<?php
// =============================================================================
// /api/config.php — buyer-facing config GET/UPDATE.
//
// GET: returns ONLY the buyer-facing fields. Crypto identity (cert_sha256_hex,
// libapksec_auth_key_hex, libapksec_build_id, target_server_key_hex, pkg_name,
// bootstrap_*) NEVER leaves the server through this endpoint — those live in
// includes/apksec_constants.php and would be enough to forge guard requests
// across the whole customer base if leaked.
//
// UPDATE: same whitelist on the way in, so even a hand-rolled curl can't write
// over the crypto fields via this endpoint.
// =============================================================================
require_once __DIR__ . '/_common.php';
require_csrf_unless_get();
list($action, $body) = read_action();

// Strict allowlist of fields a buyer can read OR write through this endpoint.
$buyer_visible_fields = [
    'display_name', 'panel_base_url',
    'theme', 'noti_title', 'noti_content',
    'home_url1', 'qr_url', 'subtitle_url',
    'apk_link', 'app_version',
    'is_ibo', 'is_vu',
    'updated_at',
];

if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $full = db_config();
    $safe = [];
    foreach ($buyer_visible_fields as $f) {
        if (array_key_exists($f, $full)) $safe[$f] = $full[$f];
    }
    json_response(['config' => $safe]);
}

if ($action === 'update') {
    $string_fields = [
        'display_name', 'panel_base_url',
        'theme', 'noti_title', 'noti_content',
        'home_url1', 'qr_url', 'subtitle_url',
        'apk_link', 'app_version',
    ];
    $bool_fields = ['is_ibo', 'is_vu'];

    // Per-field length caps so a paste-bomb (or a probe like a 2 MiB string)
    // can't bloat the config row and slow down every subsequent GET /api/config.
    $string_caps = [
        'display_name'   => 80,
        'panel_base_url' => 256,
        'theme'          => 32,
        'noti_title'     => 120,
        'noti_content'   => 1000,
        'home_url1'      => 256,
        'qr_url'         => 256,
        'subtitle_url'   => 256,
        'apk_link'       => 256,
        'app_version'    => 32,
    ];

    $sets = []; $vals = [];
    foreach ($string_fields as $f) {
        if (array_key_exists($f, $body)) {
            $v = (string)$body[$f];
            $max = $string_caps[$f] ?? 256;
            if (strlen($v) > $max) {
                json_error('"' . $f . '" is too long (max ' . $max . ' characters).', 400);
            }
            $sets[] = "$f = ?";
            $vals[] = $v;
        }
    }
    foreach ($bool_fields as $f) {
        if (array_key_exists($f, $body)) {
            $sets[] = "$f = ?";
            $vals[] = truthy($body[$f]);
        }
    }
    if (empty($sets)) {
        json_error('Nothing to update.');
    }
    $sets[] = 'updated_at = ?';
    $vals[] = unix_now();
    db_exec('UPDATE config SET ' . implode(', ', $sets) . ' WHERE id = 1', $vals);

    // Echo back only the buyer-visible fields.
    $full = db_config();
    $safe = [];
    foreach ($buyer_visible_fields as $f) {
        if (array_key_exists($f, $full)) $safe[$f] = $full[$f];
    }
    json_response(['ok' => true, 'config' => $safe]);
}

json_error('Unknown action.', 400);
