<?php
	session_start();
	require_once($_SERVER['DOCUMENT_ROOT'].'/inc/mysql.php');
	$db = new MySQL('db.syndbs.com', 'lc2user', 'SYN57CRUZ', 'lc2synment_lc');
	
	$requestBody = file_get_contents("php://input");
	$data = json_decode($requestBody, true);
	if(!empty($data)) {
		foreach($data as $k=>$v) {
			$_POST[$k] = $v;
		}
	}
	
	// ===== SPAM FILTER START =====

	// Whitelist fields (ignore everything else)
	$allowed_fields = [
		'firstName','lastName','email','phone',
		'talkedToAdmissions','inProgram','subject','message'
	];

	$clean = [];

	foreach ($allowed_fields as $field) {
		$clean[$field] = isset($_POST[$field]) ? trim($_POST[$field]) : '';
	}

	// Extract
	$first  = $clean['firstName'];
	$last   = $clean['lastName'];
	$email  = $clean['email'];
	$phone  = $clean['phone'];
	$subject= $clean['subject'];
	$message= $clean['message'];

	// 1. Required fields
	if (empty($email) || empty($message) || empty($first)) {
		exit(json_encode(['status'=>'error']));
	}

	// 2. Name validation (kills bot garbage)
	if (!preg_match("/^[a-zA-Z\s'-]{2,50}$/", $first) ||
		(!empty($last) && !preg_match("/^[a-zA-Z\s'-]{2,50}$/", $last))) {
		exit(json_encode(['status'=>'error']));
	}

	// 3. Email validation
	if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
		exit(json_encode(['status'=>'error']));
	}

	// 4. Phone sanity (optional but helpful)
	if (!empty($phone) && !preg_match("/^[0-9\-\(\)\s\+]{7,20}$/", $phone)) {
		exit(json_encode(['status'=>'error']));
	}

	// 5. Message length
	if (strlen($message) < 10 || strlen($message) > 2000) {
		exit(json_encode(['status'=>'error']));
	}

	// 6. URL spam detection
	$link_count = preg_match_all('/https?:\/\//i', $message);
	if ($link_count > 1) {
		exit(json_encode(['status'=>'error']));
	}

	// 7. Keyword filter
	$spam_keywords = [
		'viagra','casino','crypto','loan','seo','backlink','forex','porn'
	];

	foreach ($spam_keywords as $word) {
		if (stripos($message, $word) !== false) {
			exit(json_encode(['status'=>'error']));
		}
	}

	// 8. Disposable email domains
	$blocked_domains = ['mailinator.com','10minutemail.com','tempmail.com'];
	$domain = strtolower(substr(strrchr($email, "@"), 1));

	if (in_array($domain, $blocked_domains)) {
		exit(json_encode(['status'=>'error']));
	}

	// 9. MX record check
	if (!checkdnsrr($domain, "MX")) {
		exit(json_encode(['status'=>'error']));
	}

	// 10. Rate limiting (per IP)
	$ip = $_SERVER['REMOTE_ADDR'];
	$file = sys_get_temp_dir() . '/cf_' . md5($ip);

	$hits = file_exists($file) ? json_decode(file_get_contents($file), true) : [];
	$now = time();

	$hits = array_filter($hits, fn($t) => $t > $now - 600);
	$hits[] = $now;

	file_put_contents($file, json_encode($hits));

	if (count($hits) > 5) {
		exit(json_encode(['status'=>'error']));
	}

	// 11. User-Agent filter (cheap bot kill)
	if (empty($_SERVER['HTTP_USER_AGENT']) ||
		preg_match('/curl|wget|python|bot|crawler|spider/i', $_SERVER['HTTP_USER_AGENT'])) {
		exit(json_encode(['status'=>'error']));
	}

	// ===== SPAM FILTER END =====
	
	$body = '';
	foreach ($allowed_fields as $k) {
		if (!empty($clean[$k])) {
			$body .= ($body=='' ? '' : "\n") . $k . ': ' . $clean[$k];
		}
	}
	
