<?php
namespace AIAAS;

if ( ! defined( 'ABSPATH' ) ) { exit; }

/**
 * Lightweight rate limiter.
 *
 * Uses transients; designed to prevent accidental rapid-fire requests.
 */
class Rate_Limiter {

    /**
     * @param string $key            A unique key (include user id in the key).
     * @param int    $limit          Max requests within window.
     * @param int    $window_seconds Window size in seconds.
     *
     * @return bool True if allowed, false if rate limited.
     */
    public static function allow( string $key, int $limit, int $window_seconds ) : bool {
        $limit = max( 1, (int) $limit );
        $window_seconds = max( 1, (int) $window_seconds );

        // Transient keys are limited in length; hash the key.
        $tkey = 'aiaas_rl_' . md5( $key );

        $now = time();
        $data = get_transient( $tkey );

        if ( ! is_array( $data ) || empty( $data['reset'] ) || empty( $data['count'] ) ) {
            $data = array(
                'count' => 1,
                'reset' => $now + $window_seconds,
            );
            set_transient( $tkey, $data, $window_seconds );
            return true;
        }

        $reset = (int) $data['reset'];
        $count = (int) $data['count'];

        if ( $now >= $reset ) {
            // New window.
            $data = array(
                'count' => 1,
                'reset' => $now + $window_seconds,
            );
            set_transient( $tkey, $data, $window_seconds );
            return true;
        }

        if ( $count >= $limit ) {
            return false;
        }

        $data['count'] = $count + 1;
        // Keep existing reset window; transient TTL should not extend beyond reset.
        $ttl = max( 1, $reset - $now );
        set_transient( $tkey, $data, $ttl );
        return true;
    }
}