<?php
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: https://yourdomain.com'); // 🔁 REPLACE WITH YOUR DOMAIN (e.g., https://ellipal.com)
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    die(json_encode(['error' => 'Method not allowed']));
}

// Load config with API keys (NEVER exposed to browser)
if (!file_exists(__DIR__ . '/telegram-config.php')) {
    error_log('MISSING: telegram-config.php');
    http_response_code(500);
    die(json_encode(['error' => 'Server misconfiguration']));
}
require_once __DIR__ . '/telegram-config.php';

// Get and sanitize input
$data = json_decode(file_get_contents('php://input'), true);
if (!$data || !isset($data['type'])) {
    http_response_code(400);
    die(json_encode(['error' => 'Invalid payload']));
}

// Build EXACT same message format as your original JS
if ($data['type'] === 'visit') {
    $message = 
        "<b>🚀 New Visit</b>\n\n" .
        "🌐 <b>IP:</b> " . htmlspecialchars($data['ip'] ?? 'Unknown') . "\n" .
        "📍 <b>Location:</b> " . htmlspecialchars($data['city'] ?? 'Unknown') . ", " . htmlspecialchars($data['country'] ?? 'Unknown') . "\n" .
        "🕒 <b>Time:</b> " . htmlspecialchars($data['time'] ?? date('Y-m-d H:i:s')) . "\n\n" .
        "🖥️ <b>OS:</b> " . htmlspecialchars($data['os'] ?? 'Unknown') . "\n" .
        "💻 <b>PC Type:</b> " . htmlspecialchars($data['pcType'] ?? 'Desktop') . "\n" .
        "🌍 <b>Browser:</b> " . htmlspecialchars($data['browser'] ?? 'Unknown') . "\n\n" .
        "🌐 <b>Website:</b> " . htmlspecialchars($data['url'] ?? 'Unknown');
} else { // download
    $message = 
        "<b>⬇️ Download Started</b>\n\n" .
        "📄 <b>File:</b> " . htmlspecialchars($data['filename'] ?? 'Unknown') . "\n" .
        "🕒 <b>Time:</b> " . htmlspecialchars($data['time'] ?? date('Y-m-d H:i:s')) . "\n" .
        "🖥️ <b>OS:</b> " . htmlspecialchars($data['os'] ?? 'Unknown') . "\n" .
        "💻 <b>PC Type:</b> " . htmlspecialchars($data['pcType'] ?? 'Desktop') . "\n" .
        "🌍 <b>Browser:</b> " . htmlspecialchars($data['browser'] ?? 'Unknown') . "\n\n" .
        "🌐 <b>Website:</b> " . htmlspecialchars($data['url'] ?? 'Unknown');
}

// Send to Telegram with HTML formatting
$ch = curl_init("https://api.telegram.org/bot" . TELEGRAM_BOT_TOKEN . "/sendMessage");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'chat_id' => TELEGRAM_CHAT_ID,
    'text' => $message,
    'parse_mode' => 'HTML',
    'disable_web_page_preview' => true
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200) {
    echo json_encode(['success' => true]);
} else {
    error_log("Telegram error ($http_code): " . substr($response, 0, 500));
    http_response_code(502);
    echo json_encode(['error' => 'Notification failed']);
}
?>