<?php
// yamnweb - YAMN Mixmaster Network Web Interface
// Tor is retained only for remailer-list downloads. Message transport uses Nym.

// Enable error logging (disable display for security)
error_reporting(E_ALL);
ini_set('display_errors', '0');
ini_set('log_errors', '1');
// ini_set('error_log', '/var/log/php/yamnweb_errors.log'); // Uncomment if specific log needed

// PHP 8.1+ compatibility: FILTER_SANITIZE_STRING is deprecated
if (!defined('FILTER_SANITIZE_STRING')) {
    define('FILTER_SANITIZE_STRING', 513);
}

// Configure session BEFORE starting it (critical for cookie-based sessions)
ini_set('session.cookie_httponly', '1');
ini_set('session.use_only_cookies', '1');
// The public HTTPS endpoint gets a Secure cookie. The Onion service may use
// HTTP, so detect the current request instead of forcing one mode globally.
$requestIsHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
    || (isset($_SERVER['SERVER_PORT']) && (int)$_SERVER['SERVER_PORT'] === 443);
ini_set('session.cookie_secure', $requestIsHttps ? '1' : '0');
ini_set('session.cookie_samesite', 'Lax'); // Changed from 'Strict' to allow form submissions
ini_set('session.gc_maxlifetime', 7200); // 2 hours session lifetime

session_start();

// Ensure session is actually working
if (!isset($_SESSION)) {
    die("Error: Session could not be initialized. Check PHP session configuration.");
}

// Test if session is writable
if (!isset($_SESSION['session_test'])) {
    $_SESSION['session_test'] = 'working';
}

// Verify session persists
if ($_SESSION['session_test'] !== 'working') {
    die("Error: Session is not persisting. Check session.save_path permissions.");
}

// Tor is used only by the remailer-list downloader.
if (file_exists('download_remailers.php')) {
    require_once 'download_remailers.php';
} else {
    error_log("Warning: download_remailers.php not found");
}

require_once __DIR__ . '/nym_sender.php';
require_once __DIR__ . '/yamn_encoder.php';

// Theme management via cookie
$theme = 'dark'; // Default
if (isset($_COOKIE['yamn_theme'])) {
    $theme = $_COOKIE['yamn_theme'] === 'light' ? 'light' : 'dark';
}

// Handle theme switch
if (isset($_GET['theme']) && in_array($_GET['theme'], ['light', 'dark'])) {
    $theme = $_GET['theme'];
    setcookie('yamn_theme', $theme, time() + (365 * 24 * 60 * 60), '/', '', true, true);
    header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?'));
    exit;
}

// Security headers
header("X-Frame-Options: DENY");
header("X-Content-Type-Options: nosniff");
header("Referrer-Policy: no-referrer");
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';");

// NO CACHE headers - prevent browser from caching form with old CSRF token
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past

// CSRF token generation - IMPROVED with refresh after use
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// Store current token for validation BEFORE any regeneration
$currentCsrfToken = $_SESSION['csrf_token'];

/**
 * Parse remailers from file and return array by type
 * Entry and Exit can use ANY remailer
 * Middle should use remailers with specific flags
 *
 * @param string $type 'entry', 'middle', or 'exit'
 * @return array Array of remailer names
 */
function getRemailers($type) {
    $remailers = ['*']; // Always include Random option

    // Try multiple file locations
    $files = [
        '/opt/yamn-data/cache/remailers.txt',
        '/var/www/yamnweb/remailers.txt'
    ];

    foreach ($files as $file) {
        if (!file_exists($file)) continue;

        $lines = file($file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
        $inDataSection = false;

        foreach ($lines as $line) {
            $line = trim($line);

            // Start parsing after separator line (--------)
            if (preg_match('/^-{10,}/', $line)) {
                $inDataSection = true;
                continue;
            }

            // Stop at Remailer-Capabilities section
            if (stripos($line, 'Remailer-Capabilities') !== false) {
                break;
            }

            // Only parse lines after the separator
            if (!$inDataSection) continue;

