<?php
// SPDX-License-Identifier: GPL-3.0-or-later
declare(strict_types=1);

namespace Aiwend\Provider;

/**
 * Pre-flight check for the streaming provider transports.
 *
 * The transports send their requests with the WordPress HTTP API, which already applies the site's proxy settings, block list and
 * filters. This class only lets the transport refuse a request EARLIER and more precisely, as a "not dispatched" provider error, so no
 * usage is recorded as uncertain when nothing could have been sent:
 *  - WP_HTTP_BLOCK_EXTERNAL and WP_ACCESSIBLE_HOSTS (through WP_Http::block_request(), the check wp_remote_*() performs itself);
 *  - the site's `pre_http_request` filter (a site that intercepts or mocks HTTP would answer without a live stream: streaming is not possible);
 *  - the plugin's own `aiwend_streaming_enabled` filter, so an administrator or developer can switch streaming off.
 * It never relaxes anything: HTTPS only, certificate verification, no redirects, fixed provider hosts, timeouts and cancellation stay as
 * they are in the transports.
 */
final class NetworkPolicy
{
    /** @var callable(string): bool */
    private $isBlocked;
    /** @var callable(string): bool */
    private $streamingEnabled;
    /** @var callable(string): bool */
    private $intercepted;

    /**
     * @param callable(string): bool $isBlocked true when WP_HTTP_BLOCK_EXTERNAL / WP_ACCESSIBLE_HOSTS forbid the URL
     * @param callable(string): bool $streamingEnabled false when the plugin's filter turns streaming off
     * @param callable(string): bool $intercepted true when a pre_http_request filter wants to answer instead of the network
     */
    public function __construct(callable $isBlocked, callable $streamingEnabled, callable $intercepted)
    {
        $this->isBlocked = $isBlocked;
        $this->streamingEnabled = $streamingEnabled;
        $this->intercepted = $intercepted;
    }

    /** The policy wired to the running WordPress. */
    public static function forWordPress(): self
    {
        return new self(
            static fn(string $url): bool => class_exists('WP_Http') && (new \WP_Http())->block_request($url),
            static fn(string $url): bool => function_exists('apply_filters') ? (bool) apply_filters('aiwend_streaming_enabled', true, $url) : true,
            static function (string $url): bool {
                if (!function_exists('apply_filters')) {
                    return false;
                }
                // Same arguments shape as wp_remote_post() would pass, without headers or body (those hold the credential and the visitor's text).
                $args = ['method' => 'POST', 'redirection' => 0, 'blocking' => true, 'sslverify' => true, 'aiwend_streaming' => true];
                // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- WordPress core hook, not ours
                return apply_filters('pre_http_request', false, $args, $url) !== false;
            },
        );
    }

    /**
     * Refuses a request this site's rules do not allow.
     *
     * @throws ProviderException kind unavailable, never dispatched, no credentials in the message
     */
    public function prepare(string $url): void
    {
        if (!($this->streamingEnabled)($url)) {
            // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- exception messages go to logs and callers, never echoed; public errors are fixed codes
            throw new ProviderException(ProviderException::UNAVAILABLE, false, 'Streaming requests to the AI provider are switched off on this site.');
        }
        if (($this->isBlocked)($url) || ($this->intercepted)($url)) {
            // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- exception messages go to logs and callers, never echoed; public errors are fixed codes
            throw new ProviderException(ProviderException::UNAVAILABLE, false, 'This site\'s HTTP settings block requests to the AI provider. Allow the provider host in WP_ACCESSIBLE_HOSTS or lift WP_HTTP_BLOCK_EXTERNAL.');
        }
    }
}