<?php
// ═══════════════════════════════════════════════════════════════════════════════════════════════
// PURPOSE
//   Certificate status. Serves the cert panel four ways — the cached results of the last
//   cert_monitor.sh run, the configured domain list, a live read of NPM's own certificate
//   store, and an on-demand re-run of the monitor.
//
// OPERATIONAL MODEL
//   Two independent sources of truth, deliberately kept separate. cert_monitor.sh checks the
//   domains as they resolve from outside — the certificate a visitor actually receives. NPM's
//   API reports what it holds internally. They disagree exactly when something is wrong: a
//   renewed cert that was never reloaded, or a proxy host pointing at the wrong certificate.
//   Collapsing them into one number would hide the only case worth catching.
//
//   The default path serves cert_monitor.sh's cache and never checks anything itself. That
//   script runs on the Sunday report schedule; the run action exists for when someone does
//   not want to wait for it.
//
// DESIGN PRINCIPLES
//   Thresholds come from master.conf, with shipped defaults.
//       CERT_WARN_DAYS and CERT_CRIT_DAYS are read per request rather than baked in, so the
//       page and the script that notifies agree on what "critical" means.
//
//   No cache is answered with the domain list, not with an error.
//       Before the first run there is nothing to report, so the configured domains are
//       returned marked UNKN. The panel shows what is being watched rather than an empty
//       state that looks like nothing is configured.
//
//   Already expired sorts with critical, not past it.
//       A negative day count is CRIT rather than a separate state, and the sort puts the
//       smallest number first — so the most urgent certificate is always at the top.
//
//   The run action returns the script's output alongside the fresh data.
//       Capped at 30 lines. When a check fails, the reason is in that output and nowhere in
//       the structured result.
//
// OPERATIONAL SAFEGUARDS
//   The action is chosen from a fixed set, and everything else falls to the cached read.
//       No part of the request names a script, a domain, or a file. The one script this
//       endpoint can run is a hardcoded path.
//
//   The script run is externally time-boxed.
//       `timeout 180` wraps it — set_time_limit() does not cover exec() time on Linux, so
//       PHP's own limit cannot end a check hung on an unresponsive domain. Exit 124 is
//       reported as a timeout rather than a generic failure.
//
//   A missing script is reported, not executed.
//       file_exists() precedes exec(), so a partial deploy returns a named error rather than
//       a shell failure surfacing as an empty result.
//
//   Every threshold read has a default.
//       ?: 30 and ?: 7 on the regex captures, so a master.conf mid-edit or missing the keys
//       still yields coherent statuses instead of comparing every certificate against zero
//       and reporting the whole estate critical.
//
//   Missing or malformed expiry data is UNKN, never OK.
//       A certificate whose expires_on is absent or unparseable yields a null day count and
//       an explicit unknown status. Defaulting it to OK would silently drop a certificate out
//       of monitoring — the one failure this panel exists to prevent.
//
//   Every cache read degrades.
//       json_decode with ?: fallbacks throughout, so a truncated cache file yields an empty
//       result rather than a fatal.
//
//   The NPM path reports its own transport failures.
//       vv_npm_req() returns an _err key rather than throwing, and that is checked before the
//       response is treated as a certificate list — so an unreachable NPM is reported as such
//       instead of rendering as zero certificates.
//
//   The run action is POST only, which is what places it behind Unraid's CSRF guard.
//       The platform prepend validates the token on every POST and inspects no GET at all, so
//       an action that executes a script must not be reachable by GET. The three read actions
//       stay GET-reachable because they change nothing.
//
// REQUEST
//   GET                        cached status, or the configured domains when no cache exists
//   GET|POST ?action=npm       live certificate list from NPM's API
//   GET|POST ?action=domains   configured domains and thresholds, no checks run
//   POST action=run            re-run cert_monitor.sh, then return its fresh cache
//                              (POST, so Unraid's CSRF guard applies)
//
// RESPONSE
//   default  {"ok":true,"checked_at","host","warn_days","crit_days","domains":[…]}
//   npm      {"ok":true,"certs":[{id,nice_name,domain_names,provider,expires,days,status}],
//             "warn_days","crit_days"}
//   domains  {"ok":true,"host_id","domains":[…],"warn_days","crit_days"}
//   run      {"ok":true,"data":…,"output":[…],"rc":int}
//   {"ok":false,"error":"NPM request failed"|"cert_monitor.sh not found"|"… timed out …"}
//
// DEPENDS ON
//   include/config.php    vv_detect_host(), vv_read_conf_raw(), STATE_DIR, SCRIPTS_DIR
//   include/auth.php      vv_npm_req()
//   Monitors/cert_monitor.sh   writes STATE_DIR/cert_status.json
// ═══════════════════════════════════════════════════════════════════════════════════════════════
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/config.php';
require_once dirname(__DIR__) . '/include/auth.php';

$action = ($_SERVER['REQUEST_METHOD'] === 'POST')
    ? trim($_POST['action'] ?? '')
    : trim($_GET['action'] ?? '');

