<?php
/**
 * This is a stray, out-of-date duplicate of the real front controller
 * (the canonical one is the root /index.php — .htaccess rewrites every
 * non-existent path there). Because it's a real file on disk, Apache can
 * serve it directly on a request for /traderalign/public/, bypassing the
 * real router's security headers, rate limiting, and full route table,
 * and using its own weaker session-cookie config (missing 'secure').
 * Neutralized to a hard redirect rather than left live, so it can't run
 * as a second, weaker, out-of-sync auth entry point. Not deleted, so the
 * history below stays visible if anyone needs to compare it later.
 */
header('Location: /traderalign/', true, 302);
exit;

require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../src/ScopedDb.php';
require_once __DIR__ . '/../src/Auth.php';

// Session
if (session_status() === PHP_SESSION_NONE) {
    session_name(SESSION_NAME);
    session_set_cookie_params([
        'lifetime' => SESSION_LIFETIME,
        'path' => '/',
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
    session_start();
}

// Database
try {
    $dsn = "mysql:host=" . DB_HOST . ";port=" . DB_PORT . ";dbname=" . DB_NAME . ";charset=utf8mb4";
    $pdo = new PDO($dsn, DB_USER, DB_PASS, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES => false,
    ]);
} catch (PDOException $e) {
    http_response_code(500);
    die('Database connection failed.');
}

// Auth
$auth = new Auth($pdo);
$db = null;
if ($auth->isLoggedIn()) {
    $db = new ScopedDb($pdo, $auth->getUserId());
}

// Routing
$method = $_SERVER['REQUEST_METHOD'];
$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$uri = str_replace('/traderalign', '', $uri);
$uri = rtrim($uri, '/') ?: '/';
$base = __DIR__;

switch (true) {

    // ─── Public pages ───────────────────────────────────
    case $method === 'GET' && $uri === '/':
        require $base . '/../index.php';
        break;

    case $method === 'GET' && $uri === '/sign-up':
        require $base . '/sign-up.php';
        break;

    case $method === 'GET' && $uri === '/sign-in':
        require $base . '/sign-in.php';
        break;

    case $method === 'GET' && $uri === '/pricing':
        require $base . '/pricing.php';
        break;

    // ─── Auth API ───────────────────────────────────────
    case $method === 'POST' && $uri === '/api/auth/sign-up':
        require $base . '/../api/auth/sign-up.php';
        break;

    case $method === 'POST' && $uri === '/api/auth/sign-in':
        require $base . '/../api/auth/sign-in.php';
        break;

    case $method === 'POST' && $uri === '/api/auth/sign-out':
        require $base . '/../api/auth/sign-out.php';
        break;

    // ─── Protected pages ───────────────────────────────
    case $method === 'GET' && $uri === '/dashboard':
        require $base . '/dashboard.php';
        break;

    case $method === 'GET' && $uri === '/calculator':
        require $base . '/calculator.php';
        break;

    case $method === 'GET' && $uri === '/strategy':
        require $base . '/strategy.php';
        break;

    // ─── 404 ───────────────────────────────────────────
    default:
        http_response_code(404);
        echo '<!DOCTYPE html><html><head><title>404 - TraderAlign</title>';
        echo '<link rel="stylesheet" href="/traderalign/assets/tokens.css">';
        echo '<link rel="icon" type="image/png" sizes="32x32" href="/traderalign/assets/favicon/favicon-32.png">';
        echo '<link rel="icon" type="image/png" sizes="16x16" href="/traderalign/assets/favicon/favicon-16.png">';
        echo '<link rel="apple-touch-icon" sizes="180x180" href="/traderalign/assets/favicon/apple-touch-icon.png">';
        echo '<link rel="shortcut icon" href="/traderalign/assets/favicon/favicon.ico">';
        echo '<link rel="stylesheet" href="/traderalign/assets/css/brand.css">';
        echo '<style>body{display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;font-family:Inter,system-ui,sans-serif;background:var(--background);color:var(--foreground)}';
        echo '.error-container{display:flex;flex-direction:column;align-items:center}';
        echo 'h1{font-size:3rem;font-weight:800}p{color:var(--foreground-muted);margin-top:.5rem}';
        echo 'a{color:var(--primary);margin-top:1.5rem;display:inline-block}</style>';
        echo '</head><body><div class="error-container"><img src="/traderalign/images/logo.png" alt="TraderAlign" class="ta-logo ta-logo--xl" style="margin-bottom:1rem"><h1>404</h1><p>Page not found.</p>';
        echo '<a href="/traderalign/">Back to home</a></div></body></html>';
        break;
}