<?php
// Set headers for CORS and JSON response
header("Access-Control-Allow-Origin: *");
header("Content-Type: application/json");

// --- 1. SECURELY STORE YOUR API KEY HERE ---
// WARNING: Replace this placeholder with your actual Gemini API key.
// This key is stored securely on the server and is never sent to the client.
const GEMINI_API_KEY = "YOUR_SECRET_GEMINI_API_KEY_HERE";

// Check if the API key is set
if (empty(GEMINI_API_KEY) || GEMINI_API_KEY === "YOUR_SECRET_GEMINI_API_KEY_HERE") {
    http_response_code(500);
    echo json_encode(["error" => "Server API Key is not configured."]);
    exit;
}

// --- 2. GET USER PROMPT FROM CLIENT ---
$input = file_get_contents('php://input');
$data = json_decode($input, true);

if (!isset($data['prompt'])) {
    http_response_code(400);
    echo json_encode(["error" => "Prompt is missing."]);
    exit;
}

$userPrompt = $data['prompt'];
$model = "gemini-2.5-flash-preview-05-20"; // Or the model of your choice

// --- 3. CONSTRUCT THE GEMINI API PAYLOAD ---
$payload = [
    'contents' => [
        [
            'parts' => [['text' => $userPrompt]]
        ]
    ],
    'tools' => [['google_search' => []]], // Enable grounding for up-to-date info
    'systemInstruction' => [
        'parts' => [['text' => 'You are a helpful and concise assistant. Respond professionally.']]
    ],
];

$jsonPayload = json_encode($payload);

// --- 4. MAKE THE SECURE API CALL FROM THE SERVER ---
$apiUrl = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent?key=" . GEMINI_API_KEY;

// PHP stream context options for POST request
$contextOptions = [
    'http' => [
        'method'  => 'POST',
        'header'  => "Content-Type: application/json\r\n",
        'content' => $jsonPayload,
        'ignore_errors' => true // Important to catch HTTP errors
    ]
];

$context  = stream_context_create($contextOptions);
$apiResponse = @file_get_contents($apiUrl, false, $context);

// Check for cURL or connection errors
if ($apiResponse === FALSE) {
    http_response_code(502);
    echo json_encode(["error" => "Failed to connect to the external API."]);
    exit;
}

$result = json_decode($apiResponse, true);

// Check for API-specific errors (e.g., invalid key, rate limit)
if (isset($result['error'])) {
    // Pass the API error back to the client, but ensure the status code reflects the error
    $httpCode = 500;
    if (isset($http_response_header)) {
        preg_match('{HTTP\/\S+\s(\d{3})}', $http_response_header[0], $match);
        $httpCode = (int)$match[1];
    }
    http_response_code($httpCode);
    echo json_encode(["error" => "API Error: " . ($result['error']['message'] ?? 'Unknown error.')]);
    exit;
}

// --- 5. EXTRACT AND RETURN THE GENERATED TEXT ---
$generatedText = $result['candidates'][0]['content']['parts'][0]['text'] ?? 'No text generated.';

// Return a successful JSON response
echo json_encode([
    "text" => $generatedText,
    "sources" => [] // In a real scenario, you'd parse and return grounding metadata here
]);

?>