<?php
//
// eproxy.php
// Version 0.2.2
//
// Requires: PHP5, some kind of db (PDO or mysql), curl, (optionally) mcrypt
//
// Simple caching proxy for EVE API data.  Just replace
// http://api.eve-online.com with
// http://your.proxy.location/eproxy.php and it should work
// transparently.  Final URLs should look like:
// http://your.proxy.location/eproxy.php/account/Characters.xml.aspx
// Your API key is hashed and used as an index; your key is never
// stored in the databse. If I get un-lazy, I'll encrypt the stored
// data with your key as well, ensuring that even in the unlikely case
// of database compromise, noone will be able to see your data.
// 
// Note that this ignores the cachedUntil return from API methods, and
// instead always caches entries for some fixed amount of time from
// when the lats requesti was, per API call.  See the data structures
// below for the amount of time each API method is cached.  Also, not
// all API methods are here; just add the ones that are missing to the
// arrays.
//
// Configuration options are after this comment; at a minimum you'll
// need to specify a database connection string and set up the
// database.
//
// Send ISK to Isidien Madcap if you get any use out of this!
//
// Do whatever the hell you want BSD license follows.
//
// Copyright (C) 2007 Mr. Rupert's Quality Software Group
// Copyright (C) 2007 Vladimir Vukicevic
//
// Permission to use, copy, modify, distribute, and sell this software
// and its documentation for any purpose is hereby granted without
// fee, provided that the above copyright notice appear in all copies
// and that both that copyright notice and this permission notice
// appear in supporting documentation, and that the name of
// the author not be used in advertising or publicity pertaining to
// distribution of the software without specific, written prior
// permission. The author makes no representations about the
// suitability of this software for any purpose.  It is provided "as
// is" without express or implied warranty.
//
// THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS, IN NO EVENT SHALL THE AUTHOR. BE LIABLE FOR ANY SPECIAL,
// INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER
// RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
// OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
// IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
//

//
// Configuration options
//

// whether to encrypt the data in the database; the api key will be used
// as the encryption key; if this is true, mcrypt is required
$do_crypt = true;

// database connection info

// global options; for PDO, the db_server is the PDO connection string
$db_server = "data.db";
$db_user = "";
$db_password = "";

// dbtype can be either PDO or mysql; if you need others, see further
// down for database functions

// no additional config for PDO
$dbtype = "PDO";

// mysql also needs a db name
//$dbtype = "mysql";
//$mysql_db_name = "eproxy";

//
// End of Configuration
//

// we're generally going to send XML
header("Content-type: text/xml");
// we are a-ok with the cross-site awesomeness
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST");
header("Access-Control-Max-Age: 10000");

$method = $_SERVER['REQUEST_METHOD'];
if ($method == "OPTIONS") {
  // this is xhr preflight; only headers matter
  exit();
}

// do gzip, if the accept-encoding sends the right thing
ob_start("ob_gzhandler");

//
// Database functions
//

// Should you need a non-PDO database, you can implement a new dbtype
// here.  Just implement the three functions with the specified semantics.
// If you're using PDO, you may need to modify the database schema to
// be compatible with your particular database:
//
// The 'date' field needs to be an exact numeric type; it will store
// seconds since the epoch in UTC.  'key' will be exactly 64 ascii
// bytes, and 'apicall' will be a variable number of characters but
// shouldn't exceed 64.  'value' will be a chunk of text, either the
// raw results or a base64-encoded version of the encrypted data if
// encryption is active (it will be text in both cases; it may contain
// UTF8 characters, so won't necessarily always be ASCII).

// php is ridiculous
if ($dbtype == "PDO") {
    // this should open the database connection
    function eproxy_db_connect() {
        global $db;
        global $db_server, $db_user, $db_password;

        try {
            $db = new PDO($db_server, $db_user, $db_password, array(PDO::ATTR_PERSISTENT => true));
            $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        } catch (Exception $ex) {
            print_error("Couldn't open database $db_server -> $ex");
            ob_flush();
            exit();
        }

        // check if the table exists; otherwise create it.
        try {
            $q = $db->query("SELECT dval FROM data_cache LIMIT 1");
            $q->fetch();
            $q->closeCursor();
        } catch (Exception $ex) {
            $db->exec("CREATE TABLE data_cache (apicall VARCHAR(64), kval CHAR(64), dval INTEGER, value TEXT)");
            $db->exec("CREATE INDEX data_key_index ON data_cache(kval)");
        }
    }

