<?php
// SPDX-License-Identifier: GPL-3.0-or-later
declare(strict_types=1);
namespace Aiwend\Knowledge;

use Aiwend\Provider\ProviderException;

final class OpenAiEmbeddingTransport implements EmbeddingTransport
{
    public function __construct(#[\SensitiveParameter] private string $secret) {}

    public function request(array $body): array
    {
        \Aiwend\Provider\OutboundGuard::assertAllowed();
        if ($this->secret === '' || strlen($this->secret) > 4096 || preg_match('/[^\x21-\x7e]/', $this->secret)) {
            // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- exception messages go to logs and callers, never echoed; public errors are fixed codes
            throw new ProviderException(ProviderException::AUTH, false, 'Invalid embedding credential.');
        }
        $response = wp_safe_remote_post('https://api.openai.com/v1/embeddings', [
            'timeout' => 30, 'redirection' => 0, 'sslverify' => true, 'limit_response_size' => 4_000_000,
            'headers' => ['Authorization' => 'Bearer ' . $this->secret, 'Content-Type' => 'application/json'],
            'body' => json_encode($body, JSON_THROW_ON_ERROR),
        ]);
        if (is_wp_error($response) || wp_remote_retrieve_response_code($response) !== 200) {
            // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- exception messages go to logs and callers, never echoed; public errors are fixed codes
            throw new ProviderException(ProviderException::UNAVAILABLE, true, 'Embedding request failed; usage may be uncertain.');
        }
        $data = json_decode(wp_remote_retrieve_body($response), true, 32);
        // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- exception messages go to logs and callers, never echoed; public errors are fixed codes
        if (!is_array($data)) { throw new ProviderException(ProviderException::UNAVAILABLE, true, 'Invalid embedding response.'); }
        return $data;
    }
}