<?php
// ============================================================================
// 1. GLOBAL SESSION INITIALIZATION (Must be at the very top)
// ============================================================================
if (session_status() === PHP_SESSION_NONE && !headers_sent()) {
    session_start();
}

// ============================================================================
// 2. DYNAMIC CONFIGURATION LOADER
// ============================================================================
$settings_file = __DIR__ . '/site-settings.json';
$site_settings = [];

if (file_exists($settings_file)) {
    $json_content = file_get_contents($settings_file);
    if ($json_content !== false) {
        $site_settings = json_decode($json_content, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            error_log("JSON Parse Error in site-settings.json: " . json_last_error_msg());
            $site_settings = [];
        }
    } else {
        error_log("Could not read site-settings.json");
    }
}

// Define secure constants for payment gateway access
$paystack_public = $site_settings['paystack_public'] ?? '';
$paystack_secret = $site_settings['paystack_secret'] ?? '';

if (!defined('PAYMENT_PUBLIC_KEY')) {
    define('PAYMENT_PUBLIC_KEY', $paystack_public);
}
if (!defined('PAYMENT_API_KEY')) {
    define('PAYMENT_API_KEY', $paystack_secret);
}

// Global Application Constants - UPDATE THIS IF YOU MOVE FOLDERS AGAIN
define('SITE_URL', 'http://localhost/tipspac');

// ============================================================================
// 3. SECURE API ENGINE INTEGRATION PIPELINE
// ============================================================================
// Dual-Source Architecture Feature Flag
// Options: 'manual' (default) or 'api' (live feeds parsing)
define('DATA_SOURCE', 'api');

// API Engine Configuration (Dormant until toggled to 'api')
define('FOOTBALL_API_KEY', '5166ce33c6b95ec8adba7f26e037f088');
define('FOOTBALL_API_URL', 'https://v3.football.api-sports.io');
define('API_REQUEST_TIMEOUT', 10); // Connection timeout in seconds

// ============================================================================
// 4. HARDENED SECURITY & DATABASE INITIALIZATION
// ============================================================================
// Standard OWASP Security Headers
if (!headers_sent()) {
    header("X-Frame-Options: DENY");
    header("X-XSS-Protection: 1; mode=block");
    header("X-Content-Type-Options: nosniff");
}

require_once __DIR__ . '/../vendor/autoload.php';

// Include Database PDO Engine
$db_file = __DIR__ . '/database.php';
if (file_exists($db_file)) {
    require_once $db_file;
} else {
    // Log error instead of throwing exception to prevent white screen
    error_log("Critical Error: Database abstraction layer missing at: " . $db_file);
    die("System configuration error. Please contact administrator.");
}
?>