<?php
define('DB_HOST', 'localhost');
define('DB_USER', 'root');
define('DB_PASS', 'cf4492d125c46af1');
define('DB_NAME', 'xunan');
define('SITE_URL', 'http://yechuxia.top/');
define('SUPER_USER', '3603454468@qq.com');
define('SUPER_PASS', 'xunan41D');
define('SMTP_HOST', 'smtp.qq.com');
define('SMTP_PORT', 465);
define('SMTP_SECURE', 'ssl');
define('SMTP_USER', '3188640439@qq.com');
define('SMTP_PASS', 'uigpxhlwrfbwdegc');

error_reporting(0);
ini_set('display_errors', 0);
ini_set('session.cookie_httponly', 1);
ini_set('session.use_only_cookies', 1);
if (!empty($_SERVER['HTTPS'])) ini_set('session.cookie_secure', 1);
if (PHP_VERSION_ID >= 70300) {
    session_set_cookie_params([
        'samesite' => 'Strict',
        'httponly' => true,
        'secure' => !empty($_SERVER['HTTPS'])
    ]);
}
session_start();
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
if (!empty($_SERVER['HTTPS'])) {
    header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
}
header('Content-Type: text/html; charset=utf-8');

function csrf_token() {
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}
function check_csrf() {
    $token = $_POST['csrf_token'] ?? '';
    if (!isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $token)) {
        die('CSRF token无效，请刷新页面重试。');
    }
}

function smtp_mail($to, $subject, $body) {
    $to = filter_var($to, FILTER_VALIDATE_EMAIL);
    if (!$to) return false;
    $host = (SMTP_PORT == 465 ? 'ssl://' : '') . SMTP_HOST;
    $socket = @fsockopen($host, SMTP_PORT, $errno, $errstr, 30);
    if (!$socket) return false;
    stream_set_timeout($socket, 30);
    $line = fgets($socket, 515);
    if (substr($line, 0, 3) != '220') { fclose($socket); return false; }
    fputs($socket, "EHLO localhost\r\n");
    $line = fgets($socket, 515);
    while (substr($line, 3, 1) == '-') $line = fgets($socket, 515);
    if (substr($line, 0, 3) != '250') { fclose($socket); return false; }
    fputs($socket, "AUTH LOGIN\r\n");
    if (substr(fgets($socket, 515), 0, 3) != '334') { fclose($socket); return false; }
    fputs($socket, base64_encode(SMTP_USER) . "\r\n");
    if (substr(fgets($socket, 515), 0, 3) != '334') { fclose($socket); return false; }
    fputs($socket, base64_encode(SMTP_PASS) . "\r\n");
    if (substr(fgets($socket, 515), 0, 3) != '235') { fclose($socket); return false; }
    fputs($socket, "MAIL FROM: <" . SMTP_USER . ">\r\n");
    if (substr(fgets($socket, 515), 0, 3) != '250') { fclose($socket); return false; }
    fputs($socket, "RCPT TO: <$to>\r\n");
    if (substr(fgets($socket, 515), 0, 3) != '250') { fclose($socket); return false; }
    fputs($socket, "DATA\r\n");
    if (substr(fgets($socket, 515), 0, 3) != '354') { fclose($socket); return false; }
    $subject = '=?UTF-8?B?' . base64_encode($subject) . '?=';
    $headers = "MIME-Version: 1.0\r\nContent-type: text/html;charset=utf-8\r\nFrom: =?UTF-8?B?" . base64_encode('Minecraft社区') . "?= <" . SMTP_USER . ">\r\n";
    $msg = $headers . "\r\n" . wordwrap($body, 70, "\r\n", true);
    fputs($socket, $msg . "\r\n.\r\n");
    if (substr(fgets($socket, 515), 0, 3) != '250') { fclose($socket); return false; }
    fputs($socket, "QUIT\r\n");
    fclose($socket);
    return true;
}
function send_code_mail($to, $subject, $body) {
    return smtp_mail($to, $subject, $body);
}

try {
    $pdo = new PDO("mysql:host=" . DB_HOST . ";charset=utf8", DB_USER, DB_PASS);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $pdo->exec("CREATE DATABASE IF NOT EXISTS `" . DB_NAME . "`");
    $pdo->exec("USE `" . DB_NAME . "`");
    $pdo->exec("CREATE TABLE IF NOT EXISTS users (
        id INT AUTO_INCREMENT PRIMARY KEY,
        username VARCHAR(50) NULL UNIQUE,
        email VARCHAR(255) UNIQUE NOT NULL,
        password VARCHAR(255) NOT NULL,
        avatar VARCHAR(255) DEFAULT 'default.png',
        role ENUM('user','admin','super') DEFAULT 'user',
        member_expire TIMESTAMP NULL DEFAULT NULL,
        last_sign_date DATE NULL,
        sign_count INT DEFAULT 0,
        banned TINYINT(1) DEFAULT 0,
        ban_reason VARCHAR(255) NULL,
        banned_at TIMESTAMP NULL DEFAULT NULL,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    )");
    $res = $pdo->query("SHOW COLUMNS FROM users LIKE 'username'");
    if ($res->rowCount() == 0) $pdo->exec("ALTER TABLE users ADD COLUMN username VARCHAR(50) NULL UNIQUE AFTER id");
    $res = $pdo->query("SHOW COLUMNS FROM users LIKE 'avatar'");
    if ($res->rowCount() == 0) $pdo->exec("ALTER TABLE users ADD COLUMN avatar VARCHAR(255) DEFAULT 'default.png'");
    $res = $pdo->query("SHOW COLUMNS FROM users LIKE 'member_expire'");
    if ($res->rowCount() == 0) $pdo->exec("ALTER TABLE users ADD COLUMN member_expire TIMESTAMP NULL DEFAULT NULL");
    $res = $pdo->query("SHOW COLUMNS FROM users LIKE 'last_sign_date'");
    if ($res->rowCount() == 0) $pdo->exec("ALTER TABLE users ADD COLUMN last_sign_date DATE NULL");
    $res = $pdo->query("SHOW COLUMNS FROM users LIKE 'sign_count'");
    if ($res->rowCount() == 0) $pdo->exec("ALTER TABLE users ADD COLUMN sign_count INT DEFAULT 0");
    $res = $pdo->query("SHOW COLUMNS FROM users LIKE 'banned'");
    if ($res->rowCount() == 0) {
        $pdo->exec("ALTER TABLE users ADD COLUMN banned TINYINT(1) DEFAULT 0");
        $pdo->exec("ALTER TABLE users ADD COLUMN ban_reason VARCHAR(255) NULL");
        $pdo->exec("ALTER TABLE users ADD COLUMN banned_at TIMESTAMP NULL DEFAULT NULL");
    }
    $pdo->exec("CREATE TABLE IF NOT EXISTS email_codes (id INT AUTO_INCREMENT PRIMARY KEY, email VARCHAR(255), code VARCHAR(10), expire INT)");
    $pdo->exec("CREATE TABLE IF NOT EXISTS client_intro (id INT PRIMARY KEY DEFAULT 1, content TEXT, download_link TEXT)");
    $stmt = $pdo->query("SELECT * FROM client_intro WHERE id=1");
    if (!$stmt->fetch()) $pdo->exec("INSERT INTO client_intro VALUES(1,'欢迎下载我的世界客户端，体验原版生存乐趣。','#')");
    $pdo->exec("CREATE TABLE IF NOT EXISTS guilds (id INT AUTO_INCREMENT PRIMARY KEY, name VARCHAR(100), intro TEXT, leader VARCHAR(100), senior_members TEXT, created_by INT, FOREIGN KEY(created_by) REFERENCES users(id) ON DELETE SET NULL)");
    $pdo->exec("CREATE TABLE IF NOT EXISTS guild_applies (id INT AUTO_INCREMENT PRIMARY KEY, guild_id INT, user_id INT, reason TEXT, status ENUM('pending','approved','rejected') DEFAULT 'pending', applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY(guild_id) REFERENCES guilds(id) ON DELETE CASCADE, FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE)");
    $pdo->exec("CREATE TABLE IF NOT EXISTS posts (id INT AUTO_INCREMENT PRIMARY KEY, user_id INT, title VARCHAR(200), content TEXT, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE)");
    $pdo->exec("CREATE TABLE IF NOT EXISTS replies (id INT AUTO_INCREMENT PRIMARY KEY, post_id INT, user_id INT, content TEXT, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY(post_id) REFERENCES posts(id) ON DELETE CASCADE, FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE)");
    $pdo->exec("CREATE TABLE IF NOT EXISTS client_files (id INT AUTO_INCREMENT PRIMARY KEY, filename VARCHAR(255), origin_name VARCHAR(255), uploaded_by INT, upload_time TIMESTAMP DEFAULT CURRENT_TIMESTAMP)");
    $pdo->exec("CREATE TABLE IF NOT EXISTS community_music (id INT AUTO_INCREMENT PRIMARY KEY, filename VARCHAR(255) NOT NULL, origin_name VARCHAR(255) NOT NULL, uploaded_by INT, upload_time TIMESTAMP DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY(uploaded_by) REFERENCES users(id) ON DELETE SET NULL)");
    $stmt = $pdo->prepare("SELECT id FROM users WHERE email=? AND role='super'");
    $stmt->execute([SUPER_USER]);
    if (!$stmt->fetch()) {
        $hash = password_hash(SUPER_PASS, PASSWORD_DEFAULT);
        $pdo->prepare("INSERT INTO users(username,email,password,role) VALUES('SuperAdmin',?,?,'super')")->execute([SUPER_USER, $hash]);
    }
} catch (PDOException $e) {
    die("数据库错误: " . $e->getMessage());
}

