<?php
// Add this to the end of /var/www/domix.dev/public_html/main/includes/dxbots_auth.php

function dxbots_encrypt_token(string $token): string
{
  $key = getenv('DXBOTS_ENCRYPTION_KEY');
  if (!$key) {
    // Fallback: simple base64 (not secure; use env var in production)
    return 'b64:' . base64_encode($token);
  }
  $nonce = random_bytes(24);
  $cipher = sodium_crypto_secretbox($token, $nonce, $key);
  return 'nacl:' . bin2hex($nonce . $cipher);
}

function dxbots_decrypt_token(string $encrypted): ?string
{
  if (str_starts_with($encrypted, 'b64:')) {
    return base64_decode(substr($encrypted, 4), true);
  }
  if (str_starts_with($encrypted, 'nacl:')) {
    $key = getenv('DXBOTS_ENCRYPTION_KEY');
    if (!$key) return null;
    $hex = substr($encrypted, 5);
    $binary = hex2bin($hex);
    if (!$binary || strlen($binary) < 24) return null;
    $nonce = substr($binary, 0, 24);
    $cipher = substr($binary, 24);
    $token = sodium_crypto_secretbox_open($cipher, $nonce, $key);
    return $token !== false ? $token : null;
  }
  return null;
}

function dxbots_validate_bot_token(string $token): ?array
{
  $config = dxbots_config()['discord'];
  $apiBase = $config['api_base'] ?? 'https://discord.com/api/v10';

  $ch = curl_init($apiBase . '/oauth2/applications/@me');
  curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
      'Authorization: Bot ' . $token,
    ],
    CURLOPT_TIMEOUT => 10,
  ]);

  $response = curl_exec($ch);
  $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
  curl_close($ch);

  if ($httpCode !== 200 || !$response) {
    return null;
  }

  $json = json_decode($response, true);
  if (!is_array($json) || !isset($json['id'])) {
    return null;
  }

  return [
    'id' => (string)$json['id'],
    'name' => (string)($json['name'] ?? 'Unknown Bot'),
  ];
}

function dxbots_check_bot_intents(string $token): array
{
  $config = dxbots_config()['discord'];
  $apiBase = $config['api_base'] ?? 'https://discord.com/api/v10';

  $ch = curl_init($apiBase . '/oauth2/applications/@me');
  curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
      'Authorization: Bot ' . $token,
    ],
    CURLOPT_TIMEOUT => 10,
  ]);

  $response = curl_exec($ch);
  $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
  curl_close($ch);

  if ($httpCode !== 200 || !$response) {
    return ['valid' => false, 'error' => 'API_ERROR'];
  }

  $json = json_decode($response, true);
  if (!is_array($json)) {
    return ['valid' => false, 'error' => 'INVALID_RESPONSE'];
  }

  // Required intents: GUILDS (1), GUILD_MEMBERS (2), GUILD_PRESENCES (512), MESSAGE_CONTENT (32768)
  $flags = (int)($json['flags'] ?? 0);
  $requiredIntents = [1, 2, 512, 32768];
  $hasAll = true;
  $intentStatus = [];

  foreach ($requiredIntents as $intent) {
    $has = ($flags & $intent) !== 0;
    $intentStatus[$intent] = $has;
    if (!$has) $hasAll = false;
  }

  return [
    'valid' => true,
    'all_enabled' => $hasAll,
    'intents' => $intentStatus,
    'bot_id' => (string)($json['id'] ?? ''),
    'bot_name' => (string)($json['name'] ?? 'Unknown'),
  ];
}