#!/usr/bin/env php
<?php
/**
 * Generates the multi-domain env values for Coolify from docker/frontend-domains.json.
 *
 * Usage:
 *   php docker/gen-cors-env.php
 *
 * Output: ALLOWED_FRONTEND_HOSTS (comma-separated host list).
 * Paste it into the Coolify Environment Variables tab. The CORS origin regex is
 * built in PHP from this list (App\Shared\DependencyInjection\CorsRegexEnvProcessor),
 * so CORS_ALLOW_ORIGIN is no longer needed — a `$`-containing regex env gets mangled
 * by Coolify's interpolation, which is exactly the bug this avoids.
 */

$jsonFile = __DIR__ . '/frontend-domains.json';
if (!is_file($jsonFile)) {
    fwrite(STDERR, "Missing $jsonFile\n");
    exit(1);
}

try {
    $data = json_decode(file_get_contents($jsonFile), true, 512, JSON_THROW_ON_ERROR);
} catch (JsonException $e) {
    fwrite(STDERR, "Invalid JSON in $jsonFile: {$e->getMessage()}\n");
    exit(1);
}

if (!isset($data['domains']) || !is_array($data['domains'])) {
    fwrite(STDERR, "Expected a \"domains\" array in $jsonFile\n");
    exit(1);
}

$domains = [];
foreach ($data['domains'] as $entry) {
    $host = is_array($entry) ? ($entry['domain'] ?? null) : $entry;
    $host = is_string($host) ? trim($host) : '';
    if ($host === '') {
        continue;
    }
    if (!preg_match('/^[a-z0-9.-]+$/i', $host)) {
        fwrite(STDERR, "Skipping invalid domain: \"$host\"\n");
        continue;
    }
    $domains[strtolower($host)] = true; // dedupe, case-insensitive
}
$domains = array_keys($domains);
sort($domains);

if (empty($domains)) {
    fwrite(STDERR, "No valid domains found in $jsonFile\n");
    exit(1);
}

// Frontend hosts: bare hostnames, comma-separated. Drives both the CORS regex
// (CorsRegexEnvProcessor) and PaymentController host validation.
$hosts = implode(',', $domains);

echo "# ---- paste into Coolify env (" . count($domains) . " domains) ----\n\n";
echo "ALLOWED_FRONTEND_HOSTS=" . $hosts . "\n";