<?php
/**
 * Fix Basic Auth for Nginx + PHP-FPM over HTTP.
 *
 * Two problems solved:
 * 1. Nginx doesn't auto-parse Authorization header into PHP_AUTH_USER/PW
 * 2. WooCommerce only calls perform_basic_authentication() when is_ssl() is true,
 *    so it never authenticates WC API keys over HTTP and sets a blocking error.
 *
 * Fix: parse the header ourselves, then authenticate WC keys at priority 14
 * (before WC's filter at 15), so WC never enters its OAuth-only path.
 */

// Step 1: parse Authorization header into PHP_AUTH_USER / PHP_AUTH_PW
if ( ! isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
    if ( str_starts_with( $_SERVER['HTTP_AUTHORIZATION'], 'Basic ' ) ) {
        $credentials = base64_decode( substr( $_SERVER['HTTP_AUTHORIZATION'], 6 ) );
        list( $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] ) = explode( ':', $credentials, 2 );
    }
}

// Step 2: authenticate WC consumer keys over HTTP (before WC's own filter at priority 15)
add_filter( 'determine_current_user', function ( $user_id ) {
    if ( $user_id || ! isset( $_SERVER['PHP_AUTH_USER'] ) ) {
        return $user_id;
    }

    $consumer_key    = $_SERVER['PHP_AUTH_USER'];
    $consumer_secret = $_SERVER['PHP_AUTH_PW'] ?? '';

    // Only handle WC consumer keys (ck_ prefix)
    if ( ! str_starts_with( $consumer_key, 'ck_' ) ) {
        return $user_id;
    }

    global $wpdb;
    $hashed    = wc_api_hash( sanitize_text_field( $consumer_key ) );
    $user_data = $wpdb->get_row( $wpdb->prepare(
        "SELECT user_id, permissions, consumer_secret
         FROM {$wpdb->prefix}woocommerce_api_keys
         WHERE consumer_key = %s",
        $hashed
    ) );

    if ( $user_data && hash_equals( $user_data->consumer_secret, $consumer_secret ) ) {
        return (int) $user_data->user_id;
    }

    return $user_id;
}, 14 );