<?php
/**
 * Credential challenge endpoint.
 *
 * AllAccessible issues this install's signing credential only after proving
 * the request came from the site that holds the install token. The flow:
 *
 *   1. On first need, ApiClient generates a random install token and stores
 *      it in wp_options (autoload off). It never leaves the site except in
 *      the credential request to app.allaccessible.org over TLS.
 *   2. ApiClient POSTs {accountID, siteUrl, installToken} to the credential
 *      endpoint.
 *   3. The server fetches GET {siteUrl}/?rest_route=/allaccessible/v1/challenge&nonce=N
 *      from this site and expects HMAC-SHA256(install_token, N).
 *   4. Only a caller holding the same token the site holds gets a credential.
 *
 * The route is public by design: the answer reveals nothing without the
 * token, the nonce is single-use on the server, and a stranger who calls it
 * learns only that the plugin is installed, which the widget already shows.
 *
 * @package AllAccessible
 * @since   2.2.0
 */

if (!defined('ABSPATH')) {
    exit;
}

class AllAccessible_CredentialChallenge {

    const NAMESPACE_V1 = 'allaccessible/v1';
    const ROUTE        = '/challenge';

    public static function register() {
        add_action('rest_api_init', array(__CLASS__, 'register_routes'));
    }

    public static function register_routes() {
        register_rest_route(self::NAMESPACE_V1, self::ROUTE, array(
            'methods'             => 'GET',
            'callback'            => array(__CLASS__, 'answer'),
            'permission_callback' => '__return_true',
            'args'                => array(
                'nonce' => array(
                    'required'          => true,
                    'type'              => 'string',
                    'validate_callback' => array(__CLASS__, 'is_valid_nonce'),
                    'sanitize_callback' => 'sanitize_text_field',
                ),
            ),
        ));
    }

    public static function is_valid_nonce($value) {
        return is_string($value) && (bool) preg_match('/^[a-f0-9]{16,128}$/', $value);
    }

    /**
     * @param WP_REST_Request $request
     * @return WP_REST_Response|WP_Error
     */
    public static function answer($request) {
        if (!class_exists('AllAccessible_ApiClient')) {
            return new WP_Error('aacb_not_ready', 'Plugin not fully loaded', array('status' => 503));
        }
        $token = AllAccessible_ApiClient::get_instance()->get_install_token(false);
        if (empty($token)) {
            // No token yet means this install has never asked for a credential;
            // there is nothing to prove ownership of.
            return new WP_Error('aacb_no_install_token', 'No credential request pending for this site', array('status' => 404));
        }

        $nonce    = (string) $request->get_param('nonce');
        $response = rest_ensure_response(array(
            'answer'  => hash_hmac('sha256', $nonce, $token),
            'version' => defined('AACB_VERSION') ? AACB_VERSION : 'unknown',
        ));
        $response->header('Cache-Control', 'no-store, max-age=0');
        $response->header('X-Robots-Tag', 'noindex');

        return $response;
    }
}