<?php
/**
 * WordPress HTTP transport for automation webhooks.
 *
 * @package Bookline
 */

declare( strict_types=1 );

namespace Bookline\Infrastructure\Automation;

use Bookline\Application\Automation\AutomationHttpClient;
use Bookline\Domain\Shared\DomainException;

/**
 * Times out; never follows file:// or javascript: URLs.
 *
 * @since 0.1.0
 */
final class WpRemoteAutomationHttp implements AutomationHttpClient {

	private const TIMEOUT = 10;

	/**
	 * {@inheritDoc}
	 *
	 * @param string                $method  Method.
	 * @param string                $url     URL.
	 * @param array<string, string> $headers Headers.
	 * @param string                $body    Body.
	 * @param int                   $timeout Timeout.
	 * @return array{status: int, body: string}
	 *
	 * @throws DomainException When the URL is rejected or the request fails.
	 */
	public function send( string $method, string $url, array $headers, string $body, int $timeout ): array {
		$seconds = $timeout > 0 ? $timeout : self::TIMEOUT;
		$safe    = function_exists( 'wp_http_validate_url' ) ? wp_http_validate_url( $url ) : $url;
		if ( ! is_string( $safe ) || '' === $safe ) {
			throw new DomainException( 'automation.webhook_url', 'The webhook URL is not allowed.' );
		}

		$response = wp_remote_request(
			$safe,
			[
				'method'  => strtoupper( $method ),
				'headers' => $headers,
				'body'    => $body,
				'timeout' => $seconds,
			]
		);
		if ( is_wp_error( $response ) ) {
			throw new DomainException( 'automation.webhook_failed', esc_html( $response->get_error_message() ) );
		}

		return [
			'status' => (int) wp_remote_retrieve_response_code( $response ),
			'body'   => (string) wp_remote_retrieve_body( $response ),
		];
	}
}