<?php
declare(strict_types=1);
// Jednorazowy instalator TKLM V4; tylko administrator, ochrona CSRF.
require_once dirname(__DIR__).'/includes/functions.php';
require_admin_role();
header('Cache-Control: private, no-store, max-age=0');
header('X-Robots-Tag: noindex, nofollow');
$root=dirname(__DIR__);
$stage=__DIR__.'/_tklm_v4_stage';
$files = [
    'admin/menus.php' => ['old'=>'363833376c87afc75cfb09d40ddbfebbe0ffa74a7940473dfb8d523ff2a266d2','new'=>'2b6af4e858dc687fe054671d5793031ec8a12954aa12045cbd6bc4997a39731e'],
    'admin/reservations.php' => ['old'=>'09e2c3165c770214003674719f50d22ca2caf0cda1d090b8909756e46f8a3e69','new'=>'85fdd1e2241938b52e7d33bb8f20656f9f71eecd015f2c6c106cb2f31861a7bb'],
    'admin/tklm-menu-word.php' => ['old'=>'2f712db9fce9666ea7d04bdcf543a1b63349fa642b2c12bfc827683842dfe6fd','new'=>'0f91c5d32b5bc7aac6122fcc1b3343ffccaa62b606d420815375159276badeba'],
    'includes/tklm_menu_word.php' => ['old'=>'5de5eb667bf829bbcc12f721be29706eb4c69995496f7aa877da82dba3bef7de','new'=>'fe3900c009e3e45d97c75c56b8362ded284f634892bed5f21320c7db503cc663'],
];

function tklm_h(string $s):string{return htmlspecialchars($s,ENT_QUOTES|ENT_SUBSTITUTE,'UTF-8');}
function tklm_state(string $target,string $old,string $new):string {
    if(!is_file($target))return 'BRAK';
    $sum=hash_file('sha256',$target);
    if(hash_equals($new,$sum))return 'JUZ V4';
    if(hash_equals($old,$sum))return 'ZGODNY';
    return 'KONFLIKT';
}
$messages=[];$statuses=[];
foreach($files as $relative=>$hashes){
 $target=$root.'/'.$relative;
 $source=$stage.'/'.basename($relative);
 $statuses[$relative]=tklm_state($target,$hashes['old'],$hashes['new']);
 if(!is_file($source)||!hash_equals($hashes['new'],hash_file('sha256',$source)))$statuses[$relative]='PACZKA USZKODZONA';
}
if($_SERVER['REQUEST_METHOD']==='POST'){
 verify_csrf();
 if(($_POST['action']??'')==='install'){
  $blocking=array_filter($statuses,static fn($v)=>!in_array($v,['ZGODNY','JUZ V4'],true));
  if($blocking){$messages[]='Wstrzymano: co najmniej jeden plik jest inny. Nie nadpisano zadnych plikow.';}
  else {
   $stamp=date('Ymd_His').'_'.bin2hex(random_bytes(4));
   $backup=$stage.'/_backups/'.$stamp;
   if(!is_dir($backup)&&!mkdir($backup,0700,true))throw new RuntimeException('Nie mozna utworzyc backupu.');
   $done=[];$changes=[];
   try{
    // Przed jakakolwiek podmiana: kopie WSZYSTKICH plikow z kodem PHP jako pliki wykonywalne-404 (nie sa dostepnym kodem zrodlowym).
    foreach($files as $relative=>$hashes){
     if($statuses[$relative]==='JUZ V4')continue;
     $target=$root.'/'.$relative;
     if(!is_writable($target)||!is_writable(dirname($target)))throw new RuntimeException('Brak praw zapisu: '.$relative);
     $bak=$backup.'/'.str_replace('/','__',$relative).'.php';
     $raw=file_get_contents($target);
     if($raw===false)throw new RuntimeException('Nie mozna odczytac: '.$relative);
     $wrap='<?php http_response_code(404); exit; __halt_compiler(); ?>'."\n".base64_encode($raw);
     if(file_put_contents($bak,$wrap,LOCK_EX)===false)throw new RuntimeException('Nie mozna zrobic backupu: '.$relative);
     $changes[$relative]=$raw;
    }
    foreach($files as $relative=>$hashes){
     if($statuses[$relative]==='JUZ V4')continue;
     $target=$root.'/'.$relative;$source=$stage.'/'.basename($relative);
     $new=file_get_contents($source);
     if($new===false)throw new RuntimeException('Nie mozna odczytac nowego pliku: '.$relative);
     $tmp=$target.'.tklmv4_'.bin2hex(random_bytes(3));
     if(file_put_contents($tmp,$new,LOCK_EX)===false)throw new RuntimeException('Nie mozna zapisac: '.$relative);
     @chmod($tmp,fileperms($target)&0777);
     if(!rename($tmp,$target)) { @unlink($tmp); throw new RuntimeException('Nie mozna aktywowac: '.$relative); }
     $done[]=$relative;
    }
    foreach($files as $relative=>$hashes){
      if(!hash_equals($hashes['new'],hash_file('sha256',$root.'/'.$relative)))throw new RuntimeException('Weryfikacja pliku nieudana: '.$relative);
    }
    $messages[]='SUKCES: V4 zainstalowana; kopia: '.$backup;
    foreach($files as $relative=>$hashes){$statuses[$relative]='JUZ V4';}
   }catch(Throwable $e){
    // Rollback natychmiastowy tylko tych plikow, ktore zdazylismy zmienic.
    foreach(array_reverse($done) as $relative){
      $target=$root.'/'.$relative;
      if(isset($changes[$relative]))file_put_contents($target,$changes[$relative],LOCK_EX);
    }
    $messages[]='BLAD; probowano przywrocic poprzednie pliki: '.$e->getMessage();
   }
  }
 }
}
render_admin_header('TKLM POLANA V4 - instalacja');
?>
<div class="admin-title-row"><div><h1>TKLM POLANA — Naprawa V4</h1><p>Word bez plikow tymczasowych, usuwanie kart i rezerwacji, paginacja.</p></div></div>
<?php foreach($messages as $m):?><div class="card" style="padding:16px;margin-bottom:12px"><?=tklm_h($m)?></div><?php endforeach;?>
<div class="card" style="padding:20px;margin-bottom:18px"><h2>Kontrola aktualnych plikow</h2><table class="admin-table"><thead><tr><th>Plik</th><th>Status</th></tr></thead><tbody>
<?php foreach($statuses as $name=>$status):?><tr><td><?=tklm_h($name)?></td><td><strong><?=tklm_h($status)?></strong></td></tr><?php endforeach;?></tbody></table>
<p><strong>ZGODNY</strong> — przygotowany do aktualizacji; <strong>JUZ V4</strong> — nowa wersja jest na serwerze; <strong>KONFLIKT</strong> — zatrzymaj i przeslij mi obecny plik, by scalic zmiany.</p>
<form method="post"><?=csrf_field()?><input type="hidden" name="action" value="install"><button class="btn btn-primary" type="submit" <?=array_filter($statuses,static fn($v)=>!in_array($v,['ZGODNY','JUZ V4'],true))?'disabled':''?>>Zainstaluj V4 z backupem</button></form>
</div>
<p>Po instalacji sprawdz <a href="/admin/menus.php">Karty menu</a>, <a href="/admin/reservations.php">Rezerwacje</a>, a Word pobierz z <a href="/admin/tklm-menu.php">Centrum Menu</a>. Instalator i katalog <code>_tklm_v4_stage</code> usun dopiero po pomyslnych testach. Nie ujawniaj jego backupow.</p>
<?php render_admin_footer(); ?>