<?php
// /var/www/html/uploadDeltaTest5.php
// Vollständige, eigenständige Version – einfach kopieren & einfügen.

// -----------------------------
// Logging & PHP-Settings
// -----------------------------
error_reporting(E_ALL);
ini_set('display_errors', '0');
ini_set('log_errors', '1');
$LOG_FILE = __DIR__ . '/uploadDelta.log';
function log_msg($msg) {
    global $LOG_FILE;
    error_log(date('[Y-m-d H:i:s] ') . $msg . PHP_EOL, 3, $LOG_FILE);
}
header('Content-Type: application/json; charset=UTF-8');

// -----------------------------
// Krypto-/Token-Helfer
// -----------------------------
function b64_or_ascii_to_32_bytes(string $s): string {
    // Versuche Base64, sonst ASCII; pad/truncate auf 32
    $b = base64_decode($s, true);
    if ($b !== false && $b !== '') {
        return str_pad(substr($b, 0, 32), 32, "\0");
    }
    return str_pad(substr($s, 0, 32), 32, "\0");
}

function get_master_key_bytes(): string {
    // MASTER-KEY nur serverseitig (für gespeicherte DB)
    // ENV: QDB_MASTER_KEY (Base64 oder ASCII). Fallback ist alter Key.
    $env = getenv('QDB_MASTER_KEY');
    if ($env && $env !== '') return b64_or_ascii_to_32_bytes($env);
    return "12345678901234567890123456789012"; // Fallback (bitte in PROD durch ENV ersetzen!)
}

function hkdf_session_key_from_token(string $tokenHex, string $info = 'qdb-aes', int $len = 32): string {
    // HKDF-SHA256: salt = 32x0x00, info = "qdb-aes"
    $ikm = @hex2bin(trim($tokenHex));
    if ($ikm === false) $ikm = $tokenHex; // falls bereits binär
    $hashLen = 32;
    $salt = str_repeat("\0", $hashLen);
    $prk = hash_hmac('sha256', $ikm, $salt, true);
    $okm = '';
    $t = '';
    $n = (int)ceil($len / $hashLen);
    for ($i = 1; $i <= $n; $i++) {
        $t = hash_hmac('sha256', $t . $info . chr($i), $prk, true);
        $okm .= $t;
    }
    return substr($okm, 0, $len);
}

function aes256_cbc_encrypt_bytes(string $plain, string $key32): string {
    $key = str_pad(substr($key32, 0, 32), 32, "\0");
    $iv = random_bytes(16);
    $cipher = openssl_encrypt($plain, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
    if ($cipher === false) throw new Exception('openssl_encrypt failed');
    return $iv . $cipher;
}

function aes256_cbc_decrypt_bytes(string $data, string $key32): string {
    if (strlen($data) < 16) throw new Exception('cipher too short');
    $key = str_pad(substr($key32, 0, 32), 32, "\0");
    $iv = substr($data, 0, 16);
    $ct = substr($data, 16);
    $plain = openssl_decrypt($ct, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
    if ($plain === false) throw new Exception('openssl_decrypt failed');
    return $plain;
}

// Token-Validierung: bevorzugt tokens.jsonl mit exp, Fallback valid_tokens.txt
function token_is_valid(string $token): bool {
    $now = time();
    $jsonl = __DIR__ . '/tokens.jsonl';
    if (file_exists($jsonl)) {
        $h = fopen($jsonl, 'r');
        if ($h) {
            while (($line = fgets($h)) !== false) {
                $j = json_decode($line, true);
                if (!is_array($j)) continue;
                if (($j['token'] ?? '') === $token) {
                    $exp = $j['exp'] ?? ($now + 1); // falls kein exp, akzeptieren
                    fclose($h);
                    return $exp >= $now;
                }
            }
            fclose($h);
        }
    }
    $txt = __DIR__ . '/valid_tokens.txt';
    if (file_exists($txt)) {
        $arr = file($txt, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
        if ($arr && in_array($token, $arr, true)) return true;
    }
    return false;
}

// -----------------------------
// Hauptlogik
// -----------------------------
try {
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        http_response_code(405);
        echo json_encode(["error" => "Nur POST erlaubt"]);
        exit;
    }

