<?php
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/scheduler.php';

$id = trim($_POST['id'] ?? '');

if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
    echo json_encode(['ok' => false, 'error' => 'Invalid id']);
    exit;
}

$script = SCRIPTS_DIR . '/' . $id;
if (!file_exists($script)) {
    echo json_encode(['ok' => false, 'error' => 'Script not found: ' . $id]);
    exit;
}

$logFile = vv_job_log_path($id);
$logDir  = dirname($logFile);
if (!is_dir($logDir)) mkdir($logDir, 0755, true);

$location = trim($_POST['location'] ?? '');
if ($location && (!str_starts_with($location, '/') || str_contains($location, '..') || preg_match('/[\x00\n\r]/', $location))) {
    echo json_encode(['ok' => false, 'error' => 'Invalid location']);
    exit;
}

$extra_args = trim($_POST['extra_args'] ?? '');
if ($extra_args && preg_match('/[;&|`$<>\\\\"\']/', $extra_args)) {
    echo json_encode(['ok' => false, 'error' => 'Invalid extra_args']);
    exit;
}

// Refuse if already running — scripts will lock-exit anyway, but surface it clearly.
$statFile = vv_job_stat_path($id);
if (file_exists($statFile)) {
    $stat   = json_decode(file_get_contents($statFile), true) ?: [];
    $pid    = $stat['pid'] ?? null;
    $status = $stat['status'] ?? '';
    if ($status === 'running' && $pid && file_exists("/proc/{$pid}")) {
        echo json_encode(['ok' => false, 'already_running' => true, 'error' => 'Already running']);
        exit;
    }
}

$runner   = dirname(__DIR__) . '/run_job.sh';
$flags    = vv_job_flags($id);
$locArg   = $location   ? ' ' . escapeshellarg('--location=' . $location) : '';
$extraStr = $extra_args ? ' ' . $extra_args : '';
exec('nohup bash ' . escapeshellarg($runner) . ' ' . escapeshellarg($id) . ' ' . escapeshellarg($script) . ($flags ? " $flags" : '') . ' --manual' . $locArg . $extraStr . ' >> ' . escapeshellarg($logFile) . ' 2>&1 </dev/null &');

echo json_encode(['ok' => true]);