<?php
/**
 * Beispiel-Endpunkt für key.luetcke.eu
 *
 * CMS-Standard-URL: https://key.luetcke.eu/api/validate  (per Rewrite auf diese Datei zeigen)
 *
 * Erwartet: POST, Content-Type: application/json
 * Body:     { "license_key": "…", "domain": "…" }
 * Antwort:  HTTP 200, { "valid": true } oder { "valid": false, "message": "…" }
 */

declare(strict_types=1);

header('Content-Type: application/json; charset=UTF-8');

if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
    http_response_code(405);
    echo json_encode(['valid' => false, 'message' => 'Method not allowed'], JSON_UNESCAPED_UNICODE);

    exit;
}

$raw = file_get_contents('php://input');
$data = json_decode($raw === false ? '' : $raw, true);
if (! is_array($data)) {
    http_response_code(400);
    echo json_encode(['valid' => false, 'message' => 'Invalid JSON'], JSON_UNESCAPED_UNICODE);

    exit;
}

$licenseKey = trim((string) ($data['license_key'] ?? ''));
$domain = strtolower(trim((string) ($data['domain'] ?? '')));

/*
 * Hier deine echte Logik: Datenbank, JSON-Datei o. Ä.
 * Domains exakt wie das CMS sendet (ohne Port): localhost, 127.0.0.1, www.example.de, …
 *
 * Beispiel localhost (gleicher Key wie public/dev-license-validate.php zum lokalen Testen):
 */
$licenses = [
    'LOCALHOST-DEV-KEY' => ['localhost', '127.0.0.1', '::1', '[::1]'],
    // 'DEIN-SCHLUESSEL-STRING' => ['localhost', '127.0.0.1', 'kunde.de', 'www.kunde.de'],
];

if ($licenseKey === '' || $domain === '') {
    echo json_encode(['valid' => false, 'message' => 'license_key or domain missing'], JSON_UNESCAPED_UNICODE);

    exit;
}

if (! isset($licenses[$licenseKey])) {
    echo json_encode(['valid' => false, 'message' => 'Unknown license key'], JSON_UNESCAPED_UNICODE);

    exit;
}

$allowedDomains = $licenses[$licenseKey];
if (! in_array($domain, $allowedDomains, true)) {
    echo json_encode(['valid' => false, 'message' => 'Domain not allowed for this key'], JSON_UNESCAPED_UNICODE);

    exit;
}

echo json_encode(['valid' => true], JSON_UNESCAPED_UNICODE);