            // Skip empty lines
            if (empty($line)) continue;

            // Split line: name latency uptime [flags]
            // Example: "middleman    211112111211    :45   ++++++++++++  100.0%  D"
            $parts = preg_split('/\s+/', $line);

            // Must have at least name + latency
            if (count($parts) < 2) continue;

            // Extract ONLY the remailer name (first field)
            $remailerName = $parts[0];

            // Validate name: lowercase letters, numbers, hyphens only
            if (!preg_match('/^[a-z0-9-]+$/', $remailerName)) continue;

            // Check if last field is 'D' (middle capability flag)
            $lastField = end($parts);
            $isMiddleCapable = ($lastField === 'D');

            // LOGICA CORRETTA: Mutuamente esclusivi
            if ($isMiddleCapable) {
                // Remailers CON 'D' = SOLO middle
                if ($type === 'middle') {
                    $remailers[] = $remailerName;
                }
            } else {
                // Remailers SENZA 'D' = SOLO entry/exit
                if ($type === 'entry' || $type === 'exit') {
                    $remailers[] = $remailerName;
                }
            }
        }
        break; // Use first file found
    }

    return array_unique($remailers);
}

/**
 * Replace asterisk (*) with random remailer from available list
 * @param string $remailer Selected remailer (may be "*")
 * @param array $availableRemailers List of available remailers
 * @return string Actual remailer name
 */
function resolveRemailer($remailer, $availableRemailers) {
    if ($remailer === '*') {
        // Filter out the asterisk itself from candidates
        $candidates = array_filter($availableRemailers, function($r) {
            return $r !== '*';
        });

        if (empty($candidates)) {
            throw new Exception("No remailers available for random selection");
        }

        // Pick random remailer
        $randomIndex = array_rand($candidates);
        return $candidates[$randomIndex];
    }
    return $remailer;
}

// Load available remailers
$entryRemailers = getRemailers('entry');
$middleRemailers = getRemailers('middle');
$exitRemailers = getRemailers('exit');

// If no remailers loaded, try to download them
if (count($entryRemailers) <= 1 && class_exists('SecureRemailerDownloader')) {
    try {
        $downloader = new SecureRemailerDownloader();
        $downloader->downloadRemailers();
        // Reload after download
        $entryRemailers = getRemailers('entry');
        $middleRemailers = getRemailers('middle');
        $exitRemailers = getRemailers('exit');
    } catch (Exception $e) {
        error_log("Failed to download remailers: " . $e->getMessage());
    }
}

$message = '';
$messageType = '';

// Check for flash messages from previous redirect (PRG pattern)
if (isset($_SESSION['flash_message'])) {
    $message = $_SESSION['flash_message'];
    $messageType = isset($_SESSION['flash_type']) ? $_SESSION['flash_type'] : 'info';

    // Clear flash messages after displaying
    unset($_SESSION['flash_message']);
    unset($_SESSION['flash_type']);
}

// Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // CSRF validation - IMPROVED with better error handling
    if (!isset($_POST['csrf_token'])) {
        // Save error in session and redirect
        $_SESSION['flash_message'] = "Security token missing. Please reload the page and try again.";
        $_SESSION['flash_type'] = 'error';
        header('Location: ' . $_SERVER['PHP_SELF']);
        exit;
    } elseif ($_POST['csrf_token'] !== $currentCsrfToken) {
        // Save error in session and redirect
        $_SESSION['flash_message'] = "Security token mismatch. Please try submitting again.";
        $_SESSION['flash_type'] = 'error';
        header('Location: ' . $_SERVER['PHP_SELF']);
        exit;
    } else {
        try {
            if (isset($_POST['update_remailers'])) {
                if (!class_exists('SecureRemailerDownloader')) {
                    throw new Exception('Remailer list updater is not available.');
                }

                set_time_limit(0);
                $downloader = new SecureRemailerDownloader();
                if (!$downloader->forceUpdate()) {
                    throw new Exception('Remailer list update failed. The previous list was kept where possible.');
                }

