<?php

declare(strict_types=1);

/**
 * One-off SMTP test from the webspace (same path as monitor.php cron).
 * GET /mail-test.php?token=MONITOR_INGEST_TOKEN
 * Remove or restrict after verification.
 */

require_once dirname(__DIR__) . '/private/config/mail.php';

header('Content-Type: application/json; charset=utf-8');

$token = $_GET['token'] ?? '';
$expected = env('MONITOR_INGEST_TOKEN') ?? '';

if ($expected === '' || !hash_equals($expected, $token)) {
    http_response_code(403);
    echo json_encode(['ok' => false, 'error' => 'forbidden']);
    exit;
}

$to = env('ALERT_EMAIL');
if (!$to) {
    http_response_code(500);
    echo json_encode(['ok' => false, 'error' => 'ALERT_EMAIL not set']);
    exit;
}

$domain = env('DOMAIN', '0012.de');
$subject = "[{$domain}] SMTP test (server) " . gmdate('Y-m-d H:i:s') . ' UTC';
$body = implode("\n", [
    '0012.de SMTP test — sent from webspace PHP (cron path)',
    '',
    'From header: ' . env('SMTP_FROM'),
    'SMTP auth: ' . env('SMTP_USER'),
    '',
    'If you receive this, server-side mail works.',
]);

try {
    sendMail($to, $subject, $body);
    echo json_encode(['ok' => true, 'to' => $to, 'from' => env('SMTP_FROM')]);
} catch (Throwable $e) {
    http_response_code(500);
    echo json_encode(['ok' => false, 'error' => $e->getMessage()]);
}