<?php
declare(strict_types=1);

function smtp_secret_file(): string
{
    return dirname(__DIR__) . '/storage/smtp.secret';
}

function smtp_secret_key(bool $create = true): string
{
    $file = smtp_secret_file();

    if (is_file($file)) {
        $raw = file_get_contents($file);
        if (is_string($raw) && strlen($raw) >= 32) {
            return $raw;
        }
    }

    if (!$create) {
        return '';
    }

    $dir = dirname($file);
    if (!is_dir($dir)) {
        @mkdir($dir, 0700, true);
    }

    $key = random_bytes(32);
    @file_put_contents($file, $key, LOCK_EX);
    @chmod($file, 0600);

    return $key;
}

function smtp_encrypt_password(string $password): string
{
    if ($password === '') {
        return '';
    }

    if (function_exists('openssl_encrypt')) {
        $key = smtp_secret_key(true);
        $iv = random_bytes(12);
        $tag = '';

        $cipher = openssl_encrypt(
            $password,
            'aes-256-gcm',
            $key,
            OPENSSL_RAW_DATA,
            $iv,
            $tag
        );

        if (is_string($cipher)) {
            return 'enc:' . base64_encode($iv . $tag . $cipher);
        }
    }

    return 'b64:' . base64_encode($password);
}

function smtp_decrypt_password(string $stored): string
{
    if ($stored === '') {
        return '';
    }

    if (str_starts_with($stored, 'enc:') && function_exists('openssl_decrypt')) {
        $raw = base64_decode(substr($stored, 4), true);

        if (is_string($raw) && strlen($raw) > 28) {
            $iv = substr($raw, 0, 12);
            $tag = substr($raw, 12, 16);
            $cipher = substr($raw, 28);
            $key = smtp_secret_key(false);

            if ($key !== '') {
                $plain = openssl_decrypt(
                    $cipher,
                    'aes-256-gcm',
                    $key,
                    OPENSSL_RAW_DATA,
                    $iv,
                    $tag
                );

                if (is_string($plain)) {
                    return $plain;
                }
            }
        }

        return '';
    }

    if (str_starts_with($stored, 'b64:')) {
        $plain = base64_decode(substr($stored, 4), true);
        return is_string($plain) ? $plain : '';
    }

    return $stored;
}

function smtp_password(): string
{
    return smtp_decrypt_password(setting('smtp_password_secret', ''));
}

function smtp_password_is_set(): bool
{
    return setting('smtp_password_secret', '') !== '';
}

function smtp_expect($stream, array $expectedCodes): string
{
    $response = '';
    $code = 0;

    while (($line = fgets($stream, 8192)) !== false) {
        $response .= $line;

        if (preg_match('/^(\d{3})([ -])/', $line, $m)) {
            $code = (int)$m[1];

            if ($m[2] === ' ') {
                break;
            }
        }
    }

    if (!in_array($code, $expectedCodes, true)) {
        throw new RuntimeException(
            'SMTP zwrócił błąd ' . $code . ': ' . trim($response)
        );
    }

    return $response;
}

function smtp_command($stream, string $command, array $expectedCodes): string
{
    if (fwrite($stream, $command . "\r\n") === false) {
        throw new RuntimeException('Nie udało się wysłać polecenia do serwera SMTP.');
    }

    return smtp_expect($stream, $expectedCodes);
}

function smtp_header_encode(string $value): string
{
    if (function_exists('mb_encode_mimeheader')) {
        return mb_encode_mimeheader($value, 'UTF-8', 'B', "\r\n");
    }

    return $value;
}

function smtp_clean_email(string $email): string
{
    $email = trim($email);

    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        throw new InvalidArgumentException('Nieprawidłowy adres e-mail: ' . $email);
    }

    return $email;
}

function smtp_send_mail(
    string $to,
    string $subject,
    string $html,
    string $text = '',
    ?string $replyTo = null
): void {
    if (setting('smtp_enabled', '0') !== '1') {
        throw new RuntimeException('Wysyłka SMTP jest wyłączona w panelu.');
    }

