<?php

// JSON endpoint: proxy swatch searches to filamentcolors.xyz (their API has no

// CORS headers, so the browser can't call it directly) with a local cache.

require_once __DIR__ . '/inc/auth.php';

header('Content-Type: application/json');

header('Cache-Control: no-store');

if (!is_logged_in()) {

    http_response_code(401);

    echo '{"error":"unauthorized"}';

    exit;

}

function fc_fetch(string $url): ?array

{

    if (function_exists('curl_init')) {

        $ch = curl_init($url);

        curl_setopt_array($ch, [

            CURLOPT_RETURNTRANSFER => true,

            CURLOPT_CONNECTTIMEOUT => 4,

            CURLOPT_TIMEOUT        => 6,

            CURLOPT_FOLLOWLOCATION => true,

            CURLOPT_MAXREDIRS      => 2,

            CURLOPT_USERAGENT      => 'autofeed-spool-tracker/1.0',

        ]);

        $body = curl_exec($ch);

        $code = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

        curl_close($ch);

        if ($body === false || $code !== 200) {

            return null;

        }

    } else {

        $ctx = stream_context_create(['http' => [

            'timeout' => 6,

            'header'  => "User-Agent: autofeed-spool-tracker/1.0\r\n",

        ]]);

        $body = @file_get_contents($url, false, $ctx);

        if ($body === false) {

            return null;

        }

    }

    $data = json_decode($body, true);

    return is_array($data) ? $data : null;

}

// Search their swatch library; returns rows for the form or null when unreachable.

function fc_search(string $q, string $brand): ?array

{

    $params = ['page_size' => 10, 'color_name__icontains' => $q];

    if ($brand !== '') {

        $params['manufacturer__name__icontains'] = $brand;

    }

    $data = fc_fetch('https://filamentcolors.xyz/api/swatch/?' . http_build_query($params));

    if ($data === null) {

        return null;

    }

    $out = [];

    foreach ($data['results'] ?? [] as $s) {

        $hex = strtolower((string)($s['hex_color'] ?? ''));

        $out[] = [

            'type'       => (string)($s['filament_type']['name'] ?? ''),

            'brand'      => (string)($s['manufacturer']['name'] ?? ''),

            'color_name' => (string)($s['color_name'] ?? ''),

            'hex'        => preg_match('/^[0-9a-f]{6}$/', $hex) ? '#' . $hex : null,

        ];

    }

    return $out;

}

$q     = trim((string)($_GET['q'] ?? ''));

$brand = trim((string)($_GET['brand'] ?? ''));

if (strlen($q) < 2) {

    echo '[]';

    exit;

}

$key = strtolower($q) . '|' . strtolower($brand);

$st = db()->prepare("SELECT json FROM api_cache WHERE key = ? AND fetched_at > datetime('now', '-7 days')");

$st->execute([$key]);

$hit = $st->fetchColumn();

if ($hit !== false) {

    echo $hit;

    exit;

}

$results = fc_search($q, $brand);

if ($results !== null && !$results && $brand !== '') {

    // The locally entered brand may be spelled differently from theirs

    // (e.g. "Prusa" vs "Prusament"): retry on color name alone.

    $results = fc_search($q, '');

}

if ($results === null) {

    // Upstream unreachable: an expired cache entry beats nothing.

    $st = db()->prepare('SELECT json FROM api_cache WHERE key = ?');

    $st->execute([$key]);

    $old = $st->fetchColumn();

    echo $old !== false ? $old : '[]';

    exit;

}

$json = json_encode($results, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);

// INSERT OR REPLACE re-inserts the row, so fetched_at picks up its default.

db()->prepare('INSERT OR REPLACE INTO api_cache (key, json) VALUES (?, ?)')->execute([$key, $json]);

db()->exec("DELETE FROM api_cache WHERE fetched_at < datetime('now', '-30 days')");

echo $json;