<?php
/**
 * Guided web installer for NestEggCode.
 *
 * Point your browser at this file (e.g. https://your-site/install.php) and it
 * walks you through creating config.php, testing the database, importing the
 * schema, and matching the URL settings. It is intentionally written in
 * conservative PHP so that even an out-of-date server can still load it and
 * show you a helpful "please upgrade PHP" message instead of a blank page.
 *
 * SECURITY: delete this file once the site works. The admin dashboard will
 * remind you and can delete it for you after you confirm the site is working.
 */

error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT & ~E_NOTICE);
@ini_set('display_errors', '1');

$ROOT         = __DIR__;
$CONFIG_PATH  = $ROOT . '/config.php';
$SCHEMA_PATH  = $ROOT . '/schema.sql';
$HTACCESS     = $ROOT . '/.htaccess';
$UPLOADS_DIR  = $ROOT . '/uploads';

// --------------------------------------------------------------------------
// Small helpers (kept PHP 5.4-compatible on purpose).
// --------------------------------------------------------------------------

function h($s) {
    return htmlspecialchars((string) $s, ENT_QUOTES, 'UTF-8');
}

/** Best guess at the URL prefix the app is served under, e.g. "" or "/pgh5". */
function detect_base_path() {
    $script = isset($_SERVER['SCRIPT_NAME']) ? $_SERVER['SCRIPT_NAME'] : '';
    $dir    = str_replace('\\', '/', dirname($script));
    $dir    = rtrim($dir, '/');
    return $dir === '' ? '' : $dir;
}

/** Best guess at the site's public origin, e.g. "https://code.example.com". */
function detect_site_url() {
    $https = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
        || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https')
        || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443);
    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
    $host = preg_replace('/[^A-Za-z0-9.\-:\[\]]/', '', $host);
    return $host === '' ? '' : (($https ? 'https' : 'http') . '://' . $host);
}

/** Turn a PHP shorthand size like "64M" into bytes (for display only). */
function human_bytes($bytes) {
    $units = array('B', 'KB', 'MB', 'GB');
    $i = 0;
    $n = (float) $bytes;
    while ($n >= 1024 && $i < count($units) - 1) { $n /= 1024; $i++; }
    return ($i === 0 ? $n : round($n, 1)) . ' ' . $units[$i];
}

// --------------------------------------------------------------------------
// Environment pre-flight checks. Each entry: label, ok, detail, fatal.
// --------------------------------------------------------------------------

function preflight_checks($configPath, $schemaPath, $uploadsDir) {
    $checks = array();

    $phpOk = version_compare(PHP_VERSION, '7.4.0', '>=');
    $checks[] = array(
        'label'  => 'PHP version 7.4 or newer',
        'ok'     => $phpOk,
        'detail' => $phpOk
            ? 'Running PHP ' . PHP_VERSION . '.'
            : 'You are on PHP ' . PHP_VERSION . '. Ask your host to switch the PHP '
              . 'version (in cPanel this is "Select PHP Version" / "MultiPHP Manager"), '
              . 'or update your local MAMP/XAMPP.',
        'fatal'  => true,
    );

    $pdo = extension_loaded('pdo_mysql');
    $checks[] = array(
        'label'  => 'PDO MySQL database driver',
        'ok'     => $pdo,
        'detail' => $pdo
            ? 'The pdo_mysql extension is enabled.'
            : 'The pdo_mysql extension is missing. Enable it in your PHP settings '
              . '(cPanel: "Select PHP Version" → tick "pdo_mysql"; MAMP usually has it on).',
        'fatal'  => true,
    );

    $canWriteConfig = file_exists($configPath) ? is_writable($configPath) : is_writable(dirname($configPath));
    $checks[] = array(
        'label'  => 'config.php can be written',
        'ok'     => $canWriteConfig,
        'detail' => $canWriteConfig
            ? (file_exists($configPath) ? 'config.php exists and is writable.' : 'The folder is writable, so config.php can be created.')
            : 'The web server cannot write to this folder. Set the folder\'s permissions to '
              . '755 (and config.php to 644) via your host\'s File Manager or FTP client.',
        'fatal'  => true,
    );

