<?php
// Citami Connector — module. Loaded by citami-connector.php in a fixed
// order; never load this file on its own.
if (!defined('ABSPATH')) {
    exit;
}

/* ────────────────────────────────────────────────────────────────── */
/*  Key rotation (moved out of updates.php so every build has it,      */
/*  including the WordPress.org one that ships without the updater).   */
/*                                                                     */
/*  POST /wp-json/citami/v1/rotate-key {new_key}, authenticated with   */
/*  the CURRENT key, stores the new one. The platform rotates its      */
/*  copy only after this call succeeds.                                */
/* ────────────────────────────────────────────────────────────────── */

/** POST /wp-json/citami/v1/rotate-key — authenticated with the CURRENT key. */
function citami_rest_rotate_key(WP_REST_Request $request) {
    $body = $request->get_json_params();
    $new = isset($body['new_key']) ? trim((string) $body['new_key']) : '';
    if (strlen($new) < 32 || !preg_match('/^ctm_[A-Za-z0-9_\-]{28,}$/', $new)) {
        return new WP_Error('citami_bad_key', 'new_key non valida (formato ctm_…, minimo 32 caratteri).', array('status' => 400));
    }
    update_option('citami_api_key', $new, false);
    delete_transient('citami_update_check');
    return rest_ensure_response(array('success' => true, 'message' => citami_t('Chiave aggiornata.', 'Key updated.')));
}

add_action('rest_api_init', function () {
    register_rest_route('citami/v1', '/rotate-key', array(
        'methods'             => 'POST',
        'callback'            => 'citami_rest_rotate_key',
        'permission_callback' => 'citami_check_permission',
    ));
});