<?php
/**
 * Minecraft正版验证 - Microsoft OAuth代理
 *
 * 流程：
 * 1. Java调用 create_session → 生成授权URL → 返回给Java
 * 2. 玩家在浏览器打开URL → Microsoft登录 → 回调到本文件callback
 * 3. callback处理授权码 → 交换token → 获取Minecraft profile → 存入SQLite
 * 4. Java轮询 check_session → 返回验证状态和profile
 *
 * Actions:
 *   create_session  - 创建验证会话，返回授权URL
 *   check_session   - 检查会话状态（Java轮询）
 *   callback        - Microsoft OAuth回调（浏览器重定向）
 */

header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');

// 加载密钥配置
require_once __DIR__ . '/pay_secrets.php';
// 第四层：全局限流（2026-09-30）
require_once __DIR__ . '/../security.php';

// ====================================================================
//  ★ IP黑名单拦截（与 core.php 的 enforceIpBlacklist 同源数据）
//  本文件不引 core.php（自成体系），故内联一份同等逻辑：
//  被封IP访问必须携带游戏内 /web 签发的有效 token，否则 403；
//  Java 插件的 secret 调用与任何异常一律放行（fail-open）。
// ====================================================================
require_once __DIR__ . '/../config.php';   // 取 SECRET_KEY（require_once，不会重复定义）
// ★ 人机验证码（2026-10-02）：CF/VA 统一接入，见 captcha_guard.php
require_once __DIR__ . '/../captcha_guard.php';
function mcAuthIpBlacklisted() {
    if (PHP_SAPI === 'cli') return false;
    $ip = $_SERVER['REMOTE_ADDR'] ?? '';
    if ($ip === '') return false;
    // 放行通道：Java插件 secret
    if (isset($_REQUEST['secret']) && $_REQUEST['secret'] === SECRET_KEY) return false;
    try {
        $path = dirname(__DIR__) . '/db/web.db';
        if (!file_exists($path)) return false;
        $w = new PDO('sqlite:' . $path);
        $w->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $st = $w->prepare("SELECT 1 FROM web_ip_blacklist WHERE ip = ? AND (expire = 0 OR expire > ?) LIMIT 1");
        $st->execute([$ip, time()]);
        if (!$st->fetch()) return false;              // 未被封 → 放行
        // 被封 → 必须持游戏内 /web 签发的有效token
        $token = isset($_REQUEST['web_token']) ? (string)$_REQUEST['web_token'] : '';
        if ($token === '') return true;
        $t = $w->prepare("SELECT created_at, expire_seconds FROM weblogin_tokens WHERE web_token = ? LIMIT 1");
        $t->execute([$token]);
        $row = $t->fetch(PDO::FETCH_ASSOC);
        return !($row && (time() - (int)$row['created_at']) <= (int)$row['expire_seconds']);
    } catch (\Throwable $e) {
        return false;                                 // 任何异常 fail-open，避免误伤
    }
}
if (mcAuthIpBlacklisted()) {
    http_response_code(403);
    echo json_encode(['success' => false, 'blocked_ip' => true,
        'message' => '该IP已被服务器封禁，需在游戏内执行 /web 获取授权token后才能访问'], JSON_UNESCAPED_UNICODE);
    exit;
}

// ====================================================================
//  工具函数
// ====================================================================

function success($data = null) {
    // ★ 清空所有输出缓冲，保证响应体是纯JSON（否则前端 JSON.parse 失败会误报"服务器响应异常"）
    while (ob_get_level() > 0) { @ob_end_clean(); }
    echo json_encode(['success' => true, 'data' => $data], JSON_UNESCAPED_UNICODE);
    exit;
}

function error($msg, $code = 400) {
    // ★ 清空所有输出缓冲，保证响应体是纯JSON
    while (ob_get_level() > 0) { @ob_end_clean(); }
    http_response_code($code);
    echo json_encode(['success' => false, 'error' => $msg], JSON_UNESCAPED_UNICODE);
    exit;
}

function getParam($key, $default = '') {
    return isset($_GET[$key]) ? trim($_GET[$key]) : $default;
}

function postParam($key, $default = '') {
    return isset($_POST[$key]) ? trim($_POST[$key]) : $default;
}

/**
 * 获取SQLite数据库连接（orders.db）
 */
function getDb() {
    $possiblePaths = [
        dirname(__DIR__) . '/data/orders.db',
        dirname(__DIR__) . '/orders.db',
        dirname(__DIR__) . '/../data/orders.db',
        dirname(__DIR__) . '/../orders.db',
    ];
    foreach ($possiblePaths as $path) {
        if (file_exists($path)) {
            $db = new PDO('sqlite:' . $path);
            $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            $db->exec('PRAGMA journal_mode=WAL');
            return $db;
        }
    }
    // 都不存在，创建在第一个路径
    $dir = dirname($possiblePaths[0]);
    if (!is_dir($dir)) @mkdir($dir, 0755, true);
    $db = new PDO('sqlite:' . $possiblePaths[0]);
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $db->exec('PRAGMA journal_mode=WAL');
    return $db;
}