function is_logged() { return isset($_SESSION['user_id']); }
function is_admin() { return isset($_SESSION['role']) && ($_SESSION['role'] == 'admin' || $_SESSION['role'] == 'super'); }
function is_super() { return isset($_SESSION['role']) && $_SESSION['role'] == 'super'; }
function is_member($pdo) {
    if (!is_logged()) return false;
    $stmt = $pdo->prepare("SELECT member_expire FROM users WHERE id=?");
    $stmt->execute([$_SESSION['user_id']]);
    $row = $stmt->fetch();
    return $row && $row['member_expire'] && strtotime($row['member_expire']) > time();
}
function go($url) { header("Location: $url"); exit; }
function h($s) { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); }
function strong_pwd($p) { return strlen($p) >= 6 && !preg_match('/^\d+$/', $p) && !preg_match('/^(.)\1+$/', $p); }

function captcha_generate() {
    $width = 120;
    $height = 45;
    $img = imagecreatetruecolor($width, $height);
    $bg = imagecolorallocate($img, mt_rand(220, 255), mt_rand(220, 255), mt_rand(220, 255));
    imagefilledrectangle($img, 0, 0, $width, $height, $bg);
    $chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
    $code = '';
    for ($i = 0; $i < 5; $i++) $code .= $chars[random_int(0, strlen($chars) - 1)];
    $_SESSION['captcha'] = $code;
    for ($i = 0; $i < mt_rand(3, 5); $i++) {
        $c = imagecolorallocate($img, mt_rand(100, 200), mt_rand(100, 200), mt_rand(100, 200));
        imageline($img, mt_rand(0, $width), mt_rand(0, $height), mt_rand(0, $width), mt_rand(0, $height), $c);
    }
    for ($i = 0; $i < mt_rand(200, 300); $i++) {
        $c = imagecolorallocate($img, mt_rand(0, 200), mt_rand(0, 200), mt_rand(0, 200));
        imagesetpixel($img, mt_rand(0, $width), mt_rand(0, $height), $c);
    }
    $x = 10;
    for ($i = 0; $i < 5; $i++) {
        $c = imagecolorallocate($img, mt_rand(0, 100), mt_rand(0, 100), mt_rand(0, 100));
        imagestring($img, 5, $x, mt_rand(10, 28), $code[$i], $c);
        $x += 20;
    }
    header('Content-Type: image/png');
    imagepng($img);
    imagedestroy($img);
}

$act = $_GET['action'] ?? 'home';
if ($act === 'captcha') { captcha_generate(); exit; }

// 网易云音乐 API
if ($act === 'search_music') {
    $keyword = trim($_GET['keyword'] ?? '');
    if (empty($keyword)) { echo json_encode(['code' => 400, 'msg' => '请输入关键词']); exit; }
    $url = 'https://api.uomg.com/api/search.music?key=' . urlencode($keyword);
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $url,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 10,
        CURLOPT_USERAGENT => 'Mozilla/5.0',
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_SSL_VERIFYHOST => 2
    ]);
    $resp = curl_exec($ch);
    curl_close($ch);
    if ($resp === false) {
        echo json_encode(['code' => 500, 'msg' => '请求失败']);
    } else {
        $data = json_decode($resp, true);
        if (isset($data['code']) && $data['code'] == 200 && isset($data['data']['list'])) {
            $songs = [];
            foreach ($data['data']['list'] as $item) {
                $songs[] = ['id' => $item['id'], 'name' => $item['name'], 'artists' => [['name' => $item['artists']]]];
            }
            echo json_encode(['code' => 200, 'result' => ['songs' => $songs]]);
        } else {
            echo json_encode(['code' => 500, 'msg' => '搜索无结果或格式错误']);
        }
    }
    exit;
}
if ($act === 'get_music_url') {
    $song_id = (int)($_GET['id'] ?? 0);
    if (!$song_id) { echo json_encode(['code' => 400, 'msg' => '缺少歌曲ID']); exit; }
    $url = 'https://api.uomg.com/api/music.163?id=' . $song_id;
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $url,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 10,
        CURLOPT_USERAGENT => 'Mozilla/5.0',
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_SSL_VERIFYHOST => 2
    ]);
    $resp = curl_exec($ch);
    curl_close($ch);
    if ($resp === false) {
        echo json_encode(['code' => 500, 'msg' => '获取播放链接失败']);
    } else {
        $data = json_decode($resp, true);
        if (isset($data['code']) && $data['code'] == 200 && isset($data['data']['url'])) {
            echo json_encode(['code' => 200, 'url' => $data['data']['url']]);
        } else {
            echo json_encode(['code' => 500, 'msg' => '无法获取播放地址']);
        }
    }
    exit;
}

// 签到
if ($act === 'sign' && is_logged()) {
    $uid = $_SESSION['user_id'];
    $today = date('Y-m-d');
    $stmt = $pdo->prepare("SELECT last_sign_date, sign_count, member_expire FROM users WHERE id=?");
    $stmt->execute([$uid]);
    $u = $stmt->fetch();
    if ($u && $u['last_sign_date'] === $today) {
        $_SESSION['error'] = '今天已签到，请明天再来！';
        go('?action=home');
    }
    $yesterday = date('Y-m-d', strtotime('-1 day'));
    $new_count = 1;
    if ($u && $u['last_sign_date'] === $yesterday) $new_count = $u['sign_count'] + 1;
    $reward = false;
    if ($new_count >= 5) {
        $new_count = 0;
        $reward = true;
    }
    $pdo->prepare("UPDATE users SET last_sign_date=?, sign_count=? WHERE id=?")->execute([$today, $new_count, $uid]);
    if ($reward) {
        $pdo->prepare("UPDATE users SET member_expire = IFNULL(member_expire, NOW()) + INTERVAL 7 DAY WHERE id=?")->execute([$uid]);
        $_SESSION['success'] = "签到成功！连续签到5天，获得7天会员！";
    } else {
        $_SESSION['success'] = "签到成功！已连续签到 {$new_count} 天。";
    }
    go('?action=home');
}

