<?php
/**
 * Request to the site's own front end.
 *
 * @package Consentfold
 */

declare(strict_types=1);

namespace Consentfold\Scanner;

use WP_Error;

/**
 * The one way the plugin calls its own site (the scan's enqueue dump, docs/subsystems.md §5.6, and the home page
 * checks, §5.14): a short timeout, a capped response and, as core does for loopback requests, no certificate check
 * unless `https_local_ssl_verify` says so. A site that cannot reach itself (common in containers and behind some hosts)
 * gets an error back, which the callers treat as "could not check".
 */
final class Loopback {

	/**
	 * Seconds a request may take.
	 */
	public const TIMEOUT = 10;

	/**
	 * Most bytes of the answer that are read.
	 */
	public const MAX_RESPONSE = 4194304;

	/**
	 * Fetch an address of this site.
	 *
	 * @param string               $url  Address.
	 * @param array<string, mixed> $args Arguments for `wp_remote_get()` that replace the defaults.
	 * @return array<string, mixed>|WP_Error
	 */
	public static function get( string $url, array $args = array() ) {
		return wp_remote_get( // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.wp_remote_get_wp_remote_get -- Request to the site's own front page.
			$url,
			array_merge(
				array(
					'timeout'             => self::TIMEOUT,
					'redirection'         => 0,
					'limit_response_size' => self::MAX_RESPONSE,
					'sslverify'           => (bool) apply_filters( 'https_local_ssl_verify', false ), // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Core filter for loopback requests.
				),
				$args
			)
		);
	}
}