/**
 * 确保mc_auth_sessions表存在
 */
function ensureTable($db) {
    $db->exec("CREATE TABLE IF NOT EXISTS mc_auth_sessions (
        session_id TEXT PRIMARY KEY,
        player_name TEXT NOT NULL,
        status TEXT NOT NULL DEFAULT 'pending',
        mc_uuid TEXT DEFAULT '',
        mc_username TEXT DEFAULT '',
        mc_access_token TEXT DEFAULT '',
        ip_address TEXT DEFAULT '',
        created_at INTEGER NOT NULL,
        verified_at INTEGER DEFAULT 0,
        expires_at INTEGER NOT NULL
    )");
}

/**
 * 生成随机session_id
 */
function generateSessionId() {
    return bin2hex(random_bytes(16));
}

// ====================================================================
//  Microsoft OAuth 工具函数
// ====================================================================

/**
 * 向Microsoft发送POST请求
 */
function msPost($url, $data, $headers = []) {
    // 检查调用者是否已指定Content-Type
    $hasContentType = false;
    foreach ($headers as $h) {
        if (stripos($h, 'Content-Type:') === 0) {
            $hasContentType = true;
            break;
        }
    }

    $defaultHeaders = ['Accept: application/json'];
    if (!$hasContentType) {
        $defaultHeaders[] = 'Content-Type: application/x-www-form-urlencoded';
    }

    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => is_array($data) ? http_build_query($data) : $data,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_HTTPHEADER => array_merge($defaultHeaders, $headers),
    ]);
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $error = curl_error($ch);
    curl_close($ch);

    // 详细日志记录
    $log = date('Y-m-d H:i:s') . "\n";
    $log .= "URL: $url\n";
    if (is_array($data)) {
        $log .= "Data: " . http_build_query($data) . "\n";
    } else {
        $log .= "Data: $data\n";
    }
    $log .= "HTTP Code: $httpCode\n";
    $log .= "cURL Error: " . ($error ?: 'none') . "\n";
    $log .= "Response: " . substr($response, 0, 500) . "\n";
    $log .= str_repeat('-', 80) . "\n";
    @file_put_contents(__DIR__ . '/debug_minecraft.log', $log, FILE_APPEND);

    if ($error) {
        return ['error' => "cURL error: $error"];
    }
    return ['code' => $httpCode, 'body' => json_decode($response, true)];
}

/**
 * 向Microsoft发送GET请求
 */
function msGet($url, $headers = []) {
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_HTTPHEADER => array_merge([
            'Accept: application/json',
        ], $headers),
    ]);
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $error = curl_error($ch);
    curl_close($ch);

    // 详细日志记录
    $log = date('Y-m-d H:i:s') . "\n";
    $log .= "GET URL: $url\n";
    $log .= "HTTP Code: $httpCode\n";
    $log .= "cURL Error: " . ($error ?: 'none') . "\n";
    $log .= "Response: " . substr($response, 0, 500) . "\n";
    $log .= str_repeat('-', 80) . "\n";
    @file_put_contents(__DIR__ . '/debug_minecraft.log', $log, FILE_APPEND);

    if ($error) {
        return ['error' => "cURL error: $error"];
    }
    return ['code' => $httpCode, 'body' => json_decode($response, true)];
}

// ====================================================================
//  核心OAuth流程
// ====================================================================

/**
 * 步骤1: 生成Microsoft授权URL
 * ★ 使用Minecraft官方启动器的公共Client ID（00000000402b5328）
 *   此Client ID自带Xbox Live和Minecraft API权限，无需申请
 *   缺点：redirect_uri必须是login.live.com的桌面端页面，玩家需手动复制授权码
 */
function getAuthUrl($sessionId) {
    $clientId = '00000000402b5328'; // Minecraft官方启动器公共客户端ID
    // 桌面端专用redirect_uri（Microsoft展示授权码的页面）
    $redirectUri = 'https://login.live.com/oauth20_desktop.srf';
    $scope = 'XboxLive.signin offline_access';

    $params = http_build_query([
        'client_id' => $clientId,
        'response_type' => 'code',
        'scope' => $scope,
        'redirect_uri' => $redirectUri,
        'state' => $sessionId,
        'prompt' => 'select_account',
    ]);

    return "https://login.live.com/oauth20_authorize.srf?$params";
}

/**
 * 步骤2: 用授权码交换Access Token
 * ★ 公共客户端（00000000402b5328）不需要client_secret
 *   redirect_uri必须与授权时一致
 */
/**
 * 将Microsoft返回的OAuth错误映射为中文友好提示
 */
function mapMsTokenError($msErr, $msDesc = '') {
    $msDesc = trim($msDesc);
    if ($msErr === 'invalid_grant') {
        return '授权码已失效（可能已过期，或已被使用过一次）。请重新点击"打开Microsoft登录"获取新的授权码，并在短时间内完成粘贴提交，不要重复使用旧授权码。';
    }
    if ($msErr === 'invalid_client') {
        return 'OAuth客户端验证失败，请联系管理员检查 MS_CLIENT_ID 配置。';
    }
    if ($msErr === 'invalid_request') {
        return '请求参数有误（' . ($msDesc ?: 'invalid_request') . '），请联系管理员。';
    }
    return 'Token兑换失败: ' . $msErr . ($msDesc ? '（' . $msDesc . '）' : '');
}

function exchangeToken($code) {
    $clientId = '00000000402b5328'; // Minecraft公共客户端ID
    // 桌面端redirect_uri（与getAuthUrl一致）
    $redirectUri = 'https://login.live.com/oauth20_desktop.srf';

