<?php

namespace ChargeForms\Includes;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Minimal PayPal REST API client (Orders v2) — no SDK dependency, same
 * "plain wp_remote_* is enough" reasoning as Stripe_Gateway. PayPal's real
 * flow is NOT a drop-in replacement for Stripe's: Stripe confirms a charge
 * client-side (card details go straight to Stripe's iframe, the server only
 * ever sees a PaymentIntent id); PayPal instead has the buyer approve an
 * Order via a PayPal-hosted button/popup, and the actual charge only
 * happens when the SERVER captures that order afterward. That's why this
 * class exposes create_order()/capture_order() rather than
 * create_intent()/retrieve_intent() — the two-step "confirm, then verify"
 * shape doesn't apply the same way, capture IS the verification. See
 * SubmissionHandler::verify_payment()'s paypal branch for the full
 * anti-tampering sequence (recompute total server-side, compare against
 * what was actually captured, confirm the form id round-trips via
 * custom_id, anti-replay on the transaction id).
 */
class Paypal_Gateway {

	const LIVE_BASE    = 'https://api-m.paypal.com';
	const SANDBOX_BASE = 'https://api-m.sandbox.paypal.com';

	/** A little under PayPal's own access-token lifetime (typically 32400s/9h) so a cached token is never used right up to the edge of expiry. */
	const TOKEN_CACHE_MARGIN = 60;

	public static function is_configured() {
		return (bool) Settings::get( 'paypal_client_id' ) && (bool) Settings::get( 'paypal_client_secret' );
	}

	private static function api_base() {
		return 'live' === Settings::get( 'paypal_mode', 'sandbox' ) ? self::LIVE_BASE : self::SANDBOX_BASE;
	}

	/**
	 * PayPal's Orders API needs a Bearer token (unlike Stripe's plain secret-
	 * key Basic auth) — fetched via OAuth2 client-credentials and cached in a
	 * transient (keyed by mode, so a sandbox token and a live token never
	 * collide if an admin flips modes) rather than requested on every single
	 * API call.
	 */
	private static function get_access_token() {
		$mode          = Settings::get( 'paypal_mode', 'sandbox' );
		$transient_key = 'chargeforms_paypal_token_' . $mode;
		$cached        = get_transient( $transient_key );
		if ( $cached ) {
			return $cached;
		}

		$client_id = Settings::get( 'paypal_client_id' );
		$secret    = Settings::get( 'paypal_client_secret' );
		if ( ! $client_id || ! $secret ) {
			return new \WP_Error( 'chargeforms_paypal_not_configured', __( 'Payments are not configured for this site.', 'chargeforms' ) );
		}

		$response = wp_remote_post( self::api_base() . '/v1/oauth2/token', [
			'headers' => [
				'Authorization' => 'Basic ' . base64_encode( $client_id . ':' . $secret ),
				'Content-Type'  => 'application/x-www-form-urlencoded',
			],
			'body'    => [ 'grant_type' => 'client_credentials' ],
			'timeout' => 15,
		] );

		if ( is_wp_error( $response ) ) {
			return new \WP_Error( 'chargeforms_paypal_unreachable', __( 'Could not reach PayPal. Please try again.', 'chargeforms' ) );
		}

		$body = json_decode( wp_remote_retrieve_body( $response ), true );
		if ( empty( $body['access_token'] ) ) {
			return new \WP_Error( 'chargeforms_paypal_error', $body['error_description'] ?? __( 'PayPal rejected the authentication request.', 'chargeforms' ) );
		}

		$ttl = max( 60, (int) ( $body['expires_in'] ?? 3600 ) - self::TOKEN_CACHE_MARGIN );
		set_transient( $transient_key, $body['access_token'], $ttl );

		return $body['access_token'];
	}

	/**
	 * `$metadata['chargeforms_form_id']` is carried as `custom_id` on the
	 * purchase unit — PayPal's equivalent of Stripe's `metadata.chargeforms_form_id`,
	 * checked again after capture so a captured order can't be replayed
	 * against a different form.
	 */
	public static function create_order( $amount_decimal, $currency, array $metadata = [] ) {
		$token = self::get_access_token();
		if ( is_wp_error( $token ) ) {
			return $token;
		}

		$body = [
			'intent'         => 'CAPTURE',
			'purchase_units' => [
				[
					'custom_id' => (string) ( $metadata['chargeforms_form_id'] ?? '' ),
					'amount'    => [
						'currency_code' => strtoupper( $currency ),
						'value'         => number_format( (float) $amount_decimal, 2, '.', '' ),
					],
				],
			],
		];

		$response = wp_remote_post( self::api_base() . '/v2/checkout/orders', [
			'headers' => [
				'Authorization' => 'Bearer ' . $token,
				'Content-Type'  => 'application/json',
			],
			'body'    => wp_json_encode( $body ),
			'timeout' => 15,
		] );

		return self::parse_response( $response );
	}

	public static function capture_order( $order_id ) {
		$token = self::get_access_token();
		if ( is_wp_error( $token ) ) {
			return $token;
		}

		$response = wp_remote_post( self::api_base() . '/v2/checkout/orders/' . rawurlencode( $order_id ) . '/capture', [
			'headers' => [
				'Authorization' => 'Bearer ' . $token,
				'Content-Type'  => 'application/json',
			],
			'timeout' => 15,
		] );

		return self::parse_response( $response );
	}

	private static function parse_response( $response ) {
		if ( is_wp_error( $response ) ) {
			return new \WP_Error( 'chargeforms_paypal_unreachable', __( 'Could not reach PayPal. Please try again.', 'chargeforms' ) );
		}

		$body = json_decode( wp_remote_retrieve_body( $response ), true );

		if ( ! empty( $body['name'] ) && ! empty( $body['details'] ) ) {
			// PayPal's error shape: { name, message, details: [{issue, description}] }.
			$detail = $body['details'][0]['description'] ?? ( $body['message'] ?? __( 'PayPal rejected the request.', 'chargeforms' ) );
			return new \WP_Error( 'chargeforms_paypal_error', $detail );
		}

		return is_array( $body ) ? $body : new \WP_Error( 'chargeforms_paypal_error', __( 'Unexpected response from PayPal.', 'chargeforms' ) );
	}

	/** Thin delegate onto Commerce_Calculator — see Stripe_Gateway::calculate_total()'s matching comment. */
	public static function calculate_total( array $form, array $submitted_values ) {
		return Commerce_Calculator::calculate_total( $form, $submitted_values );
	}
}