<?php
/**
 * `GET /wp-json/activity-log/v1/chain`: the last verification's verdict.
 *
 * @package ActivityLog404
 */

namespace ActivityLog404\Rest;

use ActivityLog404\Chain\Key;
use ActivityLog404\Chain\Verifier;
use WP_Error;
use WP_REST_Response;
use WP_REST_Server;

defined( 'ABSPATH' ) || exit;

/**
 * Read-only, administrators only (`manage_options`, as the events route).
 * It reports; it never starts a verification or restarts the chain, because
 * a GET that does work is a request an attacker's cross-site page can fire.
 * Monitoring reads this (or `wp activity-log chain verify`, whose exit status
 * carries the verdict) after the daily run.
 *
 * Finding objects carry a kind and a row id, never a row's content.
 */
final class ChainController {

	/** The route, under EventsController::NAMESPACE. */
	public const ROUTE = '/chain';

	public static function register_hooks(): void {
		add_action( 'rest_api_init', array( __CLASS__, 'register_routes' ) );
	}

	public static function register_routes(): void {
		register_rest_route(
			EventsController::NAMESPACE,
			self::ROUTE,
			array(
				array(
					'methods'             => WP_REST_Server::READABLE,
					'callback'            => array( __CLASS__, 'read' ),
					'permission_callback' => array( __CLASS__, 'permission' ),
				),
			)
		);
	}

	/**
	 * @return true|WP_Error
	 */
	public static function permission() {
		if ( current_user_can( 'manage_options' ) ) {
			return true;
		}

		return new WP_Error(
			'rest_forbidden',
			__( 'Sorry, you are not allowed to read the log verification.', '404ops-activity-log' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	/** The verdict, or `never_verified`. */
	public static function read(): WP_REST_Response {
		$last = Verifier::last();

		return new WP_REST_Response(
			array(
				'verdict'       => (string) ( $last['verdict'] ?? 'never_verified' ),
				'running'       => Verifier::running(),
				'finished'      => isset( $last['finished'] ) ? gmdate( 'c', (int) $last['finished'] ) : null,
				'rows'          => (int) ( $last['rows'] ?? 0 ),
				'sealed'        => (int) ( $last['sealed'] ?? 0 ),
				'redacted'      => (int) ( $last['redacted'] ?? 0 ),
				'unsealed'      => (int) ( $last['unsealed'] ?? 0 ),
				'imported'      => (int) ( $last['imported'] ?? 0 ),
				'counts'        => (object) ( $last['counts'] ?? array() ),
				'findings'      => array_values( (array) ( $last['findings'] ?? array() ) ),
				'config_backed' => Key::config_backed(),
			)
		);
	}
}