    $uploadsOk = is_dir($uploadsDir) ? is_writable($uploadsDir) : is_writable(dirname($uploadsDir));
    $checks[] = array(
        'label'  => 'uploads/ folder is writable',
        'ok'     => $uploadsOk,
        'detail' => $uploadsOk
            ? (is_dir($uploadsDir) ? 'uploads/ exists and is writable.' : 'uploads/ will be created during install.')
            : 'The uploads/ folder is not writable. Create a folder named "uploads" next to '
              . 'this file and set its permissions to 755.',
        'fatal'  => false,
    );

    $schemaOk = is_file($schemaPath) && is_readable($schemaPath);
    $checks[] = array(
        'label'  => 'schema.sql is present',
        'ok'     => $schemaOk,
        'detail' => $schemaOk
            ? 'Found schema.sql (the database table definitions).'
            : 'schema.sql is missing. Re-upload it from the project files — the installer '
              . 'needs it to create the database tables.',
        'fatal'  => false,
    );

    $zip = class_exists('ZipArchive');
    $checks[] = array(
        'label'  => 'Zip extension (optional)',
        'ok'     => $zip,
        'detail' => $zip
            ? 'Zip uploads will work.'
            : 'The zip extension is off. Everything works except "Upload a zip"; you can '
              . 'still upload files and folders. Enable php-zip later if you want it.',
        'fatal'  => false,
    );

    return $checks;
}

/** Build the contents of config.php from validated values. */
function build_config_php($v) {
    $x = function ($s) { return var_export($s, true); };
    $lines   = array();
    $lines[] = '<?php';
    $lines[] = '/**';
    $lines[] = ' * Application configuration. Generated by install.php on ' . date('Y-m-d H:i') . '.';
    $lines[] = ' *';
    $lines[] = ' * This file holds secrets (database password, admin password hash).';
    $lines[] = ' * Keep it OUT of version control and do not share it.';
    $lines[] = ' */';
    $lines[] = '';
    $lines[] = '// ---- Database (PDO / MySQL) -------------------------------------------------';
    $lines[] = "define('DB_HOST', "    . $x($v['db_host']) . ');';
    $lines[] = "define('DB_NAME', "    . $x($v['db_name']) . ');';
    $lines[] = "define('DB_USER', "    . $x($v['db_user']) . ');';
    $lines[] = "define('DB_PASS', "    . $x($v['db_pass']) . ');';
    $lines[] = "define('DB_CHARSET', " . $x('utf8mb4') . ');';
    $lines[] = '';
    $lines[] = '// ---- Admin credentials (single user) ---------------------------------------';
    $lines[] = '// The password is stored as a bcrypt hash, never in plaintext.';
    $lines[] = "define('ADMIN_USER', "      . $x($v['admin_user']) . ');';
    $lines[] = "define('ADMIN_PASS_HASH', " . $x($v['admin_hash']) . ');';
    $lines[] = '';
    $lines[] = '// ---- Paths / routing --------------------------------------------------------';
    $lines[] = '// BASE_PATH is the URL prefix the app is served under';
    $lines[] = "//   Local MAMP subfolder:  '/pgh5'";
    $lines[] = "//   Production domain root: ''";
    $lines[] = "define('BASE_PATH', " . $x($v['base_path']) . ');';
    $lines[] = '';
    $lines[] = '// Public origin of the site — scheme + host, no trailing slash, no BASE_PATH.';
    $lines[] = '// Used to build the absolute URLs that social-share metadata requires.';
    $lines[] = '// Detected during install; correct it here if the site moves.';
    $lines[] = "define('SITE_URL', " . $x(isset($v['site_url']) ? $v['site_url'] : '') . ');';
    $lines[] = '';
    $lines[] = '// Absolute filesystem path to the uploads directory (no trailing slash).';
    $lines[] = "define('UPLOAD_DIR', __DIR__ . '/uploads');";
    $lines[] = '';
    $lines[] = '// Max upload size per file, in bytes (also bounds each file inside a zip).';
    $lines[] = "define('MAX_FILE_SIZE', " . (int) $v['max_file'] . ' * 1024 * 1024); // MB';
    $lines[] = '';
    $lines[] = '// Ceiling on the total uncompressed size of a single zip import, in bytes.';
    $lines[] = "define('MAX_ZIP_TOTAL', " . (int) $v['max_zip'] . ' * 1024 * 1024); // MB';
    $lines[] = '';
    return implode("\n", $lines);
}