    // this should query for data matching ($ac,$k)
    function eproxy_db_query($ac, $k) {
        global $db;
        global $APICacheTimer;

        $d = time() - $APICacheTimer[$ac];
        $q = $db->query("SELECT dval, value FROM data_cache WHERE apicall = '$ac' AND kval = '$k' AND dval > $d");
        $row = $q->fetch();
        $res = null;
        if ($row != false) {
            $res = $row['value'];
        }

        $q->closeCursor();
        return $res;
    }

    function eproxy_db_insert($ac, $k, $value) {
        global $db;
        $db->exec("DELETE FROM data_cache WHERE apicall = '$ac' AND kval = '$k'");
        $stmt = $db->prepare("INSERT INTO data_cache (apicall, kval, dval, value) VALUES (?,?,?,?)");
        $stmt->bindParam(1, $ac);
        $stmt->bindParam(2, $k);
        $stmt->bindParam(3, time());
        $stmt->bindParam(4, $value);
        $stmt->execute();
    }
} else if ($dbtype == "mysql") {
    function eproxy_db_connect() {
        global $db;
        global $db_server, $db_user, $db_password;
        global $mysql_db_name;

        if (!$mysql_db_name) {
            print_error("mysql_db_name must be specified");
            exit();
        }

        $db = mysql_connect($db_server, $db_user, $db_password);
        if (!$db) {
            print_error("couldn't connect to mysql database");
            exit();
        }

        if (!mysql_select_db($mysql_db_name)) {
            print_error("couldn't select database");
            exit();
        }

        $q = mysql_query("SHOW TABLES LIKE 'data_cache'");
        if ($q == false || mysql_num_rows($q) == 0) {
            mysql_query("CREATE TABLE data_cache (apicall VARCHAR(64), kval CHAR(64), dval INTEGER, value TEXT)");
            mysql_query("CREATE INDEX data_key_index ON data_cache(kval)");
        }

        if ($q != false)
            mysql_free_result($q);
    }

    function eproxy_db_query($ac, $k) {
        $d = time() - $APICacheTimer[$ac];
        $q = mysql_query("SELECT dval, value FROM data_cache WHERE apicall = '$ac' AND kval = '$k' AND dval > $d");
        $res = null;
        if ($q != false && mysql_num_rows($q) > 0) {
            $row = mysql_fetch_assoc($q);
            $res = $row['value'];
        }

        if ($q != false)
            mysql_free_result($q);

        return $res;
    }

    function eproxy_db_insert($ac, $k, $value) {
        $d = time();
        mysql_query("DELETE FROM data_cache where apicall = '$ac' AND kval = '$k'");
        mysql_query("INSERT INTO data_cache (apicall, kval, dval, value) VALUES('$ac', '$k', $d, '" . mysql_real_escape_string($value) . "')");
    }
} else {
    print_error("invalid proxy dbtype defined");
    exit();
}


// print an error in the eve-api error style
function print_error($str) {
    print "<?xml version='1.0' encoding='UTF-8'?>\n";
    print "<eveapi version=\"2\">\n";
    print "<currentTime>2007-12-20 01:45:24</currentTime>\n";
    print "<error code=\"9999\">eproxy error: $str</error>\n";
    print "<cachedUntil>2007-12-20 01:50:24</cachedUntil>\n";
    print "</eveapi>\n";
}

function exception_handler($exception) {
    print_error("Uncaught exception: " . $exception->getMessage());
    exit();
}

set_exception_handler('exception_handler');

if (array_key_exists("PATH_INFO", $_SERVER) && $_SERVER['PATH_INFO']) {
    $pathinfo = $_SERVER['PATH_INFO'];
} else {
    // try to emulate PATH_INFO; courtesy of Shinhan
    // find the first '/' after the first '.' -- this won't work if, for some reason, the path
    // to eproxy.php has a directory component with a period in it beforehand.  You can
    // fix that by changing the '.' to the script name, e.g. 'eproxy.php'
    $start = strpos($_SERVER['REQUEST_URI'],'/',strpos($_SERVER['REQUEST_URI'],'.'));
    $end = strpos($_SERVER['REQUEST_URI'],'?');
    if ($end > 0) {
        // we've got a GET query string at the end
        $pathinfo = substr($_SERVER['REQUEST_URI'],$start,$end - $start);
    } else {
        $pathinfo = substr($_SERVER['REQUEST_URI'],$start);
    }
}

$apicall = preg_replace('/[^A-Za-z0-9\/.-]/', '', $pathinfo);

