<?php
function required(string $name): string {
    $value = getenv($name);
    if ($value === false || $value === '') throw new RuntimeException('Set ' . $name);
    return $value;
}
function request(string $path, ?array $body = null): array {
    $authorization = base64_encode(required('SCORMBOX_API_KEY') . ':' . required('SCORMBOX_API_SECRET'));
    $context = stream_context_create(['http' => [
        'method' => $body === null ? 'GET' : 'POST',
        'header' => "Authorization: Basic $authorization\r\nContent-Type: application/json\r\n",
        'content' => $body === null ? '' : json_encode($body, JSON_THROW_ON_ERROR),
        'timeout' => 20, 'follow_location' => 0, 'ignore_errors' => true
    ]]);
    $response = @file_get_contents('https://scormbox.com/api/v1' . $path, false, $context);
    if ($response === false) throw new RuntimeException('SCORMBox request failed.');
    preg_match('/^HTTP\/\S+ (\d+)/', $http_response_header[0] ?? '', $match);
    $status = (int)($match[1] ?? 0);
    if ($status < 200 || $status >= 300) throw new RuntimeException('SCORMBox HTTP ' . $status);
    return json_decode($response, true, 512, JSON_THROW_ON_ERROR);
}
$course_path = '/courses/' . rawurlencode(required('SCORMBOX_COURSE_ID'));
$user = ['name' => required('SCORMBOX_LEARNER_NAME'), 'email' => required('SCORMBOX_LEARNER_EMAIL')];
$session = request($course_path . '/sessions', [
    'user' => $user, 'origin' => required('SCORMBOX_ORIGIN'), 'attempt_mode' => 'resume'
]);
// Deliver $session['launch_token'] only to this learner's authorized browser page.
$result = request($course_path . '/results?' . http_build_query(['email' => $user['email']]));
echo json_encode($result, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR) . "\n";