<?php
/**
 * Setup wizard REST route.
 *
 * @package Consentfold
 */

declare(strict_types=1);

namespace Consentfold\Admin;

use WP_REST_Request;
use WP_REST_Response;
use WP_REST_Server;

/**
 * `consentfold/v1/admin/setup`: whether the Overview still offers the setup wizard (docs/subsystems.md §5.13).
 *
 * The state is one value per site: nothing stored means `pending`; `finished` is stored when the wizard was walked to
 * its end and `dismissed` when the site owner dropped the Overview's "Run setup" card. The wizard saves its choices
 * through the other admin routes, so this one holds nothing but that value. It is removed on uninstall.
 *
 * Only administrators pass the permission check; core verifies the REST nonce for cookie-authenticated requests and
 * treats a request without it as logged out.
 */
final class SetupRoute {

	public const NAMESPACE = 'consentfold/v1';
	public const ROUTE     = '/admin/setup';
	public const OPTION    = 'consentfold_setup';
	public const STATES    = array( 'finished', 'dismissed' );

	/**
	 * The state of the wizard on this site: `pending`, `finished` or `dismissed`.
	 */
	public static function state(): string {
		$state = get_option( self::OPTION, '' );

		return is_string( $state ) && in_array( $state, self::STATES, true ) ? $state : 'pending';
	}

	/**
	 * Hook the route.
	 */
	public function register(): void {
		add_action( 'rest_api_init', array( $this, 'register_route' ) );
	}

	/**
	 * Register the route.
	 */
	public function register_route(): void {
		register_rest_route(
			self::NAMESPACE,
			self::ROUTE,
			array(
				array(
					'methods'             => WP_REST_Server::READABLE,
					'callback'            => array( $this, 'get' ),
					'permission_callback' => array( $this, 'can_manage' ),
				),
				array(
					'methods'             => WP_REST_Server::EDITABLE,
					'callback'            => array( $this, 'save' ),
					'permission_callback' => array( $this, 'can_manage' ),
					'args'                => array(
						'state' => array(
							'type'     => 'string',
							'enum'     => self::STATES,
							'required' => true,
						),
					),
				),
			)
		);
	}

	/**
	 * Whether the current user may manage the plugin.
	 */
	public function can_manage(): bool {
		return current_user_can( Capabilities::MANAGE );
	}

	/**
	 * The state of the wizard.
	 */
	public function get(): WP_REST_Response {
		return new WP_REST_Response( array( 'state' => self::state() ) );
	}

	/**
	 * Mark the wizard finished or dismissed.
	 *
	 * @param WP_REST_Request $request Request whose `state` argument core has already checked against {@see self::STATES}.
	 */
	public function save( WP_REST_Request $request ): WP_REST_Response {
		update_option( self::OPTION, (string) $request['state'], false );

		return $this->get();
	}
}