                $_SESSION['flash_message'] = 'Remailer list and public keyring updated successfully.';
                $_SESSION['flash_type'] = 'success';
                $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
                header('Location: ' . $_SERVER['PHP_SELF']);
                exit;
            }

            // Get and sanitize form data with additional validation
            $entryRemailer = isset($_POST['entry_remailer']) ? filter_var($_POST['entry_remailer'], FILTER_SANITIZE_STRING) : '';
            $middleRemailer = isset($_POST['middle_remailer']) ? filter_var($_POST['middle_remailer'], FILTER_SANITIZE_STRING) : '';
            $exitRemailer = isset($_POST['exit_remailer']) ? filter_var($_POST['exit_remailer'], FILTER_SANITIZE_STRING) : '';
            $from = isset($_POST['from']) ? filter_var($_POST['from'], FILTER_SANITIZE_STRING) : '';
            $replyTo = isset($_POST['reply_to']) ? filter_var($_POST['reply_to'], FILTER_SANITIZE_STRING) : '';
            $to = isset($_POST['to']) ? filter_var($_POST['to'], FILTER_SANITIZE_EMAIL) : '';
            $subject = isset($_POST['subject']) ? filter_var($_POST['subject'], FILTER_SANITIZE_STRING) : '';
            $newsgroups = isset($_POST['newsgroups']) ? filter_var($_POST['newsgroups'], FILTER_SANITIZE_STRING) : '';
            $references = isset($_POST['references']) ? filter_var($_POST['references'], FILTER_SANITIZE_STRING) : '';
            $data = isset($_POST['data']) ? $_POST['data'] : ''; // Keep original formatting
            $copies = isset($_POST['copies']) ? intval($_POST['copies']) : 1;

            // Validate copies
            if ($copies < 1 || $copies > 3) {
                throw new Exception("Number of copies must be between 1 and 3.");
            }

            if (empty($from)) {
                throw new Exception("Sender (From) is required.");
            }

            $messageKind = trim($newsgroups) === '' ? 'email' : 'usenet';
            if ($messageKind === 'email' && empty($to)) {
                throw new Exception("Email recipient is required when Newsgroup is empty.");
            }

            if ($messageKind === 'usenet') {
                $to = yamnConfig('YAMN_USENET_GATEWAY', 'mail2news@mail2news.tcpreset.net');
                if (!filter_var($to, FILTER_VALIDATE_EMAIL)) {
                    throw new Exception("Usenet gateway is not configured correctly.");
                }
            }

            // Validate remailer chain
            if (empty($entryRemailer) || empty($middleRemailer) || empty($exitRemailer)) {
                throw new Exception("All three remailers must be specified.");
            }

            // Resolve asterisks (*) to actual random remailers
            $resolvedEntry = resolveRemailer($entryRemailer, $entryRemailers);
            $resolvedMiddle = resolveRemailer($middleRemailer, $middleRemailers);
            $resolvedExit = resolveRemailer($exitRemailer, $exitRemailers);

            $encoded = encodeYamnMessage([
                'kind' => $messageKind,
                'entry' => $resolvedEntry,
                'chain' => [$resolvedEntry, $resolvedMiddle, $resolvedExit],
                'from' => $from,
                'reply_to' => $replyTo,
                'to' => $to,
                'subject' => $subject,
                'newsgroup' => $newsgroups,
                'body' => $data,
                'references' => $references,
            ]);
            if (!$encoded['success']) {
                throw new Exception($encoded['error'] ?? 'YAMN encoding failed');
            }
            $responseFinished = false;
            $onHandoff = null;
            if (function_exists('fastcgi_finish_request')) {
                $onHandoff = static function () use (&$responseFinished): void {
                    ignore_user_abort(true);
                    $_SESSION['flash_message'] = 'Message handed to the local Nym transport. The sender is completing delivery in the background; YAMN queues may take several hours, and this confirmation does not mean the message has been published or delivered yet.';
                    $_SESSION['flash_type'] = 'success';
                    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
                    session_write_close();
                    header('Location: ' . $_SERVER['PHP_SELF']);
                    fastcgi_finish_request();
                    $responseFinished = true;
                };
            }

