<?php
session_start();
header('Content-Type: application/json');
header('Access-Control-Allow-Origin: https://*.vurgati.com');
header('Access-Control-Allow-Credentials: true');

$ch = curl_init('https://auth.vurgati.com/validate.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, 'sso_token=' . ($_COOKIE['sso_token'] ?? ''));
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
$response = curl_exec($ch);
curl_close($ch);

$data = json_decode($response, true);
if (isset($data['valid']) && $data['valid']) {
    echo json_encode(['message' => 'Welcome, user ' . $data['user_id']]);
} else {
    http_response_code(401);
    echo json_encode(['error' => 'Please log in']);
}
?>