urukprize/backend/public/index.php

<?php

declare(strict_types=1);

// Set default timezone
date_default_timezone_set('Asia/Baghdad');

// 1. PSR-4 Autoloader Implementation with Composer fallback
if (file_exists(__DIR__ . '/../vendor/autoload.php')) {
    require_once __DIR__ . '/../vendor/autoload.php';
} else {
    spl_autoload_register(function (string $class) {
        $prefixes = [
            'Core\\' => __DIR__ . '/../core/',
            'App\\' => __DIR__ . '/../app/',
        ];

        foreach ($prefixes as $prefix => $baseDir) {
            $len = strlen($prefix);
            if (strncmp($prefix, $class, $len) !== 0) {
                continue;
            }

            $relativeClass = substr($class, $len);
            $file = $baseDir . str_replace('\\', '/', $relativeClass) . '.php';

            if (file_exists($file)) {
                require_once $file;
                return;
            }
        }
    });
}

// 2. Multi-Path Secure Environment Loader (Prioritizes Outside-Webroot .env on CloudPanel)
$envCandidates = [
    '/home/urukprize/.env',                      // 1. Production outside webroot on CloudPanel
    dirname(__DIR__, 4) . '/.env',               // 2. Dynamic 4-levels up from backend/public
    dirname(__DIR__, 2) . '/.env',               // 3. Project root on Mac local dev (/uruk-prize/.env)
    dirname(__DIR__, 1) . '/.env',               // 4. Decoy / fallback inside backend
];

foreach ($envCandidates as $candidate) {
    if (file_exists($candidate) && is_readable($candidate) && filesize($candidate) > 0) {
        $lines = file($candidate, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
        foreach ($lines as $line) {
            $line = trim($line);
            if (str_starts_with($line, '#') || !str_contains($line, '=')) {
                continue;
            }
            [$name, $val] = explode('=', $line, 2);
            $name = trim($name);
            $val = trim($val, " \t\n\r\0\x0B\"'");
            putenv("$name=$val");
            $_ENV[$name] = $val;
            $_SERVER[$name] = $val;
        }
        break; // Successfully loaded highest-priority environment file
    }
}

use Core\Request;
use Core\Response;
use Core\Router;
use App\Middlewares\SecurityHeaderMiddleware;
use App\Middlewares\AuthMiddleware;
use App\Middlewares\AdminMiddleware;
use App\Controllers\AuthController;
use App\Controllers\SubscriptionController;
use App\Controllers\QrController;
use App\Controllers\PartnerController;
use App\Controllers\PaymentController;
use App\Controllers\AdminController;
use App\Controllers\GatewayController;

$request = new Request();
$router = new Router();

// ==============================================================================
// PUBLIC ROUTES (No Strict Fingerprint Header Required for Initial Onboarding)
// ==============================================================================
$router->get('/api/v1/health', function (Request $req) {
    Response::success([
        'service' => 'Uruk International Prize Core Engine',
        'version' => '1.0.0',
        'server_time' => date('Y-m-d H:i:s'),
        'status' => 'operational',
    ]);
});

// Authentication routes
$router->post('/api/v1/auth/request-otp', [AuthController::class, 'requestOtp']);
$router->post('/api/v1/auth/verify-otp', [AuthController::class, 'verifyOtp']);

// Public directory of hospitals & hotels
$router->get('/api/v1/partners', [PartnerController::class, 'listPartners']);
$router->get('/api/v1/partners/{id}', [PartnerController::class, 'getPartner']);

// Public membership plan details
$router->get('/api/v1/subscription/plans', [SubscriptionController::class, 'getPlans']);

// Reception QR verification scanner (used by hospitals/hotels)
$router->post('/api/v1/qr/verify-token', [QrController::class, 'verifyToken']);

// Automated Payment Listeners & Webhooks
$router->post('/api/v1/payments/ingest-notification', [PaymentController::class, 'ingestNotification']);
$router->post('/api/v1/payments/swiftpay-webhook', [PaymentController::class, 'swiftPayWebhook']);

// ==============================================================================
// GATEWAY CALLER & SMS CLUSTER (Zain, Asiacell, Korek 3-Device Gateway Nodes)
// ==============================================================================
$router->get('/api/v1/gateway/pending-call', [GatewayController::class, 'pendingCall']);
$router->get('/pending-call.php', [GatewayController::class, 'pendingCall']);

$router->get('/api/v1/gateway/pending-sms', [GatewayController::class, 'pendingSms']);
$router->get('/pending-sms.php', [GatewayController::class, 'pendingSms']);

$router->post('/api/v1/gateway/call-done', [GatewayController::class, 'callDone']);
$router->post('/call-done.php', [GatewayController::class, 'callDone']);

$router->post('/api/v1/gateway/sms-done', [GatewayController::class, 'smsDone']);
$router->post('/sms-done.php', [GatewayController::class, 'smsDone']);

$router->post('/api/v1/gateway/register-device', [GatewayController::class, 'registerDevice']);
$router->post('/register-device.php', [GatewayController::class, 'registerDevice']);

// ==============================================================================
// SECURE USER ROUTES (Requires X-User-Id, X-Device-Fingerprint, Signature & Auth)
// ==============================================================================

$userMiddlewares = [SecurityHeaderMiddleware::class, AuthMiddleware::class];

$router->get('/api/v1/auth/profile', [AuthController::class, 'getProfile'], $userMiddlewares);
$router->get('/api/v1/subscription/my-card', [SubscriptionController::class, 'getMyCard'], $userMiddlewares);
$router->get('/api/v1/subscription/savings-summary', [SubscriptionController::class, 'getSavingsSummary'], $userMiddlewares);
$router->post('/api/v1/subscription/submit', [SubscriptionController::class, 'submitSubscription'], $userMiddlewares);
$router->get('/api/v1/qr/dynamic-token', [QrController::class, 'getDynamicToken'], $userMiddlewares);

// ==============================================================================
// HIDDEN IN-APP ADMIN ROUTES (Dr. Thamer & Management)
// ==============================================================================
$adminMiddlewares = [SecurityHeaderMiddleware::class, AuthMiddleware::class, AdminMiddleware::class];

$router->post('/api/v1/admin/partners/add', [AdminController::class, 'addPartner'], $adminMiddlewares);
$router->get('/api/v1/admin/payments/pending', [AdminController::class, 'listPendingPayments'], $adminMiddlewares);
$router->post('/api/v1/admin/payments/approve', [AdminController::class, 'approvePayment'], $adminMiddlewares);
$router->get('/api/v1/admin/stats', [AdminController::class, 'getStats'], $adminMiddlewares);

// Dispatch incoming request
$router->dispatch($request);