<?php
header('Content-Type: application/json');

// Secret token to prevent abuse
$SECRET = 'HhivpTgRelay2026';
$auth = $_SERVER['HTTP_X_RELAY_SECRET'] ?? '';
if ($auth !== $SECRET) {
    http_response_code(403);
    echo json_encode(['error' => 'Forbidden']);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed']);
    exit;
}

$data = json_decode(file_get_contents('php://input'), true);
if (!$data || empty($data['bot_token']) || empty($data['chat_id']) || empty($data['text'])) {
    http_response_code(400);
    echo json_encode(['error' => 'Missing required fields']);
    exit;
}

$bot_token  = $data['bot_token'];
$payload    = json_encode([
    'chat_id'    => $data['chat_id'],
    'text'       => $data['text'],
    'parse_mode' => $data['parse_mode'] ?? 'HTML',
]);

$ch = curl_init("https://api.telegram.org/bot{$bot_token}/sendMessage");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $payload,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 10,
]);
$result   = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

http_response_code($httpCode);
echo $result;