<?php
/**
 * Invitation Expiry Cron
 *
 * @package Albert
 * @subpackage Cron
 * @since      1.4.0
 */

namespace Albert\Cron;

defined( 'ABSPATH' ) || exit;

use Albert\Contracts\Interfaces\Hookable;
use Albert\Logging\Repository as LoggingRepository;
use Albert\OAuth\AllowedUsers;

/**
 * AllowedUserExpiry class
 *
 * Daily WP-Cron job that removes anyone from the allowed-users list whose
 * invitation has expired: added, never authorised, past the configured
 * window (docs/features/31-connections.md §5, "Invitation expiry").
 *
 * This is cleanup, not the security boundary. An expired invitation is
 * already refused live at {@see \Albert\OAuth\AllowedUsers::is_allowed()}
 * the moment somebody tries to use it, whether or not this has run since it
 * expired, the same way an expired OAuth token cannot be used regardless of
 * whether its cleanup job has run yet. This job exists only so the stored
 * list does not accumulate invitations nobody can act on any more, and so
 * the Connections screen and the Dashboard's Recent Activity reflect it.
 *
 * WP-Cron's own mechanics already give this two ways to actually run: a
 * front-end or admin page load past its scheduled time (core's normal
 * pseudo-cron), or a real system crontab hitting `wp-cron.php` directly on
 * sites that disable pseudo-cron (`DISABLE_WP_CRON`). Nothing extra to build
 * here for either.
 *
 * Somebody who *did* authorise at least once is never swept for this reason,
 * however long that connection lived or whatever happened to it since: the
 * invitation was exercised, that is what it was for. See
 * {@see \Albert\OAuth\AllowedUsers::mark_authorised()}.
 *
 * @since 1.4.0
 */
class AllowedUserExpiry implements Hookable {

	/**
	 * Cron hook name.
	 *
	 * @since 1.4.0
	 * @var string
	 */
	const HOOK = 'albert_sweep_allowed_users';

	/**
	 * Register WordPress hooks.
	 *
	 * @return void
	 * @since 1.4.0
	 */
	public function register_hooks(): void {
		add_action( self::HOOK, [ $this, 'run' ] );
	}

	/**
	 * Sweep the allowed-users list.
	 *
	 * @return void
	 * @since 1.4.0
	 */
	public function run(): void {
		try {
			$logging = new LoggingRepository();

			foreach ( AllowedUsers::ids() as $user_id ) {
				if ( ! AllowedUsers::has_expired_invitation( $user_id ) ) {
					continue;
				}

				AllowedUsers::remove( $user_id );

				// Every automatic removal is logged (docs/features/31-connections.md
				// §4/§5): "automatic" is fine, "silent" is not. Surfaces on the
				// Dashboard's Recent Activity via the shared ability log table.
				$logging->insert( 'albert/allowed-user-expired', $user_id, 'success' );
			}
		} catch ( \Throwable $e ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch
			// Never let a cron failure surface to the site.
		}
	}

	/**
	 * Schedule the daily sweep if not already scheduled.
	 *
	 * @return void
	 * @since 1.4.0
	 */
	public static function schedule(): void {
		if ( ! wp_next_scheduled( self::HOOK ) ) {
			wp_schedule_event( time() + HOUR_IN_SECONDS, 'daily', self::HOOK );
		}
	}

	/**
	 * Unschedule the daily sweep.
	 *
	 * @return void
	 * @since 1.4.0
	 */
	public static function unschedule(): void {
		$timestamp = wp_next_scheduled( self::HOOK );

		while ( $timestamp !== false ) {
			wp_unschedule_event( $timestamp, self::HOOK );
			$timestamp = wp_next_scheduled( self::HOOK );
		}
	}
}