    // ★ 关键修复：对code做一次urldecode归一化。
    //   前端JS提取code后会encodeURIComponent（! → %21），
    //   若此处不解码直接交给http_build_query，PHP会再次编码成 %2521（双重编码），
    //   导致Microsoft收到失真的授权码 → invalid_grant 400。
    //   做一次urldecode保证最终只编码一次。urldecode对已是明文的内容是幂等的，安全。
    $code = urldecode($code);

    $result = msPost('https://login.live.com/oauth20_token.srf', [
        'client_id' => $clientId,
        'code' => $code,
        'grant_type' => 'authorization_code',
        'redirect_uri' => $redirectUri,
        'scope' => 'XboxLive.signin offline_access',
    ]);

    if (isset($result['error'])) {
        return ['error' => 'Token exchange failed: ' . $result['error']];
    }
    if ($result['code'] !== 200) {
        $body = $result['body'] ?? [];
        $msErr = $body['error'] ?? 'unknown';
        $msDesc = $body['error_description'] ?? '';
        return ['error' => mapMsTokenError($msErr, $msDesc), 'ms_error' => $msErr];
    }

    $body = $result['body'];
    if (!isset($body['access_token'])) {
        return ['error' => 'No access_token in response', 'response' => $body];
    }

    return [
        'access_token' => $body['access_token'],
        'refresh_token' => $body['refresh_token'] ?? '',
    ];
}

/**
 * 步骤3: 获取Xbox Live Token
 * ★ RpsTicket格式确认：必须用 "d= {token}" 前缀（来自日志验证）
 */
function getXboxToken($msAccessToken) {
    $rpsTicket = 'd=' . $msAccessToken;

    $log = date('Y-m-d H:i:s') . "\n";
    $log .= "=== Xbox Token (d=前缀) ===\n";

    $result = msPost('https://user.auth.xboxlive.com/user/authenticate', json_encode([
        'Properties' => [
            'AuthMethod' => 'RPS',
            'SiteName' => 'user.auth.xboxlive.com',
            'RpsTicket' => $rpsTicket,
        ],
        'RelyingParty' => 'http://auth.xboxlive.com',
        'TokenType' => 'JWT',
    ]), [
        'Content-Type: application/json',
        'Accept: application/json',
    ]);

    $log .= "HTTP Code: " . ($result['code'] ?? 'N/A') . "\n";
    $log .= "Response: " . json_encode($result['body'] ?? $result['error'] ?? 'N/A') . "\n";
    $log .= str_repeat('-', 80) . "\n";
    @file_put_contents(__DIR__ . '/debug_minecraft.log', $log, FILE_APPEND);

    if (isset($result['error'])) {
        return ['error' => 'Xbox auth failed: ' . $result['error']];
    }
    if ($result['code'] !== 200) {
        return ['error' => "Xbox auth HTTP {$result['code']}: " . json_encode($result['body'] ?? [])];
    }

    $body = $result['body'];
    if (!isset($body['Token'])) {
        return ['error' => 'No Token in response: ' . json_encode($body)];
    }

    return [
        'token' => $body['Token'],
        'uhs' => $body['IssueClaims']['uhs'] ?? ($body['DisplayClaims']['xui'][0]['uhs'] ?? ''),
    ];
}

/**
 * 步骤4: 获取XSTS Token
 */
function getXstsToken($xboxToken, $uhs) {
    $result = msPost('https://xsts.auth.xboxlive.com/xsts/authorize', json_encode([
        'Properties' => [
            'SandboxId' => 'RETAIL',
            'UserTokens' => [$xboxToken],
        ],
        'RelyingParty' => 'rp://api.minecraftservices.com/',
        'TokenType' => 'JWT',
    ]), [
        'Content-Type: application/json',
        'Accept: application/json',
    ]);

    if (isset($result['error'])) {
        return ['error' => 'XSTS auth failed: ' . $result['error']];
    }
    if ($result['code'] !== 200) {
        $body = $result['body'] ?? [];
        $errCode = $body['XErr'] ?? 'unknown';
        return ['error' => "XSTS auth HTTP {$result['code']}, XErr: {$errCode}", 'response' => $body];
    }

    $body = $result['body'];
    if (!isset($body['Token'])) {
        return ['error' => 'No XSTS token', 'response' => $body];
    }

    return [
        'token' => $body['Token'],
        'uhs' => $body['IssueClaims']['uhs'] ?? $uhs,
    ];
}

/**
 * 步骤5: 获取Minecraft Access Token
 */
function getMinecraftToken($xstsToken, $uhs) {
    $result = msPost('https://api.minecraftservices.com/authentication/login_with_xbox', json_encode([
        'identityToken' => "XBL3.0 x={$uhs};{$xstsToken}",
    ]), [
        'Content-Type: application/json',
        'Accept: application/json',
    ]);

    if (isset($result['error'])) {
        return ['error' => 'MC token failed: ' . $result['error']];
    }
    if ($result['code'] !== 200) {
        return ['error' => 'MC token HTTP ' . $result['code'], 'response' => $result['body']];
    }

