<?php
// ============================================================
//  EFB Technology — Lead Form AJAX Handler
//  File: submit_lead.php  (place in same folder as index.php)
// ============================================================

header('Content-Type: application/json; charset=utf-8');
header('X-Content-Type-Options: nosniff');

// ── Allow only POST ──────────────────────────────────────────
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['success' => false, 'message' => 'Method not allowed.']);
    exit;
}

// ── CORS: restrict to same origin in production ──────────────
$allowed_origin = 'https://efbtechnology.com'; // ← change to your domain
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if (!empty($origin) && $origin !== $allowed_origin) {
    // Comment out the two lines below if you're on a local/dev server
    // http_response_code(403);
    // echo json_encode(['success' => false, 'message' => 'Forbidden.']); exit;
}

require_once __DIR__ . '/config/db.php';

// ── Sanitise & Validate Input ────────────────────────────────
function clean(string $val): string {
    return htmlspecialchars(strip_tags(trim($val)), ENT_QUOTES, 'UTF-8');
}

$name     = clean($_POST['name']     ?? '');
$phone    = clean($_POST['phone']    ?? '');
$email    = filter_var(trim($_POST['email'] ?? ''), FILTER_SANITIZE_EMAIL);
$business = clean($_POST['business'] ?? '');
$plan     = clean($_POST['plan']     ?? '');
$message  = clean($_POST['message']  ?? '');

// UTM parameters (from Google Ads)
$utm_source   = clean($_POST['utm_source']   ?? '');
$utm_medium   = clean($_POST['utm_medium']   ?? '');
$utm_campaign = clean($_POST['utm_campaign'] ?? '');
$utm_term     = clean($_POST['utm_term']     ?? '');

// ── Required field validation ────────────────────────────────
$errors = [];
if (empty($name))                              $errors[] = 'Name is required.';
if (empty($phone))                             $errors[] = 'Phone is required.';
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = 'Valid email is required.';

// Phone: allow +91 prefix or plain 10 digits
if (!empty($phone) && !preg_match('/^(\+91[\s\-]?)?[6-9]\d{9}$/', preg_replace('/\s+/', '', $phone))) {
    $errors[] = 'Please enter a valid Indian mobile number.';
}

// Plan whitelist
$validPlans = ['basic', 'standard', 'premium', 'custom', ''];
if (!in_array($plan, $validPlans, true)) {
    $plan = '';
}

if (!empty($errors)) {
    http_response_code(422);
    echo json_encode(['success' => false, 'message' => implode(' ', $errors)]);
    exit;
}

// ── Rate limiting: max 3 submissions per IP per hour ─────────
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'] ?? 'unknown';
$ip = trim(explode(',', $ip)[0]); // take first IP if behind proxy

try {
    $pdo = getDB();

    $rateStmt = $pdo->prepare(
        "SELECT COUNT(*) FROM leads
         WHERE ip_address = :ip AND created_at > NOW() - INTERVAL 1 HOUR"
    );
    $rateStmt->execute([':ip' => $ip]);
    if ((int)$rateStmt->fetchColumn() >= 5) {
        http_response_code(429);
        echo json_encode(['success' => false, 'message' => 'Too many submissions. Please try again later.']);
        exit;
    }

    // ── Insert lead ──────────────────────────────────────────
    $stmt = $pdo->prepare("
        INSERT INTO leads
            (name, phone, email, business, plan, message,
             ip_address, utm_source, utm_medium, utm_campaign, utm_term)
        VALUES
            (:name, :phone, :email, :business, :plan, :message,
             :ip, :utm_source, :utm_medium, :utm_campaign, :utm_term)
    ");

    $stmt->execute([
        ':name'         => $name,
        ':phone'        => $phone,
        ':email'        => $email,
        ':business'     => $business,
        ':plan'         => $plan,
        ':message'      => $message,
        ':ip'           => $ip,
        ':utm_source'   => $utm_source,
        ':utm_medium'   => $utm_medium,
        ':utm_campaign' => $utm_campaign,
        ':utm_term'     => $utm_term,
    ]);

    $leadId = $pdo->lastInsertId();

    // ── Optional: send email notification ───────────────────
    sendAdminNotification($name, $phone, $email, $business, $plan, $leadId);

    echo json_encode([
        'success' => true,
        'message' => 'Thank you! We will contact you within 2 hours.',
        'lead_id' => (int)$leadId
    ]);

} catch (PDOException $e) {
    http_response_code(500);
    // Log the real error server-side, never expose to client
    error_log('[EFB Lead Error] ' . $e->getMessage());
    echo json_encode(['success' => false, 'message' => 'Server error. Please try again or WhatsApp us.']);
}

// ── Admin email notification ─────────────────────────────────
function sendAdminNotification(
    string $name, string $phone, string $email,
    string $business, string $plan, int $leadId
): void {
    $adminEmail = 'info@efbtechnology.com'; // ← your notification email
    $subject    = "New Lead #{$leadId} — {$name} ({$plan})";
    $body       = "New enquiry received on EFB Technology landing page.\n\n"
                . "Lead ID : #{$leadId}\n"
                . "Name    : {$name}\n"
                . "Phone   : {$phone}\n"
                . "Email   : {$email}\n"
                . "Business: {$business}\n"
                . "Plan    : {$plan}\n\n"
                . "Login to admin panel to view full details.";

    $headers  = "From: info@efbtechnology.com\r\n";
    $headers .= "Reply-To: {$email}\r\n";
    $headers .= "X-Mailer: PHP/" . phpversion();

    @mail($adminEmail, $subject, $body, $headers);
}