<?php
header("Content-Type: application/json; charset=UTF-8");
error_reporting(E_ALL & ~E_NOTICE & ~E_WARNING);

// ====== SECURITY LAYER ======
$apiToken = "xyz123"; // samakan dengan di JS

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(["status" => false, "message" => "Gunakan POST"]);
    exit;
}

if ($_SERVER['HTTP_X_API_TOKEN'] !== $apiToken) {
    echo json_encode(["status" => false, "message" => "Unauthorized"]);
    exit;
}
// =============================

function cekRekeningFlip($bank_code, $account_number) {
    
    $flipKey = "JDJ5JDEzJHlkOFNYckl1a3U3VXJkZERKVnNZL3VTN1BLWmE2U3NMeUJXZC9COFV4LmZlb2VUTmdQaEN5"; // ganti dengan key kamu
    $url     = "https://bigflip.id/api/v2/disbursement/bank-account-inquiry";

    $data = [
        "bank_code"      => strtolower($bank_code),
        "account_number" => $account_number,
        "inquiry_key"    => uniqid("inq_")
    ];

    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        "Content-Type: application/x-www-form-urlencoded",
        "Accept: application/json; charset=UTF-8",
        "Authorization: Basic " . base64_encode($flipKey . ":")
    ]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));

    $response = curl_exec($ch);

    if (curl_errno($ch)) {
        $error_msg = curl_error($ch);
        curl_close($ch);
        return ["status" => false, "message" => $error_msg];
    }

    curl_close($ch);
    $result = json_decode($response, true);

    if (!$result) {
        return ["status" => false, "message" => "Flip API tidak balas JSON", "raw" => $response];
    }

    if (isset($result['account_number'])) {
        return [
            "status"         => true,
            "account_number" => $result['account_number'],
            "account_holder" => $result['account_holder'],
            "bank_code"      => $result['bank_code']
        ];
    }

    return ["status" => false, "message" => $result];
}

// ==== Eksekusi request ====
$bank_code      = $_POST['bank_code'] ?? '';
$account_number = $_POST['account_number'] ?? '';

if (empty($bank_code) || empty($account_number)) {
    echo json_encode(["status" => false, "message" => "Bank atau nomor rekening kosong"]);
    exit;
}

echo json_encode(cekRekeningFlip($bank_code, $account_number));