            $result = sendNymEnvelope($encoded['envelope'], 1, $encoded['entry_address'], $onHandoff);
            if ($responseFinished) {
                exit;
            }
            if (!$result['success']) {
                throw new Exception($result['error'] ?? 'Nym submission failed');
            }
            $_SESSION['flash_message'] = 'Message accepted by the Nym transport. Delivery through the YAMN queues may take several hours; this confirmation does not mean the message has been published or delivered yet.';
            $_SESSION['flash_type'] = 'success';
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
            header('Location: ' . $_SERVER['PHP_SELF']);
            exit;
        } catch (Exception $e) {
            // Save error in session and redirect (PRG pattern for errors too)
            $_SESSION['flash_message'] = "✗ Error: " . $e->getMessage();
            $_SESSION['flash_type'] = 'error';
            error_log("YAMN submission error: " . $e->getMessage() . "\nStack: " . $e->getTraceAsString());

            // Redirect to prevent form resubmission
            header('Location: ' . $_SERVER['PHP_SELF']);
            exit;
        } catch (Error $e) {
            // Catch PHP 7+ Error class (for fatal errors)
            $_SESSION['flash_message'] = "✗ Fatal Error: " . $e->getMessage();
            $_SESSION['flash_type'] = 'error';
            error_log("YAMN fatal error: " . $e->getMessage() . "\nStack: " . $e->getTraceAsString());

            // Redirect to prevent form resubmission
            header('Location: ' . $_SERVER['PHP_SELF']);
            exit;
        } catch (Throwable $e) {
            // Catch everything else
            $_SESSION['flash_message'] = "✗ Unexpected error: " . $e->getMessage();
            $_SESSION['flash_type'] = 'error';
            error_log("YAMN unexpected error: " . $e->getMessage());

            // Redirect to prevent form resubmission
            header('Location: ' . $_SERVER['PHP_SELF']);
            exit;
        }
    }
}
?>
<!DOCTYPE html>
<html lang="it">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>YAMN Web, invio anonimo</title>
    <style>
        :root {
            --transition-speed: 0.3s;
        }

        /* Dark theme (default) */
        body.theme-dark {
            --bg-primary: #0a0a0a;
            --bg-secondary: #1a1a1a;
            --text-primary: #e0e0e0;
            --text-secondary: #a0a0a0;
            --accent: #00ff00;
            --accent-hover: #00cc00;
            --border: #333;
            --error: #ff4444;
            --warning: #ffaa00;
            --success: #00ff00;
            --tor-bg: rgba(138, 43, 226, 0.1);
            --tor-border: #8a2be2;
            --tor-text: #bb86fc;
        }

        /* Light theme */
        body.theme-light {
            --bg-primary: #f5f5f5;
            --bg-secondary: #ffffff;
            --text-primary: #2a2a2a;
            --text-secondary: #666666;
            --accent: #007700;
            --accent-hover: #005500;
            --border: #dddddd;
            --error: #cc0000;
            --warning: #ff8800;
            --success: #008800;
            --tor-bg: rgba(138, 43, 226, 0.05);
            --tor-border: #6a1ba2;
            --tor-text: #6a1ba2;
        }

        * {
            margin: 0;
            padding: 0;
            box-sizing: border-box;
        }

        body {
            font-family: 'Courier New', monospace;
            background: var(--bg-primary);
            color: var(--text-primary);
            padding: 20px;
            line-height: 1.6;
            transition: background var(--transition-speed), color var(--transition-speed);
        }

        .container {
            max-width: 900px;
            margin: 0 auto;
            background: var(--bg-secondary);
            padding: 30px;
            border: 2px solid var(--border);
            border-radius: 5px;
            box-shadow: 0 0 20px rgba(0, 255, 0, 0.1);
            transition: all var(--transition-speed);
        }

        h1 {
            color: var(--accent);
            text-align: center;
            margin-bottom: 10px;
            font-size: 2em;
            text-transform: uppercase;
            letter-spacing: 3px;
            transition: color var(--transition-speed);
        }

