<?php
// Filename: security.php
// Place this in your main directory
require 'config.php';

// Disable PHP errors in output to ensure clean text
error_reporting(0);
ini_set('display_errors', 0);

// Set correct Content-Type
header('Content-Type: text/plain; charset=utf-8');
header('Cache-Control: no-cache, no-store, must-revalidate');

// --- 1. FETCH SETTINGS ---
// Prioritize a specific security email, fallback to school email, then a generic one
$contact_email = getSetting('security_email'); 
if (empty($contact_email)) $contact_email = getSetting('school_email');
if (empty($contact_email)) $contact_email = 'admin@' . $_SERVER['HTTP_HOST'];

$school_name = getSetting('school_name', 'School Management System');
$site_url = "https://" . $_SERVER['HTTP_HOST'];

// --- 2. CALCULATE EXPIRY (Mandatory Field) ---
// We automatically set expiry to 1 year from today so it never becomes "stale"
$expires = date('c', strtotime('+1 year'));

// --- 3. OUTPUT CONTENT ---
echo "# Security Policy for $school_name\n";
echo "# Reporting vulnerabilities helps us keep student data safe.\n\n";

// Mandatory: How to contact you
echo "Contact: mailto:$contact_email\n";

// Mandatory: When this file expires (Auto-renewing)
echo "Expires: $expires\n";

// Optional: Languages you accept reports in
echo "Preferred-Languages: en, ms\n";

// Optional: The canonical URL for this file
echo "Canonical: $site_url/.well-known/security.txt\n";

// Optional: Link to policy page (if you have one)
// echo "Policy: $site_url/privacy.php\n";

exit;
?>