<?php
// FILE: /public_html/index.php

// 1. Pengaturan Hak Akses API (CORS) khusus untuk domain Anda
header("Access-Control-Allow-Origin: https://facemadrasah.mra.my.id");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With");
header("Access-Control-Allow-Methods: POST, GET, OPTIONS");
header("Content-Type: application/json; charset=UTF-8");

// Mengatasi browser preflight request
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
    http_response_code(200);
    exit(0);
}

// 2. Tangkap rute URL yang diminta (Contoh: index.php?url=auth/login)
$url = isset($_GET['url']) ? filter_var($_GET['url'], FILTER_SANITIZE_URL) : '';

if (empty($url)) {
    http_response_code(400);
    echo json_encode(["status" => "error", "message" => "Endpoint tidak valid."]);
    exit();
}

// 3. Jembatan Aman ke Folder Rahasia di LUAR public_html
// __DIR__ . "/../" artinya naik satu tingkat keluar dari public_html menuju root akun hosting
$target_file = __DIR__ . "/../madrasah-core/modules/" . $url . ".php";

if (file_exists($target_file)) {
    include_once $target_file;
} else {
    http_response_code(404);
    echo json_encode(["status" => "error", "message" => "Modul backend sistem tidak ditemukan."]);
}