AI, PHP & Full-Stack Developer Building Scalable Digital Products

<?php

declare(strict_types=1);

header('Content-Type: application/json; charset=UTF-8');

// Keep the endpoint contract explicit and reject unsupported requests early.
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit(json_encode(['error' => 'Method not allowed']));
}

// Validate untrusted input before it reaches the database.
$payload = json_decode(file_get_contents('php://input'), true);
$email = filter_var($payload['email'] ?? '', FILTER_VALIDATE_EMAIL);

if (!$email) {
    http_response_code(422);
    exit(json_encode(['error' => 'Valid email required']));
}

// Prepared statements keep values separate from the SQL query.
$statement = $pdo->prepare(
    'INSERT INTO leads (email, source) VALUES (:email, :source)'
);
$statement->execute(['email' => $email, 'source' => 'portfolio']);

http_response_code(201);
echo json_encode(['id' => (int) $pdo->lastInsertId()]);

final class AiSummaryService
{
    public function __construct(
        private readonly string $endpoint,
        private readonly string $apiKey,
    ) {}

    public function summarize(string $content): string
    {
        $curl = curl_init($this->endpoint);

        // Bound connection and response time so external failures cannot hang the app.
        curl_setopt_array($curl, [
            CURLOPT_POST => true,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_CONNECTTIMEOUT => 5,
            CURLOPT_TIMEOUT => 25,
            CURLOPT_HTTPHEADER => [
                'Authorization: Bearer ' . $this->apiKey,
                'Content-Type: application/json',
            ],
            CURLOPT_POSTFIELDS => json_encode(['content' => $content]),
        ]);

        $response = curl_exec($curl);

        // Turn transport and API failures into one actionable application exception.
        if ($response === false || curl_getinfo($curl, CURLINFO_HTTP_CODE) >= 400) {
            throw new RuntimeException('AI service request failed.');
        }

        // Return a predictable string even when the optional field is absent.
        return (string) (json_decode($response, true)['summary'] ?? '');
    }
}

final class SubscriptionRepository
{
    public function __construct(private readonly PDO $database) {}

    public function activate(int $userId, int $planId): void
    {
        // Treat the subscription and audit record as one atomic operation.
        $this->database->beginTransaction();

        try {
            $subscription = $this->database->prepare(
                'INSERT INTO subscriptions (user_id, plan_id, status)
                 VALUES (:user_id, :plan_id, :status)'
            );
            $subscription->execute([
                'user_id' => $userId,
                'plan_id' => $planId,
                'status' => 'active',
            ]);

            $audit = $this->database->prepare(
                'INSERT INTO audit_logs (user_id, action) VALUES (?, ?)'
            );
            $audit->execute([$userId, 'subscription.activated']);

            $this->database->commit();
        } catch (Throwable $error) {
            // Never leave a partial subscription behind after a failed write.
            $this->database->rollBack();
            throw $error;
        }
    }
}