/** Translate a raw PDO error into plain-English advice. */
function friendly_db_error($e) {
    $msg  = $e->getMessage();
    $code = $e->getCode();
    if (stripos($msg, 'Access denied') !== false) {
        return 'The database refused the username or password. Double-check DB_USER and '
             . 'DB_PASS. On cPanel the username is usually your account name plus an '
             . 'underscore, like "myacct_code".';
    }
    if (stripos($msg, 'Unknown database') !== false) {
        return 'The database name was not found. Create the database first (cPanel → '
             . '"MySQL Databases"), or tick "Create the database if it does not exist" below '
             . 'if your user is allowed to create databases.';
    }
    if (stripos($msg, 'Connection refused') !== false || stripos($msg, "Can't connect") !== false || $code === 2002) {
        return 'Could not reach the database server at that host. Try "localhost" (most '
             . 'shared hosts and MAMP). If MAMP uses a custom port, use "127.0.0.1:8889".';
    }
    if (stripos($msg, 'getaddrinfo') !== false || stripos($msg, 'php_network_getaddresses') !== false) {
        return 'The database host name could not be resolved. Check DB_HOST for typos; it '
             . 'is usually "localhost".';
    }
    return 'Database error: ' . $msg;
}

// --------------------------------------------------------------------------
// Handle the install submission.
// --------------------------------------------------------------------------

$errors  = array();
$warnings = array();
$success = false;
$results = array();

// Sticky form values (also used to prefill on first load).
$f = array(
    'db_host'    => 'localhost',
    'db_name'    => '',
    'db_user'    => '',
    'db_pass'    => '',
    'admin_user' => '',
    'base_path'  => detect_base_path(),
    'max_file'   => 25,
    'max_zip'    => 200,
);

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['do_install'])) {
    foreach (array('db_host','db_name','db_user','db_pass','admin_user','base_path') as $k) {
        if (isset($_POST[$k])) { $f[$k] = trim($_POST[$k]); }
    }
    $f['max_file']  = isset($_POST['max_file']) ? max(1, (int) $_POST['max_file']) : 25;
    $f['max_zip']   = isset($_POST['max_zip'])  ? max(1, (int) $_POST['max_zip'])  : 200;
    $adminPass      = isset($_POST['admin_pass'])  ? (string) $_POST['admin_pass']  : '';
    $adminPass2     = isset($_POST['admin_pass2']) ? (string) $_POST['admin_pass2'] : '';
    $createDb       = !empty($_POST['create_db']);
    $importSchema   = !empty($_POST['import_schema']);

    // Normalise base path: ensure a single leading slash, no trailing slash, or ''.
    $bp = str_replace('\\', '/', $f['base_path']);
    $bp = '/' . trim($bp, '/');
    $f['base_path'] = ($bp === '/') ? '' : $bp;

    // ---- Field validation -------------------------------------------------
    if ($f['db_name'] === '')  { $errors[] = 'Database name is required.'; }
    if ($f['db_user'] === '')  { $errors[] = 'Database username is required.'; }
    if ($f['admin_user'] === '') { $errors[] = 'Admin username is required.'; }
    if (strlen($adminPass) < 8) {
        $errors[] = 'Admin password must be at least 8 characters. Pick something long and hard to guess.';
    } elseif ($adminPass !== $adminPass2) {
        $errors[] = 'The two admin passwords do not match. Re-type them carefully.';
    }

    // ---- Database connection & optional creation --------------------------
    $pdo = null;
    if (!$errors) {
        try {
            if ($createDb) {
                // Connect without a database, create it, then select it.
                $dsn = 'mysql:host=' . $f['db_host'] . ';charset=utf8mb4';
                $pdo = new PDO($dsn, $f['db_user'], $f['db_pass'], array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));
                $safe = str_replace('`', '', $f['db_name']);
                $pdo->exec('CREATE DATABASE IF NOT EXISTS `' . $safe . '` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci');
                $pdo->exec('USE `' . $safe . '`');
                $results[] = 'Database "' . h($f['db_name']) . '" is ready.';
            } else {
                $dsn = 'mysql:host=' . $f['db_host'] . ';dbname=' . $f['db_name'] . ';charset=utf8mb4';
                $pdo = new PDO($dsn, $f['db_user'], $f['db_pass'], array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));
                $results[] = 'Connected to the database successfully.';
            }
        } catch (PDOException $e) {
            $errors[] = friendly_db_error($e);
        }
    }