	$email = str_replace(["\r", "\n"], '', $email);
	
	if(!empty($_SESSION['Client'])) {
		$clients = $db->get_results("
			SELECT id, first, last, address1, city, state, zip, country, phone_1, phone_2, phone_3, fax, email 
			FROM lc_reseller 
			WHERE id = '".$db->clean($_SESSION['Client']['id'])."' LIMIT 1
			");
		if(!empty($clients)) {
			$profiles = $db->get_results("
				SELECT id,date_entered
				FROM client_profile
				WHERE client_id = '".$db->clean($_SESSION['Client']['id'])."'
				LIMIT 1;
			");
			$research_coach = '';
			if(!empty($profiles)) {
				$profile = $profiles[0];
				$profile_id = $profile->id;
				$grdb_profile_id_arr = $db->get_results("SELECT assigned_agent,profiles_id FROM grdb.grd_profiles WHERE site_code='synment' AND site_profiles_id='{$profile_id}'");
				$grdb_profile_id = $grdb_profile_id_arr[0]->profiles_id;
				
				$research_coach_arr = $db->get_results("SELECT fname,email,ext FROM grdb.grd_users WHERE users_id=(SELECT assigned_agent FROM grdb.grd_profiles WHERE profiles_id='".$db->clean($grdb_profile_id)."')");
				$research_coach = $research_coach_arr[0]->email;
				$research_coach_name = $research_coach_arr[0]->fname;
				$research_coach_phone = "(800) 858-1052 ext ".$research_coach_arr[0]->ext;
				if($research_coach=='jeremy@synergytpsreports.com') {
					$research_coach = 'example_research_coach@example.com';
					$research_coach_phone = '(555) 555-5555 ext 5';
				}
				$coach_username_res = $db->get_results("SELECT username FROM surfcrm.employees WHERE agent_id='".$db->clean($grdb_profile_id_arr[0]->assigned_agent)."'");
				$coach_username = $coach_username_res[0]->username;
			}
			
			if(!empty($research_coach)) {
				$db->query("INSERT INTO lc2synment_lc.coach_email_inboxes
						(
							client_id
							,coach_username
							,ts
							,username
							,result
							,subject
							,body
							,sender_name
							,has_seen
							,from_email
							,to_header
						) VALUES (
							'".$db->clean($_SESSION['Client']['id'])."'
							,'".$db->clean($coach_username)."'
							,NOW()
							,'".$db->clean($clients[0]->first.' '.$clients[0]->last)."'
							,'INBOX'
							,'USBusinessFundingSolutions Contact Form - Member Contact'
							,'".$db->clean(nl2br($body))."'
							,'".$db->clean($clients[0]->first.' '.$clients[0]->last)."'
							,0
							,'".$db->clean($clients[0]->email)."'
							,'".$db->clean($research_coach)."'
						)");
			} else {
				$to = 'support@usbusinessfundingsolutions.com';
				$from = 'NoReply@usbusinessfundingsolutions.com';
				$subject = 'USBusinessFundingSolutions Contact';
				$message = nl2br($body);
				$tag = 'Contact Form';
				$cc = '';
				$bcc = '';
				$site_code = 'synment';
				$client_id = $_SESSION['Client']['id'];
				$attachments = array();
				include_once($_SERVER['DOCUMENT_ROOT'].'/member/php/mailgun.php');
				mailgun_send_message($to,$from,$subject,$message,1,$tag,$cc,$bcc,$site_code,$client_id,$attachments,$email,1);
			}
		} else {
			$to = 'support@usbusinessfundingsolutions.com';
			$from = 'NoReply@usbusinessfundingsolutions.com';
			$subject = 'USBusinessFundingSolutions Contact';
			$message = nl2br($body);
			$tag = 'Contact Form';
			$cc = '';
			$bcc = '';
			$site_code = 'synment';
			$client_id = 0;
			$attachments = array();
			include_once($_SERVER['DOCUMENT_ROOT'].'/member/php/mailgun.php');
			mailgun_send_message($to,$from,$subject,$message,1,$tag,$cc,$bcc,$site_code,$client_id,$attachments,$email,1);
		}		
	} else {
		$to = 'support@usbusinessfundingsolutions.com';
		$from = 'NoReply@usbusinessfundingsolutions.com';
		$subject = 'USBusinessFundingSolutions Contact';
		$message = nl2br($body);
		$tag = 'Contact Form';
		$cc = '';
		$bcc = '';
		$site_code = 'synment';
		$client_id = 0;
		$attachments = array();
		include_once($_SERVER['DOCUMENT_ROOT'].'/member/php/mailgun.php');
		mailgun_send_message($to,$from,$subject,$message,1,$tag,$cc,$bcc,$site_code,$client_id,$attachments,$email,1);
	}
	echo json_encode(array('status'=>'success'));
	die();