        .subtitle {
            text-align: center;
            color: var(--text-secondary);
            margin-bottom: 30px;
            font-size: 0.9em;
            transition: color var(--transition-speed);
        }

        .info-box {
            background: var(--tor-bg);
            border: 1px solid var(--tor-border);
            padding: 15px;
            margin-bottom: 25px;
            border-radius: 5px;
            font-size: 0.9em;
            transition: all var(--transition-speed);
        }

        .info-box strong {
            color: var(--tor-text);
            display: block;
            margin-bottom: 10px;
        }

        .info-box ul {
            margin-left: 20px;
            color: var(--text-secondary);
        }

        .read-more {
            color: var(--accent);
            display: inline-block;
            margin-top: 12px;
            font-weight: bold;
        }

        .form-group {
            margin-bottom: 20px;
        }

        label {
            display: block;
            margin-bottom: 5px;
            color: var(--accent);
            font-weight: bold;
            transition: color var(--transition-speed);
        }

        .required {
            color: var(--error);
        }

        input[type="text"],
        input[type="email"],
        input[type="number"],
        select,
        textarea {
            width: 100%;
            padding: 10px;
            background: var(--bg-primary);
            border: 1px solid var(--border);
            color: var(--text-primary);
            border-radius: 3px;
            font-family: 'Courier New', monospace;
            font-size: 14px;
            transition: all var(--transition-speed);
        }

        input:focus,
        select:focus,
        textarea:focus {
            outline: none;
            border-color: var(--accent);
            box-shadow: 0 0 5px var(--accent);
        }

        textarea {
            min-height: 150px;
            resize: vertical;
        }

        .remailer-chain {
            display: grid;
            grid-template-columns: repeat(3, 1fr);
            gap: 15px;
            margin-top: 10px;
        }

        .remailer-chain label {
            font-size: 0.9em;
        }

        small {
            color: var(--text-secondary);
            display: block;
            margin-top: 6px;
        }

        button {
            width: 100%;
            padding: 15px;
            background: var(--accent);
            color: var(--bg-primary);
            border: none;
            border-radius: 5px;
            font-size: 1.1em;
            font-weight: bold;
            cursor: pointer;
            text-transform: uppercase;
            letter-spacing: 2px;
            font-family: 'Courier New', monospace;
            transition: all var(--transition-speed);
        }

        button:hover {
            background: var(--accent-hover);
            transform: translateY(-2px);
            box-shadow: 0 5px 15px rgba(0, 255, 0, 0.3);
        }

        .message {
            padding: 15px;
            margin-bottom: 20px;
            border-radius: 5px;
            border-left: 4px solid;
            transition: all var(--transition-speed);
        }

        .message.success {
            background: rgba(0, 255, 0, 0.1);
            border-color: var(--success);
            color: var(--success);
        }

        .message.error {
            background: rgba(255, 68, 68, 0.1);
            border-color: var(--error);
            color: var(--error);
        }

        .message.warning {
            background: rgba(255, 170, 0, 0.1);
            border-color: var(--warning);
            color: var(--warning);
        }

        .checkbox-group {
            display: flex;
            align-items: center;
            gap: 10px;
        }

        .checkbox-group input[type="checkbox"] {
            width: auto;
        }

        .checkbox-group label {
            margin: 0;
            font-weight: normal;
        }

        /* Theme toggle button */
        .theme-toggle {
            position: fixed;
            top: 20px;
            right: 20px;
            width: 50px;
            height: 50px;
            background: var(--bg-secondary);
            border: 2px solid var(--border);
            border-radius: 50%;
            display: flex;
            align-items: center;
            justify-content: center;
            cursor: pointer;
            font-size: 24px;
            transition: all var(--transition-speed);
            z-index: 1000;
            text-decoration: none;
        }

