<?php
/**
 * WhatsApp connection: status display and the "Connect WhatsApp" button.
 *
 * Meta's sign-in has to run on a CommercePing page (Meta only trusts those origins), so the button asks the backend,
 * with the usual signed request, for a short-lived single-use link and opens it in a new tab. The merchant finishes
 * there and returns here. This site never sees a Meta code, token or phone-number id.
 *
 * @package OrderPing
 */

defined( 'ABSPATH' ) || exit;

const ORDERPING_WHATSAPP_LINK_PATH   = '/woo/connect-link';
const ORDERPING_WHATSAPP_STATUS_PATH = '/woo/connect-status';

/**
 * Registers the admin-post handler.
 */
function orderping_whatsapp_register() {
	add_action( 'admin_post_orderping_connect_whatsapp', 'orderping_handle_connect_whatsapp' );
}

/**
 * Accepts only an absolute https URL with a host. Anything else is refused, so a bad or hostile response can never
 * send the merchant somewhere that is not a web address.
 *
 * @param mixed $url Candidate URL from the backend.
 * @return string|null The URL, or null.
 */
function orderping_whatsapp_safe_url( $url ) {
	if ( ! is_string( $url ) || '' === $url || strlen( $url ) > 2048 ) {
		return null;
	}
	$parts = wp_parse_url( $url );
	if ( ! is_array( $parts ) || ! isset( $parts['scheme'], $parts['host'] ) || 'https' !== strtolower( $parts['scheme'] ) ) {
		return null;
	}
	if ( isset( $parts['user'] ) || isset( $parts['pass'] ) ) {
		return null;
	}
	return $url;
}

/**
 * Maps a status response to what the page shows.
 *
 * @param array{status:int,body:array} $response Result of orderping_signed_post().
 * @return array{state:string,label:string,detail:string,css:string,can_connect:bool}
 */
function orderping_whatsapp_state( array $response ) {
	$body = $response['body'];
	if ( 200 !== (int) $response['status'] || ! isset( $body['state'] ) || ! is_string( $body['state'] ) ) {
		return array(
			'state'       => 'unknown',
			'label'       => __( 'Status unavailable', 'commerceping' ),
			'detail'      => __( 'CommercePing did not respond. Reload this page in a moment.', 'commerceping' ),
			'css'         => 'is-unknown',
			'can_connect' => true,
		);
	}
	if ( isset( $body['available'] ) && false === $body['available'] ) {
		return array(
			'state'       => 'unavailable',
			'label'       => __( 'Not available yet', 'commerceping' ),
			'detail'      => __( 'Connecting WhatsApp is not open yet. Nothing is needed from you.', 'commerceping' ),
			'css'         => 'is-unknown',
			'can_connect' => false,
		);
	}
	$last4 = isset( $body['last4'] ) && is_string( $body['last4'] ) && 1 === preg_match( '/^\d{1,4}$/', $body['last4'] ) ? $body['last4'] : '';
	switch ( $body['state'] ) {
		case 'ready':
			$detail = '' !== $last4
				/* translators: %s: last digits of the WhatsApp number. */
				? sprintf( __( 'Confirmations are sent from your WhatsApp number ending %s.', 'commerceping' ), $last4 )
				: __( 'Confirmations are sent from your WhatsApp number.', 'commerceping' );
			return array(
				'state'       => 'ready',
				'label'       => __( 'WhatsApp number linked', 'commerceping' ),
				'detail'      => $detail,
				'css'         => 'is-connected',
				'can_connect' => false,
			);
		case 'connecting':
			return array(
				'state'       => 'connecting',
				'label'       => __( 'Connecting', 'commerceping' ),
				'detail'      => __( 'Setting up your WhatsApp number. This page shows the result when it is done; reload it in a minute.', 'commerceping' ),
				'css'         => 'is-pending',
				'can_connect' => false,
			);
		case 'needs_attention':
			return array(
				'state'       => 'needs_attention',
				'label'       => __( 'Needs attention', 'commerceping' ),
				'detail'      => __( 'Connecting WhatsApp did not finish. Press Connect WhatsApp to try again.', 'commerceping' ),
				'css'         => 'is-problem',
				'can_connect' => true,
			);
		default:
			return array(
				'state'       => 'not_connected',
				'label'       => __( 'Not connected', 'commerceping' ),
				'detail'      => __( 'Connect your WhatsApp number so confirmations are sent from it.', 'commerceping' ),
				'css'         => 'is-unknown',
				'can_connect' => true,
			);
	}
}

