<?php
// TapPony CSV receiver. Appends one row per scan to a CSV file.
// Use with the "PHP CSV receiver" preset in TapPony. Save this file as
// tappony.php on your server and point the profile's URL at it.
//
// The CSV lands one folder above this script so the web server can't hand it
// out. Change $csv if your layout differs, and keep it out of the web root.

$csv    = dirname(__DIR__) . '/tappony-scans.csv';
$secret = '';   // To require signed requests, put your HMAC_KEY value here and turn on signing in the profile.

$body = file_get_contents('php://input');

if ($secret !== '') {
    $ts  = $_SERVER['HTTP_X_TAPPONY_TIMESTAMP'] ?? '';
    $sig = $_SERVER['HTTP_X_TAPPONY_SIGNATURE'] ?? '';
    $ok  = ctype_digit($ts) && abs(time() - (int)$ts) <= 300
        && hash_equals('sha256=' . hash_hmac('sha256', $ts . '.' . $body, $secret), $sig);
    if (!$ok) {
        http_response_code(401);
        exit;
    }
}

header('Content-Type: application/json');
$scan = json_decode($body, true);
if (!is_array($scan) || empty($scan['uid'])) {
    http_response_code(400);
    echo json_encode(['message' => 'Not a TapPony scan']);
    exit;
}

$cols = ['timestamp', 'uid', 'chip', 'tag_type', 'payload', 'device', 'seq'];
$row  = [];
foreach ($cols as $c) {
    $v = (string)($scan[$c] ?? '');
    // Keep spreadsheet apps from running a tag's content as a formula.
    if ($v !== '' && strpbrk($v[0], "=+-@\t\r") !== false) {
        $v = "'" . $v;
    }
    $row[] = $v;
}

$fh = fopen($csv, 'a');
if ($fh === false) {
    http_response_code(500);
    echo json_encode(['message' => 'Could not open the CSV file']);
    exit;
}
flock($fh, LOCK_EX);
clearstatcache(true, $csv);
if (filesize($csv) === 0) {
    fputcsv($fh, $cols);
}
fputcsv($fh, $row);
flock($fh, LOCK_UN);
fclose($fh);

echo json_encode(['message' => 'Logged ' . $scan['uid']]);