<?php
/**
 * Gitea Webhook 接收器
 * 路径: /var/www/webhook/receiver.php
 * 访问: https://webhook.micecola.top/kb-web.php
 */

// 配置
const SECRET = 'kb-web-webhook-secret-2024';  // 与 Gitea webhook 配置的密钥一致
const DEPLOY_SCRIPT = '/var/www/webhook/deploy.sh';
const LOG_FILE = '/var/log/webhook.log';

// 记录日志
function log_msg($msg) {
    $timestamp = date('Y-m-d H:i:s');
    file_put_contents(LOG_FILE, "[$timestamp] $msg\n", FILE_APPEND);
}

// 验证签名
function verify_signature($payload, $signature) {
    $expected = 'sha256=' . hash_hmac('sha256', $payload, SECRET);
    return hash_equals($expected, $signature);
}

// 主逻辑
log_msg("收到 webhook 请求");

$payload = file_get_contents('php://input');
$headers = getallheaders();

// 验证 Gitea 签名
$signature = $headers['X-Gitea-Signature'] ?? $headers['X-Gitea-Signature-Sha256'] ?? '';
if (!verify_signature($payload, $signature)) {
    log_msg("签名验证失败");
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$data = json_decode($payload, true);
$repo = $data['repository']['name'] ?? '';
$branch = basename($data['ref'] ?? '');
$commit = $data['after'] ?? '';

log_msg("仓库: $repo, 分支: $branch, 提交: $commit");

// 只处理 kb-web 仓库的 main 分支
if ($repo !== 'kb-web') {
    log_msg("忽略非目标仓库: $repo");
    echo json_encode(['status' => 'ignored', 'reason' => 'not target repo']);
    exit;
}

// 根据分支决定部署环境
$env = 'test';  // 默认测试环境
if ($branch === 'main' || $branch === 'master') {
    // main 分支也先部署到测试环境
    // 正式环境需要手动触发
    $env = 'test';
}

// 执行部署脚本
log_msg("开始部署到 $env 环境");
$cmd = sprintf('%s %s %s 2>&1', DEPLOY_SCRIPT, $env, $branch);
exec($cmd, $output, $return_var);

log_msg("部署输出: " . implode("\n", $output));
log_msg("部署结果: " . ($return_var === 0 ? '成功' : '失败'));

// 返回结果
header('Content-Type: application/json');
echo json_encode([
    'status' => $return_var === 0 ? 'success' : 'failed',
    'env' => $env,
    'branch' => $branch,
    'commit' => $commit,
    'output' => $output
], JSON_UNESCAPED_UNICODE);