    $body = $result['body'];
    if (!isset($body['access_token'])) {
        return ['error' => 'No MC access_token', 'response' => $body];
    }

    return ['access_token' => $body['access_token']];
}

/**
 * 步骤6: 获取Minecraft Profile
 */
function getMinecraftProfile($mcAccessToken) {
    $result = msGet('https://api.minecraftservices.com/minecraft/profile', [
        'Authorization: Bearer ' . $mcAccessToken,
    ]);

    if (isset($result['error'])) {
        return ['error' => 'MC profile failed: ' . $result['error']];
    }
    if ($result['code'] === 404) {
        return ['error' => 'No Minecraft profile found (account may not own the game)'];
    }
    if ($result['code'] !== 200) {
        return ['error' => 'MC profile HTTP ' . $result['code'], 'response' => $result['body']];
    }

    $body = $result['body'];
    if (!isset($body['id']) || !isset($body['name'])) {
        return ['error' => 'Invalid MC profile', 'response' => $body];
    }

    // 格式化UUID（加横杠）
    $rawUuid = $body['id'];
    $formattedUuid = substr($rawUuid, 0, 8) . '-'
        . substr($rawUuid, 8, 4) . '-'
        . substr($rawUuid, 12, 4) . '-'
        . substr($rawUuid, 16, 4) . '-'
        . substr($rawUuid, 20, 12);

    return [
        'uuid' => $formattedUuid,
        'name' => $body['name'],
        'skins' => $body['skins'] ?? [],
    ];
}

/**
 * 完整OAuth流程（从授权码到Minecraft Profile）
 */
function completeAuthFlow($code) {
    // 步骤2: 交换MS Token
    $tokenResult = exchangeToken($code);
    if (isset($tokenResult['error'])) return $tokenResult;

    // 步骤3: Xbox Live Token
    $xboxResult = getXboxToken($tokenResult['access_token']);
    if (isset($xboxResult['error'])) return $xboxResult;

    // 步骤4: XSTS Token
    $xstsResult = getXstsToken($xboxResult['token'], $xboxResult['uhs']);
    if (isset($xstsResult['error'])) return $xstsResult;

    // 步骤5: Minecraft Token
    $mcResult = getMinecraftToken($xstsResult['token'], $xstsResult['uhs']);
    if (isset($mcResult['error'])) return $mcResult;

    // 步骤6: Minecraft Profile
    $profileResult = getMinecraftProfile($mcResult['access_token']);
    if (isset($profileResult['error'])) return $profileResult;

    return [
        'uuid' => $profileResult['uuid'],
        'name' => $profileResult['name'],
        'access_token' => $mcResult['access_token'],
    ];
}

// ====================================================================
//  Action处理
// ====================================================================

// ★ 检测Microsoft OAuth回调（带code+state，没有action参数）
$code = getParam('code');
$state = getParam('state');
$msError = getParam('error');
if (!empty($code) && !empty($state)) {
    // 自动路由到callback处理
    $action = 'callback';
} elseif (!empty($msError)) {
    // Microsoft返回错误（如invalid_scope）→ 路由到callback显示错误
    $action = 'callback';
} else {
    $action = getParam('action');
}

$db = getDb();
ensureTable($db);

switch ($action) {

    // ===== Java调用：创建验证会话 =====
    case 'create_session': {
        $player = getParam('player');
        $secret = getParam('secret');
        $ip = $_SERVER['REMOTE_ADDR'] ?? '';

        if (empty($player)) error('缺少player参数');
        if ($secret !== MC_AUTH_SECRET) error('密钥错误', 403);

        // 检查MS_CLIENT_ID是否配置（公共客户端不需要secret）
        if (empty(MS_CLIENT_ID)) {
            error('Microsoft OAuth未配置：缺少MS_CLIENT_ID，请在pay_secrets.php中设置');
        }

        // 清理该玩家的旧会话
        $stmt = $db->prepare("DELETE FROM mc_auth_sessions WHERE player_name = ? AND status != 'verified'");
        $stmt->execute([$player]);

        // 创建新会话
        $sessionId = generateSessionId();
        $now = time();
        $expiresAt = $now + 600; // 10分钟过期

        $stmt = $db->prepare("INSERT INTO mc_auth_sessions (session_id, player_name, status, ip_address, created_at, expires_at) VALUES (?, ?, 'pending', ?, ?, ?)");
        $stmt->execute([$sessionId, $player, $ip, $now, $expiresAt]);

        // 生成授权URL
        $authUrl = getAuthUrl($sessionId);

        // ★ 动态构建paste_url：基于当前请求的域名和脚本路径，不硬编码
        $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
        $host = $_SERVER['HTTP_HOST'] ?? $_SERVER['SERVER_NAME'] ?? '';
        $scriptPath = $_SERVER['SCRIPT_NAME'] ?? '/api/minecraft_auth.php';
        $pasteUrl = $scheme . '://' . $host . $scriptPath . '?action=paste_code_page&session_id=' . $sessionId;

        success([
            'session_id' => $sessionId,
            'auth_url' => $authUrl,
            'paste_url' => $pasteUrl,
            'expires_in' => 600,
        ]);
        break;
    }

    // ===== Java调用：检查会话状态 =====
    case 'check_session': {
        $sessionId = getParam('session_id');
        $secret = getParam('secret');

        if (empty($sessionId)) error('缺少session_id参数');
        if ($secret !== MC_AUTH_SECRET) error('密钥错误', 403);

