?php
/**
 * 入口 index.php
 * 复刻 y28.my 行为：
 *   GET /  →  302  Location: url.php?id=<默认ID>&sj=<unixtime>
 *   Content-Type: application/json
 *   Access-Control-Allow-Origin: *
 *   Set-Cookie: server_name_session=<32位hex>; Max-Age=86400; httponly; path=/
 *
 * 多域名支持：按 HTTP_HOST 自动匹配最合适的活码
 */
declare(strict_types=1);

require __DIR__ . '/inc/config.php';
require __DIR__ . '/inc/db.php';
require __DIR__ . '/inc/func.php';

// ---------- 会话 Cookie（复刻 y28.my 的 server_name_session）----------
boot_session_cookie();

// 已经是 url.php 的转发
if (!empty($_GET['id'])) {
    require __DIR__ . '/url.php';
    exit;
}

// ---------- 选活码：优先按域名绑定 ----------
$host = strtolower(preg_replace('/:\d+$/', '', $_SERVER['HTTP_HOST'] ?? ''));
$link = null;

if ($host !== '') {
    $link = db_one(
        'SELECT * FROM `hm_link`
         WHERE `status` = 1 AND (`domain` = ? OR `domain` = "" OR `domain` IS NULL)
         ORDER BY (`domain` = ?) DESC, `sort` ASC, `id` ASC
         LIMIT 1',
        [$host, $host]
    );
}

if (!$link) {
    // 兜底：取第一条启用的
    $link = db_one('SELECT * FROM `hm_link` WHERE `status` = 1 ORDER BY `sort` ASC, `id` ASC LIMIT 1');
}

if (!$link) {
    header('Content-Type: text/html; charset=UTF-8');
    echo '<p>缺少或非法的 hmid 参数</p>';
    exit;
}

// ---------- 输出 302（复刻原系统的 JSON 头 + 302）----------
header('Content-Type: application/json; charset=UTF-8');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: *');
header('Cache-Control: no-store, no-cache, must-revalidate');

redirect('url.php?id=' . $link['id'] . '&sj=' . time());