<?php
if ( ! defined( 'ABSPATH' ) ) exit;

function zerocert_verify_with_kgc( $identity, $kgc, $full_priv_key, $user_secret ) {
    if ( empty( $identity ) || empty( $kgc ) || empty( $full_priv_key ) || empty( $user_secret ) ) {
        return array(
            'success' => false,
            'message' => 'All fields are required.',
        );
    }

    // Check key status with KGC
    $status_url = trailingslashit( $kgc ) . 'key/' . urlencode( $identity );
    $response   = wp_remote_get( $status_url, array(
        'timeout'    => 15,
        'user-agent' => '0cert-wordpress/' . ZEROCERT_VERSION,
    ) );

    if ( is_wp_error( $response ) ) {
        return array(
            'success' => false,
            'message' => 'Could not reach KGC: ' . $response->get_error_message(),
        );
    }

    $body = json_decode( wp_remote_retrieve_body( $response ), true );

    if ( empty( $body ) ) {
        return array(
            'success' => false,
            'message' => 'Invalid response from KGC.',
        );
    }

    if ( isset( $body['status'] ) && $body['status'] === 'revoked' ) {
        return array(
            'success' => false,
            'message' => 'This identity has been revoked at the KGC.',
        );
    }

    if ( isset( $body['status'] ) && $body['status'] === 'not-issued' ) {
        return array(
            'success' => false,
            'message' => 'No key has been issued for this identity. Register at app.0cert.io first.',
        );
    }

    // Keys look valid — save status
    $key_id = isset( $body['keyId'] ) ? $body['keyId'] : '';

    return array(
        'success' => true,
        'message' => 'Verified with KGC successfully.',
        'keyId'   => $key_id,
        'status'  => isset( $body['status'] ) ? $body['status'] : 'active',
    );
}