<?php
/**
 * Builds permission_callback closures from the capabilities map.
 *
 * @package Bookline
 */

declare( strict_types=1 );

namespace Bookline\Presentation\Rest;

use Bookline\Application\Auth\AccessScope;
use Bookline\Application\Auth\AccessScopeFactory;
use Bookline\Application\Manage\CustomerSessionService;
use Bookline\Application\Rest\RateLimiter;
use Bookline\Presentation\CommercialRuntime;
use WP_Error;
use WP_REST_Request;

/**
 * Authorisation helpers for REST routes (docs/07 §1 / §5a / §7).
 *
 * @since 0.1.0
 */
final class PermissionGate {

	/**
	 * Constructor.
	 *
	 * @param RateLimiter                 $rate_limiter Rate limiter.
	 * @param AccessScopeFactory          $scopes       Access scope factory.
	 * @param CustomerSessionService|null $customers    Customer session service.
	 */
	public function __construct(
		private readonly RateLimiter $rate_limiter,
		private readonly AccessScopeFactory $scopes,
		private readonly ?CustomerSessionService $customers = null,
	) {}

	/**
	 * Build a permission_callback for a route id.
	 *
	 * @param string $route_id Route identifier.
	 * @return callable(WP_REST_Request): (bool|WP_Error)
	 *
	 * @since 0.1.0
	 */
	public function callback_for( string $route_id ): callable {
		$entry = CapabilitiesMap::require( $route_id );

		return function ( WP_REST_Request $request ) use ( $entry ) {
			// Rate limiting temporarily disabled per ops request — see commit
			// message. The limiter and the `too_many()` helper below remain in
			// place so the throttle can be restored without rework.
			//
			// $rate_key = isset( $entry['rate_limit'] ) && is_string( $entry['rate_limit'] )
			// 	? $entry['rate_limit']
			// 	: null;
			//
			// if ( null !== $rate_key ) {
			// 	if ( 'manage_request_link' === $rate_key ) {
			// 		if ( ! $this->rate_limiter->attempt( $rate_key, $this->client_ip(), null ) ) {
			// 			return $this->too_many();
			// 		}
			// 		$email = $request->get_param( 'email' );
			// 		if ( is_string( $email ) && '' !== $email
			// 			&& ! $this->rate_limiter->attempt( $rate_key, 'address', $email ) ) {
			// 			return $this->too_many();
			// 		}
			// 	} else {
			// 		$extra = null;
			// 		if ( 'coupon_validate' === $rate_key ) {
			// 			$token = $request->get_param( 'token' );
			// 			$extra = is_string( $token ) ? $token : null;
			// 		}
			// 		if ( ! $this->rate_limiter->attempt( $rate_key, $this->client_ip(), $extra ) ) {
			// 			return $this->too_many();
			// 		}
			// 	}
			// }

			if ( ! CommercialRuntime::is_operational() ) {
				return new WP_Error(
					'bookline_unavailable',
					__( 'Booking is unavailable.', 'buildler' ),
					[ 'status' => 403 ]
				);
			}

			if ( ! empty( $entry['public'] ) ) {
				return true;
			}

			$scope = isset( $entry['scope'] ) && is_string( $entry['scope'] ) ? $entry['scope'] : 'global';
			if ( 'customer' === $scope ) {
				return $this->customer_ok( $request );
			}

			$cap = isset( $entry['cap'] ) && is_string( $entry['cap'] ) ? $entry['cap'] : null;
			if ( null === $cap || '' === $cap ) {
				return new WP_Error(
					'bookline_forbidden',
					__( 'You do not have permission to access this resource.', 'buildler' ),
					[ 'status' => 403 ]
				);
			}

			if ( ! current_user_can( $cap ) ) {
				return new WP_Error(
					'bookline_forbidden',
					__( 'You do not have permission to access this resource.', 'buildler' ),
					[ 'status' => 403 ]
				);
			}

			return true;
		};
	}

	/**
	 * AccessScope for the current WordPress user.
	 *
	 * @since 0.1.0
	 */
	public function current_scope(): AccessScope {
		$user_id = get_current_user_id();
		return $this->scopes->for_user(
			$user_id,
			static function ( string $cap ): bool {
				return current_user_can( $cap );
			}
		);
	}

	/**
	 * Customer session check.
	 *
	 * @param WP_REST_Request $request Request.
	 * @return bool|WP_Error
	 */
	private function customer_ok( WP_REST_Request $request ): bool|WP_Error {
		if ( null === $this->customers ) {
			return new WP_Error(
				'bookline_forbidden',
				__( 'Customer session is not available.', 'buildler' ),
				[ 'status' => 403 ]
			);
		}
		$header = $request->get_header( 'x_bookline_customer_session' );
		if ( ! is_string( $header ) || '' === $header ) {
			$header = $request->get_header( 'X-Bookline-Customer-Session' );
		}
		if ( ! is_string( $header ) || ! $this->customers->is_valid_session( $header ) ) {
			return new WP_Error(
				'bookline_customer_session',
				__( 'A valid customer session is required.', 'buildler' ),
				[ 'status' => 401 ]
			);
		}
		return true;
	}

	/**
	 * 429 response error.
	 */
	private function too_many(): WP_Error {
		$retry = $this->rate_limiter->retry_after();
		return new WP_Error(
			'bookline_rate_limited',
			__( 'Too many requests. Please try again later.', 'buildler' ),
			[
				'status'      => 429,
				'retry_after' => $retry,
			]
		);
	}

	/**
	 * Best-effort client IP (hashed by the limiter, never logged here).
	 */
	private function client_ip(): string {
		$ip = '';
		if ( isset( $_SERVER['REMOTE_ADDR'] ) && is_string( $_SERVER['REMOTE_ADDR'] ) ) {
			$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
		}
		return '' !== $ip ? $ip : '0.0.0.0';
	}
}