<?php
/**
 * Server-to-server client for the WordPress connection and management API.
 *
 * @package Akintu
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Sends bounded server-to-server requests to Akintu.
 */
final class Akintu_Api_Client {
	const DEFAULT_API_URL = 'https://api.akintu.io';

	/**
	 * Create a connection attempt.
	 *
	 * @param array<string, string> $payload Hashed connection material.
	 * @return array<string, mixed>|WP_Error
	 */
	public function create_connection( array $payload ) {
		return $this->request(
			'POST',
			'/api/wordpress/connections',
			array( 'body' => wp_json_encode( $payload ) )
		);
	}

	/**
	 * Read the current connection state.
	 *
	 * @param string $connection_id Connection UUID.
	 * @param string $secret        Connection secret.
	 * @return array<string, mixed>|WP_Error
	 */
	public function get_connection( $connection_id, $secret ) {
		return $this->request(
			'GET',
			'/api/wordpress/connections/' . rawurlencode( $connection_id ),
			array(
				'headers' => array(
					'X-Akintu-Connection-Secret' => $secret,
				),
			)
		);
	}

	/**
	 * Ask Akintu to verify the marker emitted by WordPress.
	 *
	 * @param string $connection_id Connection UUID.
	 * @param string $secret        Connection secret.
	 * @return array<string, mixed>|WP_Error
	 */
	public function request_verification( $connection_id, $secret ) {
		return $this->request(
			'POST',
			'/api/wordpress/connections/' . rawurlencode( $connection_id ) . '/verify',
			array(
				'headers' => array(
					'X-Akintu-Connection-Secret' => $secret,
				),
				'body'    => '{}',
			)
		);
	}

	/**
	 * Revoke the key owned by this installation.
	 *
	 * @param string $connection_id  Connection UUID.
	 * @param string $management_key Management token.
	 * @return true|WP_Error
	 */
	public function disconnect( $connection_id, $management_key ) {
		$result = $this->request(
			'DELETE',
			'/api/wordpress/connections/' . rawurlencode( $connection_id ),
			array(
				'headers' => array(
					'X-Akintu-Management-Token' => $management_key,
				),
			)
		);
		return is_wp_error( $result ) ? $result : true;
	}

	/**
	 * Perform one delegated management request without exposing its token.
	 *
	 * @param string               $method        HTTP method.
	 * @param string               $path          Allowlisted management path.
	 * @param string               $connection_id Installation UUID.
	 * @param string               $management    Local management token.
	 * @param array<string, mixed> $body          Optional JSON body.
	 * @param bool                 $raw           Whether to return an unparsed body.
	 * @return array<string, mixed>|WP_Error
	 */
	public function management_request( $method, $path, $connection_id, $management, array $body = array(), $raw = false ) {
		$options = array(
			'headers' => array(
				'X-Akintu-Management-Token' => $management,
			),
			'raw'     => $raw,
		);
		if ( ! empty( $body ) ) {
			$options['body'] = wp_json_encode( $body );
		}
		return $this->request(
			$method,
			'/api/wordpress/connections/' . rawurlencode( $connection_id ) . '/manage' . $path,
			$options
		);
	}

	/**
	 * Execute one request with bounded time and normalized failures.
	 *
	 * @param string               $method  HTTP method.
	 * @param string               $path    API path.
	 * @param array<string, mixed> $options Request overrides.
	 * @return array<string, mixed>|WP_Error
	 */
	private function request( $method, $path, array $options = array() ) {
		$api_url           = untrailingslashit(
			(string) apply_filters( 'akintu_api_url', self::DEFAULT_API_URL )
		);
		$headers           = isset( $options['headers'] ) && is_array( $options['headers'] )
			? $options['headers']
			: array();
		$headers['Accept'] = ! empty( $options['raw'] ) ? 'text/csv' : 'application/json';
		if ( isset( $options['body'] ) ) {
			$headers['Content-Type'] = 'application/json';
		}
		$response = wp_remote_request(
			$api_url . $path,
			array(
				'method'      => $method,
				'timeout'     => 20,
				'redirection' => 0,
				'headers'     => $headers,
				'body'        => isset( $options['body'] ) ? $options['body'] : null,
			)
		);
		if ( is_wp_error( $response ) ) {
			return $response;
		}
		$status = wp_remote_retrieve_response_code( $response );
		if ( 204 === $status ) {
			return array();
		}
		$response_body = wp_remote_retrieve_body( $response );
		$payload       = json_decode( $response_body, true );
		if ( $status < 200 || $status >= 300 ) {
			$code    = is_array( $payload ) && isset( $payload['error'] )
				? sanitize_key( $payload['error'] )
				: 'akintu_api_error';
			$message = is_array( $payload ) && isset( $payload['message'] )
				? sanitize_text_field( $payload['message'] )
				: __( 'Akintu did not complete the request.', 'akintu' );
			$error   = new WP_Error( $code, $message );
			$error->add_data( array( 'status' => $status ) );
			return $error;
		}
		if ( ! empty( $options['raw'] ) ) {
			return array( 'raw' => $response_body );
		}
		if ( ! is_array( $payload ) ) {
			return new WP_Error(
				'akintu_invalid_response',
				__( 'Akintu returned an invalid response.', 'akintu' )
			);
		}
		return $payload;
	}
}