<?php
header('Content-Type: text/html; charset=utf-8');
error_reporting(E_ALL);
ini_set('display_errors', 0);

$ZIBAL_MERCHANT = '69e3945ee6d570ad00fd0dad';
$BOT_TOKEN = '8849773001:AAFY4Uqiz16PCJNjZv7loZYPhIDKraBFpHc';
$TRANSACTION_CHANNEL_ID = '-1004348903892';

$db_host = 'localhost';
$db_name = 'violexst_bot';
$db_user = 'violexst_botuser';
$db_pass = 'ViolexBot#92!qR7@Lm';

$trackId = $_GET['trackId'] ?? '';
$success = $_GET['success'] ?? '';
$status  = $_GET['status'] ?? '';

function redirect_invoice($token, $ok) {
    $url = $ok
        ? '/invoice/success.php?token=' . urlencode($token)
        : '/invoice/failed.php?token=' . urlencode($token);
    header('Location: ' . $url);
    exit;
}

if (!$trackId) {
    die('پارامتر نامعتبر.');
}

$conn = new mysqli($db_host, $db_user, $db_pass, $db_name);
if ($conn->connect_error) {
    die('خطا در اتصال به دیتابیس.');
}
$conn->set_charset('utf8mb4');

$stmt = $conn->prepare("SELECT * FROM invoices WHERE authority = ? LIMIT 1");
$stmt->bind_param('s', $trackId);
$stmt->execute();
$invoice = $stmt->get_result()->fetch_assoc();
$stmt->close();

if (!$invoice) {
    $conn->close();
    die('پیش‌فاکتور یافت نشد.');
}

$token = $invoice['token'];

if ($invoice['status'] === 'paid') {
    $conn->close();
    redirect_invoice($token, true);
}

if ($success !== '1' || $status !== '2') {
    $stmt = $conn->prepare("UPDATE invoices SET status = 'failed' WHERE token = ?");
    $stmt->bind_param('s', $token);
    $stmt->execute();
    $stmt->close();
    $conn->close();
    notify_bot_failed($BOT_TOKEN, $invoice);
    redirect_invoice($token, false);
}

$data = [
    'merchant' => $ZIBAL_MERCHANT,
    'trackId'  => intval($trackId),
    'amount'   => $invoice['total_amount'] * 10
];

$ch = curl_init('https://gateway.zibal.ir/v1/verify');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($data),
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_TIMEOUT => 30,
    CURLOPT_SSL_VERIFYPEER => false
]);
$response = curl_exec($ch);
curl_close($ch);
$verify = json_decode($response, true);

if (!isset($verify['result']) || ($verify['result'] != 100 && $verify['result'] != 201)) {
    $stmt = $conn->prepare("UPDATE invoices SET status = 'failed' WHERE token = ?");
    $stmt->bind_param('s', $token);
    $stmt->execute();
    $stmt->close();
    $conn->close();
    notify_bot_failed($BOT_TOKEN, $invoice);
    redirect_invoice($token, false);
}

$ref_id   = $verify['refNumber'] ?? '-';
$card_pan = $verify['cardNumber'] ?? '-';
$now      = date('Y/m/d H:i:s');

$stmt = $conn->prepare("
    UPDATE invoices
    SET status = 'paid', ref_id = ?, card_pan = ?, paid_at = ?
    WHERE token = ?
");
$stmt->bind_param('ssss', $ref_id, $card_pan, $now, $token);
$stmt->execute();
$stmt->close();
$conn->close();

notify_bot_success($BOT_TOKEN, $invoice, $ref_id, $card_pan);

$report = "📢 *گزارش تراکنش*\n\n"
        . "👤 کاربر: `{$invoice['user_id']}`\n"
        . "📝 نام: {$invoice['payer_name']}\n"
        . "📱 شماره: `{$invoice['payer_phone']}`\n"
        . "🎁 محصول: {$invoice['product_name']}\n"
        . "💰 مبلغ: " . number_format($invoice['total_amount']) . " تومان\n"
        . "🆔 کد پیگیری: `$ref_id`\n"
        . "💳 کارت: `$card_pan`\n"
        . "🕐 زمان: $now";
tg_send($BOT_TOKEN, $TRANSACTION_CHANNEL_ID, $report);

redirect_invoice($token, true);

function tg_send($token, $chat_id, $text) {
    $url = "https://api.telegram.org/bot{$token}/sendMessage";
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => [
            'chat_id' => $chat_id,
            'text' => $text,
            'parse_mode' => 'Markdown'
        ],
        CURLOPT_TIMEOUT => 20,
        CURLOPT_SSL_VERIFYPEER => false
    ]);
    curl_exec($ch);
    curl_close($ch);
}

function notify_bot_success($token, $invoice, $ref_id, $card_pan) {
    $msg = "✅ *پرداخت شما با موفقیت انجام شد!*\n\n"
         . "📝 نام: {$invoice['payer_name']}\n"
         . "🎁 محصول: {$invoice['product_name']}\n"
         . "💰 مبلغ: " . number_format($invoice['total_amount']) . " تومان\n"
         . "🆔 کد پیگیری: `$ref_id`\n"
         . "💳 کارت: `$card_pan`\n\n"
         . "🌟 از اینکه ویولکس را انتخاب کردید سپاسگزاریم.";
    tg_send($token, $invoice['user_id'], $msg);
}

function notify_bot_failed($token, $invoice) {
    $msg = "❌ *پرداخت شما ناموفق بود.*\n\n"
         . "🎁 محصول: {$invoice['product_name']}\n"
         . "💰 مبلغ: " . number_format($invoice['total_amount']) . " تومان\n\n"
         . "لطفاً دوباره تلاش کنید یا با پشتیبانی تماس بگیرید.";
    tg_send($token, $invoice['user_id'], $msg);
}