<?php
/**
 * Endpoint: GET /buscador.php?username=X&password=X&baseurl=X&tipoid=X&search=X
 *
 * Proxy al VPS xtream-proxy (Node + got-scraping con TLS impersonation).
 * El VPS pasa el WAF de servers Xtream que bloquean a Hostinger.
 *
 * IMPORTANTE: el canal Roku NO conoce la API key — esta vive solo aqui
 * (server-side en el panel). El cliente final no ve nada.
 *
 * tipoid: 0=todos {live,movies,series}, 1=live, 2=vod, 3=series.
 * Retorna lo que retorne el VPS sin transformar.
 */
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');

// === CONFIG (server-side desde admin/config.json) ===
$configPath = __DIR__ . '/admin/config.json';
$cfg = is_file($configPath) ? json_decode(@file_get_contents($configPath), true) : [];
$VPS_BASE = $cfg['app_conf']['buscador_url']     ?? 'http://147.93.186.245';
$VPS_KEY  = $cfg['app_conf']['buscador_api_key'] ?? '';

if ($VPS_KEY === '') {
    echo json_encode(['error' => 'buscador api key not configured']);
    exit;
}

$username = $_GET['username'] ?? '';
$password = $_GET['password'] ?? '';
$baseurl  = $_GET['baseurl']  ?? '';
$tipoid   = $_GET['tipoid']   ?? '0';
$search   = $_GET['search']   ?? '';

if ($username === '' || $password === '' || $baseurl === '') {
    echo json_encode(['error' => 'missing params']);
    exit;
}

// Pasar el host del panel como "domain" para que el master-admin pueda
// validar restricciones de dominio por licencia.
$domain = $_SERVER['HTTP_HOST'] ?? '';

$qs = http_build_query([
    'api_key'  => $VPS_KEY,
    'username' => $username,
    'password' => $password,
    'baseurl'  => $baseurl,
    'tipoid'   => $tipoid,
    'search'   => $search,
    'domain'   => $domain,
]);

$url = rtrim($VPS_BASE, '/') . '/buscador?' . $qs;

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 60,
    CURLOPT_FOLLOWLOCATION => true,
]);
$rsp = curl_exec($ch);
$http = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$err  = curl_error($ch);
curl_close($ch);

if ($rsp === false || $http >= 500) {
    echo json_encode([
        'error' => 'vps unreachable',
        'http'  => $http,
        'curl'  => $err,
    ]);
    exit;
}

http_response_code($http ?: 200);
echo $rsp;