        // 查询会话
        $stmt = $db->prepare("SELECT * FROM mc_auth_sessions WHERE session_id = ?");
        $stmt->execute([$sessionId]);
        $session = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$session) {
            error('会话不存在');
        }

        // 检查是否过期
        if ($session['status'] === 'pending' && time() > $session['expires_at']) {
            $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'expired' WHERE session_id = ?");
            $stmt->execute([$sessionId]);
            $session['status'] = 'expired';
        }

        $result = [
            'status' => $session['status'],
            'player_name' => $session['player_name'],
        ];

        if ($session['status'] === 'verified') {
            $result['mc_uuid'] = $session['mc_uuid'];
            $result['mc_username'] = $session['mc_username'];
            $result['verified_at'] = $session['verified_at'];
        } elseif ($session['status'] === 'failed') {
            $result['error'] = '验证失败，请重试';
        }

        success($result);
        break;
    }

    // ===== 粘贴页/前端轮询：查询会话真实状态（仅凭session_id）=====
    // 用途：前端提交响应异常（非JSON/网关错误）时回查真实结果，避免"已验证通过却提示响应异常"的误导
    case 'status': {
        $sessionId = getParam('session_id');
        if (empty($sessionId)) error('缺少session_id参数');

        $stmt = $db->prepare("SELECT * FROM mc_auth_sessions WHERE session_id = ?");
        $stmt->execute([$sessionId]);
        $session = $stmt->fetch(PDO::FETCH_ASSOC);
        if (!$session) error('会话不存在或已过期');

        $result = [
            'status' => $session['status'],
            'player_name' => $session['player_name'],
        ];
        if ($session['status'] === 'verified') {
            $result['mc_uuid'] = $session['mc_uuid'];
            $result['mc_username'] = $session['mc_username'];
        }
        success($result);
        break;
    }

    // ===== 浏览器回调：处理Microsoft OAuth =====
    case 'callback': {
        $code = getParam('code');
        $state = getParam('state'); // session_id
        $msError = getParam('error');

        // Microsoft返回错误
        if ($msError) {
            header('Content-Type: text/html; charset=utf-8');
            $errorDesc = getParam('error_description', 'Microsoft登录被拒绝');
            if ($state) {
                $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'failed' WHERE session_id = ?");
                $stmt->execute([$state]);
            }
            echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>验证失败</title>
            <style>body{font-family:sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#1a1a2e;color:#fff;}
            .card{background:#16213e;padding:40px;border-radius:16px;text-align:center;max-width:400px;}
            .icon{font-size:48px;margin-bottom:16px;}</style></head>
            <body><div class='card'><div class='icon'>❌</div><h2>验证失败</h2><p>" . htmlspecialchars($errorDesc) . "</p>
            <p style='color:#888;font-size:14px;'>请关闭此页面并返回游戏重试</p></div></body></html>";
            exit;
        }

        if (empty($code) || empty($state)) {
            header('Content-Type: text/html; charset=utf-8');
            echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>参数错误</title></head><body><h1>参数错误</h1></body></html>";
            exit;
        }

        // 查询会话
        $stmt = $db->prepare("SELECT * FROM mc_auth_sessions WHERE session_id = ?");
        $stmt->execute([$state]);
        $session = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$session) {
            header('Content-Type: text/html; charset=utf-8');
            echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>会话不存在</title></head><body><h1>会话不存在或已过期</h1></body></html>";
            exit;
        }

        if (time() > $session['expires_at']) {
            $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'expired' WHERE session_id = ?");
            $stmt->execute([$state]);
            header('Content-Type: text/html; charset=utf-8');
            echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>会话过期</title></head><body><h1>会话已过期，请返回游戏重新发起验证</h1></body></html>";
            exit;
        }

        // 执行完整OAuth流程
        $result = completeAuthFlow($code);

        if (isset($result['error'])) {
            // 验证失败
            $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'failed' WHERE session_id = ?");
            $stmt->execute([$state]);
            header('Content-Type: text/html; charset=utf-8');
            echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>验证失败</title>
            <style>body{font-family:sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#1a1a2e;color:#fff;}
            .card{background:#16213e;padding:40px;border-radius:16px;text-align:center;max-width:400px;}
            .icon{font-size:48px;margin-bottom:16px;}</style></head>
            <body><div class='card'><div class='icon'>❌</div><h2>验证失败</h2><p>" . htmlspecialchars($result['error']) . "</p>
            <p style='color:#888;font-size:14px;'>请关闭此页面并返回游戏重试</p></div></body></html>";
            exit;
        }

        // 验证成功！
        $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'verified', mc_uuid = ?, mc_username = ?, mc_access_token = ?, verified_at = ? WHERE session_id = ?");
        $stmt->execute([$result['uuid'], $result['name'], $result['access_token'], time(), $state]);

