<?php
/**
 * Shared loopback site probe (v1.4 plan §3.0).
 *
 * One implementation of "is the site up?" for every operation that needs a
 * verdict after a risky change: update-plugin (since 1.0), check-site-response,
 * toggle-plugin and rollback-plugin (v1.4). Extracted from
 * ATB_Operation_Update_Plugin with behavior kept identical: GET the home page
 * and the REST index as an anonymous visitor, 2xx with no fatal marker = ok.
 * The atb_health cache-buster makes static page caches miss (the M3 finding:
 * a cached 200 can hide a broken site) and also whitelists the request past
 * the plugin's own maintenance page.
 */

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

if ( ! class_exists( 'ATB_Site_Probe' ) ) {
    class ATB_Site_Probe
    {
        /**
         * Loopback probe timeout per request, seconds.
         */
        const PROBE_TIMEOUT = 10;

        /**
         * Response-body markers that mean "PHP died rendering this page".
         */
        const FATAL_MARKERS = array(
            'There has been a critical error on this website',
            'Fatal error',
        );

        /**
         * Runs the probe: home + REST index, anonymous, cache-busted.
         *
         * @return array {
         *     passed:   bool     Both checks ok.
         *     failures: string[] Human lines, one per failed check (update-plugin
         *                        merges these into its warnings).
         *     checks:   array    { home: {status,ok,reason,time_ms}, rest: {…} }
         * }
         */
        public static function run()
        {
            $atb_buster = 'atb-health-' . time();
            $atb_urls   = array(
                'home' => add_query_arg( 'atb_health', $atb_buster, home_url( '/' ) ),
                'rest' => add_query_arg( 'atb_health', $atb_buster, rest_url() ),
            );

            $atb_failures = array();
            $atb_checks   = array();
            foreach ( $atb_urls as $atb_label => $atb_url ) {
                $atb_start    = microtime( true );
                $atb_response = wp_remote_get(
                    $atb_url,
                    array(
                        'timeout'   => self::PROBE_TIMEOUT,
                        'sslverify' => false, // Loopback to ourselves; local/self-signed certs must not fail the probe.
                    )
                );
                $atb_time_ms = (int) round( ( microtime( true ) - $atb_start ) * 1000 );

                if ( is_wp_error( $atb_response ) ) {
                    $atb_failures[]            = 'health probe (' . $atb_label . '): ' . $atb_response->get_error_message();
                    $atb_checks[ $atb_label ] = array(
                        'status'  => 0,
                        'ok'      => false,
                        'reason'  => $atb_response->get_error_message(),
                        'time_ms' => $atb_time_ms,
                    );
                    continue;
                }

                $atb_status  = (int) wp_remote_retrieve_response_code( $atb_response );
                $atb_verdict = self::evaluate( $atb_status, (string) wp_remote_retrieve_body( $atb_response ) );
                if ( ! $atb_verdict['ok'] ) {
                    $atb_failures[] = 'health probe (' . $atb_label . '): ' . $atb_verdict['reason'];
                }
                $atb_checks[ $atb_label ] = array(
                    'status'  => $atb_status,
                    'ok'      => $atb_verdict['ok'],
                    'reason'  => $atb_verdict['reason'],
                    'time_ms' => $atb_time_ms,
                );
            }

            return array(
                'passed'   => empty( $atb_failures ),
                'failures' => $atb_failures,
                'checks'   => $atb_checks,
            );
        }

        /**
         * Baseline check BEFORE a risky change (v1.5.2, review F2). The
         * recover operations promise "health-checked, restored if the site
         * broke" — a promise that silently inverts on a site that cannot
         * reach itself for reasons unrelated to the change (HTTP basic auth
         * or an access gate on staging, a WAF challenge, a host that blocks
         * loopback requests, a hostname the server cannot resolve): every
         * post-change probe fails, every change is "rolled back", and the
         * agent is told the update broke the site. Same stance as the
         * single-file-plugin refusal — without a working safety net the
         * operation refuses, honestly, with a machine code.
         *
         * @return array|null { reason, error, checks } to refuse with, or null
         *                    when the site answers its own probe.
         */
        public static function baseline_refusal()
        {
            $atb_probe = self::run();
            if ( $atb_probe['passed'] ) {
                return null;
            }
            return array(
                'reason' => 'loopback_unavailable',
                'error'  => 'the site cannot reach itself over HTTP before any change was made ('
                    . implode( '; ', $atb_probe['failures'] ) . '), so the post-change health check and '
                    . 'the automatic restore cannot work here and the operation is refused. Common causes: '
                    . 'HTTP basic auth or an access gate on this site, a firewall/WAF challenge, a host that '
                    . 'blocks loopback requests, or a hostname the server cannot resolve. Ask the site owner '
                    . 'to allow loopback requests (Site Health reports the same problem); agent-toolbelt/'
                    . 'check-site-response shows the per-check details.',
                'checks' => $atb_probe['checks'],
            );
        }

        /**
         * Pure verdict on one probe response: 2xx and no fatal marker = ok.
         *
         * @param int    $atb_code HTTP status code (0 when unavailable).
         * @param string $atb_body Response body.
         * @return array { ok: bool, reason: string }
         */
        public static function evaluate( $atb_code, $atb_body )
        {
            if ( $atb_code < 200 || $atb_code >= 300 ) {
                return array( 'ok' => false, 'reason' => 'unexpected HTTP status ' . $atb_code );
            }
            foreach ( self::FATAL_MARKERS as $atb_marker ) {
                if ( false !== stripos( $atb_body, $atb_marker ) ) {
                    return array( 'ok' => false, 'reason' => 'fatal-error marker found in response body' );
                }
            }
            return array( 'ok' => true, 'reason' => '' );
        }
    }
}