    // Token aus multipart oder Authorization: Bearer
    $token = $_POST['token'] ?? null;
    if (!$token) {
        $auth = $_SERVER['HTTP_AUTHORIZATION'] ?? ($_SERVER['Authorization'] ?? '');
        if (stripos($auth, 'Bearer ') === 0) {
            $token = substr($auth, 7);
        }
    }
    if (!$token || !token_is_valid($token)) {
        http_response_code(403);
        echo json_encode(["error" => "Ungültiger Token"]);
        exit;
    }

    // Upload entgegennehmen (multipart 'file' oder raw body)
    $uploadedFilePath = null;
    if (!empty($_FILES['file']) && is_uploaded_file($_FILES['file']['tmp_name'])) {
        $uploadedFilePath = $_FILES['file']['tmp_name'];
    } else {
        $raw = file_get_contents('php://input');
        if ($raw !== false && strlen($raw) > 0) {
            $tmp = tempnam(sys_get_temp_dir(), 'upl_');
            file_put_contents($tmp, $raw);
            $uploadedFilePath = $tmp;
        }
    }
    if (!$uploadedFilePath) {
        http_response_code(400);
        echo json_encode(["error" => "Keine Datei gesendet"]);
        exit;
    }

    // Payload mit SESSION-Key (aus Token via HKDF) entschlüsseln
    $encData = file_get_contents($uploadedFilePath);
    if ($encData === false) {
        http_response_code(500);
        echo json_encode(["error" => "Fehler beim Lesen der hochgeladenen Datei"]);
        exit;
    }
    $sessionKey = hkdf_session_key_from_token($token);
    $jsonData = null;
    try {
        $jsonData = aes256_cbc_decrypt_bytes($encData, $sessionKey);
    } catch (Throwable $e) {
        // Fallback: akzeptiere Plain-JSON (Kompatibilität)
        $maybeJson = trim($encData);
        if ($maybeJson === '' || json_decode($maybeJson, true) === null) {
            log_msg("Entschlüsselung fehlgeschlagen und kein valides JSON. raw len=" . strlen($encData));
            http_response_code(400);
            echo json_encode(["error" => "Ungültige verschlüsselte Datei oder kein JSON"]);
            exit;
        }
        $jsonData = $maybeJson;
    }

    $data = json_decode($jsonData, true);
    if (!is_array($data)) {
        http_response_code(400);
        echo json_encode(["error" => "Ungültiges JSON"]);
        exit;
    }

    // Ziel: MASTER-verschlüsselte DB speichern
    $dbPath = __DIR__ . '/uploads/questionnaire_database';
    if (!is_dir(dirname($dbPath))) {
        if (!mkdir(dirname($dbPath), 0755, true) && !is_dir(dirname($dbPath))) {
            throw new Exception("Konnte Upload-Ordner nicht erstellen");
        }
    }

    // Lock, damit keine parallelen Writes kollidieren
    $lockFile = __DIR__ . '/uploads/.qdb_lock';
    $lockFp = fopen($lockFile, 'c');
    if ($lockFp === false) throw new Exception("Konnte Lock-Datei nicht öffnen");
    if (!flock($lockFp, LOCK_EX)) { fclose($lockFp); throw new Exception("Konnte Lock nicht setzen"); }

    $tmpDb = null;
    $tmpEncrypted = null;

    try {
        $tmpDb = tempnam(sys_get_temp_dir(), 'qdb_');
        $masterKey = get_master_key_bytes();

