<?php
/**
 * Kautuki — early-access lead capture
 * Validates the form, appends to a CSV, and emails the team.
 * Works on standard cPanel PHP hosting (Hostycare). No dependencies.
 *
 * The notification goes out via Google Workspace SMTP when api/config.php
 * exists on the server (see api/config.example.php); otherwise it falls back
 * to PHP mail(), which is unsigned and lands in junk.
 *
 * ── Configure these two lines ──────────────────────────────────────────── */
$NOTIFY_TO   = 'shubhamgupta926@gmail.com';   // where new leads are emailed
$FROM_HEADER = 'Kautuki <no-reply@kautuki.co.in>'; // mail() fallback only; SMTP uses config.php 'from'
/* ──────────────────────────────────────────────────────────────────────── */

header('Content-Type: application/json; charset=utf-8');

// Only accept POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['ok' => false, 'error' => 'method_not_allowed']);
    exit;
}

/* ── Read & sanitise input ── */
function field($k) { return isset($_POST[$k]) ? trim((string)$_POST[$k]) : ''; }

$name    = field('name');
$phone   = preg_replace('/\D/', '', field('phone'));
$email   = field('email');
$roleIn  = field('role');
$role    = in_array($roleIn, ['student', 'parent', 'teacher', 'school'], true) ? $roleIn : 'student';
$consent = field('consent');
$hp      = field('company'); // honeypot (should stay empty)

/* ── Validate ── */
$errors = [];
if (mb_strlen($name) < 2)                       $errors[] = 'name';
if (!preg_match('/^[6-9]\d{9}$/', $phone))       $errors[] = 'phone';
if ($email !== '' && !filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = 'email';
if ($consent === '' || $consent === '0' || $consent === 'false') $errors[] = 'consent';

// Silently drop bots that filled the honeypot (pretend success)
if ($hp !== '') { echo json_encode(['ok' => true]); exit; }

if ($errors) {
    http_response_code(422);
    echo json_encode(['ok' => false, 'error' => 'validation', 'fields' => $errors]);
    exit;
}

/* ── Persist to CSV (append) ── */
$ts   = date('Y-m-d H:i:s');
$ip   = $_SERVER['REMOTE_ADDR'] ?? '';
$ua   = substr($_SERVER['HTTP_USER_AGENT'] ?? '', 0, 200);
$row  = [$ts, $name, '+91' . $phone, $email, $role, $ip, $ua];

$dir  = __DIR__ . '/../leads';
if (!is_dir($dir)) { @mkdir($dir, 0755, true); }
$csv  = $dir . '/leads.csv';

$new  = !file_exists($csv);
if ($fh = @fopen($csv, 'a')) {
    if ($new) {
        // protect the file from web access if .htaccess isn't picked up
        fputcsv($fh, ['timestamp', 'name', 'phone', 'email', 'role', 'ip', 'user_agent']);
    }
    fputcsv($fh, $row);
    fclose($fh);
}

/* ── Email the team (best-effort) ── */
$subject = 'New Kautuki early-access lead — ' . $name . ' (' . $role . ')';
$body =
    "New early-access signup on kautuki.co.in\n\n" .
    "Name:   $name\n" .
    "Phone:  +91 $phone\n" .
    "Email:  " . ($email !== '' ? $email : '—') . "\n" .
    "Role:   $role\n" .
    "Time:   $ts\n" .
    "IP:     $ip\n";

$smtpCfg = is_file(__DIR__ . '/config.php') ? (include __DIR__ . '/config.php') : null;

if (is_array($smtpCfg) && !empty($smtpCfg['user']) && !empty($smtpCfg['pass'])) {
    // Preferred: authenticated Google Workspace SMTP (SPF + DKIM + DMARC all pass).
    require_once __DIR__ . '/mail.php';
    kautuki_smtp_send($smtpCfg, $NOTIFY_TO, $subject, $body, $email);
} else {
    // Fallback: local mail() from the Hostycare box — deliverable but likely junked.
    $headers  = "From: $FROM_HEADER\r\n";
    $headers .= "Reply-To: " . ($email !== '' ? $email : $FROM_HEADER) . "\r\n";
    $headers .= "Content-Type: text/plain; charset=utf-8\r\n";
    $headers .= "X-Mailer: Kautuki-Site\r\n";
    @mail($NOTIFY_TO, $subject, $body, $headers);
}

/* Always report success to the user once the lead is safely stored. */
echo json_encode(['ok' => true]);