    // ---- Import the schema ------------------------------------------------
    if (!$errors && $pdo && $importSchema) {
        if (!is_file($SCHEMA_PATH)) {
            $errors[] = 'schema.sql is missing, so the tables could not be created. Re-upload it and try again.';
        } else {
            try {
                $sql   = file_get_contents($SCHEMA_PATH);
                $sql   = preg_replace('/^\s*--.*$/m', '', $sql); // strip comment lines
                $parts = array_filter(array_map('trim', explode(';', $sql)));
                foreach ($parts as $stmt) {
                    $pdo->exec($stmt);
                }
                $results[] = 'Database tables created (repositories, files, folders).';
            } catch (PDOException $e) {
                $errors[] = 'Could not create the tables: ' . h($e->getMessage())
                          . ' — you can also import schema.sql manually via phpMyAdmin.';
            }
        }
    }

    // ---- Write config.php -------------------------------------------------
    if (!$errors) {
        $vals = array(
            'db_host'    => $f['db_host'],
            'db_name'    => $f['db_name'],
            'db_user'    => $f['db_user'],
            'db_pass'    => $f['db_pass'],
            'admin_user' => $f['admin_user'],
            'admin_hash' => password_hash($adminPass, PASSWORD_DEFAULT),
            'base_path'  => $f['base_path'],
            'site_url'   => detect_site_url(),
            'max_file'   => $f['max_file'],
            'max_zip'    => $f['max_zip'],
        );
        $written = @file_put_contents($CONFIG_PATH, build_config_php($vals));
        if ($written === false) {
            $errors[] = 'Could not write config.php. Check the folder is writable (permissions 755) '
                      . 'and try again. Nothing else was changed.';
        } else {
            @chmod($CONFIG_PATH, 0644);
            $results[] = 'config.php written with your settings.';
        }
    }

    // ---- Make sure uploads/ exists ---------------------------------------
    if (!$errors) {
        if (!is_dir($UPLOADS_DIR)) {
            if (@mkdir($UPLOADS_DIR, 0755, true)) {
                $results[] = 'Created the uploads/ folder.';
            } else {
                $warnings[] = 'Could not create the uploads/ folder automatically. Create a folder '
                            . 'named "uploads" next to install.php (permissions 755) before uploading files.';
            }
        }
    }

    // ---- Best-effort: match .htaccess RewriteBase to BASE_PATH ------------
    if (!$errors && is_file($HTACCESS) && is_writable($HTACCESS)) {
        $ht = file_get_contents($HTACCESS);
        $rewriteBase = ($f['base_path'] === '') ? '/' : $f['base_path'] . '/';
        $newHt = preg_replace('/^(\s*RewriteBase\s+).*$/m', '${1}' . $rewriteBase, $ht, 1, $count);
        if ($count > 0 && $newHt !== null && $newHt !== $ht) {
            if (@file_put_contents($HTACCESS, $newHt) !== false) {
                $results[] = 'Updated .htaccess RewriteBase to "' . h($rewriteBase) . '".';
            } else {
                $warnings[] = 'Could not update .htaccess. If pretty URLs 404, set "RewriteBase '
                            . h($rewriteBase) . '" in .htaccess by hand.';
            }
        }
    } elseif (!$errors && is_file($HTACCESS)) {
        $rewriteBase = ($f['base_path'] === '') ? '/' : $f['base_path'] . '/';
        $warnings[] = '.htaccess is not writable, so its RewriteBase was left as-is. If pretty URLs '
                    . '404, set "RewriteBase ' . h($rewriteBase) . '" in .htaccess by hand.';
    }