        // Bestehende MASTER-verschlüsselte DB entschlüsseln oder neue DB mit Schema anlegen
        if (file_exists($dbPath) && is_file($dbPath)) {
            $storedEnc = @file_get_contents($dbPath);
            if ($storedEnc === false) throw new Exception("Konnte gespeicherte DB nicht lesen");
            $decrypted = aes256_cbc_decrypt_bytes($storedEnc, $masterKey);
            if (file_put_contents($tmpDb, $decrypted) === false) throw new Exception("Konnte temporäre DB nicht schreiben");
        } else {
            $pdo = new PDO("sqlite:$tmpDb");
            $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            $pdo->exec("PRAGMA foreign_keys = ON;");
            $pdo->exec("
                CREATE TABLE IF NOT EXISTS clients (
                    clientCode TEXT NOT NULL DEFAULT 'undefined' PRIMARY KEY
                );
                CREATE TABLE IF NOT EXISTS questionnaires (
                    id TEXT NOT NULL DEFAULT 'undefined' PRIMARY KEY
                );
                CREATE TABLE IF NOT EXISTS questions (
                    questionId TEXT NOT NULL DEFAULT 'undefined' PRIMARY KEY,
                    questionnaireId TEXT NOT NULL,
                    question TEXT NOT NULL DEFAULT '',
                    FOREIGN KEY(questionnaireId) REFERENCES questionnaires(id) ON DELETE CASCADE
                );
                CREATE TABLE IF NOT EXISTS answers (
                    clientCode TEXT NOT NULL,
                    questionId TEXT NOT NULL,
                    answerValue TEXT NOT NULL DEFAULT '',
                    PRIMARY KEY (clientCode, questionId),
                    FOREIGN KEY(clientCode) REFERENCES clients(clientCode) ON DELETE CASCADE,
                    FOREIGN KEY(questionId) REFERENCES questions(questionId) ON DELETE CASCADE
                );
                CREATE TABLE IF NOT EXISTS completed_questionnaires (
                    clientCode TEXT NOT NULL,
                    questionnaireId TEXT NOT NULL,
                    timestamp INTEGER NOT NULL,
                    isDone INTEGER NOT NULL,
                    sumPoints INTEGER,
                    PRIMARY KEY (clientCode, questionnaireId),
                    FOREIGN KEY(clientCode) REFERENCES clients(clientCode) ON DELETE CASCADE,
                    FOREIGN KEY(questionnaireId) REFERENCES questionnaires(id) ON DELETE CASCADE
                );
            ");
            $pdo = null;
        }

        // Einspielen der Daten
        $db = new PDO("sqlite:$tmpDb");
        $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $db->exec("PRAGMA foreign_keys = ON;");
        $db->beginTransaction();

        // --- Sammeln, welche IDs/Paarungen betroffen sind ---
        $questionnaireIds = [];           // set[string] questionnaireId => true
        $clientQuestionPairs = [];        // set["client|qid"] => true

        if (!empty($data['questionnaires'])) {
            foreach ($data['questionnaires'] as $q) {
                if (isset($q['id']) && $q['id'] !== null && $q['id'] !== '') {
                    $questionnaireIds[$q['id']] = true;
                }
            }
        }
        if (!empty($data['questions'])) {
            foreach ($data['questions'] as $q) {
                if (isset($q['questionnaireId']) && $q['questionnaireId'] !== null && $q['questionnaireId'] !== '') {
                    $questionnaireIds[$q['questionnaireId']] = true;
                }
            }
        }
        if (!empty($data['completed_questionnaires'])) {
            foreach ($data['completed_questionnaires'] as $c) {
                if (isset($c['questionnaireId']) && $c['questionnaireId'] !== null && $c['questionnaireId'] !== '') {
                    $questionnaireIds[$c['questionnaireId']] = true;
                }
                if (isset($c['clientCode']) && isset($c['questionnaireId'])) {
                    $client = ($c['clientCode'] === null || $c['clientCode'] === '') ? 'undefined' : $c['clientCode'];
                    $qid = ($c['questionnaireId'] === null || $c['questionnaireId'] === '') ? 'undefined' : $c['questionnaireId'];
                    $clientQuestionPairs["$client|$qid"] = true;
                }
            }
        }
        if (!empty($data['answers'])) {
            foreach ($data['answers'] as $a) {
                if (isset($a['clientCode'])) {
                    $client = ($a['clientCode'] === null || $a['clientCode'] === '') ? 'undefined' : $a['clientCode'];
                    $qid = null;
                    if (isset($a['questionId']) && is_string($a['questionId'])) {
                        $parts = explode('-', $a['questionId'], 2);
                        if (count($parts) >= 1) {
                            $potential = $parts[0];
                            if ($potential !== '') $qid = $potential;
                        }
                    }
                    if ($qid !== null) {
                        $questionnaireIds[$qid] = true;
                        $clientQuestionPairs["$client|$qid"] = true;
                    }
                }
            }
        }
        if (!empty($data['clients']) && !empty($data['questionnaires'])) {
            foreach ($data['clients'] as $c) {
                if (!isset($c['clientCode'])) continue;
                $client = ($c['clientCode'] === null || $c['clientCode'] === '') ? 'undefined' : $c['clientCode'];
                foreach ($data['questionnaires'] as $q) {
                    if (!isset($q['id'])) continue;
                    $qid = ($q['id'] === null || $q['id'] === '') ? 'undefined' : $q['id'];
                    $clientQuestionPairs["$client|$qid"] = true;
                }
            }
        }

