<?php
// ═══════════════════════════════════════════════════════════════════════════════════════════════
// PURPOSE
//   Raw conf read and write. Serves the full text of one configuration file and saves it
//   back, and — when the file is master.conf — distributes the result to every partner host.
//
// OPERATIONAL MODEL
//   Read and write on one URL, split on method, sharing one allowlist. GET also returns the
//   allowlist itself, so the editor can populate its file picker from the same authority that
//   will later authorise the save. The two can therefore never disagree about what this host
//   is permitted to edit.
//
//   master.conf is shared; host*.conf is not. A master.conf save is followed by a push to
//   every partner, because a threshold or toggle that differs between hosts produces
//   behaviour neither side expects. A host conf is local by definition and is never pushed.
//
// DESIGN PRINCIPLES
//   The allowlist encodes sparse checkout.
//       vv_get_conf_files() returns master.conf plus its own host conf on HOST1, and its own
//       conf alone elsewhere. That is the same split git enforces at checkout — HOST2 has no
//       host1.conf to read, and this endpoint will not name one either.
//
//   master.conf defaults on read, nothing defaults on write.
//       GET with no file returns master.conf, because that is what the editor opens to. POST
//       has no default: a save must name its target explicitly.
//
//   Push results travel with the response.
//       Per-host outcomes are returned rather than logged, so the page can show that a partner
//       did not receive the change instead of leaving the two hosts quietly divergent.
//
// OPERATIONAL SAFEGUARDS
//   Exact allowlist membership with strict comparison, on both paths.
//       in_array(..., true) against vv_get_conf_files() — not a pattern, not basename(). A
//       filename that is not literally one of the permitted strings is rejected, which makes
//       traversal and absolute paths unreachable rather than merely filtered. The redundant
//       '..' check is kept as a second, explicit statement of intent.
//
//   The content is syntax-checked before it can replace a working file.
//       Conf files are sourced by every script in the system, and master.conf is pushed from
//       here to every partner — so a stray quote saved through this endpoint would not just
//       break this host's orchestrators, watchdogs and fallback, it would distribute that
//       break across the mesh. `bash -n` on a private temp copy is checked first, and a file
//       that does not parse is refused with the previous version left untouched.
//
//   The temp copy is created with tempnam() and always removed, so a rejected save cannot
//   leave a stray file beside the real conf for a script to source.
//
//   The write goes through the one guarded conf path.
//       vv_conf_edit() takes an exclusive lock, copies the previous file into CONF_BACKUP_DIR,
//       re-checks the syntax, installs via .vv.tmp + rename() so a concurrent reader sees the
//       old file or the new one but never a half-written one, then sources the installed file
//       to prove it still loads and restores the backup if it does not. That backup matters
//       more here than anywhere else: this endpoint replaces a whole hand-edited file, and the
//       confs are gitignored, so before it existed a bad paste had nothing to go back to.
//
//   The push only happens after a confirmed write.
//       Guarded on $written, so a failed save cannot distribute a stale or partly-written
//       master.conf. The push is also a no-op on a host with no SSH key, which is what stops a
//       partner from overwriting the owner's file.
//
//   Unknown methods are refused explicitly, so a PUT or DELETE cannot fall through the two
//   handled blocks into an empty 200.
//
// REQUEST
//   GET  ?file=<allowed conf name>          defaults to master.conf
//   POST file=<allowed conf name>  content=<full file text>
//
// RESPONSE
//   GET   {"ok":true,"content":"…","file":"…","allowed":["…"]}
//   POST  {"ok":true,"push":[{"host","ok","ready","error"}, …]}
//         push is empty for host confs and on hosts with no partners
//   {"ok":false,"error":"Not allowed"|"Syntax error: …"|"Method not allowed"}
//
// DEPENDS ON
//   include/config.php     vv_get_conf_files(), vv_read_conf_raw(),
//                          vv_push_master_conf(), vv_push_setup_state()
//   include/confform.php   vv_conf_syntax_error(), vv_conf_edit()
// ═══════════════════════════════════════════════════════════════════════════════════════════════
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/config.php';
require_once dirname(__DIR__) . '/include/confform.php';

$allowed = vv_get_conf_files();

if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    $file = trim($_GET['file'] ?? 'master.conf');
    if (!in_array($file, $allowed, true) || str_contains($file, '..')) {
        echo json_encode(['ok' => false, 'error' => 'Not allowed']);
        exit;
    }
    echo json_encode(['ok' => true, 'content' => vv_read_conf_raw($file), 'file' => $file, 'allowed' => $allowed]);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $file    = trim($_POST['file'] ?? '');
    $content = $_POST['content'] ?? '';
    if (!in_array($file, $allowed, true) || str_contains($file, '..')) {
        echo json_encode(['ok' => false, 'error' => 'Not allowed']);
        exit;
    }
    // Every script sources these, and master.conf is pushed to every partner from here — a
    // syntax error saved through this endpoint would propagate the outage across the mesh.
    // Checked here as well as inside vv_conf_edit() so the editor can show bash's own complaint;
    // the write path only knows whether to proceed, not what to tell the person typing.
    $syntax = vv_conf_syntax_error($content, $file);
    if ($syntax !== null) {
        echo json_encode(['ok' => false, 'error' => 'Syntax error: ' . $syntax, 'push' => []]);
        exit;
    }

    $written = vv_conf_edit($file, fn() => $content, [], ['whole-file']);
    $push    = [];
    if ($written && $file === 'master.conf') {
        $push = vv_push_master_conf();
        vv_push_setup_state();
    }
    echo json_encode(['ok' => $written, 'push' => $push]);
    exit;
}

echo json_encode(['ok' => false, 'error' => 'Method not allowed']);