<?php
/**
 * index.php
 *
 * This script sits at the root of your API domain (https://databaseledak.site/)
 * and enforces token-based access to any API functionality. Clients must
 * provide a valid token either via the `token` query parameter or as a
 * Bearer token in the `Authorization` header. If the token is missing or
 * invalid, the script returns a 401 Unauthorized response and stops
 * processing.
 */

// Define an array of valid tokens. Replace these with your own secrets.
$VALID_TOKENS = [
    '1861e186-2cab-4a20-b11a-fb2e404d4fcb',
    'd50086bc-ec32-4d81-87bf-60bceac22e2d',
];

// Helper to extract the token from the request. Supports ?token=... or
// Authorization: Bearer ... header.
function get_request_token(): ?string {
    // 1) Check for token in query params
    if (isset($_GET['token']) && is_string($_GET['token'])) {
        return trim($_GET['token']);
    }
    // 2) Check for Bearer token in the Authorization header
    $auth = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
    if ($auth) {
        if (preg_match('/^Bearer\\s+(\\S+)$/i', $auth, $m)) {
            return $m[1];
        }
    }
    return null;
}

// Extract the provided token
$requestToken = get_request_token();

// Validate the token
if (!$requestToken || !in_array($requestToken, $VALID_TOKENS, true)) {
    // Respond with 401 Unauthorized and a simple JSON error body
    http_response_code(401);
    header('Content-Type: application/json; charset=UTF-8');
    echo json_encode([
        'error' => 'unauthorized',
        'message' => 'Missing or invalid API token.'
    ], JSON_UNESCAPED_SLASHES);
    exit;
}

// If we reach this point, the token is valid. You can route the request
// to specific API endpoints or return a default response. For example,
// below we return a list of available endpoints. Replace or extend this
// with your own logic as needed.
header('Content-Type: application/json; charset=UTF-8');
echo json_encode([
    'message' => 'Welcome to the DatabaseLedak API',
    'note'    => 'Token validated successfully.',
    'available_endpoints' => [
        '/api/lotto.php' => 'Returns lottery results in JSON format',
        // Add other endpoints here as needed
    ],
]);
?>