<?php

declare(strict_types=1);

/**
 * Landing page HTML rendering with CTA overlay.
 * Included by redirect/index.php after constants and helpers are defined.
 *
 * Depends on (from index.php):
 *   srp_e(), SRP_CF_INSIGHTS_SCRIPT, SRP_CF_INSIGHTS_BEACON, SRP_FB_APP_ID
 */
function srp_render_landing(string $targetUrl, bool $allowCloudflareInsights): void
{
    $nonce = bin2hex(random_bytes(16));
    $nonceEsc = srp_e($nonce);
    $targetEsc = srp_e($targetUrl);
    // body::before (watermark) and body::after (favicon) are defined in /assets/style.css.
    // Inline CSS only enforces z-index stacking and visibility guard overrides.
    $inlineCss = 'html,body{width:100%;height:100dvh;margin:0}body{position:relative}.layout{min-height:100vh;position:relative}'
        . '.main-block{position:relative;z-index:5;max-width:470px;width:100%;min-height:100vh;margin:0 auto;display:flex;flex-direction:column}'
        . '.steps-wrap{min-height:100vh;display:flex!important;flex-direction:column;justify-content:center;padding:5vh 25px;position:relative;z-index:6}'
        . '.steps{display:flex!important;flex:1 0 auto;flex-direction:column;justify-content:center;text-align:center}'
        . '.steps-content{display:flex!important;flex-direction:column;justify-content:center;width:100%}'
        . '.step-item{display:block!important;visibility:visible!important;opacity:1!important;width:100%;position:relative;z-index:7}'
        . '.step-title,.step-subtitle,.btn,.btns-wrap{visibility:visible!important;opacity:1!important}.btns-wrap{display:flex!important;justify-content:center}'
        . '.bg{z-index:1}'
        . '.bg-stage{width:100%;animation:bg 60s linear infinite}.bg-stage img{display:block;width:100%;height:100vh;object-fit:cover}'
        . '@keyframes bg{0%{transform:translateY(0)}100%{transform:translateY(-33.333%)}}'
        . '.btn-sec{background:rgba(128,0,0,.82);-webkit-backdrop-filter:blur(10px);backdrop-filter:blur(10px);color:#fff}.step-title{color:#fafafa;font-size:56px;font-weight:800;line-height:1.3;margin:0 0 5px;text-transform:uppercase;text-shadow:0 1px 8px rgba(0,0,0,.45)}.step-subtitle{color:rgba(255,255,255,.88);font-size:20px;margin:0;text-shadow:0 1px 4px rgba(0,0,0,.40)}';

    $scriptSrc = "script-src 'self' 'nonce-{$nonce}'";
    $connectSrc = "connect-src 'self'";

    if ($allowCloudflareInsights) {
        $scriptSrc .= ' ' . SRP_CF_INSIGHTS_SCRIPT;
        $connectSrc .= ' ' . SRP_CF_INSIGHTS_SCRIPT . ' ' . SRP_CF_INSIGHTS_BEACON;
    }

    header('Content-Type: text/html; charset=UTF-8');
    header(
        "Content-Security-Policy: default-src 'self'; "
        . $scriptSrc . '; '
        . "style-src 'self' 'nonce-{$nonce}'; "
        . "font-src 'self'; "
        . "img-src 'self' data:; "
        . $connectSrc . '; '
        . "object-src 'none'; "
        . "base-uri 'self'; "
        . "frame-ancestors 'none'; "
        . "form-action 'self'",
    );

    $markup = [
        '<!DOCTYPE html>',
        '<html lang="en-US" prefix="og: https://ogp.me/ns# fb: https://ogp.me/ns/fb#"><head>',
        '<meta charset="UTF-8">',
        '<meta prefix="fb: https://ogp.me/ns/fb#" property="fb:app_id" content="' . SRP_FB_APP_ID . '">',
        '<title>Attention</title>',
        '<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no">',
        '<link href="/favicon.ico" rel="icon" type="image/x-icon">',
        '<link rel="stylesheet" type="text/css" href="/assets/reset.min.css">',
        '<link rel="stylesheet" type="text/css" href="/assets/style.css">',
        '<style nonce="' . $nonceEsc . '">' . $inlineCss . '</style>',
        '</head><body>',
        '<div class="layout"><main class="main-block"><div class="steps-wrap"><div class="steps"><div class="steps-content">'
            . '<div class="step-item is-active"><h2 class="step-title text16">Attention!</h2><p class="step-subtitle text17">wants to exchange candid photos with you.</p>'
            . '<p class="step-subtitle text18">You confirm?</p><div class="btns-wrap"><a class="btn btn-sec text19" href="' . $targetEsc . '">YES</a></div></div>'
            . '</div></div></div><div class="bg"><div class="bg-stage"><img src="/assets/bg-lg.jpg" alt=""><img src="/assets/bg-lg.jpg" alt=""><img src="/assets/bg-lg.jpg" alt=""></div></div></main></div>',
        '<div id="wrp-id"></div>',
        '<script nonce="' . $nonceEsc . '">setTimeout(function(){window.location.replace(' . json_encode($targetUrl, JSON_UNESCAPED_SLASHES) . ')},2000);</script>',
        '</body></html>',
    ];

    echo implode('', $markup);
}
