<?php
/**
 * =============================================================================
 * WHost — Next-Gen Hosting Control Panel
 *
 * Copyright (c) 2026 WISECP LLC. All rights reserved.
 *
 * NOTICE: All information contained herein is, and remains the property of
 * WISECP LLC. The intellectual and technical concepts contained herein are
 * proprietary to WISECP LLC and may not be reproduced, disclosed, or used
 * without express written authorization.
 *
 * Website: https://wisecp.com
 * Contact: hello@wisecp.com
 * =============================================================================
 *
 * HMAC-SHA256 v2 signing example for the WHost Agent API.
 * Signature payload: METHOD\nPATH\nTIMESTAMP\nNONCE\nBODY
 *
 * Usage:
 *   php hmac-example.php
 *
 * Environment:
 *   WHOST_BASE_URL   e.g. https://your-server:443
 *   WHOST_API_KEY
 *   WHOST_API_SECRET
 */

$baseUrl   = getenv('WHOST_BASE_URL')   ?: exit("WHOST_BASE_URL not set\n");
$apiKey    = getenv('WHOST_API_KEY')    ?: exit("WHOST_API_KEY not set\n");
$apiSecret = getenv('WHOST_API_SECRET') ?: exit("WHOST_API_SECRET not set\n");

$method    = 'GET';
$path      = '/api/v1/system/info';
$body      = '';
$timestamp = (string) time();
$nonce     = bin2hex(random_bytes(16));

// v2 payload: METHOD\nPATH\nTIMESTAMP\nNONCE\nBODY
$payload   = "{$method}\n{$path}\n{$timestamp}\n{$nonce}\n{$body}";
$signature = hash_hmac('sha256', $payload, $apiSecret);

$ch = curl_init($baseUrl . $path);
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST   => $method,
    CURLOPT_RETURNTRANSFER  => true,
    // TLS verification ON by default (production-safe). Only disable
    // for local development against a self-signed cert by setting
    // WHOST_TLS_VERIFY=0 in the env.
    CURLOPT_SSL_VERIFYPEER  => (getenv('WHOST_TLS_VERIFY') === '0') ? false : true,
    CURLOPT_SSL_VERIFYHOST  => (getenv('WHOST_TLS_VERIFY') === '0') ? 0 : 2,
    CURLOPT_HTTPHEADER      => [
        "X-WHost-Key: {$apiKey}",
        "X-WHost-Timestamp: {$timestamp}",
        "X-WHost-Nonce: {$nonce}",
        "X-WHost-Signature: {$signature}",
    ],
]);

// POST/PUT/PATCH/DELETE with a body: pass the JSON in CURLOPT_POSTFIELDS and
// use the same string as $body above when computing the signature.
if ($body !== '' && in_array($method, ['POST', 'PUT', 'PATCH', 'DELETE'], true)) {
    curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
}

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

echo "HTTP {$status}\n{$response}\n";