// 删除帖子/回复
if ($act === 'delete_post' && is_logged()) {
    $pid = (int)$_GET['id'];
    $stmt = $pdo->prepare("SELECT user_id, created_at FROM posts WHERE id=?");
    $stmt->execute([$pid]);
    $post = $stmt->fetch();
    if (!$post) {
        $_SESSION['error'] = '帖子不存在';
    } elseif ($post['user_id'] != $_SESSION['user_id']) {
        $_SESSION['error'] = '无权删除';
    } elseif (strtotime($post['created_at']) < time() - 86400) {
        $_SESSION['error'] = '超过24小时，无法删除';
    } else {
        $pdo->prepare("DELETE FROM posts WHERE id=?")->execute([$pid]);
        $_SESSION['success'] = '帖子已删除';
    }
    go('?action=forum');
}
if ($act === 'delete_reply' && is_logged()) {
    $rid = (int)$_GET['id'];
    $stmt = $pdo->prepare("SELECT user_id, post_id, created_at FROM replies WHERE id=?");
    $stmt->execute([$rid]);
    $rep = $stmt->fetch();
    if (!$rep) {
        $_SESSION['error'] = '回复不存在';
    } elseif ($rep['user_id'] != $_SESSION['user_id']) {
        $_SESSION['error'] = '无权删除';
    } elseif (strtotime($rep['created_at']) < time() - 86400) {
        $_SESSION['error'] = '超过24小时，无法删除';
    } else {
        $pdo->prepare("DELETE FROM replies WHERE id=?")->execute([$rid]);
        $_SESSION['success'] = '回复已删除';
    }
    go('?action=view_post&id=' . $rep['post_id']);
}

// 上传头像
if ($act === 'upload_avatar' && is_logged()) {
    check_csrf();
    $dir = __DIR__ . '/uploads/avatars/';
    if (!is_dir($dir)) mkdir($dir, 0755, true);
    if (!isset($_FILES['avatar']) || $_FILES['avatar']['error'] !== UPLOAD_ERR_OK) {
        $_SESSION['error'] = '上传失败';
        go('?action=profile');
    }
    $tmp = $_FILES['avatar']['tmp_name'];
    $info = getimagesize($tmp);
    $allowed = [IMAGETYPE_JPEG, IMAGETYPE_PNG, IMAGETYPE_GIF];
    if (!$info || !in_array($info[2], $allowed)) {
        $_SESSION['error'] = '只允许 JPG/PNG/GIF 图片';
        go('?action=profile');
    }
    if ($_FILES['avatar']['size'] > 2 * 1024 * 1024) {
        $_SESSION['error'] = '文件不能超过2MB';
        go('?action=profile');
    }
    $ext = image_type_to_extension($info[2], false);
    $filename = 'avatar_' . $_SESSION['user_id'] . '.' . $ext;
    if (move_uploaded_file($tmp, $dir . $filename)) {
        $pdo->prepare("UPDATE users SET avatar=? WHERE id=?")->execute([$filename, $_SESSION['user_id']]);
        $_SESSION['success'] = '头像更新成功';
    } else {
        $_SESSION['error'] = '保存失败';
    }
    go('?action=profile');
}

// 封禁/解封
if (($act === 'ban_user' || $act === 'unban_user') && is_admin()) {
    check_csrf();
    $uid = (int)($_POST['user_id'] ?? 0);
    if (!$uid) { $_SESSION['error'] = '未指定用户'; go('?action=admin'); }
    if ($uid == $_SESSION['user_id']) { $_SESSION['error'] = '不能操作自己'; go('?action=admin'); }
    $stmt = $pdo->prepare("SELECT role FROM users WHERE id=?");
    $stmt->execute([$uid]);
    $target = $stmt->fetch();
    if (!$target) { $_SESSION['error'] = '用户不存在'; go('?action=admin'); }
    if (!is_super() && $target['role'] !== 'user') { $_SESSION['error'] = '权限不足'; go('?action=admin'); }
    if ($act === 'ban_user') {
        $reason = trim($_POST['ban_reason'] ?? '');
        $pdo->prepare("UPDATE users SET banned=1, ban_reason=?, banned_at=NOW() WHERE id=?")->execute([$reason, $uid]);
        $_SESSION['success'] = '用户已封禁';
    } else {
        $pdo->prepare("UPDATE users SET banned=0, ban_reason=NULL, banned_at=NULL WHERE id=?")->execute([$uid]);
        $_SESSION['success'] = '用户已解封';
    }
    go('?action=admin');
}

// 添加/去除管理员
if ($act === 'add_admin' && is_super()) {
    check_csrf();
    $email = trim($_POST['email'] ?? '');
    $stmt = $pdo->prepare("UPDATE users SET role='admin' WHERE email=? AND role='user'");
    $stmt->execute([$email]);
    if ($stmt->rowCount()) {
        $_SESSION['success'] = "已将 $email 设为管理员";
    } else {
        $_SESSION['error'] = '用户不存在或已是管理员';
    }
    go('?action=superadmin');
}
if ($act === 'remove_admin' && is_super()) {
    check_csrf();
    $email = trim($_POST['email'] ?? '');
    $stmt = $pdo->prepare("SELECT id FROM users WHERE email=? AND role='admin'");
    $stmt->execute([$email]);
    $t = $stmt->fetch();
    if (!$t) {
        $_SESSION['error'] = '该管理员不存在或已非管理员';
    } elseif ($t['id'] == $_SESSION['user_id']) {
        $_SESSION['error'] = '不能去除自己的超级管理员身份';
    } else {
        $pdo->prepare("UPDATE users SET role='user' WHERE id=?")->execute([$t['id']]);
        $_SESSION['success'] = "已将 $email 的管理员身份移除";
    }
    go('?action=superadmin');
}

// 上传社区音乐
if ($act === 'upload_music' && is_admin()) {
    if ($_SERVER['REQUEST_METHOD'] !== 'POST' || !isset($_FILES['music_file'])) {
        go('?action=admin');
    }
    check_csrf();
    $dir = __DIR__ . '/uploads/music/';
    if (!is_dir($dir)) {
        mkdir($dir, 0755, true);
        file_put_contents($dir . '.htaccess', "Deny from all\n");
    }
    $origin = $_FILES['music_file']['name'];
    $ext = strtolower(pathinfo($origin, PATHINFO_EXTENSION));
    $allowed = ['mp3', 'wav', 'ogg', 'flac', 'm4a', 'aac'];
    if (!in_array($ext, $allowed)) {
        $_SESSION['error'] = '不支持的音频格式';
        go('?action=admin');
    }
    if ($_FILES['music_file']['size'] > 10 * 1024 * 1024) {
        $_SESSION['error'] = '文件不能超过10MB';
        go('?action=admin');
    }
    $newname = 'music_' . bin2hex(random_bytes(8)) . '.' . $ext;
    if (move_uploaded_file($_FILES['music_file']['tmp_name'], $dir . $newname)) {
        $pdo->prepare("INSERT INTO community_music (filename, origin_name, uploaded_by) VALUES (?, ?, ?)")->execute([$newname, $origin, $_SESSION['user_id']]);
        $_SESSION['success'] = '音乐上传成功';
    } else {
        $_SESSION['error'] = '上传失败，请检查目录权限';
    }
    go('?action=admin');
}

// 删除公会
if ($act === 'delete_guild' && is_admin()) {
    check_csrf();
    $gid = (int)($_POST['guild_id'] ?? 0);
    if (!$gid) { $_SESSION['error'] = '未指定公会'; go('?action=admin'); }
    $stmt = $pdo->prepare("DELETE FROM guilds WHERE id=?");
    $stmt->execute([$gid]);
    if ($stmt->rowCount()) {
        $_SESSION['success'] = '公会已删除';
    } else {
        $_SESSION['error'] = '公会不存在';
    }
    go('?action=admin');
}

