<?php

declare(strict_types=1);

namespace WebCalendar\WP\Bridge;

defined( 'ABSPATH' ) || exit;

use WebCalendar\Core\Application\Contract\WebhookProviderInterface;

/**
 * WordPress implementation of WebhookProviderInterface.
 */
class WpWebhookProvider implements WebhookProviderInterface {

	/**
	 * Sends a webhook notification using wp_safe_remote_post().
	 *
	 * Uses the _safe_ HTTP variant to block requests to private-network IPs
	 * (SSRF hardening). Webhook URLs are user-configured in the admin, so
	 * without the allowlist an attacker-positioned admin could target cloud
	 * metadata endpoints or internal hosts. Sites that legitimately need
	 * to reach an internal receiver can override via:
	 *
	 *     add_filter( 'http_request_host_is_external', '__return_true', 10, 3 );
	 *
	 * @param string               $url Webhook URL.
	 * @param array<string, mixed> $payload Webhook payload.
	 */
	#[\Override]
	public function trigger( string $url, array $payload ): void {
		$body = wp_json_encode( $payload );
		if ( false === $body ) {
			return;
		}

		wp_safe_remote_post(
			$url,
			[
				'body'    => $body,
				'headers' => [
					'Content-Type' => 'application/json',
				],
			]
		);
	}
}