<?php
if (!defined('ABSPATH')) exit;

/**
 * download_url() usa wp_safe_remote_get(), que ya rechaza hosts internos/privados — no hace falta
 * validar aquí la URL contra SSRF.
 */
function ailoquence_set_featured_image_from_url($post_id, $image_url) {
  if (!$image_url) return null;

  require_once ABSPATH . 'wp-admin/includes/file.php';
  require_once ABSPATH . 'wp-admin/includes/media.php';
  require_once ABSPATH . 'wp-admin/includes/image.php';

  $tmp = download_url($image_url);
  if (is_wp_error($tmp)) return $tmp;

  $path = wp_parse_url($image_url, PHP_URL_PATH);
  $name = $path ? basename($path) : ('image_' . time() . '.jpg');
  $file_array = ['name' => sanitize_file_name($name), 'tmp_name' => $tmp];

  $att_id = media_handle_sideload($file_array, $post_id);

  if (is_wp_error($att_id)) {
    wp_delete_file($tmp);
    return $att_id;
  }

  set_post_thumbnail($post_id, $att_id);
  return $att_id;
}