WooNooW/includes/Api/NewsletterController.php

<?php
namespace WooNooW\API;

use WP_REST_Request;
use WP_REST_Response;
use WP_Error;
use WooNooW\Core\Validation;

class NewsletterController {
    const API_NAMESPACE = 'woonoow/v1';
    
    public static function register_routes() {
        register_rest_route(self::API_NAMESPACE, '/newsletter/subscribe', [
            'methods' => 'POST',
            'callback' => [__CLASS__, 'subscribe'],
            'permission_callback' => '__return_true',
            'args' => [
                'email' => [
                    'required' => true,
                    'type' => 'string',
                    'validate_callback' => function($param) {
                        return is_email($param);
                    },
                ],
            ],
        ]);
        
        register_rest_route(self::API_NAMESPACE, '/newsletter/subscribers', [
            'methods' => 'GET',
            'callback' => [__CLASS__, 'get_subscribers'],
            'permission_callback' => function() {
                return current_user_can('manage_options');
            },
        ]);
        
        register_rest_route(self::API_NAMESPACE, '/newsletter/subscribers/(?P<email>[^/]+)', [
            'methods' => 'DELETE',
            'callback' => [__CLASS__, 'delete_subscriber'],
            'permission_callback' => function() {
                return current_user_can('manage_options');
            },
        ]);
        
        register_rest_route(self::API_NAMESPACE, '/newsletter/template/(?P<template>[^/]+)', [
            'methods' => 'GET',
            'callback' => [__CLASS__, 'get_template'],
            'permission_callback' => function() {
                return current_user_can('manage_options');
            },
        ]);
        
        register_rest_route(self::API_NAMESPACE, '/newsletter/template/(?P<template>[^/]+)', [
            'methods' => 'POST',
            'callback' => [__CLASS__, 'save_template'],
            'permission_callback' => function() {
                return current_user_can('manage_options');
            },
        ]);
        
        // Public unsubscribe endpoint (no auth needed, uses token)
        register_rest_route(self::API_NAMESPACE, '/newsletter/unsubscribe', [
            'methods' => 'GET',
            'callback' => [__CLASS__, 'unsubscribe'],
            'permission_callback' => '__return_true',
            'args' => [
                'email' => [
                    'required' => true,
                    'type' => 'string',
                ],
                'token' => [
                    'required' => true,
                    'type' => 'string',
                ],
            ],
        ]);
    }
    
    public static function get_template(WP_REST_Request $request) {
        $template = $request->get_param('template');
        $option_key = "woonoow_newsletter_{$template}_template";
        
        $data = get_option($option_key, [
            'subject' => $template === 'welcome' ? 'Welcome to {site_name} Newsletter!' : 'Confirm your newsletter subscription',
            'content' => $template === 'welcome' 
                ? "Thank you for subscribing to our newsletter!\n\nYou'll receive updates about our latest products and offers.\n\nBest regards,\n{site_name}"
                : "Please confirm your newsletter subscription by clicking the link below:\n\n{confirmation_url}\n\nBest regards,\n{site_name}",
        ]);
        
        return new WP_REST_Response([
            'success' => true,
            'subject' => $data['subject'] ?? '',
            'content' => $data['content'] ?? '',
        ], 200);
    }
    
    public static function save_template(WP_REST_Request $request) {
        $template = $request->get_param('template');
        $subject = sanitize_text_field($request->get_param('subject'));
        $content = wp_kses_post($request->get_param('content'));
        
        $option_key = "woonoow_newsletter_{$template}_template";
        
        update_option($option_key, [
            'subject' => $subject,
            'content' => $content,
        ]);
        
        return new WP_REST_Response([
            'success' => true,
            'message' => 'Template saved successfully',
        ], 200);
    }
    
    public static function delete_subscriber(WP_REST_Request $request) {
        $email = urldecode($request->get_param('email'));
        $subscribers = get_option('woonoow_newsletter_subscribers', []);
        
        $subscribers = array_filter($subscribers, function($sub) use ($email) {
            return isset($sub['email']) && $sub['email'] !== $email;
        });
        
        update_option('woonoow_newsletter_subscribers', array_values($subscribers));
        
        return new WP_REST_Response([
            'success' => true,
            'message' => 'Subscriber removed successfully',
        ], 200);
    }
    
    public static function subscribe(WP_REST_Request $request) {
        $email = sanitize_email($request->get_param('email'));
        
        // Use centralized validation with extensible filter hooks
        $validation = Validation::validate_email($email, 'newsletter_subscribe');
        
        if (is_wp_error($validation)) {
            return $validation;
        }
        
        // Get existing subscribers (now stored as objects with metadata)
        $subscribers = get_option('woonoow_newsletter_subscribers', []);
        
        // Check if already subscribed
        $existing = array_filter($subscribers, function($sub) use ($email) {
            return isset($sub['email']) && $sub['email'] === $email;
        });
        
        if (!empty($existing)) {
            return new WP_REST_Response([
                'success' => true,
                'message' => 'You are already subscribed to our newsletter!',
            ], 200);
        }
        