    if (!$errors) {
        $success = true;
    }
}

// Public login / home URLs for the success screen.
$base       = $f['base_path'];
$loginUrl   = ($base === '' ? '' : $base) . '/admin/login.php';
$homeUrl    = ($base === '' ? '/' : $base . '/');
$checks     = preflight_checks($CONFIG_PATH, $SCHEMA_PATH, $UPLOADS_DIR);
$fatalBlock = false;
foreach ($checks as $c) { if ($c['fatal'] && !$c['ok']) { $fatalBlock = true; } }
$alreadyInstalled = is_file($CONFIG_PATH) && !$success;
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Install NestEggCode</title>
<style>
    :root { color-scheme: light dark; }
    * { box-sizing: border-box; }
    body {
        margin: 0; padding: 2rem 1rem;
        font: 15px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
        background: #f4f5f7; color: #1c1e21;
    }
    .wrap { max-width: 760px; margin: 0 auto; }
    .card {
        background: #fff; border: 1px solid #e2e4e8; border-radius: 12px;
        padding: 1.5rem 1.75rem; margin-bottom: 1.25rem;
        box-shadow: 0 1px 3px rgba(0,0,0,.05);
    }
    h1 { font-size: 1.6rem; margin: 0 0 .25rem; }
    h2 { font-size: 1.15rem; margin: 0 0 1rem; }
    .lede { color: #616a75; margin: 0 0 1.5rem; }
    label { display: block; margin: 0 0 1rem; font-weight: 600; }
    label .hint { display: block; font-weight: 400; color: #6b7280; font-size: .86rem; margin-top: .15rem; }
    input[type=text], input[type=password], input[type=number] {
        width: 100%; margin-top: .4rem; padding: .6rem .7rem; font-size: 1rem;
        border: 1px solid #c7ccd3; border-radius: 8px; background: #fff; color: inherit;
    }
    input:focus { outline: 2px solid #3b82f6; outline-offset: 1px; border-color: #3b82f6; }
    .row { display: flex; gap: 1rem; flex-wrap: wrap; }
    .row > label { flex: 1 1 200px; }
    .check-row { display: flex; gap: .6rem; align-items: flex-start; margin: 0 0 .9rem; font-weight: 400; }
    .check-row input { margin-top: .25rem; }
    button {
        font: inherit; font-weight: 600; cursor: pointer;
        background: #2563eb; color: #fff; border: 0; border-radius: 8px;
        padding: .7rem 1.4rem; font-size: 1rem;
    }
    button:hover { background: #1d4ed8; }
    ul.checks { list-style: none; padding: 0; margin: 0; }
    ul.checks li { display: flex; gap: .6rem; padding: .55rem 0; border-bottom: 1px solid #f0f1f3; }
    ul.checks li:last-child { border-bottom: 0; }
    .mark { flex: 0 0 1.3rem; font-weight: 700; }
    .ok    { color: #15803d; }
    .bad   { color: #b91c1c; }
    .warn  { color: #b45309; }
    .detail { color: #6b7280; font-size: .88rem; }
    .banner { padding: .9rem 1rem; border-radius: 8px; margin: 0 0 1rem; }
    .banner.err  { background: #fee2e2; border: 1px solid #fca5a5; color: #7f1d1d; }
    .banner.ok   { background: #dcfce7; border: 1px solid #86efac; color: #14532d; }
    .banner.warn { background: #fef3c7; border: 1px solid #fcd34d; color: #78350f; }
    .banner ul { margin: .4rem 0 0; padding-left: 1.2rem; }
    code { background: rgba(0,0,0,.06); padding: .1rem .35rem; border-radius: 5px; font-size: .9em; }
    ol.checklist { padding-left: 1.3rem; }
    ol.checklist li { margin: .5rem 0; }
    a.btn-link {
        display: inline-block; margin-top: .5rem; padding: .55rem 1rem; border-radius: 8px;
        background: #eef2ff; color: #1d4ed8; text-decoration: none; font-weight: 600;
    }
    a.btn-link:hover { background: #e0e7ff; }
    .muted { color: #6b7280; font-size: .9rem; }
    @media (prefers-color-scheme: dark) {
        body { background: #16181d; color: #e6e8eb; }
        .card { background: #1f2228; border-color: #2c3038; box-shadow: none; }
        .lede, .detail, .muted, label .hint { color: #9aa3ad; }
        input[type=text], input[type=password], input[type=number] { background: #14161a; border-color: #3a3f48; }
        code { background: rgba(255,255,255,.1); }
        ul.checks li { border-bottom-color: #262a31; }
        a.btn-link { background: #1e2740; color: #93c5fd; }
    }
</style>
</head>
<body>
<div class="wrap">

