<?php
// #GoFile Connect API — plain PHP, no composer, no dependencies beyond curl.
$base   = 'https://api.gofile.co.uk';
$key    = 'gfk_sandbox_your_key_id_here';
$secret = 'gfs_sandbox_your_secret_here';

$gofileSaveConnection = static function (string $connectionId): void {
    // Demo only. Save connectionId encrypted in your database against the customer, service and environment.
    // Production: save connection_id encrypted in your customer database.
    $_SESSION['gofile_connections']['vat'] = $connectionId;
};

// Everything below handles the authorisation journey for you.
function gofile($path, $body, $key, $secret, $base, $extraHeaders = array()) {
    if (!is_string($path) || strpos($path, '/api/v1/') !== 0) {
        throw new RuntimeException('Use a full API path beginning /api/v1/.');
    }

    $raw = $body === null ? '' : json_encode($body);
    if ($raw === false) throw new RuntimeException('Could not encode request JSON: ' . json_last_error_msg());
    $ts = (string) time();
    $nonce = bin2hex(random_bytes(16));
    $canonical = $path . "\n" . $ts . "\n" . $nonce . "\n" . hash('sha256', $raw);
    $headers = array(
        'Content-Type: application/json',
        'X-GoFile-Key: ' . $key,
        'X-GoFile-Timestamp: ' . $ts,
        'X-GoFile-Nonce: ' . $nonce,
        'X-GoFile-Signature: ' . hash_hmac('sha256', $canonical, $secret),
    );
    $ch = curl_init($base . $path);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_HTTPHEADER, array_merge($headers, $extraHeaders));
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
    curl_setopt($ch, CURLOPT_TIMEOUT, 20);
    if ($raw !== '') curl_setopt($ch, CURLOPT_POSTFIELDS, $raw);
    $out = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE) ?: 'not supplied';
    $curlError = curl_error($ch);
    curl_close($ch);
    if ($out === false) throw new RuntimeException('API request failed: ' . $curlError);
    $reply = json_decode($out, true);
    if (json_last_error() !== JSON_ERROR_NONE || !is_array($reply)) {
        throw new RuntimeException('Expected a JSON object from ' . $path . '; received HTTP ' . $status
            . ' (Content-Type: ' . $contentType . '). Check the API base URL, path and server routing.');
    }
    return array($status, $reply);
}

// Save this complete example as a PHP page on YOUR HTTPS website.
// No return URL, registered origin or webhook is needed.
// In your product, require your own user sign-in and bind this page's
// server-side attempts and saved connection to the selected customer.
$base = getenv('GOFILE_API_BASE') ?: $base;
$key = getenv('GOFILE_KEY_ID') ?: $key;
$secret = getenv('GOFILE_SECRET') ?: $secret;
$service = 'vat';
$path = '/api/v1/authorise/' . $service;

header('Content-Type: text/html; charset=utf-8');
header('Cache-Control: no-store');
header('Referrer-Policy: no-referrer');
$scriptNonce = base64_encode(random_bytes(24));
header("Content-Security-Policy: default-src 'none'; script-src 'nonce-$scriptNonce'; connect-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'");
session_start(['use_strict_mode' => true, 'cookie_secure' => true,
    'cookie_httponly' => true, 'cookie_samesite' => 'Lax']);

function authorisationReply($status, $data) {
    session_write_close();
    http_response_code($status);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($data);
    exit;
}

