<?php



/**

 * Nur für lokale Entwicklung (localhost / 127.0.0.1).

 * In Produktion diese Datei nicht auf den öffentlichen Server legen bzw. löschen.

 *

 * .env:

 *   CMS_LICENSE_KEY=LOCALHOST-DEV-KEY

 *   CMS_LICENSE_VALIDATE_URL=http://localhost/PFAD-ZU/public/dev-license-validate.php

 * (URL an XAMPP-Unterordner oder „php artisan serve“ anpassen)

 */



declare(strict_types=1);



header('Content-Type: application/json; charset=UTF-8');



if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {

    http_response_code(405);

    echo json_encode(['valid' => false, 'message' => 'Method not allowed'], JSON_UNESCAPED_UNICODE);

    exit;

}



$raw = file_get_contents('php://input');

$data = json_decode($raw === false ? '' : $raw, true);

if (! is_array($data)) {

    http_response_code(400);

    echo json_encode(['valid' => false, 'message' => 'Invalid JSON'], JSON_UNESCAPED_UNICODE);

    exit;

}



$licenseKey = trim((string) ($data['license_key'] ?? ''));

$domain = strtolower(trim((string) ($data['domain'] ?? '')));



/** Muss derselbe Wert wie CMS_LICENSE_KEY in der lokalen .env sein */

const LOCAL_DEV_LICENSE_KEY = 'LOCALHOST-DEV-KEY';



$localDomains = ['localhost', '127.0.0.1', '[::1]', '::1'];



if ($licenseKey === '' || $domain === '') {

    echo json_encode(['valid' => false, 'message' => 'license_key or domain missing'], JSON_UNESCAPED_UNICODE);

    exit;

}



if ($licenseKey !== LOCAL_DEV_LICENSE_KEY) {

    echo json_encode(['valid' => false, 'message' => 'Invalid key for local dev'], JSON_UNESCAPED_UNICODE);

    exit;

}



if (! in_array($domain, $localDomains, true)) {

    echo json_encode(['valid' => false, 'message' => 'Only localhost domains allowed here'], JSON_UNESCAPED_UNICODE);

    exit;

}



echo json_encode(['valid' => true], JSON_UNESCAPED_UNICODE);