// 修改用户名
if ($act === 'change_username' && is_logged()) {
    check_csrf();
    $newName = trim($_POST['new_username'] ?? '');
    if (empty($newName) || mb_strlen($newName) > 50) {
        $_SESSION['error'] = '用户名不能为空且不超过50字符';
        go('?action=profile');
    }
    $stmt = $pdo->prepare("SELECT username FROM users WHERE id=?");
    $stmt->execute([$_SESSION['user_id']]);
    $current = $stmt->fetch();
    if ($current['username'] === $newName) {
        $_SESSION['error'] = '新用户名与当前相同';
        go('?action=profile');
    }
    $stmt = $pdo->prepare("SELECT id FROM users WHERE username=? AND id != ?");
    $stmt->execute([$newName, $_SESSION['user_id']]);
    if ($stmt->fetch()) {
        $_SESSION['error'] = '该用户名已被占用';
        go('?action=profile');
    }
    $pdo->prepare("UPDATE users SET username=? WHERE id=?")->execute([$newName, $_SESSION['user_id']]);
    $_SESSION['success'] = '用户名修改成功';
    go('?action=profile');
}

// 注册/登录等
if ($act == 'do_register') {
    check_csrf();
    $username = trim($_POST['username'] ?? '');
    $email = trim($_POST['email'] ?? '');
    $pwd = $_POST['password'] ?? '';
    $captcha = $_POST['captcha'] ?? '';
    $code = $_POST['email_code'] ?? '';
    if (strtoupper($captcha) != $_SESSION['captcha']) {
        $_SESSION['error'] = '图形验证码错误';
        go('?action=register');
    }
    $stmt = $pdo->prepare("SELECT * FROM email_codes WHERE email=? AND code=? AND expire>?");
    $stmt->execute([$email, $code, time()]);
    if (!$stmt->fetch()) {
        $_SESSION['error'] = '邮箱验证码错误或过期';
        go('?action=register');
    }
    $stmt = $pdo->prepare("SELECT id FROM users WHERE email=?");
    $stmt->execute([$email]);
    if ($stmt->fetch()) {
        $_SESSION['error'] = '邮箱已注册';
        go('?action=register');
    }
    if (empty($username)) {
        $_SESSION['error'] = '用户名不能为空';
        go('?action=register');
    }
    $stmt = $pdo->prepare("SELECT id FROM users WHERE username=?");
    $stmt->execute([$username]);
    if ($stmt->fetch()) {
        $_SESSION['error'] = '用户名已被占用';
        go('?action=register');
    }
    if (!strong_pwd($pwd)) {
        $_SESSION['error'] = '密码至少6位，不能纯数字或单一重复';
        go('?action=register');
    }
    $hash = password_hash($pwd, PASSWORD_DEFAULT);
    $pdo->prepare("INSERT INTO users(username, email, password, role) VALUES(?,?,?,'user')")->execute([$username, $email, $hash]);
    $_SESSION['success'] = '注册成功，请登录';
    go('?action=login');
}
if ($act == 'send_email_code') {
    $email = $_GET['email'] ?? '';
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) die('invalid');
    $limitKey = 'send_code_' . $email . '_' . $_SERVER['REMOTE_ADDR'];
    if (isset($_SESSION[$limitKey]) && $_SESSION[$limitKey] > time() - 60) die('rate_limit');
    $code = random_int(100000, 999999);
    $pdo->prepare("REPLACE INTO email_codes (email, code, expire) VALUES(?,?,?)")->execute([$email, $code, time() + 300]);
    $ok = send_code_mail($email, '【Minecraft】注册验证码', "您的验证码：<b>$code</b>，有效期5分钟。");
    if ($ok) $_SESSION[$limitKey] = time();
    echo $ok ? 'ok' : 'fail';
    exit;
}
if ($act == 'do_login') {
    check_csrf();
    $email = $_POST['email'] ?? '';
    $pwd = $_POST['password'] ?? '';
    $stmt = $pdo->prepare("SELECT id, password, role, banned FROM users WHERE email=?");
    $stmt->execute([$email]);
    $user = $stmt->fetch();
    if (!$user || !password_verify($pwd, $user['password'])) {
        $_SESSION['error'] = '账号或密码错误';
        go('?action=login');
    }
    if ($user['banned']) {
        $_SESSION['error'] = '该账号已被封禁，请联系管理员。';
        go('?action=login');
    }
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['role'] = $user['role'];
    $_SESSION['success'] = '登录成功';
    go('?action=home');
}
if ($act == 'logout') { session_destroy(); go('?action=home'); }
if ($act == 'add_guild' && is_admin()) {
    check_csrf();
    $name = trim($_POST['name'] ?? '');
    $intro = trim($_POST['intro'] ?? '');
    $leader = trim($_POST['leader'] ?? '');
    $senior = trim($_POST['senior_members'] ?? '');
    if ($name) {
        $pdo->prepare("INSERT INTO guilds (name, intro, leader, senior_members, created_by) VALUES(?,?,?,?,?)")->execute([$name, $intro, $leader, $senior, $_SESSION['user_id']]);
        $_SESSION['success'] = '公会添加成功';
    } else {
        $_SESSION['error'] = '公会名称不能为空';
    }
    go('?action=admin');
}
if ($act == 'apply_guild') {
    if (!is_logged()) go('?action=login');
    check_csrf();
    $gid = (int)($_POST['guild_id'] ?? 0);
    $reason = trim($_POST['reason'] ?? '');
    $stmt = $pdo->prepare("SELECT 1 FROM guild_applies WHERE guild_id=? AND user_id=? AND status='pending'");
    $stmt->execute([$gid, $_SESSION['user_id']]);
    if ($stmt->fetch()) {
        $_SESSION['error'] = '已有待审核申请';
    } else {
        $pdo->prepare("INSERT INTO guild_applies (guild_id, user_id, reason) VALUES(?,?,?)")->execute([$gid, $_SESSION['user_id'], $reason]);
        $_SESSION['success'] = '申请已提交，等待审核';
    }
    go('?action=guild_detail&id=' . $gid);
}
if ($act == 'review_apply' && is_admin()) {
    check_csrf();
    $aid = (int)($_GET['apply_id'] ?? 0);
    $status = $_GET['status'] ?? '';
    if (in_array($status, ['approved', 'rejected'])) {
        $pdo->prepare("UPDATE guild_applies SET status=? WHERE id=?")->execute([$status, $aid]);
        $_SESSION['success'] = '审核完成';
    }
    go('?action=admin');
}
if ($act == 'edit_client_intro' && is_super()) {
    check_csrf();
    $content = $_POST['content'] ?? '';
    $link = $_POST['download_link'] ?? '';
    $pdo->prepare("UPDATE client_intro SET content=?, download_link=? WHERE id=1")->execute([$content, $link]);
    $_SESSION['success'] = '客户端介绍已更新';
    go('?action=client');
}
if ($act == 'upload_file' && is_super() && isset($_FILES['client_file'])) {
    check_csrf();
    $dir = __DIR__ . '/uploads/';
    if (!is_dir($dir)) mkdir($dir, 0755, true);
    $origin = $_FILES['client_file']['name'];
    $ext = strtolower(pathinfo($origin, PATHINFO_EXTENSION));
    $allowed = ['zip', 'rar', '7z', 'jar', 'exe', 'dmg', 'msi', 'deb', 'tar', 'gz'];
    if (!in_array($ext, $allowed)) {
        $_SESSION['error'] = '不允许的文件类型';
        go('?action=superadmin');
    }
    $newname = 'client_' . time() . '.' . $ext;
    if (move_uploaded_file($_FILES['client_file']['tmp_name'], $dir . $newname)) {
        $pdo->prepare("INSERT INTO client_files (filename, origin_name, uploaded_by) VALUES(?,?,?)")->execute([$newname, $origin, $_SESSION['user_id']]);
        $_SESSION['success'] = '文件上传成功';
    } else {
        $_SESSION['error'] = '上传失败';
    }
    go('?action=superadmin');
}
if ($act == 'new_post' && is_logged()) {
    check_csrf();
    $title = trim($_POST['title'] ?? '');
    $content = trim($_POST['content'] ?? '');
    if ($title && $content) {
        $pdo->prepare("INSERT INTO posts (user_id, title, content) VALUES(?,?,?)")->execute([$_SESSION['user_id'], $title, $content]);
    } else {
        $_SESSION['error'] = '标题内容不能为空';
    }
    go('?action=forum');
}
if ($act == 'reply' && is_logged()) {
    check_csrf();
    $pid = (int)($_POST['post_id'] ?? 0);
    $content = trim($_POST['content'] ?? '');
    if ($content) {
        $pdo->prepare("INSERT INTO replies (post_id, user_id, content) VALUES(?,?,?)")->execute([$pid, $_SESSION['user_id'], $content]);
    }
    go('?action=view_post&id=' . $pid);
}