// Keep result references briefly so a refresh or lost HTTP response can recover.
// GoFile itself expires abandoned authorisation journeys after twenty minutes.
foreach (($_SESSION['gofile_attempts'] ?? []) as $id => $attempt) {
    if (($attempt['retain_until'] ?? 0) <= time()) unset($_SESSION['gofile_attempts'][$id]);
}
$_SESSION['gofile_csrf'] = $_SESSION['gofile_csrf'] ?? bin2hex(random_bytes(32));
$stage = 'starting authorisation';
try {
    if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
        if (!is_string($_POST['csrf'] ?? null) || !hash_equals($_SESSION['gofile_csrf'], $_POST['csrf'])) {
            authorisationReply(403, ['error' => 'This page has expired. Reload it and try again.']);
        }
        // The browser supplies only a local reference, never a GoFile session ID
        // or customer ID. Resolve the GoFile session from this authenticated session.
        $id = is_string($_POST['attempt'] ?? null) ? $_POST['attempt'] : '';
        $attempt = $_SESSION['gofile_attempts'][$id] ?? null;
        if (!$attempt || $attempt['service'] !== $service) {
            authorisationReply(404, ['error' => 'This authorisation attempt is unavailable. Reload to start again.']);
        }
        $action = $_POST['action'] ?? '';
        $reply = null;
        if ($action === 'start') {
            if ($attempt['state'] === 'completed') authorisationReply(200, ['state' => 'completed']);
            if (in_array($attempt['state'], ['failed', 'expired'], true)) authorisationReply(200, ['state' => $attempt['state']]);
            if (empty($attempt['session_id'])) {
                $stage = 'requesting authorisation from GoFile';
                // Replace user-42 with the user ID from your authenticated backend session and
                // 999999999 with the customer's nine-digit VAT number: a new connection names the client it is for.
                // Stable idempotency key makes retrying this attempt safe.
                list($status, $reply) = gofile($path, array('software_user_id' => 'user-42', 'vat_number' => '999999999'), $key, $secret, $base,
                    ['Idempotency-Key: web-' . $service . '-' . $id]);
                if (!in_array($status, [200, 201], true)) throw new RuntimeException('Could not start authorisation: HTTP ' . $status . ' ' . ($reply['data']['message'] ?? $reply['detail'] ?? 'API error'));
                $data = $reply['data'] ?? [];
                $state = $reply['state'] ?? '';
                if (!in_array($state, ['pending', 'authorising', 'exchanging', 'completed', 'failed', 'expired'], true)) {
                    throw new RuntimeException('GoFile returned an unexpected authorisation state.');
                }
                if (!in_array($state, ['completed', 'failed', 'expired'], true)) {
                    $session = $data['authorisation_session_id'] ?? '';
                    if (!is_string($session) || !preg_match('/^aus_[a-f0-9]{48}$/D', $session)) throw new RuntimeException('GoFile returned an invalid session reference.');
                    $url = $data['authorisation_url'] ?? '';
                    if ($state !== 'exchanging' && (!is_string($url) || parse_url($url, PHP_URL_SCHEME) !== 'https'
                        || parse_url($url, PHP_URL_HOST) !== parse_url($base, PHP_URL_HOST)
                        || parse_url($url, PHP_URL_PORT) !== parse_url($base, PHP_URL_PORT)
                        || parse_url($url, PHP_URL_USER) !== null || parse_url($url, PHP_URL_PASS) !== null)) {
                        throw new RuntimeException('Unexpected authorisation destination.');
                    }
                    $attempt['session_id'] = $session;
                    $attempt['authorisation_url'] = $url;
                    $attempt['state'] = $state;
                    $_SESSION['gofile_attempts'][$id] = $attempt;
                    authorisationReply(200, ['state' => $state, 'authorisation_url' => $url]);
                }
                // A completed replay already contains the connection; save it below.
            } else authorisationReply(200, ['state' => $attempt['state'], 'authorisation_url' => $attempt['authorisation_url']]);
        }
        if (!in_array($action, ['start', 'status'], true)) authorisationReply(400, ['error' => 'Unknown action.']);
        if (in_array($attempt['state'], ['completed', 'failed', 'expired'], true)) {
            authorisationReply(200, ['state' => $attempt['state']]);
        }
        if ($reply === null) {
            if (empty($attempt['session_id'])) authorisationReply(409, ['error' => 'Start authorisation first.']);
            $stage = 'checking authorisation with GoFile';
            // One bounded API request per check. Never sleep or loop inside PHP.
            list($status, $reply) = gofile($path, array('authorisation_session_id' => $attempt['session_id']), $key, $secret, $base);
        }
        if ($status === 404 || $status === 410) $state = 'expired';
        elseif (!in_array($status, [200, 201], true)) throw new RuntimeException('Could not check authorisation: HTTP ' . $status . ' ' . ($reply['data']['message'] ?? $reply['detail'] ?? 'API error'));
        else $state = $reply['state'] ?? '';
        if (!in_array($state, ['pending', 'authorising', 'exchanging', 'completed', 'failed', 'expired'], true)) {
            throw new RuntimeException('GoFile returned an unexpected authorisation state.');
        }
        if ($state === 'completed') {
            $connection = $reply['data']['connection_id'] ?? '';
            if (!is_string($connection) || !preg_match('/^hmc_[a-f0-9]{24}$/D', $connection)) {
                throw new RuntimeException('GoFile did not return a valid completed connection.');
            }
            // Run the save step configured at the top of this file.
            // If saving throws, do not report success; the next check can retry.
            $stage = 'saving the connection in your software';
            $gofileSaveConnection($connection);
        }
        $_SESSION['gofile_attempts'][$id]['state'] = $state;
        if (in_array($state, ['completed', 'failed', 'expired'], true)) {
            unset($_SESSION['gofile_attempts'][$id]['authorisation_url']);
        }
        authorisationReply(200, ['state' => $state]);
    }

