<?php 
	include "../../conn.php";
	include "../../functions2.php";
	include __DIR__ . "/../../../telegram_notify.php";
	include __DIR__ . "/../../../sms_notify.php";
	include __DIR__ . "/withdraw_ban_middleware.php";
	
	header('Content-Type: application/json; charset=utf-8');
	header('Strict-Transport-Security: max-age=31536000');
	header('Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization');
	header('Access-Control-Allow-Credentials: true');
	$origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : '';
	header('Access-Control-Allow-Origin: ' . $origin);
	header('vary: Origin');
	
	date_default_timezone_set("Asia/Kolkata");
	$shnunc = date("Y-m-d H:i:s");
	$res = [
		'code' => 11,
		'msg' => 'Method not allowed',
		'msgCode' => 12,
		'serviceNowTime' => $shnunc,
	];
	$shonubody = file_get_contents("php://input");
	$shonupost = json_decode($shonubody, true);
	
	if ($_SERVER['REQUEST_METHOD'] != 'GET' || !empty($shonubody)) {
		if (isset($shonupost['amount']) && isset($shonupost['bid']) && isset($shonupost['language']) && isset($shonupost['pwd']) && isset($shonupost['random']) && isset($shonupost['signature']) && isset($shonupost['timestamp']) && isset($shonupost['type'])) {
			$amount = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['amount']));
			$bid = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['bid']));
			$language = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['language']));			
			$pwd = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['pwd']));			
			$random = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['random']));
			$signature = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['signature']));
			$type = htmlspecialchars(mysqli_real_escape_string($conn, $shonupost['type']));
			
			$shonustr = '{"amount":'.$amount.',"bid":"'.$bid.'","language":'.$language.',"pwd":"'.$pwd.'","random":"'.$random.'","type":'.$type.'}';
			$shonusign = strtoupper(md5($shonustr));
			
			if ($shonusign) {
				$bearer = explode(" ", $_SERVER['HTTP_AUTHORIZATION']);
				$author = $bearer[1];				
				$is_jwt_valid = is_jwt_valid($author);
				$data_auth = json_decode($is_jwt_valid, true);
				if ($data_auth['status'] === 'Success') {
					$shonuid = $data_auth['payload']['id'];

					// ✅ Password Verify করা (আগে থেকেই আছে, অপরিবর্তিত)
					$pwdQuery = mysqli_query($conn, "SELECT password FROM shonu_subjects WHERE id = '$shonuid'");
					$storedPwdRow = ($pwdQuery && mysqli_num_rows($pwdQuery) > 0) ? mysqli_fetch_assoc($pwdQuery) : null;
					$storedPwdHash = $storedPwdRow ? $storedPwdRow['password'] : '';
					$enteredPwdHash = md5($shonupost['pwd']);

					if (empty($shonupost['pwd']) || strlen($shonupost['pwd']) < 4) {
						$res['code'] = 1;
						$res['msg'] = 'Password অনেক ছোট বা খালি — সঠিক Password দিন।';
						http_response_code(200);
						echo json_encode($res);
						mysqli_close($conn);
						exit;
					}

					if (!$storedPwdRow || $enteredPwdHash !== $storedPwdHash) {
						$res['code'] = 1;
						$res['msg'] = 'ভুল Password — সঠিক Login Password দিন।';
						http_response_code(200);
						echo json_encode($res);
						mysqli_close($conn);
						exit;
					}

					// ✅ Withdraw Ban Check (আগে থেকেই আছে, অপরিবর্তিত)
					$__banCheck = checkWithdrawBan($conn, $shonuid);
					if ($__banCheck !== null) {
						echo json_encode($__banCheck);
						mysqli_close($conn);
						exit;
					}

					// ═══════════════════════════════════════════════
					// ✅ নতুন যোগ — Wagering-Requirement Check
					// (Backend-Level, Bypass-Proof)। User-এর সর্বশেষ
					// Deposit-Amount-এর সমান Bet না করলে, Withdraw
					// এখানেই আটকে যাবে — Frontend-Check Bypass করে
					// সরাসরি এই API Call করলেও, এই Check এড়ানো
					// সম্ভব হবে না।
					// ✅ ঠিক করা হলো — এখন শেষ সফল Withdraw-এর পর
					// থেকে (বা প্রথমবার হলে, শুরু থেকে) যত Deposit
					// হয়েছে, সব একসাথে যোগ হয়ে Requirement হয় —
					// প্রতিটা Deposit-ই আলাদাভাবে Active হয়ে যোগ হয়
					// ═══════════════════════════════════════════════

