<?php
// ============================================================
// guard.php — AccessMyStuff Guard Snippet
// ============================================================
// INSTRUCTIONS:
//   Option A (single page): Paste this entire file's contents
//   at the very top of any PHP file (before any HTML output).
//
//   Option B (whole folder): Place this file in a folder as
//   guard.php, then add to .htaccess:
//     php_value auto_prepend_file /full/path/to/guard.php
//   Every PHP/HTML page in that folder is then protected.
//
//   Option C (.htaccess only): Place guard.php + the .htaccess
//   snippet from your dashboard in a folder. All requests
//   (including .html files served via PHP) are protected.
// ============================================================

// ── YOUR RESOURCE CREDENTIALS (from your dashboard) ──────────
define('AMS_RESOURCE_ID',   '1');      // e.g. '12'
define('AMS_ACCESS_TOKEN',  'eba9806dac10bcbf59e809b2a4cedc71de459390701b8081ac728c954ded20e8');     // 64-char hex
define('AMS_AUTH_DOMAIN',   'https://auth.accessmystuff.com');
define('AMS_SESSION_NAME',  'ams_local_1');
define('AMS_SESSION_DAYS',  30);       // e.g. 30
// ─────────────────────────────────────────────────────────────

(function () {
    // Start a session local to this domain, scoped to this resource
    $session_name = AMS_SESSION_NAME;
    if (session_name() !== $session_name) {
        session_name($session_name);
    }
    if (session_status() === PHP_SESSION_NONE) {
        session_set_cookie_params([
            'lifetime' => AMS_SESSION_DAYS * 86400,
            'path'     => '/',
            'secure'   => true,
            'httponly' => true,
            'samesite' => 'Lax',
        ]);
        session_start();
    }

    // ── Already authenticated locally? ───────────────────────
    if (!empty($_SESSION['ams_end_user_id'])) {
        return; // Access granted — page continues loading
    }

    // ── Handoff token in URL? ─────────────────────────────────
    // This fires once after redirect back from auth.accessmystuff.com
    $atok = $_GET['_atok'] ?? '';
    if ($atok) {
        $result = _ams_validate_token($atok);
        if ($result && $result['success']) {
            // Store in local session
            $_SESSION['ams_end_user_id']  = $result['end_user_id'];
            $_SESSION['ams_email']        = $result['email'];
            $_SESSION['ams_first_name']   = $result['first_name'];
            $_SESSION['ams_last_name']    = $result['last_name'];

            // Strip _atok from URL to keep things clean
            $clean_url = _ams_strip_param(
                (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'],
                '_atok'
            );
            header('Location: ' . $clean_url);
            exit;
        }
        // Invalid token — fall through to redirect to login
    }

    // ── Not authenticated — redirect to central auth ──────────
    $current_url  = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
    $current_url  = _ams_strip_param($current_url, '_atok'); // clean any stale token
    $redirect_to  = AMS_AUTH_DOMAIN . '/index.php'
                  . '?rid=' . urlencode(AMS_RESOURCE_ID)
                  . '&return=' . urlencode($current_url);

    header('Location: ' . $redirect_to);
    exit;

    // ── Helper: call central API to validate handoff token ────
    function _ams_validate_token(string $token): ?array {
        $api_url = AMS_AUTH_DOMAIN . '/api/validate.php';
        $payload = http_build_query([
            'token'        => $token,
            'resource_id'  => AMS_RESOURCE_ID,
            'access_token' => AMS_ACCESS_TOKEN,
        ]);

        // Try cURL first (most reliable)
        if (function_exists('curl_init')) {
            $ch = curl_init($api_url);
            curl_setopt_array($ch, [
                CURLOPT_POST           => true,
                CURLOPT_POSTFIELDS     => $payload,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT        => 5,
                CURLOPT_SSL_VERIFYPEER => true,
            ]);
            $response = curl_exec($ch);
            $err      = curl_error($ch);
            curl_close($ch);
            if ($err || !$response) return null;
        } else {
            // Fallback: file_get_contents (requires allow_url_fopen = On)
            $ctx = stream_context_create([
                'http' => [
                    'method'  => 'POST',
                    'header'  => 'Content-Type: application/x-www-form-urlencoded',
                    'content' => $payload,
                    'timeout' => 5,
                ],
            ]);
            $response = @file_get_contents($api_url, false, $ctx);
            if (!$response) return null;
        }

        return json_decode($response, true);
    }

    // ── Helper: remove a single param from a URL ─────────────
    function _ams_strip_param(string $url, string $param): string {
        $parsed = parse_url($url);
        $query  = [];
        if (!empty($parsed['query'])) {
            parse_str($parsed['query'], $query);
        }
        unset($query[$param]);
        $qs  = $query ? '?' . http_build_query($query) : '';
        $frag = isset($parsed['fragment']) ? '#' . $parsed['fragment'] : '';
        return ($parsed['scheme'] ?? 'https') . '://'
             . ($parsed['host']   ?? '')
             . ($parsed['path']   ?? '')
             . $qs . $frag;
    }
})();

// ============================================================
// If execution reaches here: end user is authenticated.
// Your page content continues below this point.
// You can optionally access:
//   $_SESSION['ams_end_user_id']
//   $_SESSION['ams_email']
//   $_SESSION['ams_first_name']
//   $_SESSION['ams_last_name']
// ============================================================
This is a test2