<?php if ($success): ?>

    <div class="card">
        <h1>&#127881; Installation complete</h1>
        <p class="lede">NestEggCode is set up. Here is what the installer did:</p>
        <div class="banner ok">
            <ul>
                <?php foreach ($results as $r): ?><li><?= $r /* already escaped where needed */ ?></li><?php endforeach; ?>
            </ul>
        </div>
        <?php if ($warnings): ?>
        <div class="banner warn">
            <strong>Heads-up:</strong>
            <ul><?php foreach ($warnings as $w): ?><li><?= $w ?></li><?php endforeach; ?></ul>
        </div>
        <?php endif; ?>
        <a class="btn-link" href="<?= h($loginUrl) ?>">Go to the admin login &rarr;</a>
        &nbsp;
        <a class="btn-link" href="<?= h($homeUrl) ?>">View the public site &rarr;</a>
    </div>

    <div class="card">
        <h2>&#9989; Post-launch checklist</h2>
        <p class="muted">Run through this to confirm everything works. Once it all checks out,
        delete <code>install.php</code> (the dashboard will offer to do this for you).</p>
        <ol class="checklist">
            <li><strong>Log in.</strong> Open the <a href="<?= h($loginUrl) ?>">admin login</a> and sign in
                with the username and password you just chose.</li>
            <li><strong>Create a repository.</strong> On the dashboard, add one (e.g. slug <code>demo</code>,
                name <code>Demo</code>). It should appear in the list.</li>
            <li><strong>Upload a file.</strong> Click <em>Upload</em>, drop in a small text or code file,
                and confirm it saves without an error.</li>
            <li><strong>Browse it publicly.</strong> Visit <a href="<?= h($homeUrl) ?>">the home page</a>,
                open your repo, and click the file — it should show with line numbers and highlighting.</li>
            <li><strong>Check a README renders.</strong> Upload a <code>README.md</code>; it should render
                as formatted text on the repo's front page (headings, code blocks, links).</li>
            <li><strong>Try Raw &amp; Download.</strong> On a file page, both buttons should work.</li>
            <li><strong>Confirm secrets are protected.</strong> Visit <code><?= h(($base === '' ? '' : $base)) ?>/config.php</code>
                directly — you should get a "Forbidden" error, not the file contents.</li>
            <li><strong>Delete this installer.</strong> Return to the dashboard and use the
                "Remove installer" prompt, or delete <code>install.php</code> via FTP/File Manager.</li>
        </ol>
        <p class="muted">Tip: also add <code>config.php</code>, <code>uploads/</code> and <code>*.zip</code>
        to a <code>.gitignore</code> before pushing this project anywhere public.</p>
    </div>

<?php else: ?>

    <div class="card">
        <h1>Install NestEggCode</h1>
        <p class="lede">This sets up your self-hosted code browser. Have your database name,
        username and password ready (create the database in your host's control panel first if you can).</p>

        <?php if ($errors): ?>
        <div class="banner err">
            <strong>Please fix the following, then submit again:</strong>
            <ul><?php foreach ($errors as $er): ?><li><?= $er ?></li><?php endforeach; ?></ul>
        </div>
        <?php endif; ?>

        <?php if ($alreadyInstalled): ?>
        <div class="banner warn">
            <strong>config.php already exists.</strong> This looks installed already. Submitting the form
            will <em>overwrite</em> config.php with new settings. If the site works, you can skip the
            installer and just delete this file instead.
        </div>
        <?php endif; ?>

        <h2>Server checks</h2>
        <ul class="checks">
            <?php foreach ($checks as $c): ?>
            <li>
                <span class="mark <?= $c['ok'] ? 'ok' : ($c['fatal'] ? 'bad' : 'warn') ?>">
                    <?= $c['ok'] ? '&#10003;' : ($c['fatal'] ? '&#10007;' : '!') ?>
                </span>
                <span>
                    <strong><?= h($c['label']) ?></strong><br>
                    <span class="detail"><?= h($c['detail']) ?></span>
                </span>
            </li>
            <?php endforeach; ?>
        </ul>
        <?php if ($fatalBlock): ?>
        <div class="banner err" style="margin-top:1rem">
            Fix the items marked <span class="bad">&#10007;</span> above before installing —
            the app cannot run until they pass.
        </div>
        <?php endif; ?>
    </div>

