<?php
class SC_Users_Endpoint {
    public function register() {
        register_rest_route(SC_REST_NAMESPACE, '/users', [
            [
                'methods'             => 'GET',
                'callback'            => [$this, 'list_users'],
                'permission_callback' => ['SC_Api_Auth', 'verify'],
            ],
            [
                'methods'             => 'POST',
                'callback'            => [$this, 'create_user'],
                'permission_callback' => ['SC_Api_Auth', 'verify'],
            ],
        ]);
        register_rest_route(SC_REST_NAMESPACE, '/users/(?P<id>\d+)', [
            [
                'methods'             => 'PUT',
                'callback'            => [$this, 'update_user'],
                'permission_callback' => ['SC_Api_Auth', 'verify'],
            ],
            [
                'methods'             => 'DELETE',
                'callback'            => [$this, 'delete_user'],
                'permission_callback' => ['SC_Api_Auth', 'verify'],
            ],
        ]);
    }

    public function list_users($request) {
        $users = get_users(['number' => -1]);
        $result = [];
        foreach ($users as $user) {
            $result[] = [
                'id'         => $user->ID,
                'login'      => $user->user_login,
                'email'      => $user->user_email,
                'display_name' => $user->display_name,
                'role'       => implode(', ', $user->roles),
                'registered' => $user->user_registered,
            ];
        }
        return rest_ensure_response($result);
    }

    public function create_user($request) {
        $params = $request->get_json_params();
        $username = sanitize_user($params['username'] ?? '');
        $email = sanitize_email($params['email'] ?? '');
        $password = $params['password'] ?? wp_generate_password(16);
        $role = sanitize_text_field($params['role'] ?? 'subscriber');

        if (empty($username) || empty($email)) {
            return new WP_Error('missing_fields', 'Username and email required', ['status' => 400]);
        }

        $user_id = wp_insert_user([
            'user_login' => $username,
            'user_email' => $email,
            'user_pass'  => $password,
            'role'       => $role,
        ]);

        if (is_wp_error($user_id)) {
            return $user_id;
        }

        return rest_ensure_response([
            'id'       => $user_id,
            'login'    => $username,
            'email'    => $email,
            'role'     => $role,
            'password' => $password,
        ]);
    }

    public function update_user($request) {
        $id = (int)$request['id'];
        $params = $request->get_json_params();

        $data = ['ID' => $id];
        if (isset($params['email'])) $data['user_email'] = sanitize_email($params['email']);
        if (isset($params['password'])) $data['user_pass'] = $params['password'];
        if (isset($params['display_name'])) $data['display_name'] = sanitize_text_field($params['display_name']);
        if (isset($params['role'])) $data['role'] = sanitize_text_field($params['role']);

        $result = wp_update_user($data);
        if (is_wp_error($result)) return $result;

        return rest_ensure_response(['success' => true, 'id' => $id]);
    }

    public function delete_user($request) {
        require_once ABSPATH . 'wp-admin/includes/user.php';
        $id = (int)$request['id'];
        $result = wp_delete_user($id);
        return rest_ensure_response(['success' => $result]);
    }
}