<?php
/**
 * PHP Mailer API Endpoint for Advanced Email Sender
 * 
 * Instructions:
 * 1. Upload this file to your web server (e.g., public_html/mailer.php)
 * 2. Change 'YOUR_SECRET_TOKEN_HERE' to a strong password.
 * 3. Put the URL (e.g., https://yourdomain.com/mailer.php) into the Sender App.
 */

// Allow CORS if needed
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-Type');
header('Content-Type: application/json');

// Handle preflight OPTIONS request
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    die(json_encode(["status" => "error", "message" => "Invalid request method"]));
}

// Parse JSON input
$input = json_decode(file_get_contents('php://input'), true);
if (!$input) {
    http_response_code(400);
    die(json_encode(["status" => "error", "message" => "Invalid JSON payload"]));
}

// --- CONFIGURATION ---
// CHANGE THIS TOKEN to secure your script!
$expected_token = 'SMOX_PRIV8_2026'; 
// ---------------------

$token = $input['token'] ?? '';
if ($token !== $expected_token) {
    http_response_code(401);
    die(json_encode(["status" => "error", "message" => "Unauthorized: Invalid token"]));
}

$to = $input['to'] ?? '';
$subject = $input['subject'] ?? '';
$body = $input['body'] ?? '';
$headers = $input['headers'] ?? '';
$from = $input['from'] ?? '';
$encoded = $input['encoded'] ?? false;

if ($encoded) {
    $body = base64_decode($body);
    $headers = base64_decode($headers);
    // Subject could also be encoded if needed, but WAFs usually block body/headers
}
$from = $input['from'] ?? '';

if (empty($to) || empty($subject) || empty($body)) {
    http_response_code(400);
    die(json_encode(["status" => "error", "message" => "Missing required fields (to, subject, body)"]));
}

// Add -f flag for Return-Path to improve deliverability and bounce handling
$additional_params = "";
if (!empty($from)) {
    $additional_params = "-f " . escapeshellarg($from);
}

// Send email using PHP's built-in mail() function
$sent = mail($to, $subject, $body, $headers, $additional_params);

if ($sent) {
    echo json_encode(["status" => "success", "message" => "Email successfully sent via PHP mail()"]);
} else {
    http_response_code(500);
    echo json_encode(["status" => "error", "message" => "PHP mail() function returned false. Your server might have disabled it."]);
}
?>