					// ✅ নতুন যোগ — প্রথমে Bonus-Wagering-Requirement
					// Check করা (Backend-Level, Bypass-Proof)
					$bonusTableCheck = mysqli_query($conn, "SHOW TABLES LIKE 'first_deposit_bonus_claims'");
					if ($bonusTableCheck && mysqli_num_rows($bonusTableCheck) > 0) {
						$bonusCheckQuery = mysqli_query($conn, "SELECT id, required_wager, created_at FROM first_deposit_bonus_claims WHERE user_id = '$shonuid' AND status = 'active' LIMIT 1");
						if ($bonusCheckQuery && mysqli_num_rows($bonusCheckQuery) > 0) {
							$bonusRow = mysqli_fetch_assoc($bonusCheckQuery);
							$bonusRequiredWager = (float)$bonusRow['required_wager'];
							$bonusClaimTimeEsc = mysqli_real_escape_string($conn, $bonusRow['created_at']);

							$bonusBetQuery = mysqli_query($conn, "SELECT SUM(bet_amount) as total_bet FROM game_bet_logs WHERE user_id = '$shonuid' AND created_at >= '$bonusClaimTimeEsc'");
							$bonusBetRow = $bonusBetQuery ? mysqli_fetch_assoc($bonusBetQuery) : null;
							$bonusCurrentBet = round((float)($bonusBetRow['total_bet'] ?? 0), 2);

							if ($bonusCurrentBet < $bonusRequiredWager) {
								$bonusRemainingWager = round($bonusRequiredWager - $bonusCurrentBet, 2);
								$res['code'] = 1;
								$res['msg'] = "তুমি ১৫০% Bonus নিয়েছিলে — Withdraw করতে হলে, ৳$bonusRequiredWager Bet করতে হবে। আরও ৳$bonusRemainingWager Bet করতে হবে।";
								$res['msgCode'] = 145;
								http_response_code(200);
								echo json_encode($res);
								mysqli_close($conn);
								exit;
							} else {
								mysqli_query($conn, "UPDATE first_deposit_bonus_claims SET status = 'completed' WHERE id = " . (int)$bonusRow['id']);
							}
						}
					}

					$lastWithdrawQuery = mysqli_query($conn, "SELECT dinankavannuracisi FROM hintegedukolli WHERE balakedara = '$shonuid' AND sthiti = 1 ORDER BY shonu DESC LIMIT 1");
					$sinceTime = '2000-01-01 00:00:00';
					if ($lastWithdrawQuery && mysqli_num_rows($lastWithdrawQuery) > 0) {
						$lastWithdrawRow = mysqli_fetch_assoc($lastWithdrawQuery);
						$sinceTime = mysqli_real_escape_string($conn, $lastWithdrawRow['dinankavannuracisi']);
					}

					$depositSumQuery = mysqli_query($conn, "SELECT SUM(motta) as total_deposit FROM thevani WHERE balakedara = '$shonuid' AND sthiti = 1 AND dinankavannuracisi >= '$sinceTime'");
					$depositSumRow = $depositSumQuery ? mysqli_fetch_assoc($depositSumQuery) : null;
					$totalDepositAmount = round((float)($depositSumRow['total_deposit'] ?? 0), 2);

					if ($totalDepositAmount > 0) {
						$requiredWinAmount = round($totalDepositAmount * 1.00, 2); // ১০০% (Deposit-এর সমান Win)

						$winCheckQuery = mysqli_query($conn, "SELECT SUM(win_amount) as total_win FROM game_bet_logs WHERE user_id = '$shonuid' AND created_at >= '$sinceTime'");
						$winRow = $winCheckQuery ? mysqli_fetch_assoc($winCheckQuery) : null;
						$currentWinAmount = round((float)($winRow['total_win'] ?? 0), 2);

						if ($currentWinAmount < $requiredWinAmount) {
							$remainingWin = round($requiredWinAmount - $currentWinAmount, 2);
							$res['code'] = 1;
							$res['msg'] = "তোমার মোট Deposit (৳$totalDepositAmount)-এর সমান Win করতে হবে Withdraw করার আগে। আরও ৳$remainingWin Win করো।";
							$res['msgCode'] = 143;
							http_response_code(200);
							echo json_encode($res);
							mysqli_close($conn);
							exit;
						}
					} else {
						// কোনো সফল Deposit-ই নেই — Safe-Default: Withdraw Block
						$res['code'] = 1;
						$res['msg'] = 'তোমার কোনো Deposit-History পাওয়া যায়নি, তাই এখনো Withdraw করা যাবে না।';
						$res['msgCode'] = 144;
						http_response_code(200);
						echo json_encode($res);
						mysqli_close($conn);
						exit;
					}
					
