<?php

if (!defined('ABSPATH')) {
    exit;
}

/**
 * Server-side client for the BunStream read-only integration API.
 *
 * The key travels only from this server to the configured BunStream base URL,
 * in the Authorization header. Answers are cached in transients for five
 * minutes so an editor typing in the lesson search does not spend the key's
 * per-minute budget.
 */
class BunStream_Api
{
    const CACHE_TTL = 300;

    /**
     * GET an API path. Returns the decoded "data" (plus "meta" when present)
     * or a WP_Error with a message fit to show an editor.
     *
     * @param string $path  e.g. 'lessons'
     * @param array  $query query arguments
     * @param bool   $fresh skip the cache (connection test)
     * @return array|WP_Error
     */
    public static function get($path, array $query = array(), $fresh = false)
    {
        $key = (string) BunStream_Options::get('api_key');
        if ($key === '') {
            return new WP_Error('bunstream_no_key', __('لم يتم إدخال مفتاح الربط بعد. أدخله من الإعدادات ← BunStream.', 'bunstream'));
        }

        $url = BunStream_Options::api_base() . '/api/integration/v1/' . ltrim($path, '/');
        $query = array_filter($query, function ($v) {
            return $v !== null && $v !== '';
        });
        if ($query) {
            $url .= '?' . http_build_query($query, '', '&', PHP_QUERY_RFC3986);
        }

        // The cache key includes a hash of the key, so changing the key never
        // serves another account's cached answer.
        $cache_key = 'bunstream_' . md5($url . '|' . $key);
        if (!$fresh) {
            $cached = get_transient($cache_key);
            if (is_array($cached)) {
                return $cached;
            }
        }

        $response = wp_remote_get($url, array(
            'timeout' => 10,
            'redirection' => 0,
            'headers' => array(
                'Authorization' => 'Bearer ' . $key,
                'Accept' => 'application/json',
            ),
        ));

        if (is_wp_error($response)) {
            /* translators: %s: connection error */
            return new WP_Error('bunstream_http', sprintf(__('تعذّر الاتصال بـ BunStream: %s', 'bunstream'), $response->get_error_message()));
        }

        $code = (int) wp_remote_retrieve_response_code($response);
        $body = json_decode((string) wp_remote_retrieve_body($response), true);

        if ($code === 401) {
            return new WP_Error('bunstream_auth', __('المفتاح غير صحيح أو تم إلغاؤه. اعمل مفتاح WordPress جديد من صفحة «ربط المنصة» في BunStream.', 'bunstream'));
        }
        if ($code === 429) {
            return new WP_Error('bunstream_throttled', __('طلبات كثيرة في دقيقة واحدة. حاول بعد قليل.', 'bunstream'));
        }
        if ($code < 200 || $code >= 300 || !is_array($body) || empty($body['success'])) {
            $message = is_array($body) && !empty($body['message']) ? (string) $body['message'] : 'HTTP ' . $code;
            /* translators: %s: error message from the server */
            return new WP_Error('bunstream_api', sprintf(__('BunStream رجّع خطأ: %s', 'bunstream'), $message));
        }

        $result = array('data' => isset($body['data']) ? $body['data'] : array());
        if (isset($body['meta'])) {
            $result['meta'] = $body['meta'];
        }

        set_transient($cache_key, $result, self::CACHE_TTL);

        return $result;
    }

    /**
     * The account details, refreshed from the API, and remembered in an
     * option for the front end (which never calls the API).
     *
     * @return array|WP_Error
     */
    public static function refresh_account($fresh = false)
    {
        $result = self::get('account', array(), $fresh);
        if (is_wp_error($result)) {
            return $result;
        }

        $data = is_array($result['data']) ? $result['data'] : array();
        $account = array(
            'name' => isset($data['name']) ? sanitize_text_field($data['name']) : '',
            'require_signed_student_id' => !empty($data['require_signed_student_id']),
            'allowed_domains' => isset($data['allowed_domains']) && is_array($data['allowed_domains'])
                ? array_values(array_map('sanitize_text_field', $data['allowed_domains'])) : array(),
            'player_embed_base' => isset($data['player_embed_base']) ? esc_url_raw($data['player_embed_base']) : '',
            'checked_at' => time(),
        );
        update_option(BunStream_Options::ACCOUNT_OPTION, $account, false);

        return $account;
    }

    /** Drop every cached answer (after the key or base URL changes). */
    public static function flush_cache()
    {
        global $wpdb;
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- transients have no delete-by-prefix API.
        $wpdb->query($wpdb->prepare(
            "DELETE FROM {$wpdb->options} WHERE option_name LIKE %s OR option_name LIKE %s",
            $wpdb->esc_like('_transient_bunstream_') . '%',
            $wpdb->esc_like('_transient_timeout_bunstream_') . '%'
        ));
    }
}