<?php
declare(strict_types=1);

/**
 * 越前 AI HELPER 开发者回调接收示例
 *
 * 启动：
 *   WORKTOOL_CALLBACK_SECRET=your-secret php -S 0.0.0.0:19080 callback-receiver.php
 *
 * 回调地址：
 *   https://你的域名/callback
 */

$path = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/';
if ($path !== '/callback' && $path !== '/callback/') {
    http_response_code(404);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode(['ok' => false, 'error' => 'not_found'], JSON_UNESCAPED_UNICODE);
    return;
}

if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') {
    http_response_code(405);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode(['ok' => false, 'error' => 'method_not_allowed'], JSON_UNESCAPED_UNICODE);
    return;
}

$rawBody = file_get_contents('php://input') ?: '';
$secret = getenv('WORKTOOL_CALLBACK_SECRET') ?: '';
$timestamp = $_SERVER['HTTP_X_WORKTOOL_TIMESTAMP'] ?? '';
$signature = strtolower((string)($_SERVER['HTTP_X_WORKTOOL_SIGNATURE'] ?? ''));

if ($secret !== '') {
    if ($timestamp === '' || $signature === '' || !ctype_digit($timestamp)) {
        http_response_code(401);
        header('Content-Type: application/json; charset=utf-8');
        echo json_encode(['ok' => false, 'error' => 'invalid_signature_headers'], JSON_UNESCAPED_UNICODE);
        return;
    }

    if (abs(time() - (int)$timestamp) > 300) {
        http_response_code(401);
        header('Content-Type: application/json; charset=utf-8');
        echo json_encode(['ok' => false, 'error' => 'timestamp_expired'], JSON_UNESCAPED_UNICODE);
        return;
    }

    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    if (!hash_equals($expected, $signature)) {
        http_response_code(401);
        header('Content-Type: application/json; charset=utf-8');
        echo json_encode(['ok' => false, 'error' => 'invalid_signature'], JSON_UNESCAPED_UNICODE);
        return;
    }
}

$payload = json_decode($rawBody, true);
if (!is_array($payload)) {
    http_response_code(400);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode(['ok' => false, 'error' => 'invalid_json'], JSON_UNESCAPED_UNICODE);
    return;
}

$eventType = (string)($payload['eventType'] ?? 'unknown');
$messageId = (string)($payload['messageId'] ?? '');
$robotId = (string)($payload['robotId'] ?? '');

error_log(sprintf(
    'callback eventType=%s robotId=%s messageId=%s body=%s',
    $eventType,
    $robotId,
    $messageId,
    $rawBody
));

switch ($eventType) {
    case 'command_result':
        // 指令执行结果：读取 $payload['data']
        break;
    case 'incoming_message':
        // 企微新消息：读取 $payload['data']
        break;
    case 'group_qrcode':
        // 群二维码：$payload['data']['qrcode']
        break;
    case 'robot_data':
        // 群、好友、企业等查询数据
        break;
}

http_response_code(200);
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['ok' => true], JSON_UNESCAPED_UNICODE);