<?php

namespace ChargeForms\Includes\Integrations;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Thin wrapper around the Google Sheets API v4, authenticated via a Google
 * Service Account (a JSON key file downloaded from Google Cloud Console)
 * rather than interactive OAuth. A self-hosted WordPress plugin has no
 * server to receive an OAuth redirect callback that Google itself will
 * trust with a shared client id across every install, and building a
 * hosted OAuth-proxy service is out of scope here — a service account is
 * Google's own documented server-to-server auth mechanism for exactly this
 * case: the site owner creates one in their Google Cloud project, downloads
 * its JSON key, and shares the target spreadsheet with the service
 * account's own email address (same as sharing a Doc with any other
 * "person"), no consent screen involved.
 */
class Google_Sheets_Client {

	const TOKEN_URL = 'https://oauth2.googleapis.com/token';
	const SCOPE      = 'https://www.googleapis.com/auth/spreadsheets';

	private static function base64url_encode( $data ) {
		return rtrim( strtr( base64_encode( $data ), '+/', '-_' ), '=' );
	}

	/**
	 * Parses the pasted service-account JSON and validates it has the two
	 * fields every downstream call needs — callers get one clear error up
	 * front instead of a confusing failure three requests later.
	 */
	private static function parse_credentials( $json ) {
		$creds = json_decode( (string) $json, true );
		if ( ! is_array( $creds ) || empty( $creds['client_email'] ) || empty( $creds['private_key'] ) ) {
			return new \WP_Error( 'chargeforms_sheets_bad_credentials', __( 'This does not look like a valid Google service account JSON key (missing client_email/private_key).', 'chargeforms' ) );
		}
		return $creds;
	}

	/**
	 * A signed, short-lived JWT exchanged for a bearer access token — the
	 * OAuth2 "JWT Bearer" server-to-server flow Google's own service-account
	 * docs describe. Cached via transient (keyed by the service account's
	 * own email, since a site only ever configures one) so a burst of
	 * submissions doesn't mint a fresh token — and therefore make an extra
	 * round trip to Google — on every single one.
	 */
	public static function access_token( $service_account_json ) {
		$creds = self::parse_credentials( $service_account_json );
		if ( is_wp_error( $creds ) ) {
			return $creds;
		}

		$cache_key = 'chargeforms_sheets_token_' . md5( $creds['client_email'] );
		$cached    = get_transient( $cache_key );
		if ( $cached ) {
			return $cached;
		}

		$now    = time();
		$header = self::base64url_encode( wp_json_encode( [ 'alg' => 'RS256', 'typ' => 'JWT' ] ) );
		$claims = self::base64url_encode( wp_json_encode( [
			'iss'   => $creds['client_email'],
			'scope' => self::SCOPE,
			'aud'   => self::TOKEN_URL,
			'iat'   => $now,
			'exp'   => $now + 3600,
		] ) );

		$signing_input = $header . '.' . $claims;
		$signature     = '';
		$key           = openssl_pkey_get_private( $creds['private_key'] );
		if ( ! $key || ! openssl_sign( $signing_input, $signature, $key, OPENSSL_ALGO_SHA256 ) ) {
			return new \WP_Error( 'chargeforms_sheets_bad_credentials', __( 'Could not sign a request with this service account\'s private key — the JSON key may be corrupted.', 'chargeforms' ) );
		}

		$jwt = $signing_input . '.' . self::base64url_encode( $signature );

		$response = wp_remote_post( self::TOKEN_URL, [
			'timeout' => 12,
			'body'    => [
				'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',
				'assertion'  => $jwt,
			],
		] );

		if ( is_wp_error( $response ) ) {
			return $response;
		}

		$code = wp_remote_retrieve_response_code( $response );
		$data = json_decode( wp_remote_retrieve_body( $response ), true );

		if ( $code >= 400 || empty( $data['access_token'] ) ) {
			$message = is_array( $data ) && ! empty( $data['error_description'] ) ? $data['error_description'] : __( 'Google rejected this service account (check that the Sheets API is enabled for this project).', 'chargeforms' );
			return new \WP_Error( 'chargeforms_sheets_auth_failed', $message, [ 'status' => $code ] );
		}

		// 60s safety margin so a token already mid-flight to Google never expires between the cache check and the actual API call.
		set_transient( $cache_key, $data['access_token'], max( 60, (int) ( $data['expires_in'] ?? 3600 ) - 60 ) );

		return $data['access_token'];
	}

	private static function request( $access_token, $method, $path, $body = null ) {
		$args = [
			'method'  => $method,
			'timeout' => 12,
			'headers' => [
				'Authorization' => 'Bearer ' . $access_token,
				'Content-Type'  => 'application/json',
			],
		];
		if ( null !== $body ) {
			$args['body'] = wp_json_encode( $body );
		}

		$response = wp_remote_request( 'https://sheets.googleapis.com/v4/spreadsheets' . $path, $args );

		if ( is_wp_error( $response ) ) {
			return $response;
		}

		$code = wp_remote_retrieve_response_code( $response );
		$data = json_decode( wp_remote_retrieve_body( $response ), true );

		if ( $code >= 400 ) {
			$message = is_array( $data ) && ! empty( $data['error']['message'] ) ? $data['error']['message'] : sprintf( /* translators: %d: HTTP status code */ __( 'Google Sheets returned an unexpected error (HTTP %d).', 'chargeforms' ), $code );
			return new \WP_Error( 'chargeforms_sheets_api_error', $message, [ 'status' => $code, 'body' => $data ] );
		}

		return is_array( $data ) ? $data : [];
	}

	/** Connection test — confirms the token works AND the spreadsheet is actually shared with this service account (a very common setup mistake: creating the account but forgetting to share the sheet). */
	public static function ping( $access_token, $spreadsheet_id ) {
		$result = self::request( $access_token, 'GET', '/' . rawurlencode( $spreadsheet_id ) . '?fields=spreadsheetId' );
		return is_wp_error( $result ) ? $result : true;
	}

	/** @return array<int, array>|\WP_Error Row arrays, or [] if the range is empty. */
	public static function get_values( $access_token, $spreadsheet_id, $range ) {
		$result = self::request( $access_token, 'GET', '/' . rawurlencode( $spreadsheet_id ) . '/values/' . rawurlencode( $range ) );
		if ( is_wp_error( $result ) ) {
			return $result;
		}
		return $result['values'] ?? [];
	}

	/** Overwrites the given range verbatim — used only to write the one-time header row, never submission data (which always goes through append_row()). */
	public static function update_values( $access_token, $spreadsheet_id, $range, array $rows ) {
		$result = self::request( $access_token, 'PUT', '/' . rawurlencode( $spreadsheet_id ) . '/values/' . rawurlencode( $range ) . '?valueInputOption=USER_ENTERED', [ 'values' => $rows ] );
		return is_wp_error( $result ) ? $result : true;
	}

	/** Appends after the last row with data in `$range`'s sheet — Sheets' own table-detection, not a row number ChargeForms has to track itself. */
	public static function append_row( $access_token, $spreadsheet_id, $range, array $row ) {
		$result = self::request( $access_token, 'POST', '/' . rawurlencode( $spreadsheet_id ) . '/values/' . rawurlencode( $range ) . ':append?valueInputOption=USER_ENTERED&insertDataOption=INSERT_ROWS', [ 'values' => [ $row ] ] );
		return is_wp_error( $result ) ? $result : true;
	}
}