?>
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1.0">
<title>Minecraft 社区 - yechuxia.top</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{font-family:'Segoe UI',system-ui,sans-serif;background:linear-gradient(145deg,#e0eafc,#cfdef3);min-height:100vh}
.nav{background:rgba(44,62,80,0.9);backdrop-filter:blur(10px);color:#fff;padding:14px 30px;border-radius:0 0 30px 30px;box-shadow:0 8px 20px rgba(0,0,0,0.1);position:sticky;top:0;z-index:1000;display:flex;flex-wrap:wrap;justify-content:center;gap:20px}
.nav a{color:#f0f0f0;text-decoration:none;font-weight:500;padding:8px 16px;border-radius:40px;transition:0.2s}
.nav a:hover{background:rgba(255,255,255,0.2);transform:translateY(-2px)}
.nav span{padding:8px 16px;background:rgba(255,215,0,0.2);border-radius:40px}
.container{max-width:1300px;margin:30px auto;background:rgba(255,255,255,0.92);backdrop-filter:blur(2px);padding:30px;border-radius:48px;box-shadow:0 25px 50px -12px rgba(0,0,0,0.25)}
.alert{padding:14px 20px;margin:20px 0;border-radius:60px;font-weight:500}
.alert-error{background:#ffe6e5;color:#b91c1c;border-left:6px solid #e74c3c}
.alert-success{background:#e0f7e8;color:#0a5c2e;border-left:6px solid #2ecc71}
.card{background:#ffffffdd;backdrop-filter:blur(4px);border:1px solid rgba(255,255,255,0.6);padding:24px;margin:20px 0;border-radius:32px;box-shadow:0 10px 20px rgba(0,0,0,0.05);transition:0.2s}
.card:hover{transform:translateY(-4px);box-shadow:0 20px 30px -12px rgba(0,0,0,0.15);background:#fff}
.btn{display:inline-block;padding:10px 24px;background:linear-gradient(135deg,#3b82f6,#2563eb);color:#fff;font-weight:600;border-radius:60px;border:none;cursor:pointer;transition:0.2s}
.btn:hover{transform:scale(1.02);background:linear-gradient(135deg,#2563eb,#1d4ed8);box-shadow:0 6px 14px rgba(37,99,235,0.4)}
.btn-danger{background:linear-gradient(135deg,#ef4444,#dc2626)}
input,textarea,select{width:100%;padding:12px 18px;margin:8px 0 16px;border:2px solid #e2e8f0;border-radius:40px;font-size:1rem;transition:0.2s;background:#fefefe}
input:focus,textarea:focus{outline:none;border-color:#3b82f6;box-shadow:0 0 0 3px rgba(59,130,246,0.2)}
textarea{border-radius:24px}
.row{display:flex;gap:30px;flex-wrap:wrap}
.col{flex:1;min-width:260px}
table{width:100%;border-collapse:separate;border-spacing:0;background:#fff;border-radius:28px;overflow:hidden}
th,td{padding:14px 16px;text-align:left;border-bottom:1px solid #eef2f6}
th{background:#f8fafc;font-weight:600}
.music-player{position:fixed;bottom:24px;right:24px;background:rgba(0,0,0,0.7);backdrop-filter:blur(12px);color:#fff;padding:12px 20px;border-radius:80px;z-index:1100}
.music-player button{background:#f59e0b;border:none;padding:6px 14px;border-radius:40px;margin-left:10px;cursor:pointer}
h2{margin-bottom:20px;border-left:6px solid #3b82f6;padding-left:20px}
.captcha-img{border-radius:20px;cursor:pointer;margin:6px 0}
.friend-link{margin-top:40px;padding-top:20px;border-top:1px solid rgba(0,0,0,0.08);font-size:14px;color:#4b5563;text-align:center}
.search-box{display:flex;gap:10px;margin-bottom:20px}
.search-box input{flex:1}
.search-box button{width:100px}
.song-list{list-style:none;margin-top:15px}
.song-list li{padding:10px;border-bottom:1px solid #e2e8f0;cursor:pointer;transition:0.1s}
.song-list li:hover{background:#f1f5f9}
@media (max-width:700px){.container{padding:20px;margin:15px;border-radius:32px}.nav{gap:8px;padding:12px}.nav a{padding:6px 12px;font-size:14px}}
.avatar-sm{width:30px;height:30px;border-radius:50%;object-fit:cover;vertical-align:middle;margin-right:6px}
.avatar-md{width:40px;height:40px;border-radius:50%;object-fit:cover;vertical-align:middle;margin-right:8px}
.avatar-lg{width:80px;height:80px;border-radius:50%;object-fit:cover;margin-right:16px}
.vip-badge{background:linear-gradient(135deg,#f59e0b,#ef4444);color:#fff;font-size:0.75rem;padding:2px 8px;border-radius:10px;margin-left:4px;font-weight:bold}
.sign-btn{display:inline-block;padding:8px 20px;background:#10b981;color:#fff;border-radius:20px;text-decoration:none;margin:10px 0;font-weight:500}
.sign-btn:hover{background:#059669}
.delete-btn{color:#ef4444;font-size:0.85em;margin-left:6px;cursor:pointer;text-decoration:none}
.delete-btn:hover{text-decoration:underline}
.pagination{margin-top:15px;display:flex;gap:10px;justify-content:center;align-items:center}
.pagination a,.pagination span{padding:8px 16px;border-radius:20px;background:#f0f0f0;color:#333;text-decoration:none;font-size:0.9em}
.pagination a:hover{background:#3b82f6;color:#fff}
.pagination .current{background:#3b82f6;color:#fff;font-weight:bold}
</style>
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
</head>
<body>
<div class="nav">
    <a href="?action=home">首页</a>
    <a href="?action=client">客户端下载</a>
    <a href="?action=guild">生存圈公会</a>
    <a href="?action=forum">论坛</a>
    <a href="?action=music">音乐</a>
    <?php if (!is_logged()): ?>
        <a href="?action=login">登录</a>
        <a href="?action=register">注册</a>
    <?php else: 
        $curUser = $pdo->prepare("SELECT username, avatar FROM users WHERE id=?");
        $curUser->execute([$_SESSION['user_id']]);
        $cu = $curUser->fetch();
        $uname = h($cu['username'] ?? '用户');
        $avatar = 'uploads/avatars/' . ($cu['avatar'] ?? 'default.png');
        $vip = is_member($pdo);
    ?>
        <span>
            <img class="avatar-sm" src="<?= $avatar ?>" alt="头">
            <a href="?action=profile" style="color:#fff;text-decoration:none;"><?= $uname ?></a>
            <?php if ($vip): ?><span class="vip-badge">VIP</span><?php endif; ?>
        </span>
        <?php if (is_admin()): ?><a href="?action=admin">管理面板</a><?php endif; ?>
        <?php if (is_super()): ?><a href="?action=superadmin">超级管理</a><?php endif; ?>
        <a href="?action=logout">注销</a>
    <?php endif; ?>
</div>
<div class="container">
    <?php if (isset($_SESSION['error'])): ?>
        <div class="alert alert-error"><?= h($_SESSION['error']) ?></div>
        <?php unset($_SESSION['error']); ?>
    <?php endif; ?>
    <?php if (isset($_SESSION['success'])): ?>
        <div class="alert alert-success"><?= h($_SESSION['success']) ?></div>
        <?php unset($_SESSION['success']); ?>
    <?php endif; ?>

