<?php
/**
 * BOMCAS Canada — Contact Form Handler
 * Sends to: info@bomcas.ca (primary, visible on site)
 * BCC:      bomcasltd@gmail.com (hidden, never shown on site)
 *
 * Spam Protection: Cloudflare Turnstile (server-side verification)
 */
header('Content-Type: application/json');
header('X-Content-Type-Options: nosniff');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['success' => false, 'message' => 'Method not allowed.']);
    exit;
}

// ── Honeypot check (always active — catches basic bots) ──────────────────────
if (!empty($_POST['website'])) {
    // Silent success — don't tell bots they were blocked
    echo json_encode(['success' => true]);
    exit;
}

// ── Cloudflare Turnstile server-side verification ────────────────────────────
$TURNSTILE_SECRET = '0x4AAAAAACDK4JSuuqzVRbEWHzjZp-nGJl4';

$turnstile_token = trim($_POST['cf-turnstile-response'] ?? '');

if (!empty($TURNSTILE_SECRET)) {
    if (empty($turnstile_token)) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'Security verification failed. Please refresh and try again.']);
        exit;
    }

    // Verify token with Cloudflare API
    $verify_url  = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
    $verify_data = http_build_query([
        'secret'   => $TURNSTILE_SECRET,
        'response' => $turnstile_token,
        'remoteip' => $_SERVER['REMOTE_ADDR'] ?? ''
    ]);

    $context = stream_context_create([
        'http' => [
            'method'  => 'POST',
            'header'  => "Content-Type: application/x-www-form-urlencoded\r\n",
            'content' => $verify_data,
            'timeout' => 10
        ]
    ]);

    $verify_result = @file_get_contents($verify_url, false, $context);
    $verify_json   = $verify_result ? json_decode($verify_result, true) : null;

    if (!$verify_json || !($verify_json['success'] ?? false)) {
        http_response_code(403);
        $error_codes = implode(', ', $verify_json['error-codes'] ?? ['unknown']);
        error_log('[BOMCAS Turnstile] Verification failed: ' . $error_codes . ' | IP: ' . ($_SERVER['REMOTE_ADDR'] ?? 'unknown'));
        echo json_encode(['success' => false, 'message' => 'Security verification failed. Please refresh the page and try again.']);
        exit;
    }
}

// ── Rate limiting (5 submissions per hour per IP) ────────────────────────────
$rate_limit_file = sys_get_temp_dir() . '/bomcas_rl_' . md5($_SERVER['REMOTE_ADDR'] ?? 'unknown') . '.json';
$now = time();
$rate_data = file_exists($rate_limit_file) ? json_decode(file_get_contents($rate_limit_file), true) : ['count' => 0, 'window_start' => $now];
if (($now - $rate_data['window_start']) > 3600) {
    $rate_data = ['count' => 0, 'window_start' => $now];
}
$rate_data['count']++;
file_put_contents($rate_limit_file, json_encode($rate_data));
if ($rate_data['count'] > 5) {
    http_response_code(429);
    echo json_encode(['success' => false, 'message' => 'Too many submissions. Please wait an hour before trying again.']);
    exit;
}

// Sanitize inputs
function clean($val) {
    return htmlspecialchars(strip_tags(trim($val)), ENT_QUOTES, 'UTF-8');
}

$name    = clean($_POST['name']    ?? '');
$email   = filter_var(trim($_POST['email'] ?? ''), FILTER_VALIDATE_EMAIL);
$phone   = clean($_POST['phone']   ?? '');
$service = clean($_POST['service'] ?? '');
$message = clean($_POST['message'] ?? '');
$city    = clean($_POST['city']    ?? '');

// Validate required fields
if (!$name || !$email || !$message) {
    echo json_encode(['success' => false, 'message' => 'Please fill in all required fields.']);
    exit;
}

// Email addresses
$to_primary = 'info@bomcas.ca';
$bcc_hidden  = 'bomcasltd@gmail.com';

$subject = 'New Contact Form Submission — BOMCAS Canada';
if ($service) {
    $subject = 'Inquiry: ' . $service . ' — BOMCAS Canada';
}

$body  = "New contact form submission from the BOMCAS Canada website.\n\n";
$body .= "-------------------------------------------\n";
$body .= "Name:    " . $name    . "\n";
$body .= "Email:   " . $email   . "\n";
if ($phone)   $body .= "Phone:   " . $phone   . "\n";
if ($city)    $body .= "City:    " . $city    . "\n";
if ($service) $body .= "Service: " . $service . "\n";
$body .= "-------------------------------------------\n\n";
$body .= "Message:\n" . $message . "\n\n";
$body .= "-------------------------------------------\n";
$body .= "Submitted: " . date('Y-m-d H:i:s T') . "\n";
$body .= "IP: " . ($_SERVER['REMOTE_ADDR'] ?? 'unknown') . "\n";

$headers  = "From: BOMCAS Canada Website <no-reply@bomcas.ca>\r\n";
$headers .= "Reply-To: " . $name . " <" . $email . ">\r\n";
$headers .= "Bcc: " . $bcc_hidden . "\r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/plain; charset=UTF-8\r\n";
$headers .= "X-Mailer: BOMCAS-Contact-Form/2.0\r\n";

$sent = mail($to_primary, $subject, $body, $headers);

if ($sent) {
    echo json_encode(['success' => true, 'message' => 'Thank you! Your message has been sent. We will contact you within 24 hours.']);
} else {
    http_response_code(500);
    echo json_encode(['success' => false, 'message' => 'Mail delivery failed. Please call us at 780-667-5250 or email info@bomcas.ca directly.']);
}