// Which arguments each api call takes
$APIArgs = array(
    "/eve/SkillTree.xml.aspx" => array(),
    "/eve/RefTypes.xml.aspx" => array(),
    "/eve/AllianceList.xml.aspx" => array(),
    "/map/Sovereignty.xml.aspx" => array(),
    "/account/Characters.xml.aspx" => array("userID", "apiKey"),
    "/char/CharacterSheet.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/char/SkillInTraining.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/char/AssetList.xml.aspx" => array("userID", "apiKey", "characterID", "version"),

    "/eve/ConquerableStationList.xml.aspx" => array("version"),
    "/eve/ErrorList.xml.aspx" => array("version"),
    "/eve/RefTypes.xml.aspx" => array("version"),
    "/eve/CharacterID.xml.aspx" => array("names"),
    "/map/Jumps.xml.aspx" => array("version"),
    "/map/Kills.xml.aspx" => array("version"),

    "/char/AccountBalance.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/corp/AccountBalance.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/corp/MemberTracking.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/corp/AssetList.xml.aspx" => array("userID", "apiKey", "characterID", "version"),
    "/char/IndustryJobs.xml.aspx" => array("userID", "apiKey", "characterID", "version"),
    "/corp/IndustryJobs.xml.aspx" => array("userID", "apiKey", "characterID", "version"),

    "/char/WalletJournal.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/corp/WalletJournal.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/char/WalletTransactions.xml.aspx" => array("userID", "apiKey", "characterID"),
    "/corp/WalletTransactions.xml.aspx" => array("userID", "apiKey", "characterID"),

    "/char/KillLog.xml.aspx" => array("userID", "apiKey", "characterID", "version"),
    "/corp/KillLog.xml.aspx" => array("userID", "apiKey", "characterID", "version"),
    "/corp/StarbaseDetail.xml.aspx" => array("userID", "apiKey", "characterID", "version", "starbaseID"),
    "/corp/StarbaseList.xml.aspx" => array("userID", "apiKey", "characterID", "version"),

    "/char/MarketOrders.xml.aspx" => array("userID", "apiKey", "characterID", "version"),
    "/corp/MarketOrders.xml.aspx" => array("userID", "apiKey", "characterID", "version"),

    );

$OptionalAPIArgs = array(
    "/char/KillLog.xml.aspx" => array("beforeKillID"),
    "/corp/KillLog.xml.aspx" => array("beforeKillID"),
    "/char/WalletJournal.xml.aspx" => array("beforeRefID"),
    "/corp/WalletJournal.xml.aspx" => array("beforeRefID"),
    "/char/WalletTransactions.xml.aspx" => array("beforeTransID"),
    "/corp/WalletTransactions.xml.aspx" => array("beforeTransID"),
    );

define("DAYS", 24*60*60);
define("HOURS", 60*60);
define("MINUTES", 60);

// how long to cache the results of each api call
$APICacheTimer = array(
    "/eve/SkillTree.xml.aspx"        => 7*DAYS,
    "/eve/RefTypes.xml.aspx"         => 7*DAYS,
    "/eve/AllianceList.xml.aspx"     => 60*MINUTES,
    "/map/Sovereignty.xml.aspx"      => 1*DAYS,
    "/account/Characters.xml.aspx"   => 1*DAYS,
    "/char/CharacterSheet.xml.aspx"  => 1*HOURS,
    "/char/SkillInTraining.xml.aspx" => 15*MINUTES,
    "/char/AssetList.xml.aspx"       => 1*DAYS,

    "/eve/ConquerableStationList.xml.aspx" => 1*HOURS,
    "/eve/ErrorList.xml.aspx" => 7*DAYS,
    "/eve/RefTypes.xml.aspx" => 7*DAYS,
    "/eve/CharacterID.xml.aspx" => 1*DAYS,
    "/map/Jumps.xml.aspx" => 1*HOUR,
    "/map/Kills.xml.aspx" => 1*HOUR,

    "/char/AccountBalance.xml.aspx" => 15*MINUTES,
    "/corp/AccountBalance.xml.aspx" => 15*MINUTES,
    "/corp/MemberTracking.xml.aspx" => 6*HOURS,
    "/corp/AssetList.xml.aspx" => 1*DAYS,
    "/char/IndustryJobs.xml.aspx" => 30*MINUTES, // can be 15
    "/corp/IndustryJobs.xml.aspx" => 30*MINUTES, // can be 15

