WHERE id = :id AND contestterms IS NOT NULL AND contestterms != ''");
    $stmt->execute([':id' => $contestId]);
    $terms = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$terms) {
        echo 'No terms and conditions available.';
    } else {
        echo $terms['contestterms'];
    }
}