Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

Nog geen response.

<?php
declare(strict_types=1);

/*
|--------------------------------------------------------------------------
| PostcodeConnect API proxy voor klanten
|--------------------------------------------------------------------------
| Plaats dit bestand op je eigen website, bijvoorbeeld als:
| https://jouwdomein.nl/api-proxy.php
|
| Vul hieronder alleen je eigen API-key en toegestane website(s) in.
| De API-key blijft zo veilig op de server en komt niet in JavaScript terecht.
*/

header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Headers: Content-Type, X-Requested-With');
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header('Cache-Control: no-store');

/*
|--------------------------------------------------------------------------
| Instellingen
|--------------------------------------------------------------------------
*/

$BASE_API = 'https://api.postcodeconnect.nl';
$API_KEY = 'VUL_HIER_JE_API_KEY_IN';

// Vul hier je eigen website(s) in. Laat leeg voor same-origin gebruik.
$ALLOWED_ORIGINS = [
    'https://www.jouwdomein.nl',
    'https://jouwdomein.nl',
];

// Zet gelijk aan de RPS van je pakket. Gebruik 0 om proxy-throttling uit te schakelen.
$PROXY_REQUESTS_PER_SECOND = 10;

/*
|--------------------------------------------------------------------------
| Helpers
|--------------------------------------------------------------------------
*/

function proxy_error(int $status, string $error, array $extra = []): void
{
    http_response_code($status);
    echo json_encode(array_merge(['ok' => false, 'error' => $error], $extra), JSON_UNESCAPED_UNICODE);
    exit;
}

function proxy_throttle_rps(float $maxRequestsPerSecond, string $bucketKey): void
{
    if ($maxRequestsPerSecond <= 0) {
        return;
    }

    $minInterval = 1 / $maxRequestsPerSecond;
    $lockFile = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
        . DIRECTORY_SEPARATOR
        . 'postcodeconnect_proxy_rps_' . sha1($bucketKey) . '.lock';

    $fp = fopen($lockFile, 'c+');
    if (!$fp) {
        return;
    }

    try {
        if (!flock($fp, LOCK_EX)) {
            return;
        }

        rewind($fp);
        $raw = trim((string)stream_get_contents($fp));
        $nextAllowedAt = is_numeric($raw) ? (float)$raw : 0.0;
        $now = microtime(true);

        if ($nextAllowedAt > $now) {
            usleep((int)(($nextAllowedAt - $now) * 1000000));
            $now = microtime(true);
        }

        $nextAllowedAt = max($nextAllowedAt, $now) + $minInterval;

        ftruncate($fp, 0);
        rewind($fp);
        fwrite($fp, sprintf('%.6F', $nextAllowedAt));
        fflush($fp);
        flock($fp, LOCK_UN);
    } finally {
        fclose($fp);
    }
}

/*
|--------------------------------------------------------------------------
| CORS en basisvalidatie
|--------------------------------------------------------------------------
*/

if (isset($_SERVER['HTTP_ORIGIN']) && $ALLOWED_ORIGINS !== []) {
    if (!in_array($_SERVER['HTTP_ORIGIN'], $ALLOWED_ORIGINS, true)) {
        proxy_error(403, 'forbidden_origin');
    }

    header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
    header('Vary: Origin');
}

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'GET' && $_SERVER['REQUEST_METHOD'] !== 'POST') {
    proxy_error(405, 'method_not_allowed');
}

if ($API_KEY === '' || $API_KEY === 'VUL_HIER_JE_API_KEY_IN') {
    proxy_error(500, 'missing_api_key');
}

$action = trim((string)($_GET['action'] ?? ''));
if ($action === '') {
    proxy_error(400, 'missing_action');
}

if (!preg_match('/^[a-z0-9_]+$/i', $action)) {
    proxy_error(400, 'invalid_action');
}

/*
|--------------------------------------------------------------------------
| Request doorsturen naar PostcodeConnect
|--------------------------------------------------------------------------
*/

$params = $_GET;
unset($params['action']);

$queryString = http_build_query($params);

if ($action === 'polygonsearch') {
    $upstreamUrl = rtrim($BASE_API, '/') . '/?action=polygonsearch';
    if ($queryString !== '') {
        $upstreamUrl .= '&' . $queryString;
    }
} else {
    $upstreamUrl = rtrim($BASE_API, '/') . '/' . rawurlencode($action);
    if ($queryString !== '') {
        $upstreamUrl .= '?' . $queryString;
    }
}

$headers = [
    'Accept: application/json',
    'Authorization: Bearer ' . $API_KEY,
    'X-Forwarded-For: ' . ($_SERVER['REMOTE_ADDR'] ?? '0.0.0.0'),
];

$curlOptions = [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => $headers,
    CURLOPT_TIMEOUT => 20,
    CURLOPT_CONNECTTIMEOUT => 5,
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_SSL_VERIFYHOST => 2,
    CURLOPT_FOLLOWLOCATION => false,
];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if ($action !== 'polygonsearch') {
        proxy_error(405, 'post_not_allowed_for_action');
    }

    $body = file_get_contents('php://input');
    if ($body === false || trim($body) === '') {
        proxy_error(400, 'missing_body');
    }

    $headers[] = 'Content-Type: ' . ($_SERVER['CONTENT_TYPE'] ?? 'application/json');
    $headers[] = 'Content-Length: ' . strlen($body);

    $curlOptions[CURLOPT_HTTPHEADER] = $headers;
    $curlOptions[CURLOPT_POST] = true;
    $curlOptions[CURLOPT_CUSTOMREQUEST] = 'POST';
    $curlOptions[CURLOPT_POSTFIELDS] = $body;
}

$ch = curl_init($upstreamUrl);
if ($ch === false) {
    proxy_error(500, 'curl_init_failed');
}

proxy_throttle_rps((float)$PROXY_REQUESTS_PER_SECOND, $BASE_API . '|' . $API_KEY);
curl_setopt_array($ch, $curlOptions);

$response = curl_exec($ch);
$status = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
$error = curl_error($ch);

curl_close($ch);

if ($response === false || $status === 0) {
    proxy_error(502, 'upstream_failed', [
        'detail' => $error !== '' ? $error : 'timeout',
    ]);
}

http_response_code($status);
echo $response;