        // Check if email belongs to a WP user
        $user = get_user_by('email', $email);
        $user_id = $user ? $user->ID : null;
        
        // Add new subscriber with metadata
        $subscribers[] = [
            'email' => $email,
            'user_id' => $user_id,
            'status' => 'active',
            'subscribed_at' => current_time('mysql'),
            'ip_address' => $_SERVER['REMOTE_ADDR'] ?? '',
        ];
        
        update_option('woonoow_newsletter_subscribers', $subscribers);
        
        // Trigger notification events
        do_action('woonoow_newsletter_subscribed', $email, $user_id);
        
        // Trigger notification system events (uses email builder)
        do_action('woonoow/notification/event', 'newsletter_welcome', 'customer', [
            'email' => $email,
            'user_id' => $user_id,
            'subscribed_at' => current_time('mysql'),
        ]);
        
        do_action('woonoow/notification/event', 'newsletter_subscribed_admin', 'staff', [
            'email' => $email,
            'user_id' => $user_id,
            'subscribed_at' => current_time('mysql'),
        ]);
        
        return new WP_REST_Response([
            'success' => true,
            'message' => 'Successfully subscribed! Check your email for confirmation.',
        ], 200);
    }
    
    private static function send_welcome_email($email) {
        $site_name = get_bloginfo('name');
        $template = get_option('woonoow_newsletter_welcome_template', '');
        
        if (empty($template)) {
            $template = "Thank you for subscribing to our newsletter!\n\nYou'll receive updates about our latest products and offers.\n\nBest regards,\n{site_name}";
        }
        
        $subject = sprintf('Welcome to %s Newsletter!', $site_name);
        $message = str_replace('{site_name}', $site_name, $template);
        
        wp_mail($email, $subject, $message);
    }
    
    public static function get_subscribers(WP_REST_Request $request) {
        $subscribers = get_option('woonoow_newsletter_subscribers', []);
        
        return new WP_REST_Response([
            'success' => true,
            'data' => [
                'subscribers' => $subscribers,
                'count' => count($subscribers),
            ],
        ], 200);
    }
    
    /**
     * Handle unsubscribe request
     */
    public static function unsubscribe(WP_REST_Request $request) {
        $email = sanitize_email(urldecode($request->get_param('email')));
        $token = sanitize_text_field($request->get_param('token'));
        
        // Verify token
        $expected_token = self::generate_unsubscribe_token($email);
        if (!hash_equals($expected_token, $token)) {
            return new WP_REST_Response([
                'success' => false,
                'message' => __('Invalid unsubscribe link', 'woonoow'),
            ], 400);
        }
        
        // Get subscribers
        $subscribers = get_option('woonoow_newsletter_subscribers', []);
        $found = false;
        
        foreach ($subscribers as &$sub) {
            if (isset($sub['email']) && $sub['email'] === $email) {
                $sub['status'] = 'unsubscribed';
                $sub['unsubscribed_at'] = current_time('mysql');
                $found = true;
                break;
            }
        }
        
        if (!$found) {
            return new WP_REST_Response([
                'success' => false,
                'message' => __('Email not found', 'woonoow'),
            ], 404);
        }
        
        update_option('woonoow_newsletter_subscribers', $subscribers);
        
        do_action('woonoow_newsletter_unsubscribed', $email);
        
        // Return HTML page for nice UX
        $site_name = get_bloginfo('name');
        $html = sprintf(
            '<!DOCTYPE html><html><head><title>%s</title><style>body{font-family:system-ui,sans-serif;display:flex;justify-content:center;align-items:center;min-height:100vh;margin:0;background:#f5f5f5;}.box{background:white;padding:40px;border-radius:8px;text-align:center;box-shadow:0 2px 10px rgba(0,0,0,0.1);max-width:400px;}h1{color:#333;margin-bottom:16px;}p{color:#666;}</style></head><body><div class="box"><h1>✓ Unsubscribed</h1><p>You have been unsubscribed from %s newsletter.</p></div></body></html>',
            __('Unsubscribed', 'woonoow'),
            esc_html($site_name)
        );
        
        header('Content-Type: text/html; charset=utf-8');
        echo $html;
        exit;
    }
    
    /**
     * Generate secure unsubscribe token
     */
    private static function generate_unsubscribe_token($email) {
        $secret = wp_salt('auth');
        return hash_hmac('sha256', $email, $secret);
    }
    
    /**
     * Generate unsubscribe URL for email templates
     */
    public static function generate_unsubscribe_url($email) {
        $token = self::generate_unsubscribe_token($email);
        $base_url = rest_url('woonoow/v1/newsletter/unsubscribe');
        return add_query_arg([
            'email' => urlencode($email),
            'token' => $token,
        ], $base_url);
    }
}