        .theme-toggle:hover {
            transform: scale(1.1) rotate(15deg);
            border-color: var(--accent);
            box-shadow: 0 0 20px var(--accent);
        }

        .theme-toggle-slider {
            transition: transform var(--transition-speed);
        }

        .theme-toggle:hover .theme-toggle-slider {
            transform: rotate(180deg);
        }

        /* Better mobile support */
        input[type="number"] {
            -moz-appearance: textfield;
        }

        input[type="number"]::-webkit-inner-spin-button,
        input[type="number"]::-webkit-outer-spin-button {
            -webkit-appearance: none;
            margin: 0;
        }

        /* Improved select dropdown */
        select {
            cursor: pointer;
            background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath fill='%2300ff00' d='M6 9L1 4h10z'/%3E%3C/svg%3E");
            background-repeat: no-repeat;
            background-position: right 10px center;
            padding-right: 30px;
            appearance: none;
            -webkit-appearance: none;
            -moz-appearance: none;
        }

        body.theme-light select {
            background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath fill='%23007700' d='M6 9L1 4h10z'/%3E%3C/svg%3E");
        }

        select:hover {
            border-color: var(--accent);
        }

        select option:checked {
            background: var(--accent);
            color: var(--text-primary);
        }

        .tor-indicator {
            display: inline-block;
            padding: 5px 10px;
            background: var(--tor-bg);
            border: 1px solid var(--tor-border);
            color: var(--tor-text);
            border-radius: 3px;
            font-size: 12px;
            margin-left: 10px;
            transition: all var(--transition-speed);
        }

        small {
            color: var(--text-secondary);
            transition: color var(--transition-speed);
        }

        select option {
            background: var(--bg-secondary);
            color: var(--text-primary);
        }

        @media (max-width: 768px) {
            .remailer-chain {
                grid-template-columns: 1fr;
            }

            .theme-toggle {
                top: 10px;
                right: 10px;
            }

            h1 {
                font-size: 1.5em;
                padding-right: 70px;
            }
        }

        /* Smooth theme transition */
        body, .container, input, select, textarea, button, .message, .info-box, .tor-indicator {
            transition: all var(--transition-speed) ease-in-out;
        }
    </style>
</head>
<body class="theme-<?php echo htmlspecialchars($theme); ?>">
    <div class="container">
        <!-- Theme Toggle -->
        <a href="?theme=<?php echo $theme === 'dark' ? 'light' : 'dark'; ?>" class="theme-toggle" title="Switch to <?php echo $theme === 'dark' ? 'Light' : 'Dark'; ?> Mode">
            <div class="theme-toggle-slider">
                <?php echo $theme === 'dark' ? '🌙' : '☀️'; ?>
            </div>
        </a>

        <h1>⚡ YAMN WEB INTERFACE ⚡</h1>
        <div class="subtitle">YAMN composition, local encryption, send-only Nym transport</div>

        <?php if (!empty($message)): ?>
            <div class="message <?php echo $messageType; ?>">
                <?php echo htmlspecialchars($message); ?>
            </div>
        <?php endif; ?>

        <div class="info-box">
            <strong>This interface prepares and submits YAMN packets.</strong>
            <ul>
                <li>The YAMN chain consists of Entry, Middle, and Exit remailers.</li>
                <li>The message is converted into an encrypted envelope before transport.</li>
                <li>Nym transports only the encrypted envelope, not the individual message fields.</li>
                <li>The service is send-only: it provides no inbox, fetch, reading, or reply retrieval.</li>
            </ul>
            <a class="read-more" href="about.html">Read more: detailed architecture and operation</a>
        </div>

        <div class="info-box">
            <strong>Remailer data</strong>
            <p>The primary statistics source is Victor's YAMN pinger at <code>echolot.virebent.art</code>. Fallback pingers are tried automatically if needed.</p>
            <form method="POST" action="">
                <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">
                <button type="submit" name="update_remailers" value="1">Update remailer list and keyring</button>
            </form>
            <small>This may take a few minutes because the update uses Tor and tries fallback sources if necessary.</small>
        </div>