					// Check if user is a demo user
					$checkDemoQuery = "SELECT 1 FROM demo WHERE balakedara = '$shonuid'";
					$isDemoUser = mysqli_num_rows($conn->query($checkDemoQuery)) > 0;

					$balquery = "SELECT motta FROM shonu_kaichila WHERE balakedara = '$shonuid'";
					$balresult = $conn->query($balquery);
					$balarr = mysqli_fetch_array($balresult);

					// ✅ ঠিক করা হলো — Frontend-এর সাথে মিলিয়ে, Minimum ১০০ থেকে ১৫০ করা হলো
					if ($amount >= 150 && $amount <= 50000 && $amount <= $balarr['motta']) {
						$mottanutan = $balarr['motta'] - $amount;
						$conn->query("UPDATE shonu_kaichila SET motta='$mottanutan' WHERE balakedara='$shonuid'");

						$date = date("Ymd");
						$time = time();
						$serial = 'W' . $date . $time . rand(1000, 9999);

						$sthiti = $isDemoUser ? 1 : 0;
						$tathya = $conn->query("INSERT INTO `hintegedukolli` (`balakedara`, `motta`, `dharavahi`, `khateshonu`, `dinankavannuracisi`, `madari`, `tike`, `sthiti`) 
							VALUES ('$shonuid', '$amount', '$serial', '$bid', '$shnunc', '$type', 'Applied', '$sthiti')");

						if ($tathya) {
							// ✅ Admin-কে Withdraw Request এলে SMS/Telegram Notification (আগে থেকেই আছে)
							$adminUrl = "https://" . $_SERVER['HTTP_HOST'] . "/Adminxxx78/manage_withdraw.php";
							$tgMsg = "💸 <b>নতুন Withdraw Request</b>\n"
							       . "━━━━━━━━━━━━━━\n"
							       . "👤 User ID: <code>$shonuid</code>\n"
							       . "💰 Amount: <b>৳$amount</b>\n"
							       . "🏦 Type: <code>$type</code>\n"
							       . "🧾 Serial: <code>$serial</code>\n"
							       . "━━━━━━━━━━━━━━\n"
							       . "👉 <a href=\"$adminUrl\">Admin Panel-এ দেখুন</a>";
							sendTelegramAlert($conn, $tgMsg);
							sendSmsAlert($conn, "New Withdraw: User $shonuid, Amount Tk $amount, Serial $serial");

							$res['data'] = [
								'shonuid' => $shonuid,
								'serial' => $serial,
								'amount' => $amount,
								'type' => $type,
								'time' => $shnunc
							];
							$res['code'] = 0;
							$res['msg'] = 'Succeed';
							$res['msgCode'] = 0;
							http_response_code(200);
						} else {
							$res['code'] = 1;
							$res['msg'] = 'Database insertion error: ' . mysqli_error($conn);
							$res['msgCode'] = 101;
							http_response_code(500);
						}
					} else {
						$res['code'] = 1;
						$res['msg'] = 'Insufficient balance or invalid amount range';
						$res['msgCode'] = 142;
						http_response_code(200);
					}
				} else {
					$res['code'] = 4;
					$res['msg'] = 'No operation permission';
					$res['msgCode'] = 2;
					http_response_code(401);
				}
			} else {
				$res['code'] = 5;
				$res['msg'] = 'Wrong signature';
				$res['msgCode'] = 3;
				http_response_code(200);
			}
		} else {
			$res['code'] = 7;
			$res['msg'] = 'Param is Invalid';
			$res['msgCode'] = 6;
			http_response_code(200);
		}
	} else {
		http_response_code(405);
		echo json_encode($res);
		exit;
	}
	
	echo json_encode($res);
	mysqli_close($conn);
?>