    <form method="post" autocomplete="off">
        <div class="card">
            <h2>Database</h2>
            <p class="muted" style="margin-top:-.5rem">On shared hosting, create the database and a user in your
            control panel (cPanel &rarr; "MySQL Databases"), then paste those exact values here.</p>
            <label>Database host
                <input type="text" name="db_host" value="<?= h($f['db_host']) ?>" placeholder="localhost">
                <span class="hint">Almost always <code>localhost</code>. MAMP with a custom port: <code>127.0.0.1:8889</code>.</span>
            </label>
            <div class="row">
                <label>Database name
                    <input type="text" name="db_name" value="<?= h($f['db_name']) ?>" required>
                </label>
                <label>Database username
                    <input type="text" name="db_user" value="<?= h($f['db_user']) ?>" required>
                </label>
            </div>
            <label>Database password
                <input type="password" name="db_pass" value="<?= h($f['db_pass']) ?>">
                <span class="hint">Leave blank only if your database truly has no password (rare in production).</span>
            </label>
            <div class="check-row">
                <input type="checkbox" name="create_db" id="create_db" value="1">
                <label for="create_db" style="margin:0">Create the database if it doesn't exist
                    <span class="hint">Works locally (MAMP). On shared hosting the database usually must exist already.</span>
                </label>
            </div>
            <div class="check-row">
                <input type="checkbox" name="import_schema" id="import_schema" value="1" checked>
                <label for="import_schema" style="margin:0">Create the tables now (import schema.sql)
                    <span class="hint">Leave checked for a fresh install. Uncheck if the tables already exist.</span>
                </label>
            </div>
        </div>

        <div class="card">
            <h2>Admin account</h2>
            <p class="muted" style="margin-top:-.5rem">The single login for managing repositories. The password is
            stored as a secure bcrypt hash — never in plain text.</p>
            <label>Admin username
                <input type="text" name="admin_user" value="<?= h($f['admin_user']) ?>" required>
            </label>
            <div class="row">
                <label>Admin password
                    <input type="password" name="admin_pass" required>
                    <span class="hint">At least 8 characters. Longer is better.</span>
                </label>
                <label>Confirm password
                    <input type="password" name="admin_pass2" required>
                </label>
            </div>
        </div>

        <div class="card">
            <h2>Site settings</h2>
            <label>Base path (URL prefix)
                <input type="text" name="base_path" value="<?= h($f['base_path']) ?>" placeholder="(blank for a domain root)">
                <span class="hint">Auto-detected. Blank for <code>https://yoursite.com/</code>; use
                <code>/pgh5</code> for <code>https://yoursite.com/pgh5/</code>.</span>
            </label>
            <div class="row">
                <label>Max file size (MB)
                    <input type="number" name="max_file" min="1" value="<?= h($f['max_file']) ?>">
                </label>
                <label>Max zip total (MB)
                    <input type="number" name="max_zip" min="1" value="<?= h($f['max_zip']) ?>">
                    <span class="hint">Uncompressed size limit for a single zip import.</span>
                </label>
            </div>
            <p class="muted">Your server also caps uploads via PHP settings
            (<code>upload_max_filesize</code> is currently <?= h(human_bytes(return_bytes(ini_get('upload_max_filesize')))) ?>,
            <code>post_max_size</code> <?= h(human_bytes(return_bytes(ini_get('post_max_size')))) ?>). Raise those in
            <code>.user.ini</code> or <code>php.ini</code> if you need bigger uploads.</p>
        </div>

        <div class="card">
            <button type="submit" name="do_install" value="1"<?= $fatalBlock ? ' disabled' : '' ?>>Install NestEggCode</button>
            <?php if ($fatalBlock): ?>
                <p class="muted" style="margin-top:.6rem">Resolve the failed server checks above to enable this button.</p>
            <?php endif; ?>
        </div>
    </form>

<?php endif; ?>

    <p class="muted" style="text-align:center">NestEggCode installer &middot; delete <code>install.php</code> when you're done.</p>
</div>
</body>
</html>
<?php
/** Convert a PHP ini size shorthand (e.g. "64M") to bytes. Defined last; PHP hoists it. */
function return_bytes($val) {
    $val  = trim((string) $val);
    if ($val === '') { return 0; }
    $unit = strtolower($val[strlen($val) - 1]);
    $num  = (int) $val;
    switch ($unit) {
        case 'g': $num *= 1024; // fall through
        case 'm': $num *= 1024; // fall through
        case 'k': $num *= 1024;
    }
    return $num;
}