<?php

header('Content-Type: application/json; charset=utf-8');

function respond(int $statusCode, array $body)
{
    http_response_code($statusCode);
    echo json_encode($body, JSON_UNESCAPED_SLASHES);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Allow: POST');
    respond(405, ['received' => false, 'message' => 'POST requests only.']);
}

$maxBodySize = 16384;
$contentLength = (int) ($_SERVER['CONTENT_LENGTH'] ?? 0);
if ($contentLength > $maxBodySize) {
    respond(413, ['received' => false, 'message' => 'Callback payload is too large.']);
}

$contentType = strtolower(trim(explode(';', $_SERVER['CONTENT_TYPE'] ?? '')[0]));
$payload = $_POST;

if ($contentType === 'application/json') {
    $rawBody = file_get_contents('php://input', false, null, 0, $maxBodySize + 1);
    if ($rawBody === false || strlen($rawBody) > $maxBodySize) {
        respond(413, ['received' => false, 'message' => 'Callback payload is too large.']);
    }

    $decoded = json_decode($rawBody, true);
    if (!is_array($decoded)) {
        respond(400, ['received' => false, 'message' => 'Invalid JSON callback payload.']);
    }
    $payload = $decoded;
} elseif (!in_array($contentType, [
    'application/x-www-form-urlencoded',
    'multipart/form-data',
], true)) {
    respond(415, ['received' => false, 'message' => 'Unsupported callback content type.']);
}

if ($payload === []) {
    respond(400, ['received' => false, 'message' => 'Callback payload is empty.']);
}

respond(200, [
    'received' => true,
    'verified' => false,
    'processed' => false,
    'message' => 'Callback received; transaction status has not been verified or processed.',
]);