<?php
// Travlix API v1 - signed request in PHP (curl). Usage: TLX_KEY=... TLX_SECRET=... php sign.php
$base = getenv('TLX_BASE') ?: 'https://api.travlix.com';
$key = getenv('TLX_KEY');
$secret = getenv('TLX_SECRET');

function tlx_call(string $method, string $path, ?array $body = null, array $headers = []): array
{
    global $base, $key, $secret;
    $raw = $body === null ? '' : json_encode($body, JSON_UNESCAPED_SLASHES);
    $u = parse_url($path);
    $ts = (string) time();
    $nonce = bin2hex(random_bytes(16));
    $sts = implode("\n", [strtoupper($method), $u['path'], $u['query'] ?? '', $ts, $nonce, hash('sha256', $raw)]);
    $h = array_merge(['Content-Type: application/json', 'X-Api-Key: ' . $key, 'X-Timestamp: ' . $ts,
        'X-Nonce: ' . $nonce, 'X-Signature: ' . hash_hmac('sha256', $sts, $secret)], $headers);
    $ch = curl_init($base . $path);
    curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $h, CURLOPT_TIMEOUT => 90]);
    if ($method !== 'GET') curl_setopt($ch, CURLOPT_POSTFIELDS, $raw);
    $res = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    return [$code, json_decode((string) $res, true)];
}

[$code, $r] = tlx_call('GET', '/v1/wallet/balance');
echo "balance $code: " . json_encode($r['data'] ?? $r['error']) . "\n";
[$code, $r] = tlx_call('POST', '/v1/flight/search', ['origin' => 'DEL', 'destination' => 'BOM',
    'departure_date' => date('Y-m-d', strtotime('+30 days')), 'adults' => 1]);
echo "search $code: " . ($r['data']['count'] ?? 0) . " offers\n";
if (!empty($r['data']['offers'])) {
    [$code, $q] = tlx_call('POST', '/v1/flight/fare-quote', ['offer_id' => $r['data']['offers'][0]['offer_id']]);
    echo "fare-quote $code: total " . ($q['data']['price']['total'] ?? '?') . "\n";
    // Book (uncomment): tlx_call('POST', '/v1/flight/book', [...], ['Idempotency-Key: ' . bin2hex(random_bytes(12))]);
}