        // --- Löschungen (zuerst abhängige Tabellen) ---
        $delAnswersByPairStmt = $db->prepare("
            DELETE FROM answers
            WHERE clientCode = :clientCode
              AND questionId IN (SELECT questionId FROM questions WHERE questionnaireId = :questionnaireId)
        ");
        $delCompletedByPairStmt = $db->prepare("
            DELETE FROM completed_questionnaires
            WHERE clientCode = :clientCode
              AND questionnaireId = :questionnaireId
        ");
        foreach ($clientQuestionPairs as $pair => $_) {
            list($clientCode, $qid) = explode('|', $pair, 2);
            try {
                $delAnswersByPairStmt->execute([
                    ':clientCode' => $clientCode,
                    ':questionnaireId' => $qid
                ]);
                $delCompletedByPairStmt->execute([
                    ':clientCode' => $clientCode,
                    ':questionnaireId' => $qid
                ]);
                log_msg("Deleted answers & completed for client='$clientCode' questionnaire='$qid'");
            } catch (Exception $e) {
                log_msg("Delete error for pair $pair: " . $e->getMessage());
            }
        }

        if (!empty($questionnaireIds)) {
            $delQuestionsStmt = $db->prepare("DELETE FROM questions WHERE questionnaireId = :questionnaireId");
            foreach ($questionnaireIds as $qid => $_) {
                try {
                    $delQuestionsStmt->execute([':questionnaireId' => $qid]);
                    log_msg("Deleted questions for questionnaireId='$qid'");
                } catch (Exception $e) {
                    log_msg("Delete questions error for $qid: " . $e->getMessage());
                }
            }
        }

        // --- Inserts/Upserts ---
        if (!empty($data['clients'])) {
            $stmt = $db->prepare("INSERT OR IGNORE INTO clients (clientCode) VALUES (:clientCode)");
            foreach ($data['clients'] as $client) {
                if (!isset($client['clientCode'])) continue;
                $val = $client['clientCode'] === null || $client['clientCode'] === '' ? 'undefined' : $client['clientCode'];
                $stmt->execute([':clientCode' => $val]);
            }
        }

        if (!empty($data['questionnaires'])) {
            $stmt = $db->prepare("INSERT OR IGNORE INTO questionnaires (id) VALUES (:id)");
            foreach ($data['questionnaires'] as $q) {
                if (!isset($q['id'])) continue;
                $val = $q['id'] === null || $q['id'] === '' ? 'undefined' : $q['id'];
                $stmt->execute([':id' => $val]);
            }
        }

        if (!empty($data['questions'])) {
            $stmt = $db->prepare("
                INSERT OR IGNORE INTO questions (questionId, questionnaireId, question)
                VALUES (:questionId, :questionnaireId, :question)
            ");
            foreach ($data['questions'] as $q) {
                if (!isset($q['questionId'])) continue;
                $questionId = $q['questionId'] === null || $q['questionId'] === '' ? 'undefined' : $q['questionId'];
                $questionnaireId = $q['questionnaireId'] === null || $q['questionnaireId'] === '' ? 'undefined' : $q['questionnaireId'];
                $questionText = $q['question'] ?? '';
                $stmt->execute([
                    ':questionId' => $questionId,
                    ':questionnaireId' => $questionnaireId,
                    ':question' => $questionText
                ]);
            }
        }

