<?php

/**
 * Simple configuration for website
 */

// Composer autoloader (vendor/ may be sibling dir in dev or same dir in prod)
$autoloadPath = file_exists(__DIR__ . '/vendor/autoload.php')
    ? __DIR__ . '/vendor/autoload.php'
    : __DIR__ . '/../vendor/autoload.php';
require_once $autoloadPath;

// The site serves the ERG (Brussels), but the server + SQLite timestamps run in
// UTC (CURRENT_TIMESTAMP). We intentionally do NOT change the PHP default
// timezone: code that writes timestamps via date()/time() (e.g. one-time
// tokens, share-link expiries) must stay wall-clock consistent with SQLite's
// CURRENT_TIMESTAMP (UTC), otherwise expiries drift by the UTC↔Brussels offset.
// Conversion to Brussels is handled explicitly at the display layer via
// db_datetime() below.

/**
 * Format a database-stored datetime for display in Brussels local time.
 *
 * SQLite timestamps (submitted_at, created_at, published_at, …) are written
 * with CURRENT_TIMESTAMP (= UTC). This parses the value as UTC and converts it
 * to Europe/Brussels (UTC+1 winter / UTC+2 summer) — independent of the PHP
 * default timezone, so it never affects DB write/read consistency elsewhere.
 */
function db_datetime(string $raw, string $format = 'd/m/Y à H:i'): string
{
    if ($raw === '') {
        return '';
    }

    $dt = DateTime::createFromFormat('Y-m-d H:i:s', $raw, new DateTimeZone('UTC'));
    if ($dt === false) {
        // Non-ISO fallback: parse the naive string as UTC.
        $ts = strtotime($raw . ' UTC');
        if ($ts === false) {
            return $raw;
        }
        $dt = (new DateTime('@' . $ts))->setTimezone(new DateTimeZone('UTC'));
    }

    $dt->setTimezone(new DateTimeZone('Europe/Brussels'));
    return $dt->format($format);
}

// Define application root
define('APP_ROOT', __DIR__);

// Storage directory for uploaded files — intentionally outside the webroot
// so no uploaded content is ever directly web-accessible (items #3 & #4).
// Files are served through MediaController which validates paths and MIME types.
// In dev (cli-server) use the local storage/ directory; in production use the
// absolute path outside the webroot.
define('STORAGE_ROOT', php_sapi_name() === 'cli-server'
    ? __DIR__ . '/storage'
    : '/var/www/xamxam/storage'
);

// Error reporting
if (php_sapi_name() === 'cli-server') {
    // Development mode
    error_reporting(E_ALL);
    ini_set('display_errors', '1');
} else {
    // Production mode
    error_reporting(E_ALL);
    ini_set('display_errors', '0');
    ini_set('log_errors', '1');
}

// Admin password hash is stored in site_settings (DB).
// AdminAuth reads it on demand — no static config file needed.

// Central application helper (boot, auth guard, CSRF, flash, render)
require_once APP_ROOT . '/src/App.php';
require_once APP_ROOT . '/src/icon.php';

// Maintenance mode gate — block public pages; allow /admin/ through.
// The flag file lives in storage/ (outside webroot) to avoid web exposure.
define('MAINTENANCE_FLAG', APP_ROOT . '/storage/maintenance.flag');
if (file_exists(MAINTENANCE_FLAG)) {
    // Allow admin panel, partage pages (path prefix), and the maintenance page itself
    $requestPath = $_SERVER['REQUEST_URI'] ?? '';
    $isAdmin       = str_starts_with($requestPath, '/admin');
    $isPartage     = str_starts_with($requestPath, '/partage');
    $isMaintenance = str_contains($requestPath, 'maintenance.php');
    if (!$isAdmin && !$isPartage && !$isMaintenance) {
        require APP_ROOT . '/public/maintenance.php';
        exit();
    }
}