    "/char/WalletJournal.xml.aspx" => 1*HOURS,
    "/corp/WalletJournal.xml.aspx" => 1*HOURS,
    "/char/WalletTransactions.xml.aspx" => 1*HOURS,
    "/corp/WalletTransactions.xml.aspx" => 1*HOURS,

    "/char/KillLog.xml.aspx" => 1*HOURS,
    "/corp/KillLog.xml.aspx" => 1*HOURS,
    "/corp/StarbaseDetail.xml.aspx" => 15*MINUTES,
    "/corp/StarbaseList.xml.aspx" => 15*MINUTES,

    "/char/MarketOrders.xml.aspx" => 1*HOURS,
    "/corp/MarketOrders.xml.aspx" => 1*HOURS
    );

function encryptionKey($api, $params) {
    global $APIArgs;

    $i = array_search("apiKey", $APIArgs[$api]);
    if ($i === NULL || $i === FALSE)
        return null;
    return base64_decode($params["apiKey"]);
}

function extractArgs($api, $params) {
    global $APIArgs;
    global $OptionalAPIArgs;

    $k = array();

    foreach ($APIArgs[$api] as $a) {
        $k[$a] = $params[$a];
    }

    if (array_key_exists($api, $OptionalAPIArgs)) {
        foreach ($OptionalAPIArgs[$api] as $a) {
            if (array_key_exists($a, $params))
                $k[$a] = $params[$a];
        }
    }

    return $k;
}

function decryptData($data, $key) {
    global $do_crypt;
    if(!$do_crypt || $key == null || substr_compare($data, "<?xml", 0) == 0)
        return $data;

    $data = base64_decode($data);
    $mod = mcrypt_module_open('blowfish', '', 'cfb', '');

    $iv = substr($data, 0, mcrypt_enc_get_iv_size($mod));
    $cdata = substr($data, mcrypt_enc_get_iv_size($mod));

    mcrypt_generic_init($mod, $key, $iv);
    $decrypted_data = mdecrypt_generic($mod, $cdata);
    mcrypt_generic_deinit($mod);
    mcrypt_module_close($mod);

    return gzuncompress($decrypted_data);
}

function encryptData($data, $key) {
    global $do_crypt;
    if(!$do_crypt || $key == null)
        return $data;

    $mod = mcrypt_module_open('blowfish', '', 'cfb', '');
    $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($mod));
    mcrypt_generic_init($mod, $key, $iv);
    $encrypted_data = mcrypt_generic($mod, gzcompress($data));
    mcrypt_generic_deinit($mod);
    mcrypt_module_close($mod);

    return base64_encode($iv . $encrypted_data);
}

function makeKey($api, $params) {
    global $APIArgs;

    $k = "";

    // make the key into a concatenation of the param values
    // as listed in the APIArgs array
    foreach ($APIArgs[$api] as $a) {
        if (!array_key_exists($a, $params)) {
            print_error("Missing parameter: " . $a);
            exit();
        }
        $k .= preg_replace('/[^A-Za-z0-9-]/', '', $params[$a]);
    }

    // take the SHA-256 hash
    if ($k == "")
        return "";
    return hash('sha256', $k);
}

if (!array_key_exists($apicall, $APIArgs)) {
    print_error("Unknown api call");
    ob_flush();
    return;
}

eproxy_db_connect();

$args = extractArgs($apicall, $_POST);
$key = makeKey($apicall, $args);
$cryptkey = encryptionKey($apicall, $args);

// grab a cached value from the database, if any
$value = eproxy_db_query($apicall, $key);

// did we find a cached value?
if ($value != null) {
    $data = decryptData($value, $cryptkey);
    print $data;
    ob_flush();
    exit();
}

// no cached value; have to do the actual query

$eve_api = "http://api.eve-online.com" . $apicall;
//print $eve_api . "\n";

$req = curl_init($eve_api);
curl_setopt($req, CURLOPT_POST, true);
curl_setopt($req, CURLOPT_POSTFIELDS, $args);
curl_setopt($req, CURLOPT_RETURNTRANSFER, true);
$resp = curl_exec($req);
$http_code = curl_getinfo($req,  CURLINFO_HTTP_CODE);
curl_close($req);

// check if the response has an error
if ($http_code != 200 || strpos($resp, "<error ") !== FALSE) {
    // yeah, there was an error; don't save this
    print $resp;
    ob_flush();
    return;
}

$cachedata = encryptData($resp, $cryptkey);

// save the non-error response into the cache
// XXX parse the cachedUntil and use that instead of our cache timer
eproxy_db_insert($apicall, $key, $cachedata);

print $resp;

ob_flush();

?>