<?php

namespace ChargeForms\Includes;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Public "Manage your subscription" link — the one a payer gets in their
 * payment receipt email (SubmissionHandler::send_payment_receipt()) for a
 * recurring payment. Not a REST route: this needs to end in a real browser
 * redirect to Stripe's hosted portal, which is exactly what admin-post.php
 * actions are for elsewhere in this codebase (see
 * Forms_List_Page::handle_preview() for the same admin-post-redirect
 * shape, gated by a nonce instead of Subscription's token since that one's
 * for a logged-in admin).
 *
 * Stripe-only for now — PayPal has no subscriptions support in this
 * codebase yet (Paypal_Gateway is one-time payments only), so a non-
 * Stripe subscription can't reach here in practice, but the gateway check
 * below fails closed rather than assuming.
 */
class Subscription_Portal {

	public static function boot() {
		add_action( 'admin_post_chargeforms_manage_subscription', [ __CLASS__, 'handle' ] );
		add_action( 'admin_post_nopriv_chargeforms_manage_subscription', [ __CLASS__, 'handle' ] );
	}

	public static function handle() {
		$id    = isset( $_GET['sub'] ) ? (int) $_GET['sub'] : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Subscription::verify_manage_token() below IS the auth check; a WP nonce isn't meaningful here since the visitor clicking this was never given a WP session/page load to embed one in.
		$token = isset( $_GET['token'] ) ? sanitize_text_field( wp_unslash( $_GET['token'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended

		if ( ! $id || ! $token || ! Subscription::verify_manage_token( $id, $token ) ) {
			wp_die( esc_html__( 'This link is invalid or has expired.', 'chargeforms' ), 403 );
		}

		$subscription = Subscription::get( $id );
		if ( ! $subscription || 'stripe' !== $subscription['gateway'] || empty( $subscription['gateway_customer_id'] ) ) {
			wp_die( esc_html__( 'This subscription could not be found.', 'chargeforms' ), 404 );
		}

		$portal_url = Stripe_Gateway::create_portal_session( $subscription['gateway_customer_id'], home_url( '/' ) );
		if ( is_wp_error( $portal_url ) ) {
			wp_die( esc_html__( 'Could not open the billing portal right now. Please try again shortly, or contact us if this keeps happening.', 'chargeforms' ), 502 );
		}

		// wp_safe_redirect() only allows same-host targets by default; Stripe's billing
		// portal is intentionally off-site, so its host needs a one-off allowance here.
		add_filter( 'allowed_redirect_hosts', function ( $hosts ) {
			$hosts[] = wp_parse_url( $portal_url, PHP_URL_HOST );
			return $hosts;
		} );
		wp_safe_redirect( esc_url_raw( $portal_url ) );
		exit;
	}

	/** Builds the stable link a receipt email embeds — verified fresh, server-side, only at the moment the payer actually clicks it (see Stripe_Gateway::create_portal_session()'s doc comment for why this is never pre-generated). */
	public static function manage_url( $subscription_id ) {
		return add_query_arg(
			[ 'action' => 'chargeforms_manage_subscription', 'sub' => (int) $subscription_id, 'token' => Subscription::sign_manage_token( $subscription_id ) ],
			admin_url( 'admin-post.php' )
		);
	}
}