        if (!empty($data['answers'])) {
            $stmt = $db->prepare("
                INSERT OR IGNORE INTO answers (clientCode, questionId, answerValue)
                VALUES (:clientCode, :questionId, :answerValue)
            ");
            foreach ($data['answers'] as $a) {
                if (!isset($a['clientCode']) || !isset($a['questionId'])) continue;
                $clientCode = $a['clientCode'] === null || $a['clientCode'] === '' ? 'undefined' : $a['clientCode'];
                $questionId = $a['questionId'] === null || $a['questionId'] === '' ? 'undefined' : $a['questionId'];
                $answerValue = array_key_exists('answerValue', $a) && $a['answerValue'] !== null ? $a['answerValue'] : '';
                $stmt->execute([
                    ':clientCode' => $clientCode,
                    ':questionId' => $questionId,
                    ':answerValue' => $answerValue
                ]);
            }
        }

        if (!empty($data['completed_questionnaires'])) {
            $stmt = $db->prepare("
                INSERT OR REPLACE INTO completed_questionnaires (clientCode, questionnaireId, timestamp, isDone, sumPoints)
                VALUES (:clientCode, :questionnaireId, :timestamp, :isDone, :sumPoints)
            ");
            foreach ($data['completed_questionnaires'] as $c) {
                if (!isset($c['clientCode']) || !isset($c['questionnaireId'])) continue;
                $clientCode = $c['clientCode'] === null || $c['clientCode'] === '' ? 'undefined' : $c['clientCode'];
                $questionnaireId = $c['questionnaireId'] === null || $c['questionnaireId'] === '' ? 'undefined' : $c['questionnaireId'];
                $timestamp = isset($c['timestamp']) ? (int)$c['timestamp'] : time();
                $isDone = !empty($c['isDone']) ? 1 : 0;
                $sumPoints = array_key_exists('sumPoints', $c) ? ($c['sumPoints'] === null ? null : (int)$c['sumPoints']) : null;
                $stmt->execute([
                    ':clientCode' => $clientCode,
                    ':questionnaireId' => $questionnaireId,
                    ':timestamp' => $timestamp,
                    ':isDone' => $isDone,
                    ':sumPoints' => $sumPoints
                ]);
            }
        }

        $db->commit();
        $db = null;

        // MASTER-verschlüsselt speichern (atomar via temp + rename)
        $plainDb = file_get_contents($tmpDb);
        if ($plainDb === false) throw new Exception("Konnte tmp DB nicht lesen");
        $enc = aes256_cbc_encrypt_bytes($plainDb, $masterKey);

        $tmpEncrypted = tempnam(dirname($dbPath), 'enc_qdb_');
        if (file_put_contents($tmpEncrypted, $enc) === false) throw new Exception("Konnte verschlüsselte DB nicht schreiben");
        if (!@rename($tmpEncrypted, $dbPath)) {
            if (!@copy($tmpEncrypted, $dbPath) || !@unlink($tmpEncrypted)) {
                throw new Exception("Konnte verschlüsselte DB nicht speichern (rename/copy fehlgeschlagen)");
            }
        }
        @chmod($dbPath, 0644);

        // Cleanup
        @unlink($uploadedFilePath);
        @unlink($tmpDb);
        flock($lockFp, LOCK_UN);
        fclose($lockFp);

        echo json_encode(["success" => true, "message" => "Delta erfolgreich eingespielt und DB gespeichert"]);
        exit;

    } catch (Throwable $inner) {
        // Cleanup bei Fehler
        @flock($lockFp, LOCK_UN);
        @fclose($lockFp);
        @unlink($tmpDb ?? '');
        @unlink($tmpEncrypted ?? '');
        @unlink($uploadedFilePath ?? '');
        log_msg("Inner exception: " . $inner->getMessage());
        http_response_code(500);
        echo json_encode(["error" => "Fehler beim Speichern", "message" => $inner->getMessage()]);
        exit;
    }

} catch (Throwable $e) {
    log_msg("Top-level exception: " . $e->getMessage());
    http_response_code(500);
    echo json_encode(["error" => "Fehler", "message" => $e->getMessage()]);
    exit;
}