        // 显示成功页面
        $mcName = htmlspecialchars($result['name']);
        $mcUuid = htmlspecialchars($result['uuid']);
        header('Content-Type: text/html; charset=utf-8');
        echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>验证成功</title>
        <style>body{font-family:sans-serif;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#1a1a2e;color:#fff;}
        .card{background:#16213e;padding:40px;border-radius:16px;text-align:center;max-width:400px;}
        .icon{font-size:48px;margin-bottom:16px;}
        .name{font-size:24px;font-weight:bold;color:#4ade80;margin:8px 0;}
        .uuid{font-size:12px;color:#888;word-break:break-all;}</style></head>
        <body><div class='card'>
        <div class='icon'>✅</div>
        <h2>正版验证成功！</h2>
        <div class='name'>$mcName</div>
        <div class='uuid'>$mcUuid</div>
        <p style='margin-top:20px;color:#4ade80;'>请关闭此页面返回游戏</p>
        <p style='color:#888;font-size:14px;'>你的正版身份已验证，将自动登录服务器</p>
        </div></body></html>";
        exit;
    }

    // ===== 玩家手动粘贴授权码（公共客户端流程） =====
    case 'verify_code': {
        // 兼容JSON和表单两种POST方式
        $rawInput = file_get_contents('php://input');
        $json = json_decode($rawInput, true);
        $sessionId = postParam('session_id') ?: ($json['session_id'] ?? '');
        $code = postParam('code') ?: ($json['code'] ?? '');
        $secret = postParam('secret') ?: ($json['secret'] ?? '');

        // ★ 详细调试日志
        $debugLine = date('Y-m-d H:i:s') . " [verify_code] 来源: " . (postParam('code') !== '' ? 'POST表单' : 'JSON体') . "\n";
        $debugLine .= "  Raw input(前300): " . substr($rawInput, 0, 300) . "\n";
        $debugLine .= "  Session: $sessionId\n";
        $debugLine .= "  Code(pre-extract,前200): " . substr($code, 0, 200) . " (len=" . strlen($code) . ")\n";
        $debugLine .= "  Secret: " . substr($secret, 0, 30) . "\n";
        @file_put_contents(__DIR__ . '/debug_minecraft.log', $debugLine, FILE_APPEND);

        if (empty($sessionId)) error('缺少session_id参数');
        if (empty($code)) error('缺少code参数（授权码）');

        // 自动从URL中提取code参数（兼容 ?code= & #code= & 直接粘贴code）
        if (strpos($code, 'code=') !== false || strpos($code, 'http') === 0 || strpos($code, '#') !== false) {
            if (preg_match('/[#?&]code=([^&]+)/', $code, $m)) {
                $code = urldecode($m[1]);
            }
        }

        // ★ 提取后日志
        $debugLine2 = "  Code(post-extract,前200): " . substr($code, 0, 200) . " (len=" . strlen($code) . ")\n";
        @file_put_contents(__DIR__ . '/debug_minecraft.log', $debugLine2, FILE_APPEND);

        // 密钥验证：Java调用需要secret，浏览器表单用session_id自身认证
        if (!empty($secret)) {
            if ($secret !== MC_AUTH_SECRET) {
                $debugLine3 = "  ★ 密钥不匹配! 收到: " . substr($secret, 0, 30) . " 期望: " . substr(MC_AUTH_SECRET, 0, 30) . "\n";
                @file_put_contents(__DIR__ . '/debug_minecraft.log', $debugLine3, FILE_APPEND);
                error('密钥错误', 403);
            }
        }

        // ★ 人机验证码（2026-10-02）：只拦浏览器粘贴页的提交；
        //   Java 插件带 secret 的调用走的是服务端，不需要人机验证。
        if (empty($secret)) {
            cgEnforce('verify_code');
        }

        // 查询会话
        $stmt = $db->prepare("SELECT * FROM mc_auth_sessions WHERE session_id = ?");
        $stmt->execute([$sessionId]);
        $session = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$session) {
            $debugLine4 = "  ★ 会话不存在! sessionId=$sessionId\n";
            @file_put_contents(__DIR__ . '/debug_minecraft.log', $debugLine4, FILE_APPEND);
            error('会话不存在或已过期');
        }
        if ($session['status'] !== 'pending') {
            $debugLine4 = "  ★ 会话状态异常: " . $session['status'] . " (期望pending)\n";
            @file_put_contents(__DIR__ . '/debug_minecraft.log', $debugLine4, FILE_APPEND);
            error('会话状态异常: ' . $session['status']);
        }
        if (time() > $session['expires_at']) {
            $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'expired' WHERE session_id = ?");
            $stmt->execute([$sessionId]);
            error('会话已过期，请重新发起验证');
        }

        // 执行完整OAuth流程
        $debugLine5 = "  → 调用 completeAuthFlow, code前50: " . substr($code, 0, 50) . "\n";
        @file_put_contents(__DIR__ . '/debug_minecraft.log', $debugLine5, FILE_APPEND);
        $result = completeAuthFlow($code);
        $debugLine6 = "  ← completeAuthFlow返回: " . (isset($result['error']) ? 'ERROR: ' . $result['error'] : 'SUCCESS uuid=' . ($result['uuid'] ?? '?') . ' name=' . ($result['name'] ?? '?')) . "\n";
        $debugLine6 .= str_repeat('-', 80) . "\n";
        @file_put_contents(__DIR__ . '/debug_minecraft.log', $debugLine6, FILE_APPEND);

        if (isset($result['error'])) {
            $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'failed' WHERE session_id = ?");
            $stmt->execute([$sessionId]);
            error('验证失败: ' . $result['error']);
        }

