<?php

namespace Akantio\Woo\Rest;

defined( 'ABSPATH' ) || exit;

/**
 * Opts this plugin's own REST routes into WooCommerce's native
 * consumer-key/secret REST API authentication (Basic Auth over HTTPS,
 * OAuth1.0a otherwise) via the extension point WooCommerce documents for
 * exactly this purpose — WC_REST_Authentication::is_request_to_rest_api()
 * only recognizes the wc/ namespace and wc-prefixed namespaces by default
 * ("Allow third party plugins use our authentication methods" is the
 * actual source comment on the filter it exposes). Without this hook,
 * consumer-key/secret credentials are never checked for these routes,
 * regardless of how valid they are.
 *
 * Covers this plugin's own akantio-pos/v1 namespace (the /orders endpoint)
 * plus the one core WordPress route the connect flow needs to resolve an
 * admin's email after authenticating — wp/v2/users/me — deliberately not a
 * blanket allowance for all of wp/v2.
 */
class NativeAuth {

	private const COVERED_SEGMENTS = [
		'akantio-pos/v1',
		'wp/v2/users/me',
	];

	public function register(): void {
		add_filter( 'woocommerce_rest_is_request_to_rest_api', [ $this, 'filterCallback' ] );
	}

	public function filterCallback( bool $isRestApiRequest ): bool {
		// Only ever used below in a strpos() containment check against a
		// fixed allow-list — never output or stored — but sanitize anyway
		// to satisfy static analysis and as defense in depth.
		$requestUri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';

		return $this->maybeAllow( $isRestApiRequest, $requestUri );
	}

	public function maybeAllow( bool $isRestApiRequest, string $requestUri ): bool {
		if ( $isRestApiRequest ) {
			return true;
		}

		return $this->isCoveredRequest( $requestUri );
	}

	public function isCoveredRequest( string $requestUri ): bool {
		foreach ( self::COVERED_SEGMENTS as $segment ) {
			if ( false !== strpos( $requestUri, $segment ) ) {
				return true;
			}
		}

		return false;
	}
}