#!/usr/bin/env node
/**
 * Specto LCO API — Node.js 18+ example client (no dependencies; uses global fetch).
 *
 *   SPECTO_API_BASE=https://api.spectotv.com/api/v1 SPECTO_API_KEY=spk_... SPECTO_API_SECRET=sps_... node specto_client.js
 *
 * Server-side only: never put the API secret in browser or mobile-app code.
 */
'use strict';
const crypto = require('crypto');

const enc = (s) => encodeURIComponent(s).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());

function canonicalQuery(query) {
  if (!query) return '';
  const pairs = query.split('&').filter(Boolean).map((p) => {
    const i = p.indexOf('=');
    const k = decodeURIComponent((i < 0 ? p : p.slice(0, i)).replace(/\+/g, '%20'));
    const v = i < 0 ? '' : decodeURIComponent(p.slice(i + 1).replace(/\+/g, '%20'));
    return [enc(k), enc(v)];
  });
  pairs.sort((a, b) => (a[0] === b[0] ? (a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0) : a[0] < b[0] ? -1 : 1));
  return pairs.map((p) => p[0] + '=' + p[1]).join('&');
}

function sign(secret, method, path, query, ts, nonce, body) {
  const sts = [method.toUpperCase(), path, canonicalQuery(query), ts, nonce,
    crypto.createHash('sha256').update(body, 'utf8').digest('hex')].join('\n');
  return crypto.createHmac('sha256', secret).update(sts, 'utf8').digest('hex');
}

class SpectoClient {
  constructor(base, key, secret) {
    this.base = base.replace(/\/+$/, '');
    this.origin = this.base.replace(/\/api\/v1$/, '');
    this.key = key; this.secret = secret;
  }
  async request(method, endpoint, query = {}, body = null, idempotencyKey = null) {
    const path = '/api/v1/' + endpoint.replace(/^\/+/, '');
    const qs = Object.entries(query).map(([k, v]) => enc(k) + '=' + enc(String(v))).join('&');
    const raw = body === null ? '' : JSON.stringify(body);
    const ts = String(Math.floor(Date.now() / 1000));
    const nonce = crypto.randomBytes(16).toString('hex');
    const headers = {
      'X-API-Key': this.key, 'X-Timestamp': ts, 'X-Nonce': nonce,
      'X-Signature': sign(this.secret, method, path, qs, ts, nonce, raw), Accept: 'application/json',
    };
    if (method === 'POST') headers['Content-Type'] = 'application/json';
    if (idempotencyKey) headers['Idempotency-Key'] = idempotencyKey;
    // optional extra headers, e.g. for your own outbound proxy (JSON array of "Name: value")
    for (const h of JSON.parse(process.env.SPECTO_EXTRA_HEADERS || '[]')) { const i = h.indexOf(':'); headers[h.slice(0, i).trim()] = h.slice(i + 1).trim(); }
    const res = await fetch(this.origin + path + (qs ? '?' + qs : ''), { method, headers, body: method === 'POST' ? raw : undefined });
    return { http: res.status, body: await res.json() };
  }
}

module.exports = { SpectoClient, sign, canonicalQuery };

if (require.main === module) {
  // Demo: balance -> subscription lookup -> (optional) advance renewal with a retry-safe key -> transaction lookup.
  (async () => {
    const c = new SpectoClient(process.env.SPECTO_API_BASE || 'https://api.spectotv.com/api/v1', process.env.SPECTO_API_KEY || '', process.env.SPECTO_API_SECRET || '');
    const bal = await c.request('GET', 'balance');
    console.log('balance:', bal.http, bal.body.code, bal.body.data && bal.body.data.wallet_balance);
    const sid = process.env.SPECTO_DEMO_SUBSCRIBER;
    if (!sid) return;
    const sub = await c.request('GET', 'subscription', { subscriber_id: sid });
    console.log('subscription:', sub.http, sub.body.code, sub.body.data && sub.body.data.expiry_date);
    const planId = process.env.SPECTO_DEMO_PLAN;
    if (!planId) return;
    const key = 'adv-' + crypto.randomBytes(8).toString('hex');   // store with your order before sending
    let res;
    for (let attempt = 1; attempt <= 3; attempt++) {
      try { res = await c.request('POST', 'advance-renew', {}, { subscriber_id: sid, plan_id: planId }, key); break; }
      catch (e) { await new Promise((r) => setTimeout(r, 1000 * attempt)); }   // network error: retry with the SAME key
    }
    console.log('advance-renew:', res.http, res.body.code, res.body.message, res.body.data && res.body.data.expiry && res.body.data.expiry.start_date);
    const t = await c.request('GET', 'transaction', { idempotency_key: key });
    console.log('lookup:', t.body.data && t.body.data.status);
  })().catch((e) => { console.error(e); process.exit(1); });
}