        // 验证成功
        $stmt = $db->prepare("UPDATE mc_auth_sessions SET status = 'verified', mc_uuid = ?, mc_username = ?, mc_access_token = ?, verified_at = ? WHERE session_id = ?");
        $stmt->execute([$result['uuid'], $result['name'], $result['access_token'], time(), $sessionId]);

        success([
            'status' => 'verified',
            'mc_uuid' => $result['uuid'],
            'mc_username' => $result['name'],
        ]);
        break;
    }

    // ===== Java调用：直接验证（用于验证Minecraft账号是否正版） =====
    case 'verify_premium': {
        $player = getParam('player');
        $secret = getParam('secret');

        if (empty($player)) error('缺少player参数');
        if ($secret !== MC_AUTH_SECRET) error('密钥错误', 403);

        // 通过Mojang API验证用户名是否对应正版账号
        $url = "https://api.mojang.com/users/profiles/minecraft/" . urlencode($player);
        $result = msGet($url);

        if (isset($result['error'])) {
            error('Mojang API请求失败: ' . $result['error']);
        }

        if ($result['code'] === 200 && isset($result['body']['id'])) {
            $rawUuid = $result['body']['id'];
            $formattedUuid = substr($rawUuid, 0, 8) . '-'
                . substr($rawUuid, 8, 4) . '-'
                . substr($rawUuid, 12, 4) . '-'
                . substr($rawUuid, 16, 4) . '-'
                . substr($rawUuid, 20, 12);

            success([
                'is_premium' => true,
                'uuid' => $formattedUuid,
                'name' => $result['body']['name'] ?? $player,
            ]);
        } else {
            success([
                'is_premium' => false,
                'uuid' => null,
                'name' => $player,
            ]);
        }
        break;
    }

    // ===== 网页粘贴授权码页面（公共客户端流程） =====
    case 'paste_code_page': {
        header('Content-Type: text/html; charset=utf-8');
        $sessionId = getParam('session_id');
        if (empty($sessionId)) {
            echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>参数错误</title></head><body><h1>缺少session_id参数</h1></body></html>";
            exit;
        }

        // 验证session存在
        $stmt = $db->prepare("SELECT * FROM mc_auth_sessions WHERE session_id = ?");
        $stmt->execute([$sessionId]);
        $session = $stmt->fetch(PDO::FETCH_ASSOC);
        if (!$session) {
            echo "<!DOCTYPE html><html><head><meta charset='utf-8'><title>会话不存在</title></head><body><h1>会话不存在或已过期</h1></body></html>";
            exit;
        }

        $playerName = htmlspecialchars($session['player_name']);
        $authUrl = htmlspecialchars(getAuthUrl($sessionId));
        $captchaHtml = cgWidgetHtml();
        echo <<<HTML
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Minecraft正版验证 - 粘贴授权码</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;display:flex;justify-content:center;align-items:center;min-height:100vh;background:#0f0f23;color:#e0e0e0}
.card{background:#1a1a3e;padding:40px;border-radius:16px;text-align:center;max-width:420px;width:90%;box-shadow:0 8px 32px rgba(0,0,0,0.4)}
h2{margin-bottom:8px;color:#4ade80}
.player{color:#888;font-size:14px;margin-bottom:24px}
.steps{text-align:left;background:#0f0f23;border-radius:8px;padding:16px;margin-bottom:24px;font-size:14px;line-height:1.8}
.steps li{margin-left:20px;color:#bbb}
.steps li b{color:#e0e0e0}
.input-group{margin-bottom:16px}
input[type=text]{width:100%;padding:14px 16px;font-size:16px;font-family:monospace;background:#0f0f23;border:2px solid #333;border-radius:8px;color:#4ade80;text-align:center;letter-spacing:2px;outline:none;transition:border-color 0.2s}
input[type=text]:focus{border-color:#4ade80}
button{width:100%;padding:14px;font-size:16px;font-weight:bold;background:#4ade80;color:#0f0f23;border:none;border-radius:8px;cursor:pointer;transition:all 0.2s}
button:hover{background:#22c55e;transform:translateY(-1px)}
button:disabled{opacity:0.5;cursor:not-allowed;transform:none}

