<?php
/**
 * POST /api/qz_sign.php
 * Firma el request de QZ Tray con la llave privada RSA del servidor.
 * QZ Tray verifica la firma usando el digital-certificate.txt instalado en el cliente.
 */
header('Content-Type: text/plain');
header('Access-Control-Allow-Origin: *');

$request = file_get_contents('php://input');
if (!$request) { http_response_code(400); exit('missing request'); }

$keyPath = __DIR__ . '/../config/qz/private-key.pem';
$key = openssl_pkey_get_private('file://' . $keyPath);
if (!$key) { http_response_code(500); exit('key error'); }

openssl_sign($request, $signature, $key, 'SHA512');
echo base64_encode($signature);