    <?php if ($act === 'home'): ?>
        <?php if (is_logged()):
            $stmt = $pdo->prepare("SELECT sign_count, last_sign_date, member_expire FROM users WHERE id=?");
            $stmt->execute([$_SESSION['user_id']]);
            $us = $stmt->fetch();
            $today = date('Y-m-d');
            $signed = ($us['last_sign_date'] === $today);
        ?>
        <div class="card">
            <h3>签到</h3>
            <?php if ($signed): ?>
                <p>今日已签到 ✅ | 连续签到 <?= $us['sign_count'] ?> 天</p>
            <?php else: ?>
                <a href="?action=sign" class="sign-btn">点击签到</a>
                <p style="margin-top:6px;">连续签到 <?= $us['sign_count'] ?> 天，再签到 <?= 5 - $us['sign_count'] ?> 天可得7天会员</p>
            <?php endif; ?>
            <?php if ($us['member_expire'] && strtotime($us['member_expire']) > time()): ?>
                <p>VIP 到期：<?= date('Y-m-d H:i', strtotime($us['member_expire'])) ?></p>
            <?php endif; ?>
        </div>
        <?php endif; ?>
        <h1>欢迎来到 yechuxia.top Minecraft 社区</h1>
        <div class="row">
            <div class="col card"><h2>我的世界客户端</h2><p>下载纯净/模组客户端，开启你的方块之旅。</p><a href="?action=client" class="btn">进入下载区</a></div>
            <div class="col card"><h2>网易版生存圈</h2><p>加入公会，与伙伴共建生存家园，共同冒险。</p><a href="?action=guild" class="btn">浏览公会</a></div>
        </div>

    <?php elseif ($act === 'register'): ?>
        <h2>注册账号</h2>
        <form method="post" action="?action=do_register">
            <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">
            <label>用户名：</label><input type="text" name="username" required placeholder="您的昵称">
            <label>邮箱：</label><input type="email" name="email" id="reg_email" required>
            <label>密码（至少6位，不能纯数字或单一重复）：</label><input type="password" name="password" required>
            <label>图形验证码：</label>
            <img class="captcha-img" src="?action=captcha&t=<?= time() ?>" onclick="this.src='?action=captcha&t='+Math.random()">
            <input type="text" name="captcha" placeholder="输入图片中的字符" required>
            <label>邮箱验证码：</label>
            <div style="display:flex; gap:12px;">
                <input type="text" name="email_code" id="email_code" placeholder="6位数字" style="flex:2" required>
                <button type="button" id="sendCodeBtn" class="btn" style="flex:1">发送验证码</button>
            </div>
            <button type="submit" class="btn" style="width:100%; margin-top:12px;">立即注册</button>
        </form>
        <script>
            $('#sendCodeBtn').click(function() {
                var email = $('#reg_email').val();
                if (!email) { alert('请先填写邮箱'); return; }
                $(this).prop('disabled', true).text('发送中...');
                $.get('?action=send_email_code&email=' + email, function(res) {
                    if (res === 'ok') alert('验证码已发送至邮箱，请查收');
                    else if (res === 'rate_limit') alert('操作太频繁，请60秒后再试');
                    else alert('发送失败，请稍后重试');
                    $('#sendCodeBtn').prop('disabled', false).text('发送验证码');
                });
            });
        </script>

    <?php elseif ($act === 'login'): ?>
        <h2>登录</h2>
        <form method="post" action="?action=do_login">
            <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">
            <label>邮箱：</label><input type="email" name="email" required>
            <label>密码：</label><input type="password" name="password" required>
            <button type="submit" class="btn" style="width:100%">登录</button>
        </form>

    <?php elseif ($act === 'profile' && is_logged()):
        $stmt = $pdo->prepare("SELECT username, email, avatar, member_expire, sign_count FROM users WHERE id=?");
        $stmt->execute([$_SESSION['user_id']]);
        $u = $stmt->fetch();
    ?>
        <h2>个人中心</h2>
        <div class="card" style="display:flex; align-items:center; gap:20px; flex-wrap:wrap;">
            <img src="uploads/avatars/<?= h($u['avatar']) ?>" class="avatar-lg">
            <div>
                <h3><?= h($u['username']) ?></h3>
                <p>邮箱：<?= h($u['email']) ?></p>
                <p>会员到期：<?= $u['member_expire'] ? date('Y-m-d H:i', strtotime($u['member_expire'])) : '无' ?></p>
                <p>签到天数：<?= $u['sign_count'] ?>天</p>
                <?php if (is_member($pdo)): ?><span class="vip-badge">VIP</span><?php endif; ?>
            </div>
        </div>
        <div class="card">
            <h3>修改用户名</h3>
            <form method="post" action="?action=change_username">
                <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">
                <label>新用户名：</label>
                <input type="text" name="new_username" placeholder="输入新的用户名" value="<?= h($u['username']) ?>" required maxlength="50">
                <button type="submit" class="btn">更新用户名</button>
            </form>
            <p style="margin-top:8px; color:#666;">用户名长度为1-50个字符，且不能与他人重复。</p>
        </div>
        <div class="card">
            <h3>修改头像</h3>
            <form method="post" action="?action=upload_avatar" enctype="multipart/form-data">
                <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">
                <input type="file" name="avatar" accept="image/*" required>
                <button type="submit" class="btn">上传新头像</button>
            </form>
        </div>

    <?php elseif ($act === 'client'):
        $intro = $pdo->query("SELECT content, download_link FROM client_intro WHERE id=1")->fetch();
    ?>
        <h2>我的世界客户端下载</h2>
        <div class="card"><?= nl2br(h($intro['content'])) ?></div>
        <p><strong>官方下载链接：</strong><a href="<?= h($intro['download_link']) ?>" target="_blank">点击下载客户端</a></p>
        <?php if (is_super()): ?>
            <hr><h3>编辑客户端介绍（仅超级管理员）</h3>
            <form method="post" action="?action=edit_client_intro">
                <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">
                <textarea name="content" rows="5"><?= h($intro['content']) ?></textarea>
                <label>下载链接：</label><input type="text" name="download_link" value="<?= h($intro['download_link']) ?>">
                <button type="submit" class="btn">保存修改</button>
            </form>
        <?php endif; ?>

    <?php elseif ($act === 'guild'):
        $guilds = $pdo->query("SELECT * FROM guilds ORDER BY id DESC")->fetchAll();
    ?>
        <h2>生存圈公会列表</h2>
        <?php foreach ($guilds as $g): ?>
            <div class="card"><h3><a href="?action=guild_detail&id=<?= $g['id'] ?>"><?= h($g['name']) ?></a></h3><p><?= nl2br(h($g['intro'])) ?></p></div>
        <?php endforeach; ?>

    <?php elseif ($act === 'guild_detail'):
        $id = (int)$_GET['id'];
        $g = $pdo->prepare("SELECT * FROM guilds WHERE id=?");
        $g->execute([$id]);
        $guild = $g->fetch();
        if (!$guild): ?>
            <p>公会不存在</p>
        <?php else: $senior = explode(',', $guild['senior_members'] ?? ''); ?>
            <h2><?= h($guild['name']) ?></h2>
            <div class="card">介绍：<?= nl2br(h($guild['intro'])) ?></div>
            <div class="row"><div class="col"><strong>会长：</strong> <?= h($guild['leader']) ?></div><div class="col"><strong>高层：</strong> <?= implode(', ', array_map('h', $senior)) ?></div></div>
            <?php if (is_logged()): ?>
                <hr><h4>申请加入公会</h4>
                <form method="post" action="?action=apply_guild">
                    <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">
                    <input type="hidden" name="guild_id" value="<?= $id ?>">
                    <textarea name="reason" placeholder="请说说你的优势或理由..."></textarea>
                    <button type="submit" class="btn">提交申请</button>
                </form>
            <?php endif; ?>
        <?php endif; ?>