/* ===== 人机验证挂件对齐（正版验证页专用） =====
   挂件自带 <style> 在本页之后输出、同优先级会覆盖，故用 .card 前缀提高优先级 */
.card .cg-box{margin:0 0 16px;padding:14px 16px;background:#0f0f23;border:2px solid #333;
  border-radius:8px;text-align:center}
.card .cg-head{justify-content:center;gap:10px}
.card .cg-err{text-align:center}
.card .cg-btn{border-radius:8px}
#cgCfBox{display:flex!important;justify-content:center;align-items:center}
.msg{margin-top:16px;font-size:14px;min-height:20px}
.msg.ok{color:#4ade80}
.msg.err{color:#f87171}
</style>
</head>
<body>
<div class="card">
<h2>🎮 正版验证</h2>
<p class="player">玩家: <b>$playerName</b></p>
<div style="margin-bottom:20px">
<a href="$authUrl" target="_blank" style="display:inline-block;padding:12px 24px;background:#4ade80;color:#0f0f23;text-decoration:none;border-radius:8px;font-weight:bold;font-size:16px">点击打开Microsoft登录</a>
</div>
<ol class="steps">
<li>点击上方<b>"打开Microsoft登录"</b>按钮</li>
<li>登录Microsoft账号</li>
<li>登录成功后，<b>复制浏览器地址栏的完整URL</b></li>
<li>将URL<b>粘贴</b>到下方输入框（会自动提取授权码）</li>
<li>点击"提交验证"</li>
</ol>
<div class="input-group">
<input type="text" id="codeInput" placeholder="粘贴完整URL或授权码" autofocus autocomplete="off">
</div>
{$captchaHtml}
<button id="submitBtn" onclick="submitCode()">提交验证</button>
<div class="msg" id="msg"></div>
</div>
<script>
var sessionId="{$sessionId}";
var submitting=false;
function extractCode(input){
input=input.trim();
var m=input.match(/[#?&]code=([^&]+)/);
if(m) return decodeURIComponent(m[1]);
if(input.indexOf('http')===-1 && input.indexOf('code=')===-1) return input;
try{
var u=new URL(input);
var p=new URLSearchParams(u.search);
if(p.has('code'))return p.get('code');
var ph=new URLSearchParams(u.hash.replace(/^#/,''));
if(ph.has('code'))return p.get('code');
}catch(e){}
return input;
}
function enableBtn(){var btn=document.getElementById('submitBtn');btn.disabled=false;btn.textContent='提交验证';}
function showRealStatus(httpStatus,raw){
// ★ 提交响应异常时回查会话真实状态：已验证就如实告知"已通过"，不再误导为"服务器响应异常"
var x2=new XMLHttpRequest();
x2.open('GET','minecraft_auth.php?action=status&session_id='+encodeURIComponent(sessionId),true);
x2.onreadystatechange=function(){
if(x2.readyState!==4)return;
var st=null;
try{var d2=JSON.parse(x2.responseText); if(d2.success&&d2.data)st=d2.data.status;}catch(e){}
var rawPrev=String(raw||'').replace(/\s+/g,' ').substring(0,160);
if(st==='verified'){showMsg('✅ 服务器已验证通过（提交时响应异常已自动忽略），请关闭此页面返回游戏','ok');}
else if(st==='failed'){showMsg('❌ 验证失败，请重新提交 (HTTP '+httpStatus+')','err');enableBtn();}
else if(st==='expired'){showMsg('❌ 会话已过期，请回游戏重新发起验证','err');enableBtn();}
else if(st==='pending'){showMsg('⚠️ 响应异常(HTTP '+httpStatus+')，服务器仍在验证中，请稍后再次点击提交…','err');enableBtn();}
else{showMsg('❌ 服务器响应异常(HTTP '+httpStatus+'): '+rawPrev,'err');enableBtn();}
};
x2.send();
}
async function doSubmit(code){
if(submitting)return;
submitting=true;
var btn=document.getElementById('submitBtn');
btn.disabled=true;btn.textContent='验证中...';
// ★ 人机验证（2026-10-02）：CF 渲染完即有 token（基本无感）；VA 没做会在这里拉起验证
var cap={};
if(window.CaptchaGuard){
try{cap=await CaptchaGuard.payload();}
catch(e){submitting=false;btn.disabled=false;btn.textContent='提交验证';
showMsg('❌ '+(e.message||'请先完成人机验证'),'err');return;}
}
var xhr=new XMLHttpRequest();
xhr.open('POST','minecraft_auth.php?action=verify_code',true);
xhr.setRequestHeader('Content-Type','application/x-www-form-urlencoded');
xhr.onreadystatechange=function(){
if(xhr.readyState===4){
submitting=false;
var body='';
try{body=xhr.responseText||'';}catch(e){}
try{var d=JSON.parse(body);
if(d.success){showMsg('✅ 验证成功！请关闭此页面返回游戏','ok');}
else{showMsg('❌ '+(d.error||d.message||'验证失败'),'err');enableBtn();}
}catch(e){showRealStatus(xhr.status,body);}
}};
xhr.send('session_id='+encodeURIComponent(sessionId)+'&code='+encodeURIComponent(code)
+'&captcha_provider='+encodeURIComponent(cap.captcha_provider||'')
+'&captcha_token='+encodeURIComponent(cap.captcha_token||'')
+'&captcha_knock='+encodeURIComponent(cap.captcha_knock||'')
+'&captcha_dfu='+encodeURIComponent(cap.captcha_dfu||'')
+'&captcha_ip='+encodeURIComponent(cap.captcha_ip||''));
}
function submitCode(){
var raw=document.getElementById('codeInput').value.trim();
if(!raw){showMsg('请输入授权码或URL','err');return}
var code=extractCode(raw);
if(!code){showMsg('无法从输入中提取授权码','err');return}
doSubmit(code);
}
document.getElementById('codeInput').addEventListener('paste',function(){
var el=this;
setTimeout(function(){
var raw=el.value.trim();
if(raw.indexOf('login.live.com')!==-1||raw.indexOf('login.microsoftonline.com')!==-1){
var code=extractCode(raw);
if(code&&code.length>10){doSubmit(code);}
}
},100);
});
function showMsg(t,c){var m=document.getElementById('msg');m.textContent=t;m.className='msg '+c;}
</script>
</body>
</html>
HTML;
        exit;
    }

    default:
        error('未知action: ' . $action);
}