/**
 * Asks the backend for a connect link and sends the browser to it. Admin only, nonce checked. The new tab is
 * opened by the link that points here (target=_blank), so this redirect lands in that tab.
 */
function orderping_handle_connect_whatsapp() {
	if ( ! current_user_can( 'manage_woocommerce' ) ) {
		wp_die( esc_html__( 'You do not have permission to do this.', 'commerceping' ), 403 );
	}
	check_admin_referer( 'orderping_connect_whatsapp' );
	$settings_page = admin_url( 'admin.php?page=orderping' );
	$response      = orderping_signed_post( ORDERPING_WHATSAPP_LINK_PATH, array( 'type' => 'connect_link' ) );
	$url           = 200 === (int) $response['status'] && isset( $response['body']['connect_url'] )
		? orderping_whatsapp_safe_url( $response['body']['connect_url'] )
		: null;
	if ( null === $url ) {
		$code = 503 === (int) $response['status'] ? 'whatsapp_unavailable' : 'whatsapp_link_failed';
		wp_safe_redirect( add_query_arg( 'orderping_notice', $code, $settings_page ) );
		exit;
	}
	// The link is on CommercePing's own host (returned over our signed channel), so the safe-redirect allow-list does not apply.
	// phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- CommercePing connect page, https only.
	wp_redirect( $url );
	exit;
}

/**
 * Fetches the WhatsApp connection state from the backend.
 *
 * @return array{state:string,label:string,detail:string,css:string,can_connect:bool}
 */
function orderping_whatsapp_current_state() {
	return orderping_whatsapp_state( orderping_signed_post( ORDERPING_WHATSAPP_STATUS_PATH, array( 'type' => 'connect_status' ) ) );
}

/**
 * Renders the WhatsApp status and button. Only called while the store is connected to CommercePing.
 *
 * @param array|null $state Result of orderping_whatsapp_current_state(); fetched here when omitted.
 */
function orderping_render_whatsapp( $state = null ) {
	if ( null === $state ) {
		$state = orderping_whatsapp_current_state();
	}
	?>
	<h2><?php esc_html_e( 'WhatsApp', 'commerceping' ); ?></h2>
	<p class="orderping-status" data-orderping-whatsapp="<?php echo esc_attr( $state['state'] ); ?>">
		<span class="orderping-badge <?php echo esc_attr( $state['css'] ); ?>"><?php echo esc_html( $state['label'] ); ?></span>
		<?php echo esc_html( $state['detail'] ); ?>
		<?php if ( 'connecting' === $state['state'] ) : ?>
			<a href="<?php echo esc_url( admin_url( 'admin.php?page=orderping' ) ); ?>"><?php esc_html_e( 'Check again', 'commerceping' ); ?></a>
		<?php endif; ?>
	</p>
	<?php if ( $state['can_connect'] ) : ?>
		<p>
			<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=orderping_connect_whatsapp' ), 'orderping_connect_whatsapp' ) ); ?>" target="_blank" rel="noopener">
				<?php esc_html_e( 'Connect WhatsApp', 'commerceping' ); ?>
			</a>
			<span class="description"><?php esc_html_e( 'Opens CommercePing in a new tab. Come back here when you are done.', 'commerceping' ); ?></span>
		</p>
	<?php endif; ?>
	<?php
}