$cacheFile = STATE_DIR . '/cert_status.json';

// ── Live NPM cert list ────────────────────────────────────────────────────────
if ($action === 'npm') {
    $raw = vv_npm_req('GET', '/api/nginx/certificates');
    if (!is_array($raw) || isset($raw['_err']))
        die(json_encode(['ok' => false, 'error' => $raw['_err'] ?? 'NPM request failed']));

    $master = vv_read_conf_raw('master.conf');
    preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
    preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
    $warn = (int)($w[1] ?? 30);
    $crit = (int)($c[1] ?? 7);
    $now  = time();

    $certs = [];
    foreach ($raw as $cert) {
        $exp    = !empty($cert['expires_on']) ? strtotime($cert['expires_on']) : false;
        $days   = $exp !== false ? (int)(($exp - $now) / 86400) : null;
        $status = $days === null ? 'UNKN'
                : ($days < 0    ? 'CRIT'
                : ($days <= $crit ? 'CRIT'
                : ($days <= $warn ? 'WARN' : 'OK')));
        $certs[] = [
            'id'          => $cert['id'],
            'nice_name'   => $cert['nice_name'] ?? implode(', ', $cert['domain_names'] ?? []),
            'domain_names'=> $cert['domain_names'] ?? [],
            'provider'    => $cert['provider'] ?? 'unknown',
            'expires'     => !empty($cert['expires_on']) ? substr($cert['expires_on'], 0, 10) : '',
            'days'        => $days,
            'status'      => $status,
        ];
    }
    usort($certs, fn($a, $b) => ($a['days'] ?? PHP_INT_MAX) <=> ($b['days'] ?? PHP_INT_MAX));

    echo json_encode(['ok' => true, 'certs' => $certs, 'warn_days' => $warn, 'crit_days' => $crit]);
    exit;
}

// ── Per-domain history, totals, and the DDNS containers ──────────────────────
// Read-only. Tools/cert_history.sh is what writes the store; serving it from here would mean the
// counters only advance when somebody happens to have the tab open.
if ($action === 'history') {
    $file = rtrim(defined('DB_DIR') ? DB_DIR : (DATA_DIR . '/db'), '/') . '/cert_history.json';
    $hist = is_file($file) ? (json_decode((string) @file_get_contents($file), true) ?: []) : [];
    $doms = is_array($hist['domains'] ?? null) ? $hist['domains'] : [];

    $now  = time();
    $rows = [];
    $tot  = ['tracked' => 0, 'active' => 0, 'retired' => 0, 'removed' => 0,
             'renewals' => 0, 'failures' => 0, 'checks' => 0, 'oldest' => null];

    foreach ($doms as $domain => $r) {
        $first   = (int) ($r['first_seen'] ?? $now);
        $retired = !empty($r['retired_at']);
        $removed = !empty($r['removed_at']);
        $rows[] = [
            'domain'    => (string) $domain,
            'first_seen'=> $first,
            'tracked'   => vv_cert_span_php($first, $now),
            'checks'    => (int) ($r['checks'] ?? 0),
            'renewals'  => (int) ($r['renewals'] ?? 0),
            'failures'  => (int) ($r['failures'] ?? 0),
            'strikes'   => (int) ($r['strikes'] ?? 0),
            'expires'   => $r['last_expiry'] ?? null,
            'last_renewal' => $r['last_renewal'] ?? null,
            'provider'  => $r['provider'] ?? null,
            'state'     => $removed ? 'removed' : ($retired ? 'retired' : 'active'),
        ];
        $tot['tracked']++;
        $tot[$removed ? 'removed' : ($retired ? 'retired' : 'active')]++;
        $tot['renewals'] += (int) ($r['renewals'] ?? 0);
        $tot['failures'] += (int) ($r['failures'] ?? 0);
        $tot['checks']   += (int) ($r['checks'] ?? 0);
        if ($tot['oldest'] === null || $first < $tot['oldest']) $tot['oldest'] = $first;
    }
    // Longest-tracked first: the domains with the most history are the ones the card is for.
    usort($rows, fn($a, $b) => $a['first_seen'] <=> $b['first_seen']);
    $tot['oldest_span'] = $tot['oldest'] ? vv_cert_span_php($tot['oldest'], $now) : '—';

    // DDNS is on this tab because it is the other half of the same story: a certificate is issued
    // against a name, and the name only points here while DDNS keeps it pointed. The ten dead
    // certificates removed on 2026-08-15 all failed with NXDOMAIN.
    $hostUp  = strtoupper(vv_detect_host());
    $names   = vv_parse_bash_array(vv_read_conf_raw(strtolower($hostUp) . '.conf'),
                                   $hostUp . '_DDNS_CONTAINERS');
    $running = [];
    foreach (vv_docker_containers() as $c) $running[$c['name']] = $c['status'];
    $ddns = [];
    foreach ($names as $n) {
        $n = trim((string) $n);
        if ($n === '') continue;
        $ddns[] = ['name' => $n,
                   'running' => isset($running[$n]),
                   'status'  => $running[$n] ?? 'not running'];
    }

    echo json_encode(['ok' => true, 'rows' => $rows, 'totals' => $tot, 'ddns' => $ddns,
                      'last_pass' => $hist['last_pass'] ?? null,
                      'strike_limit' => (int) (vv_conf_vars()['CERT_HISTORY_STRIKES'] ?? 5)]);
    exit;
}