        <form method="POST" action="" id="yamnForm">
            <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">

            <div class="form-group">
                <label>Three-hop YAMN chain <span class="required">*</span></label>
                <div class="remailer-chain">
                    <div><label for="entry_remailer">Entry</label><select name="entry_remailer" id="entry_remailer" required><?php foreach ($entryRemailers as $remailer): ?><option value="<?php echo htmlspecialchars($remailer); ?>"><?php echo htmlspecialchars($remailer); ?></option><?php endforeach; ?></select></div>
                    <div><label for="middle_remailer">Middle</label><select name="middle_remailer" id="middle_remailer" required><?php foreach ($middleRemailers as $remailer): ?><option value="<?php echo htmlspecialchars($remailer); ?>"><?php echo htmlspecialchars($remailer); ?></option><?php endforeach; ?></select></div>
                    <div><label for="exit_remailer">Exit</label><select name="exit_remailer" id="exit_remailer" required><?php foreach ($exitRemailers as $remailer): ?><option value="<?php echo htmlspecialchars($remailer); ?>"><?php echo htmlspecialchars($remailer); ?></option><?php endforeach; ?></select></div>
                </div>
                <small>Entry receives the YAMN packet, Middle forwards it through the chain, and Exit delivers the decoded message.</small>
            </div>
            <div class="form-group"><label for="from">From <span class="required">*</span></label><input type="text" name="from" id="from" placeholder="Anonymous &lt;anon@example.org&gt;" required><small>Used as the From header.</small></div>
            <div class="form-group"><label for="reply_to">Reply-To address</label><input type="text" name="reply_to" id="reply_to"><small>Optional. It is not used to retrieve replies.</small></div>
            <div class="form-group"><label for="to">Email recipient</label><input type="email" name="to" id="to"><small>Required for email delivery. Leave empty when publishing to a newsgroup.</small></div>
            <div class="form-group"><label for="subject">Subject <span class="required">*</span></label><input type="text" name="subject" id="subject" required></div>
            <div class="form-group"><label for="newsgroups">Newsgroup</label><input type="text" name="newsgroups" id="newsgroups" placeholder="misc.test"><small>Optional. When set, the message is routed through the configured Mail-to-News gateway. Leave empty for email.</small></div>
            <div class="form-group"><label for="references">References</label><input type="text" name="references" id="references" placeholder="&lt;message-id@example.org&gt;"><small>Optional. Links the article to an existing thread.</small></div>
            <div class="form-group"><label for="data">Message body <span class="required">*</span></label><textarea name="data" id="data" required></textarea>
                <small>The server creates the encrypted YAMN envelope in memory and sends only that packet through Nym. Remailer queues may take several hours.</small>
            </div>

            <button type="submit">🚀 Submit message</button>
        </form>
    </div>

    <script>
        const to = document.getElementById('to');
        const newsgroups = document.getElementById('newsgroups');
        const updateDestinationValidation = () => {
            to.required = newsgroups.value.trim() === '';
        };
        newsgroups.addEventListener('input', updateDestinationValidation);
        updateDestinationValidation();

        document.querySelectorAll('.remailer-chain select').forEach((select) => {
            select.addEventListener('change', () => {
                const selected = Array.from(document.querySelectorAll('.remailer-chain select'))
                    .map((item) => item.value)
                    .filter((value) => value !== '*');
                document.querySelectorAll('.remailer-chain select').forEach((item) => {
                    Array.from(item.options).forEach((option) => {
                        option.disabled = option.value !== '*' &&
                            selected.includes(option.value) &&
                            option.value !== item.value;
                    });
                });
            });
        });

        // Smooth scroll to top after theme change
        if (window.location.search.includes('theme=')) {
            window.scrollTo({top: 0, behavior: 'smooth'});
            // Clean URL without reloading
            const url = new URL(window.location);
            url.searchParams.delete('theme');
            window.history.replaceState({}, '', url);
        }
    </script>
</body>
</html>