From f05ae2488200f43ee3959743f36d15bef194f559 Mon Sep 17 00:00:00 2001
From: Vladimir Bryzgalov <vladimir.bryzgalov@gmail.com>
Date: Sat, 16 May 2026 22:35:23 +0500
Subject: [PATCH] feat(wpmc S5): RestUrlFilter forces HTTPS + preserves
 HTTP_HOST

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 includes/class-rest-url-filter.php | 22 ++++++++++++++++++
 tests/RestUrlFilterTest.php        | 37 ++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100644 includes/class-rest-url-filter.php
 create mode 100644 tests/RestUrlFilterTest.php

diff --git a/includes/class-rest-url-filter.php b/includes/class-rest-url-filter.php
new file mode 100644
index 0000000..716ae4e
--- /dev/null
+++ b/includes/class-rest-url-filter.php
@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+namespace WPMultiCity;
+
+final class RestUrlFilter
+{
+    public static function register(): void
+    {
+        \add_filter('rest_url', [self::class, 'preserve_host']);
+    }
+
+    public static function preserve_host(string $url): string
+    {
+        $host = $_SERVER['HTTP_HOST'] ?? '';
+        if ($host === '') {
+            return $url;
+        }
+        $replaced = preg_replace('#^https?://[^/]+#', 'https://' . $host, $url);
+        return is_string($replaced) ? $replaced : $url;
+    }
+}
diff --git a/tests/RestUrlFilterTest.php b/tests/RestUrlFilterTest.php
new file mode 100644
index 0000000..7fff6f4
--- /dev/null
+++ b/tests/RestUrlFilterTest.php
@@ -0,0 +1,37 @@
+<?php
+declare(strict_types=1);
+
+namespace WPMultiCity\Tests;
+
+use WPMultiCity\RestUrlFilter;
+
+final class RestUrlFilterTest extends TestCase
+{
+    public function test_register_attaches_rest_url_filter(): void
+    {
+        RestUrlFilter::register();
+
+        self::assertNotFalse(
+            has_filter('rest_url', [RestUrlFilter::class, 'preserve_host']),
+            'RestUrlFilter::register() must hook rest_url'
+        );
+    }
+
+    public function test_preserve_host_replaces_host_when_http_host_set(): void
+    {
+        $_SERVER['HTTP_HOST'] = 'site.com';
+
+        self::assertSame(
+            'https://site.com/wp-json/wp/v2/posts',
+            RestUrlFilter::preserve_host('http://other.example/wp-json/wp/v2/posts')
+        );
+    }
+
+    public function test_preserve_host_returns_url_unchanged_when_http_host_missing(): void
+    {
+        unset($_SERVER['HTTP_HOST']);
+
+        $url = 'https://other.example/wp-json/wp/v2/posts';
+        self::assertSame($url, RestUrlFilter::preserve_host($url));
+    }
+}