<?php
// ─── SunScope Extra — Subscription Still Active? ─────────────────────────────
// JSON endpoint polled roughly once a day per visitor (see useAppState.js)
// to catch subscribers who cancelled in Stripe. One-off payers never call
// this - their access is permanent by design.
//
// Returns {"active": bool}

require __DIR__ . '/secrets.local.php';

header('Content-Type: application/json');

$customer = trim($_GET['customer'] ?? $_POST['customer'] ?? '');

if ($customer === '' || !preg_match('/^cus_[A-Za-z0-9_]+$/', $customer)) {
    echo json_encode(['active' => false]);
    exit;
}

$ch = curl_init('https://api.stripe.com/v1/subscriptions?customer=' . urlencode($customer) . '&status=active&limit=1');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => STRIPE_SECRET_KEY . ':',
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

echo json_encode(['active' => !empty($response['data'])]);