<?php

declare(strict_types=1);

use App\App\Bootstrap;
use App\Security\EntraAuth;
use App\Security\Csrf;
use App\Storage\JsonStore;
use App\Mail\Mailer;

require dirname(__DIR__) . '/src/autoload.php';
Bootstrap::init();

$auth = new EntraAuth();
$auth->requireLogin();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: ' . Bootstrap::url('portal/index.php'));
    exit;
}

if (!Csrf::validate((string) ($_POST['csrf'] ?? ''))) {
    header('Location: ' . Bootstrap::url('portal/index.php'));
    exit;
}

$applicationKey = (string) ($_POST['id'] ?? '');
$store = new JsonStore();
$submission = $store->getSubmissionByKey($applicationKey);

// Only minor submissions are actionable here.
if ($submission === null || !(bool) ($submission['is_minor_submission'] ?? false)) {
    header('Location: ' . Bootstrap::url('portal/index.php'));
    exit;
}

// Already confirmed → no duplicate email.
if (isset($submission['signed_form_received']) && is_array($submission['signed_form_received'])) {
    header('Location: ' . Bootstrap::url('portal/index.php?done=already'));
    exit;
}

$user = $auth->user() ?? ['email' => '', 'name' => ''];
$result = $store->markSignedFormReceived($applicationKey, [
    'received_by' => (string) ($user['name'] ?? ''),
    'received_by_email' => (string) ($user['email'] ?? ''),
]);

if ($result === null) {
    header('Location: ' . Bootstrap::url('portal/index.php'));
    exit;
}

// Only the call that actually set the marker sends the notification (no duplicate mail).
if (!$result['newly_marked']) {
    header('Location: ' . Bootstrap::url('portal/index.php?done=already'));
    exit;
}

$updated = $result['submission'];

Bootstrap::log('portal', 'Eingang unterschriebenes Formular bestätigt für ' . (string) ($updated['email'] ?? '')
    . ' durch ' . (string) ($user['email'] ?? ''));

$mailer = new Mailer();
$mailer->sendSignedFormReceivedMail($updated);

header('Location: ' . Bootstrap::url('portal/index.php?done=1'));
exit;