<?php
/**
 * "Connect to 404 Emails" - connects this site without anyone copying an
 * API key (an OAuth-style hand-off with PKCE):
 *
 * 1. start_url(): a random `state` and a secret `verifier` are kept for this
 *    admin (a transient, 15 minutes), and the browser goes to 404 Emails'
 *    /connect/wordpress with the challenge (SHA-256 of the verifier).
 * 2. The person signs in there and clicks Allow; 404 Emails sends the
 *    browser back to this plugin's page with a one-time `code` and the `state`.
 * 3. complete(): the state must match, then the code + verifier are swapped
 *    server to server for this site's own API key, which is stored like a
 *    pasted one. The verifier never leaves this server, so a code seen in a
 *    browser history or log is useless on its own.
 *
 * @package Emails404
 */

namespace Emails404;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Connect {

	const TRANSIENT_PREFIX = 'emails404_connect_';
	const TTL_SECONDS      = 900;

	/** Outcomes complete() reports, shown as notices on the plugin page. */
	const RESULT_CONNECTED = 'connected';
	const RESULT_CANCELLED = 'cancelled';
	const RESULT_FAILED    = 'failed';
	const RESULT_EXPIRED   = 'expired';

	/**
	 * Starts connecting for the current admin and returns the 404 Emails
	 * address to send their browser to.
	 *
	 * @param string $return_url This plugin's admin page - where 404 Emails sends the browser back.
	 * @return string
	 */
	public static function start_url( $return_url ) {
		$platform_url = Settings::default_platform_url();
		$state        = self::random_token( 32 );
		$verifier     = self::random_token( 64 );

		set_transient(
			self::transient_key(),
			array(
				'state'        => $state,
				'verifier'     => $verifier,
				'platform_url' => $platform_url,
			),
			self::TTL_SECONDS
		);

		return $platform_url . '/connect/wordpress?' . http_build_query(
			array(
				'return'    => $return_url,
				'state'     => $state,
				'challenge' => self::challenge( $verifier ),
			),
			'',
			'&',
			PHP_QUERY_RFC3986
		);
	}

	/**
	 * Finishes connecting when 404 Emails sends the browser back.
	 *
	 * @param string      $state The `state` from the redirect.
	 * @param string|null $code  The one-time code, or null when the person cancelled.
	 * @return string One of the RESULT_* constants.
	 */
	public static function complete( $state, $code ) {
		$pending = get_transient( self::transient_key() );
		delete_transient( self::transient_key() );

		if ( ! is_array( $pending ) || empty( $pending['state'] ) || ! is_string( $state ) || ! hash_equals( (string) $pending['state'], $state ) ) {
			// Not a connection this admin started here (or it took too long).
			return self::RESULT_EXPIRED;
		}
		if ( null === $code || '' === $code ) {
			return self::RESULT_CANCELLED;
		}

		$response = Api_Client::exchange_connect_code( (string) $pending['platform_url'], (string) $code, (string) $pending['verifier'] );
		if ( ! $response->success || empty( $response->data['apiKey'] ) ) {
			return self::RESULT_FAILED;
		}

		// Connecting again (e.g. to give the site a new permission): the old key is no longer needed.
		if ( Settings::is_connected() ) {
			Api_Client::from_settings()->revoke_connection();
		}

		Settings::update_platform_url_raw( (string) $pending['platform_url'] );
		Settings::set_api_key( (string) $response->data['apiKey'] );
		Settings::set_workspace_name( isset( $response->data['workspaceName'] ) ? (string) $response->data['workspaceName'] : '' );
		Settings::set_connection_result( Settings::CONNECTION_CONNECTED );
		return self::RESULT_CONNECTED;
	}

	/**
	 * "Disconnect": revokes this site's key on 404 Emails (best effort) and
	 * forgets it here, keeping every other setting.
	 */
	public static function disconnect() {
		if ( Settings::is_connected() ) {
			Api_Client::from_settings()->revoke_connection();
		}
		Settings::clear_connection();
	}

	/** base64url(SHA-256(verifier)) - the PKCE S256 challenge. */
	public static function challenge( $verifier ) {
		return rtrim( strtr( base64_encode( hash( 'sha256', $verifier, true ) ), '+/', '-_' ), '=' );
	}

	/** Random URL-safe characters (A-Z a-z 0-9 - _). */
	public static function random_token( $length ) {
		$token = rtrim( strtr( base64_encode( random_bytes( (int) ceil( $length * 3 / 4 ) + 2 ) ), '+/', '-_' ), '=' );
		return substr( $token, 0, $length );
	}

	private static function transient_key() {
		return self::TRANSIENT_PREFIX . get_current_user_id();
	}
}