<?php
/**
 * API Client — Low-level HTTP wrapper for communicating with child sites.
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

class WPUHM_API_Client {

    /**
     * Prepare request arguments with secure parameters (HMAC, Nonce, Timestamp).
     *
     * @param string $api_key The site's API key.
     * @param string $method  HTTP method.
     * @param mixed  $body    Request body.
     * @param string $url     Request URL (passed by reference to append params).
     * @return array
     */
    private static function prepare_request_args( $api_key, $method, $body = '', &$url = '' ) {
        $timestamp = time();
        $nonce     = wp_generate_password( 16, false );
        
        // Serialize body if it's an array (for POST/PUT)
        $body_str = is_array( $body ) ? wp_json_encode( $body ) : $body;
        if ( empty( $body_str ) ) {
            $body_str = '';
        }

        // Construct payload: timestamp + nonce + body
        $payload = $timestamp . $nonce . $body_str;
        $signature = hash_hmac( 'sha256', $payload, $api_key );

        // Append to URL if provided
        if ( ! empty( $url ) ) {
            $url = add_query_arg( array(
                'api_key'   => $api_key,
                'timestamp' => $timestamp,
                'nonce'     => $nonce,
                'signature' => $signature,
            ), $url );
        }

        return array(
            'method'    => $method,
            'timeout'   => 30,
            'sslverify' => apply_filters( 'wpuhm_sslverify', true ),
            'headers'   => array(
                'Content-Type'    => 'application/json',
                'Accept'          => 'application/json',
            ),
            'body'      => $body_str,
        );
    }

    /**
     * Send a GET request to a child site.
     */
    public static function get( $site_url, $api_key, $endpoint, $params = array() ) {
        $url = trailingslashit( $site_url ) . 'wp-json/wp-user-hub/v1/' . ltrim( $endpoint, '/' );

        if ( ! empty( $params ) ) {
            $url = add_query_arg( $params, $url );
        }

        // GET requests have no body
        $args = self::prepare_request_args( $api_key, 'GET', '', $url );
        unset( $args['body'] ); // Not needed for GET

        $response = wp_remote_get( $url, $args );
        return self::parse_response( $response );
    }

    /**
     * Send a POST request to a child site.
     */
    public static function post( $site_url, $api_key, $endpoint, $body = array() ) {
        $url = trailingslashit( $site_url ) . 'wp-json/wp-user-hub/v1/' . ltrim( $endpoint, '/' );
        
        $args = self::prepare_request_args( $api_key, 'POST', $body, $url );
        $response = wp_remote_post( $url, $args );

        return self::parse_response( $response );
    }

    /**
     * Send a DELETE request to a child site.
     */
    public static function delete( $site_url, $api_key, $endpoint, $params = array() ) {
        $url = trailingslashit( $site_url ) . 'wp-json/wp-user-hub/v1/' . ltrim( $endpoint, '/' );

        if ( ! empty( $params ) ) {
            $url = add_query_arg( $params, $url );
        }

        $args = self::prepare_request_args( $api_key, 'DELETE', '', $url );
        unset( $args['body'] );

        $response = wp_remote_request( $url, $args );
        return self::parse_response( $response );
    }

    /**
     * Send a PUT request to a child site.
     */
    public static function put( $site_url, $api_key, $endpoint, $body = array() ) {
        $url = trailingslashit( $site_url ) . 'wp-json/wp-user-hub/v1/' . ltrim( $endpoint, '/' );

        $args = self::prepare_request_args( $api_key, 'PUT', $body, $url );
        $response = wp_remote_request( $url, $args );

        return self::parse_response( $response );
    }

    /**
     * Parse the HTTP response into a standardized format.
     */
    private static function parse_response( $response ) {
        if ( is_wp_error( $response ) ) {
            return array(
                'success' => false,
                'error'   => $response->get_error_message(),
                'code'    => 0,
                'data'    => null,
            );
        }

        $code = wp_remote_retrieve_response_code( $response );
        $body = wp_remote_retrieve_body( $response );
        $data = json_decode( $body, true );

        if ( json_last_error() !== JSON_ERROR_NONE ) {
            return array(
                'success' => false,
                'error'   => 'Invalid JSON response from site.',
                'code'    => $code,
                'data'    => $body,
            );
        }

        return array(
            'success' => ( $code >= 200 && $code < 300 ),
            'error'   => ( $code >= 400 ) ? ( isset( $data['message'] ) ? $data['message'] : 'Unknown error' ) : null,
            'code'    => $code,
            'data'    => $data,
        );
    }
}