    <?php elseif ($act === 'forum'):
        $posts = $pdo->query("SELECT p.*, u.username, u.avatar FROM posts p JOIN users u ON p.user_id=u.id ORDER BY p.created_at DESC")->fetchAll();
    ?>
        <h2>社区论坛</h2>
        <?php if (is_logged()): ?>
            <details style="margin-bottom:20px;"><summary style="cursor:pointer; padding:10px; background:#f1f5f9; border-radius:40px;">发布新帖</summary>
                <div class="card"><form method="post" action="?action=new_post"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="text" name="title" placeholder="标题" required><textarea name="content" placeholder="内容" rows="4" required></textarea><button type="submit" class="btn">发布帖子</button></form></div>
            </details>
        <?php endif; ?>
        <?php foreach ($posts as $post): ?>
            <div class="card">
                <div style="display:flex; align-items:center; gap:8px; margin-bottom:8px;">
                    <img src="uploads/avatars/<?= h($post['avatar'] ?? 'default.png') ?>" class="avatar-sm">
                    <strong><?= h($post['username']) ?></strong>
                    <small style="color:#666;"><?= $post['created_at'] ?></small>
                    <?php if (is_logged() && $_SESSION['user_id'] == $post['user_id'] && (time() - strtotime($post['created_at']) < 86400)): ?>
                        <a href="?action=delete_post&id=<?= $post['id'] ?>" class="delete-btn" onclick="return confirm('确定删除此帖？')">删除</a>
                    <?php endif; ?>
                </div>
                <h3><a href="?action=view_post&id=<?= $post['id'] ?>"><?= h($post['title']) ?></a></h3>
                <p><?= nl2br(h(mb_substr($post['content'], 0, 120))) ?>...</p>
            </div>
        <?php endforeach; ?>

    <?php elseif ($act === 'view_post'):
        $pid = (int)$_GET['id'];
        $post = $pdo->prepare("SELECT p.*, u.username, u.avatar FROM posts p JOIN users u ON p.user_id=u.id WHERE p.id=?");
        $post->execute([$pid]);
        $post = $post->fetch();
        if (!$post): ?>
            <p>帖子不存在</p>
        <?php else:
            $replies = $pdo->prepare("SELECT r.*, u.username, u.avatar FROM replies r JOIN users u ON r.user_id=u.id WHERE r.post_id=? ORDER BY r.created_at ASC");
            $replies->execute([$pid]);
        ?>
            <h2><?= h($post['title']) ?></h2>
            <div class="card"><div style="display:flex; align-items:center; gap:8px; margin-bottom:8px;"><img src="uploads/avatars/<?= h($post['avatar'] ?? 'default.png') ?>" class="avatar-sm"><strong><?= h($post['username']) ?></strong><small style="color:#666;"><?= $post['created_at'] ?></small><?php if (is_logged() && $_SESSION['user_id'] == $post['user_id'] && (time() - strtotime($post['created_at']) < 86400)): ?><a href="?action=delete_post&id=<?= $post['id'] ?>" class="delete-btn" onclick="return confirm('确定删除此帖？')">删除</a><?php endif; ?></div><p><?= nl2br(h($post['content'])) ?></p></div>
            <h3>回复</h3>
            <?php foreach ($replies as $rep): ?>
                <div class="card"><div style="display:flex; align-items:center; gap:8px; margin-bottom:4px;"><img src="uploads/avatars/<?= h($rep['avatar'] ?? 'default.png') ?>" class="avatar-sm"><strong><?= h($rep['username']) ?></strong><small style="color:#666;"><?= $rep['created_at'] ?></small><?php if (is_logged() && $_SESSION['user_id'] == $rep['user_id'] && (time() - strtotime($rep['created_at']) < 86400)): ?><a href="?action=delete_reply&id=<?= $rep['id'] ?>" class="delete-btn" onclick="return confirm('确定删除此回复？')">删除</a><?php endif; ?></div><p><?= nl2br(h($rep['content'])) ?></p></div>
            <?php endforeach; ?>
            <?php if (is_logged()): ?>
                <form method="post" action="?action=reply"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="hidden" name="post_id" value="<?= $pid ?>"><textarea name="content" placeholder="写下你的回复..." required></textarea><button type="submit" class="btn">回复</button></form>
            <?php endif; ?>
        <?php endif; ?>

    <?php elseif ($act === 'music'):
        $mtracks = $pdo->query("SELECT * FROM community_music ORDER BY upload_time DESC")->fetchAll();
    ?>
        <h2>网易云音乐搜索</h2>
        <div class="card"><h3>搜索歌曲</h3><div class="search-box"><input type="text" id="searchKeyword" placeholder="输入歌名、歌手..." autocomplete="off"><button id="searchBtn" class="btn">搜索</button></div><div id="searchResults"><ul class="song-list" id="songList"></ul></div></div>
        <div class="card"><h3>当前播放</h3><div id="nowPlaying">未播放</div><audio id="musicPlayer" controls style="width:100%; margin-top:10px; border-radius:60px;"></audio></div>
        <div class="card"><h3>社区音乐库</h3><?php if (count($mtracks) > 0): ?><ul class="song-list" id="communityList"><?php foreach ($mtracks as $t): ?><li data-src="uploads/music/<?= h($t['filename']) ?>"><?= h($t['origin_name']) ?> <small>(<?= $t['upload_time'] ?>)</small></li><?php endforeach; ?></ul><?php else: ?><p>暂无社区音乐，管理员快来上传吧～</p><?php endif; ?></div>
        <script>
        function searchMusic() {
            var keyword = $('#searchKeyword').val().trim();
            if (!keyword) { alert('请输入关键词'); return; }
            $('#searchBtn').prop('disabled', true).text('搜索中...');
            $.get('?action=search_music&keyword=' + encodeURIComponent(keyword), function(data) {
                if (data.code === 200 && data.result && data.result.songs) {
                    var songs = data.result.songs; var html = '';
                    if (songs.length === 0) html = '<li>没有找到相关歌曲</li>';
                    else {
                        $.each(songs, function(i, song) {
                            var artists = '';
                            if (song.artists) artists = song.artists.map(function(a) { return a.name }).join(',');
                            html += '<li data-id="' + song.id + '">' + song.name + ' - ' + artists + '</li>';
                        });
                    }
                    $('#songList').html(html);
                    $('.song-list li').off('click').on('click', function() {
                        var sid = $(this).data('id'), songName = $(this).text();
                        $('#nowPlaying').text('加载中...');
                        $.get('?action=get_music_url&id=' + sid, function(res) {
                            if (res.code === 200 && res.url) {
                                $('#musicPlayer').attr('src', res.url);
                                $('#musicPlayer')[0].play();
                                $('#nowPlaying').text('正在播放：' + songName);
                            } else { alert('无法获取播放地址，可能版权限制'); $('#nowPlaying').text('播放失败'); }
                        }).fail(function() { alert('请求失败'); });
                    });
                } else { $('#songList').html('<li>搜索失败，请稍后重试</li>'); }
                $('#searchBtn').prop('disabled', false).text('搜索');
            }).fail(function() { alert('网络错误'); $('#searchBtn').prop('disabled', false).text('搜索'); });
        }
        $('#searchBtn').click(searchMusic);
        $('#searchKeyword').keypress(function(e) { if (e.which == 13) searchMusic(); });
        $('#communityList li').click(function() {
            var src = $(this).data('src'), name = $(this).text();
            $('#musicPlayer').attr('src', src); $('#musicPlayer')[0].play(); $('#nowPlaying').text('正在播放：' + name);
        });
        </script>