    // Resume an unfinished journey after refresh without asking users for IDs.
    $id = '';
    foreach (array_reverse($_SESSION['gofile_attempts'] ?? [], true) as $candidate => $attempt) {
        if ($attempt['service'] === $service && !in_array($attempt['state'], ['completed', 'failed', 'expired'], true)) {
            $id = $candidate; break;
        }
    }
    if ($id === '') {
        $id = bin2hex(random_bytes(16));
        $_SESSION['gofile_attempts'][$id] = ['service' => $service, 'state' => 'new', 'retain_until' => time() + 86400];
    }
    $resume = !empty($_SESSION['gofile_attempts'][$id]['session_id']);
    $config = ['csrf' => $_SESSION['gofile_csrf'], 'attempt' => $id, 'resume' => $resume];
    session_write_close();
    echo '<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">'
        . '<title>Connect ' . strtoupper($service) . '</title><body><h1>Connect ' . strtoupper($service) . '</h1>'
        . '<p id="message" role="status">Authorise through HMRC. This page will confirm when your connection is saved.</p>'
        . '<button id="connect" type="button">Continue to HMRC</button> '
        . '<button id="check" type="button" hidden>Check again</button> '
        . '<a id="continue" target="_blank" rel="noopener noreferrer" hidden>Open authorisation window</a>'
        . '<a id="restart" href="" hidden>Start a new authorisation</a>'
        . '<noscript><p>Enable JavaScript to open authorisation and check its result automatically.</p></noscript>';
    echo '<script nonce="' . $scriptNonce . '">const gofileAuthorisation = '
        . json_encode($config, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';' . "\n";
    echo '(() => {
    const message = document.getElementById(\'message\');
    const connect = document.getElementById(\'connect\');
    const check = document.getElementById(\'check\');
    const link = document.getElementById(\'continue\');
    const restart = document.getElementById(\'restart\');
    let timer, popup, busy = false, stopped = false, deadline = 0, failures = 0;

    async function request(action) {
        const response = await fetch(location.pathname, {
            method: \'POST\', credentials: \'same-origin\',
            headers: {\'Content-Type\': \'application/x-www-form-urlencoded\'},
            body: new URLSearchParams({action, csrf: gofileAuthorisation.csrf, attempt: gofileAuthorisation.attempt}),
            signal: AbortSignal.timeout(25000)
        });
        const text = await response.text();
        let result;
        try { result = JSON.parse(text); }
        catch (_) { throw new Error(\'The server returned an unreadable response (HTTP \' + response.status + \'). Check again or contact your software provider.\'); }
        if (!response.ok || result.error) throw new Error(result.error || \'Request failed (HTTP \' + response.status + \').\');
        return result;
    }

    function terminal(state) {
        if (![\'completed\', \'failed\', \'expired\'].includes(state)) return false;
        stopped = true;
        clearTimeout(timer);
        connect.hidden = check.hidden = link.hidden = true;
        restart.hidden = state === \'completed\';
        message.textContent = state === \'completed\'
            ? \'Authorisation complete. Your connection has been saved.\'
            : \'Authorisation \' + state + \'. Start a new authorisation to try again.\';
        // Success comes only from our backend, never from the popup closing.
        if (state === \'completed\' && popup) { try { popup.close(); } catch (_) {} }
        return true;
    }

    async function poll() {
        if (busy || stopped) return;
        clearTimeout(timer);
        busy = true;
        try {
            const result = await request(\'status\');
            failures = 0;
            if (terminal(result.state)) return;
            message.textContent = \'Waiting for HMRC authorisation. Complete it in the other window.\';
        } catch (error) {
            failures++;
            message.textContent = error.message;
        } finally {
            busy = false;
        }
        if (stopped) return;
        check.hidden = false;
        if (Date.now() >= deadline || failures >= 3) {
            message.textContent += \' Automatic checks have paused. Select Check again to resume.\';
            return;
        }
        // Serial, bounded checks. Closing a window is not a failure signal.
        timer = setTimeout(poll, failures ? 5000 : 3000);
    }

    connect.addEventListener(\'click\', async () => {
        if (busy || stopped) return;
        clearTimeout(timer);
        busy = true;
        connect.disabled = true;
        // Open synchronously from the user\'s click so popup blockers permit it.
        popup = window.open(\'about:blank\', \'_blank\', \'popup,width=640,height=800\');
        if (popup) popup.opener = null;
        try {
            const result = await request(\'start\');
            if (terminal(result.state)) return;
            if (result.authorisation_url) {
                link.href = result.authorisation_url;
                link.hidden = false;
                if (popup) { try { popup.location.replace(result.authorisation_url); } catch (_) {} }
            } else if (popup) popup.close();
            connect.hidden = true;
            message.textContent = popup ? \'Complete authorisation in the other window.\'
                : \'Open the authorisation window using the link, then return here. Completion is checked automatically.\';
            deadline = Date.now() + 20 * 60 * 1000;
            failures = 0;
        } catch (error) {
            if (popup) { try { popup.close(); } catch (_) {} }
            message.textContent = error.message;
            return;
        } finally {
            busy = false;
            connect.disabled = false;
        }
        await poll();
    });
    check.addEventListener(\'click\', () => {
        deadline = Date.now() + 20 * 60 * 1000;
        failures = 0;
        poll();
    });
    if (gofileAuthorisation.resume) {
        deadline = Date.now() + 20 * 60 * 1000;
        check.hidden = false;
        poll();
    }
})();
';
    echo '</script></body></html>';
} catch (Throwable $error) {
    $message = str_replace(array_filter([$key, $secret]), '[redacted]', $error->getMessage());
    error_log('GoFile authorisation error: ' . json_encode([
        'service' => $service, 'stage' => $stage, 'message' => $message,
    ], JSON_UNESCAPED_SLASHES | JSON_INVALID_UTF8_SUBSTITUTE));
    authorisationReply(500, ['error' => 'Unable to complete authorisation while ' . $stage . '. ' . $message]);
}