<?php
// /public/api/proxy.php
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
  http_response_code(204);
  exit;
}

$url = isset($_GET['url']) ? $_GET['url'] : '';
if (!$url) {
  http_response_code(400);
  header('Content-Type: text/plain; charset=utf-8');
  echo "Missing url";
  exit;
}

// Segurança: só permite seu Apps Script
$allowedPrefix = 'https://script.google.com/macros/s/AKfycbz1ju8rrbyG2u1irPTsDJaOeRS9RRjA5MlRIc0Oj7nTNSoxHStde6ws2Hr_wm-_er-jQQ/exec';
if (strpos($url, $allowedPrefix) !== 0) {
  http_response_code(403);
  header('Content-Type: text/plain; charset=utf-8');
  echo "URL not allowed";
  exit;
}

$ch = curl_init();
curl_setopt_array($ch, [
  CURLOPT_URL => $url,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_MAXREDIRS => 5,
  CURLOPT_CONNECTTIMEOUT => 10,
  CURLOPT_TIMEOUT => 25,
  CURLOPT_SSL_VERIFYPEER => true,
  CURLOPT_SSL_VERIFYHOST => 2,
  CURLOPT_USERAGENT => 'Mozilla/5.0 (Dashboard Proxy; +https://viniciusmartini.com)',
]);

$body = curl_exec($ch);
$err  = curl_error($ch);
$http = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
curl_close($ch);

if ($body === false || $http < 200 || $http >= 300) {
  http_response_code(502);
  header('Content-Type: text/plain; charset=utf-8');
  echo "Proxy error. HTTP={$http}. Err={$err}";
  exit;
}

if ($contentType) header('Content-Type: '.$contentType);
else header('Content-Type: text/html; charset=utf-8');

echo $body;