<?php
/**
 * HTTPS state for configured WordPress URLs without storing hostnames.
 *
 * @package Px320\SiteAudit
 */

declare(strict_types=1);

namespace Px320\SiteAudit\Checks\WordPress;

use Px320\SiteAudit\Checks\Checker;
use Px320\SiteAudit\Checks\FindingFactory;
use Px320\SiteAudit\Security\LocalHashKey;

final class UrlsHttpsChecker implements Checker {
	private FindingFactory $findings;

	public function __construct( FindingFactory $findings ) {
		$this->findings = $findings;
	}

	public function id(): string {
		// phpcs:ignore WordPress.WP.CapitalPDangit.MisspelledInText -- Stable registry machine ID.
		return 'wordpress.urls_https';
	}

	/**
	 * @return array<string, mixed>
	 */
	public function execute( string $timestamp ): array {
		$hash_key     = ( new LocalHashKey() )->derive();
		$urls         = array(
			'home' => home_url( '/' ),
			'site' => site_url( '/' ),
		);
		$observations = array();
		$https_count  = 0;

		foreach ( $urls as $type => $url ) {
			$parts = wp_parse_url( $url );
			if ( ! is_array( $parts ) || ! isset( $parts['scheme'], $parts['host'] ) ) {
				continue;
			}

			$scheme = strtolower( (string) $parts['scheme'] );
			if ( 'https' === $scheme ) {
				++$https_count;
			}
			$observations[] = array(
				'type'       => $type,
				'scheme'     => $scheme,
				'host_hash'  => hash_hmac( 'sha256', strtolower( (string) $parts['host'] ), $hash_key ),
				'path_state' => empty( $parts['path'] ) || '/' === $parts['path'] ? 'root' : 'custom',
			);
		}

		$observed = count( $observations );
		if ( 0 === $observed ) {
			$status   = 'not_tested';
			$coverage = 'none';
		} elseif ( $observed < count( $urls ) ) {
			$status   = 'not_tested';
			$coverage = 'partial';
		} elseif ( count( $urls ) === $https_count ) {
			$status   = 'pass';
			$coverage = 'complete';
		} else {
			$status   = 'production' === wp_get_environment_type() ? 'fail' : 'warning';
			$coverage = 'complete';
		}

		return $this->findings->build(
			$this->id(),
			$status,
			array(
				'observations' => $observations,
				'method'       => 'wordpress_url_api',
				'limitations'  => array( 'Configured schemes were checked; TLS delivery was not requested by this local checker.' ),
			),
			$observed,
			count( $urls ),
			$coverage,
			$timestamp
		);
	}
}