    <?php elseif ($act === 'admin' && is_admin()):
        $search = trim($_GET['search'] ?? ''); $page = max(1, (int)($_GET['page'] ?? 1)); $perPage = 10;
        $params = []; $where = '';
        if ($search !== '') { $where = " WHERE (username LIKE ? OR email LIKE ?)"; $params[] = "%$search%"; $params[] = "%$search%"; }
        $countStmt = $pdo->prepare("SELECT COUNT(*) FROM users $where"); $countStmt->execute($params); $total = $countStmt->fetchColumn();
        $totalPages = max(1, ceil($total / $perPage)); $offset = ($page - 1) * $perPage;
        $usersList = $pdo->prepare("SELECT id, username, email, role, banned FROM users $where ORDER BY id LIMIT $perPage OFFSET $offset"); $usersList->execute($params); $userList = $usersList->fetchAll();
        $applies = $pdo->query("SELECT a.*, u.email, g.name AS gname FROM guild_applies a JOIN users u ON a.user_id=u.id JOIN guilds g ON a.guild_id=g.id WHERE a.status='pending'")->fetchAll();
        $guilds = $pdo->query("SELECT * FROM guilds ORDER BY id DESC")->fetchAll();
    ?>
        <h2>管理员面板</h2>
        <div class="card"><h3>添加新公会</h3><form method="post" action="?action=add_guild"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="text" name="name" placeholder="公会名称" required><textarea name="intro" placeholder="公会介绍"></textarea><input type="text" name="leader" placeholder="会长名称"><input type="text" name="senior_members" placeholder="高层名单（逗号分隔）"><button type="submit" class="btn">创建公会</button></form></div>
        <div class="card"><h3>入会申请审核</h3><table><tr><th>申请人</th><th>公会</th><th>理由</th><th>操作</th></tr><?php foreach ($applies as $ap): ?><tr><td><?= h($ap['email']) ?></td><td><?= h($ap['gname']) ?></td><td><?= h($ap['reason']) ?></td><td><a href="?action=review_apply&apply_id=<?= $ap['id'] ?>&status=approved&csrf_token=<?= csrf_token() ?>" class="btn">通过</a> <a href="?action=review_apply&apply_id=<?= $ap['id'] ?>&status=rejected&csrf_token=<?= csrf_token() ?>" class="btn btn-danger">拒绝</a></td></tr><?php endforeach; ?></table></div>
        <div class="card"><h3>用户列表 (共<?= $total ?>人)</h3><form method="get" action="?" style="margin-bottom:15px;"><input type="hidden" name="action" value="admin"><div style="display:flex; gap:10px;"><input type="text" name="search" placeholder="用户名或邮箱" value="<?= h($search) ?>"><button type="submit" class="btn" style="width:auto;">搜索</button></div></form><div style="overflow-x:auto;"><table><tr><th>用户名</th><th>邮箱</th><th>角色</th><th>状态</th><th>操作</th></tr><?php foreach ($userList as $u): $roleMap = ['user' => '普通', 'admin' => '管理员', 'super' => '超级管理']; $roleText = $roleMap[$u['role']] ?? $u['role']; $banned = $u['banned']; ?><tr><td><?= h($u['username']) ?></td><td><?= h($u['email']) ?></td><td><?= $roleText ?></td><td><?= $banned ? '<span style="color:red;">封禁</span>' : '<span style="color:green;">正常</span>' ?></td><td><?php if ($u['id'] != $_SESSION['user_id'] && ($u['role'] == 'user' || is_super())): ?><?php if (!$banned): ?><form method="post" action="?action=ban_user" style="display:inline;"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="hidden" name="user_id" value="<?= $u['id'] ?>"><input type="text" name="ban_reason" placeholder="原因(可选)" style="width:80px; display:inline; padding:4px 8px; margin:0;"><button type="submit" class="btn btn-danger" style="padding:4px 8px;">封禁</button></form><?php else: ?><form method="post" action="?action=unban_user" style="display:inline;"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="hidden" name="user_id" value="<?= $u['id'] ?>"><button type="submit" class="btn" style="padding:4px 8px;">解封</button></form><?php endif; ?><?php elseif ($u['id'] == $_SESSION['user_id']): ?><span style="color:#999;">自己</span><?php else: ?>-<?php endif; ?></td></tr><?php endforeach; ?></table></div><?php if ($totalPages > 1): ?><div class="pagination"><?php if ($page > 1): ?><a href="?action=admin&search=<?= urlencode($search) ?>&page=<?= $page-1 ?>">上一页</a><?php endif; for ($i = 1; $i <= $totalPages; $i++): if ($i == $page): ?><span class="current"><?= $i ?></span><?php else: ?><a href="?action=admin&search=<?= urlencode($search) ?>&page=<?= $i ?>"><?= $i ?></a><?php endif; endfor; if ($page < $totalPages): ?><a href="?action=admin&search=<?= urlencode($search) ?>&page=<?= $page+1 ?>">下一页</a><?php endif; ?></div><?php endif; ?></div>
        <div class="card"><h3>现有公会管理</h3><?php if (count($guilds) > 0): ?><table><tr><th>公会名称</th><th>会长</th><th>操作</th></tr><?php foreach ($guilds as $g): ?><tr><td><?= h($g['name']) ?></td><td><?= h($g['leader']) ?></td><td><form method="post" action="?action=delete_guild" style="display:inline;" onsubmit="return confirm('确定删除公会【<?= h($g['name']) ?>】？此操作不可恢复！');"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="hidden" name="guild_id" value="<?= $g['id'] ?>"><button type="submit" class="btn btn-danger" style="padding:4px 10px;">删除</button></form></td></tr><?php endforeach; ?></table><?php else: ?><p>暂无公会</p><?php endif; ?></div>
        <div class="card"><h3>上传社区音乐</h3><form method="post" action="?action=upload_music" enctype="multipart/form-data"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="file" name="music_file" accept="audio/*" required><p style="margin-top:5px; color:#666;">支持 mp3, wav, ogg, flac, m4a, aac 格式，限 10MB</p><button type="submit" class="btn">上传音乐</button></form></div>

    <?php elseif ($act === 'superadmin' && is_super()):
        $files = $pdo->query("SELECT * FROM client_files ORDER BY upload_time DESC")->fetchAll();
    ?>
        <h2>超级管理员专属</h2>
        <div class="card"><h3>添加普通管理员</h3><form method="post" action="?action=add_admin"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="email" name="email" placeholder="用户邮箱" required><button type="submit" class="btn">设为管理员</button></form></div>
        <div class="card"><h3>去除管理员（降为普通用户）</h3><form method="post" action="?action=remove_admin"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="email" name="email" placeholder="管理员邮箱" required><button type="submit" class="btn btn-danger">去除管理员</button></form></div>
        <div class="card"><h3>上传客户端文件</h3><form method="post" action="?action=upload_file" enctype="multipart/form-data"><input type="hidden" name="csrf_token" value="<?= csrf_token() ?>"><input type="file" name="client_file" required><button type="submit" class="btn">上传文件</button></form></div>
        <div class="card"><h3>已上传文件</h3><table><tr><th>原文件名</th><th>保存名</th><th>上传时间</th></tr><?php foreach ($files as $f): ?><tr><td><?= h($f['origin_name']) ?></td><td><?= h($f['filename']) ?></td><td><?= $f['upload_time'] ?></td></tr><?php endforeach; ?></table></div>

    <?php else: ?>
        <p>页面未找到，返回 <a href="?action=home">首页</a></p>
    <?php endif; ?>

    <div class="friend-link">
        友情链接：
        <a href="https://www.milk-box.top" target="_blank" rel="noopener" style="color:#3b82f6; text-decoration:none; font-weight:500;">MILK盒子</a>
        - 可爱牛奶盒的博客网站
    </div>
</div>

<?php if ($act !== 'music'): ?>
<div class="music-player">
    随机音乐 <button onclick="location.href='?action=music'">打开</button>
</div>
<?php endif; ?>
</body>
</html>