<?php
if (!defined('ABSPATH')) { exit; }

final class MMI_RemoteAuth {

	const OPTION_KEY = 'if_remote_secret';

	public static function get_secret() : string {
		$s = get_option(self::OPTION_KEY);
		if (is_string($s) && $s !== '') return $s;

		$s = wp_generate_password(64, true, true);
		update_option(self::OPTION_KEY, $s, false);
		return $s;
	}

	public static function sign(string $intent_json, int $ts) : string {
		$secret = self::get_secret();
		return hash_hmac('sha256', $ts . ':' . $intent_json, $secret);
	}

	public static function verify(string $intent_json, int $ts, string $sig) : bool {
		if (abs(time() - $ts) > 300) return false; // 5 min window
		$expected = self::sign($intent_json, $ts);
		return hash_equals($expected, $sig);
	}
}