    $host = trim(setting('smtp_host', ''));
    $port = (int)setting('smtp_port', '587');
    $security = setting('smtp_security', 'starttls');
    $username = trim(setting('smtp_username', ''));
    $password = smtp_password();
    $fromEmail = trim(setting('smtp_from_email', ''));
    $fromName = trim(setting('smtp_from_name', setting('site_name', APP_NAME)));

    if ($host === '' || $port < 1 || $fromEmail === '') {
        throw new RuntimeException('Uzupełnij host, port i adres nadawcy SMTP.');
    }

    $to = smtp_clean_email($to);
    $fromEmail = smtp_clean_email($fromEmail);

    if ($replyTo !== null && trim($replyTo) !== '') {
        $replyTo = smtp_clean_email($replyTo);
    }

    $scheme = $security === 'ssl' ? 'ssl' : 'tcp';
    $remote = sprintf('%s://%s:%d', $scheme, $host, $port);

    $context = stream_context_create([
        'ssl' => [
            'verify_peer' => true,
            'verify_peer_name' => true,
            'allow_self_signed' => false,
            'SNI_enabled' => true,
        ],
    ]);

    $errno = 0;
    $errstr = '';

    $stream = @stream_socket_client(
        $remote,
        $errno,
        $errstr,
        15,
        STREAM_CLIENT_CONNECT,
        $context
    );

    if (!is_resource($stream)) {
        throw new RuntimeException(
            'Nie udało się połączyć z SMTP: ' . ($errstr ?: 'błąd połączenia') .
            ($errno ? ' (' . $errno . ')' : '')
        );
    }

    stream_set_timeout($stream, 15);

    try {
        smtp_expect($stream, [220]);

        $helo = $_SERVER['HTTP_HOST'] ?? 'polanasmakow.pl';
        $helo = preg_replace('/:\d+$/', '', $helo) ?: 'polanasmakow.pl';

        smtp_command($stream, 'EHLO ' . $helo, [250]);

        if ($security === 'starttls') {
            smtp_command($stream, 'STARTTLS', [220]);

            $crypto = @stream_socket_enable_crypto(
                $stream,
                true,
                STREAM_CRYPTO_METHOD_TLS_CLIENT
            );

            if ($crypto !== true) {
                throw new RuntimeException('Nie udało się uruchomić STARTTLS.');
            }

            smtp_command($stream, 'EHLO ' . $helo, [250]);
        }

        if ($username !== '') {
            smtp_command($stream, 'AUTH LOGIN', [334]);
            smtp_command($stream, base64_encode($username), [334]);
            smtp_command($stream, base64_encode($password), [235]);
        }

        smtp_command($stream, 'MAIL FROM:<' . $fromEmail . '>', [250]);
        smtp_command($stream, 'RCPT TO:<' . $to . '>', [250, 251]);
        smtp_command($stream, 'DATA', [354]);

        if ($text === '') {
            $text = trim(
                preg_replace('/\s+/', ' ', strip_tags(
                    str_replace(['<br>', '<br/>', '<br />'], "\n", $html)
                )) ?? ''
            );
        }

        $headers = [
            'Date: ' . date(DATE_RFC2822),
            'Message-ID: <' . bin2hex(random_bytes(12)) . '@' . $helo . '>',
            'From: ' . smtp_header_encode($fromName) . ' <' . $fromEmail . '>',
            'To: <' . $to . '>',
            'Subject: ' . smtp_header_encode($subject),
            'MIME-Version: 1.0',
            'Content-Type: text/html; charset=UTF-8',
            'Content-Transfer-Encoding: 8bit',
        ];

        if ($replyTo !== null && $replyTo !== '') {
            $headers[] = 'Reply-To: <' . $replyTo . '>';
        }

        $message = implode("\r\n", $headers)
            . "\r\n\r\n"
            . str_replace("\n.", "\n..", str_replace(["\r\n", "\r"], "\n", $html))
            . "\r\n.";

        if (fwrite($stream, $message . "\r\n") === false) {
            throw new RuntimeException('Nie udało się wysłać treści wiadomości SMTP.');
        }

        smtp_expect($stream, [250]);

        @smtp_command($stream, 'QUIT', [221]);
    } finally {
        fclose($stream);
    }
}