// Same shape as the tool's own formatter — years, months and days, because "3 years 6 months and
// 22 days" is how the question gets asked and 1298 days is the same fact nobody thinks in.
function vv_cert_span_php(int $from, int $to): string {
    if ($to < $from) return '0d';
    $d = (new DateTime())->setTimestamp($from)->diff((new DateTime())->setTimestamp($to));
    $out = [];
    if ($d->y) $out[] = $d->y . 'y';
    if ($d->m) $out[] = $d->m . 'mo';
    if ($d->d || !$out) $out[] = $d->d . 'd';
    return implode(' ', $out);
}

// ── Read configured domains (without running checks) ─────────────────────────
if ($action === 'domains') {
    $hostId   = vv_detect_host();
    $hostIdUp = strtoupper($hostId);
    $confRaw  = ($hostId !== 'unknown') ? vv_read_conf_raw($hostId . '.conf') : '';
    $master   = vv_read_conf_raw('master.conf');

    // Extract CERT_WARN_DAYS / CERT_CRIT_DAYS from master
    preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
    preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);

    // Extract domains array from host conf
    $domains = [];
    if (preg_match('/' . $hostIdUp . '_CERT_MONITOR_DOMAINS\s*=\s*\(([^)]*)\)/s', $confRaw, $dm)) {
        preg_match_all('/"([^"]+)"/', $dm[1], $dd);
        $domains = $dd[1] ?? [];
    }

    echo json_encode([
        'ok'        => true,
        'host_id'   => $hostId,
        'domains'   => $domains,
        'warn_days' => (int)($w[1] ?? 30),
        'crit_days' => (int)($c[1] ?? 7),
    ]);
    exit;
}

// ── Run cert_monitor.sh now ───────────────────────────────────────────────────
if ($action === 'run') {
    // POST only. This executes a script, and Unraid's CSRF prepend validates POSTs while
    // ignoring GETs entirely — over GET it would run with no token check at all.
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        http_response_code(405);
        echo json_encode(['ok' => false, 'error' => 'POST only']);
        exit;
    }
    $script = SCRIPTS_DIR . '/Monitors/cert_monitor.sh';
    if (!file_exists($script)) {
        echo json_encode(['ok' => false, 'error' => 'cert_monitor.sh not found']);
        exit;
    }
    // set_time_limit() does not cover exec() time on Linux, so the bound has to be external —
    // cert_monitor.sh reaches out to every configured domain and one unreachable host would
    // otherwise hold a php-fpm worker open indefinitely.
    set_time_limit(210);
    exec('timeout 180 bash ' . escapeshellarg($script) . ' 2>&1', $out, $rc);
    if ($rc === 124) {
        echo json_encode(['ok' => false, 'error' => 'cert_monitor.sh timed out after 180s']);
        exit;
    }
    // Read freshly written cache
    $data = file_exists($cacheFile)
        ? (json_decode(file_get_contents($cacheFile), true) ?: null)
        : null;
    echo json_encode([
        'ok'     => true,
        'data'   => $data,
        'output' => array_slice(array_filter(array_map('trim', $out)), 0, 30),
        'rc'     => $rc,
    ]);
    exit;
}

// ── Default: return cached status ─────────────────────────────────────────────
if (!file_exists($cacheFile)) {
    // No cache yet — return configured domains so UI can show them unchecked
    $hostId   = vv_detect_host();
    $hostIdUp = strtoupper($hostId);
    $confRaw  = ($hostId !== 'unknown') ? vv_read_conf_raw($hostId . '.conf') : '';
    $master   = vv_read_conf_raw('master.conf');

    preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
    preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
    $domains = [];
    if (preg_match('/' . $hostIdUp . '_CERT_MONITOR_DOMAINS\s*=\s*\(([^)]*)\)/s', $confRaw, $dm)) {
        preg_match_all('/"([^"]+)"/', $dm[1], $dd);
        foreach ($dd[1] ?? [] as $d) {
            $domains[] = ['domain' => $d, 'status' => 'UNKN', 'days' => null, 'expires' => ''];
        }
    }

    echo json_encode([
        'ok'         => true,
        'checked_at' => null,
        'host'       => $hostId !== 'unknown' ? strtoupper($hostId) : null,
        'warn_days'  => (int)($w[1] ?? 30),
        'crit_days'  => (int)($c[1] ?? 7),
        'domains'    => $domains,
    ]);
    exit;
}

$data = json_decode(file_get_contents($cacheFile), true) ?: [];
echo json_encode(array_merge(['ok' => true], $data));