<?php
/**
 * Send and check codes for purposes other than signing in.
 *
 * @package Aslansheed\OTP
 */

namespace Aslansheed\OTP\Auth;

use Aslansheed\OTP\Channels\Dispatcher;
use Aslansheed\OTP\Core\Options;
use Aslansheed\OTP\Core\Request;
use Aslansheed\OTP\Security\Access_Control;
use Aslansheed\OTP\Security\Audit_Log;
use WP_Error;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Shared rate-limited send and verify steps, used by phone linking and the
 * checkout verification. Purposes keep these codes apart from sign-in codes.
 */
final class Code_Service {

	/**
	 * Parses a phone number using the default country.
	 *
	 * @param string $raw Raw input.
	 * @return string|WP_Error E.164 number.
	 */
	public static function parse_phone( $raw ) {
		$e164 = Phone_Normalizer::to_e164( (string) $raw, Access_Control::default_country() );

		if ( null === $e164 ) {
			return new WP_Error( 'aslansheed_invalid_identifier', __( 'Please enter a valid phone number, including the country code if it is not local.', 'aslansheed-login' ) );
		}

		return $e164;
	}

	/**
	 * Sends a code to a recipient.
	 *
	 * @param string $recipient E.164 number or email address.
	 * @param string $type      "phone" or "email".
	 * @param string $purpose   Purpose slug.
	 * @return array|WP_Error
	 */
	public static function send( $recipient, $type, $purpose ) {
		$access = Access_Control::check(
			array(
				'type'  => $type,
				'value' => $recipient,
			)
		);

		if ( is_wp_error( $access ) ) {
			return $access;
		}

		$ip      = Request::ip();
		$allowed = Rate_Limiter::check( Rate_Limiter::ACTION_SEND, $recipient, $ip );

		if ( is_wp_error( $allowed ) ) {
			return $allowed;
		}

		$issued = Otp_Manager::issue( $recipient, $purpose, '' );

		if ( is_wp_error( $issued ) ) {
			return $issued;
		}

		$sent = Dispatcher::send_code( $recipient, $type, $issued['code'], $purpose );

		Rate_Limiter::record( Rate_Limiter::ACTION_SEND, $recipient, $ip, $sent['success'] );

		if ( ! $sent['success'] ) {
			Otp_Manager::discard( $recipient, $purpose );

			return new WP_Error( 'aslansheed_delivery_failed', __( 'We could not send the code. Please try again in a moment or use another method.', 'aslansheed-login' ) );
		}

		Audit_Log::log(
			'otp_sent',
			array(
				'identifier' => 'phone' === $type ? Phone_Normalizer::mask( $recipient ) : $recipient,
				'context'    => array(
					'channel' => $sent['channel'],
					'purpose' => $purpose,
				),
			)
		);

		return array(
			'sent'      => true,
			'resend_in' => (int) Options::get( 'otp.resend_delay' ),
			'length'    => (int) Options::get( 'otp.length' ),
		);
	}

	/**
	 * Checks a code.
	 *
	 * @param string $recipient E.164 number or email address.
	 * @param string $purpose   Purpose slug.
	 * @param string $code      Code typed by the visitor.
	 * @return true|WP_Error
	 */
	public static function check( $recipient, $purpose, $code ) {
		$ip      = Request::ip();
		$allowed = Rate_Limiter::check( Rate_Limiter::ACTION_VERIFY, $recipient, $ip );

		if ( is_wp_error( $allowed ) ) {
			return $allowed;
		}

		$result = Otp_Manager::verify( $recipient, $purpose, preg_replace( '/\D+/', '', Phone_Normalizer::ascii_digits( (string) $code ) ) );

		if ( is_wp_error( $result ) ) {
			Rate_Limiter::record( Rate_Limiter::ACTION_VERIFY, $recipient, $ip, false );

			return $result;
		}

		Rate_Limiter::record( Rate_Limiter::ACTION_VERIFY, $recipient, $ip, true );
		Rate_Limiter::reset_failures( $recipient );

		return true;
	}
}