<?php
/**
 * Scope of the CortexCommerce WooCommerce key.
 *
 * @package CortexCommerce
 */

namespace CortexCommerce\Rest;

use CortexCommerce\Settings\Options;

defined( 'ABSPATH' ) || exit;

/**
 * Limits the key this plugin minted to what CortexCommerce needs (spec §3 "Key scope", §4.3): reading products
 * with their variations, categories and tags, updating a product, and the plugin's own cortex/v1 routes.
 *
 * WooCommerce authenticates an admin-owned read_write key on every wc/v3 route. Before WooCommerce 11.1 it also
 * authenticated a key on ANY request whose URL merely contains "wp-json/wc/", including another REST namespace
 * or admin-ajax.php with that text in the query string. So the plugin enforces the scope itself, on every
 * supported WooCommerce version:
 * - at login (registered when the plugin file loads, so no early wp_get_current_user() call can cache the key's
 *   owner first), our key only logs its owner in on the REST front controller for an in-scope route. WooCommerce
 *   11.2.2 moved key authentication out of determine_current_user, into its rest_authentication_errors fallback
 *   once WordPress is dispatching a REST request, so the same rule runs again right after that fallback;
 * - at dispatch, a request presenting our key gets a 403 unless the route and method WordPress runs are allowed.
 * Our key is recognised exactly as WooCommerce looks keys up, whatever form it arrives in. Requests that don't
 * present our key (other keys, cookie logins) are never touched.
 */
final class KeyScope {

	const CORTEX_ROUTE = '#^/cortex/v1(?:/.*)?$#';

	/**
	 * Product routes the key may read. Case-sensitive on purpose: WordPress matches routes case-insensitively,
	 * so any other spelling fails closed.
	 */
	const PRODUCT_READ_ROUTE = '#^/wc/v3/products(?:/\d+(?:/variations(?:/\d+)?)?|/categories(?:/\d+)?|/tags(?:/\d+)?)?/?$#';

	/**
	 * The one route the key may write: updating a single product (PUT/PATCH wc/v3/products/{id}).
	 */
	const PRODUCT_WRITE_ROUTE = '#^/wc/v3/products/\d+/?$#';

	const READ_METHODS  = array( 'GET', 'HEAD', 'OPTIONS' );
	const WRITE_METHODS = array( 'PUT', 'PATCH' );

	/**
	 * Registers the dispatch check. The login check is added from cortexcommerce.php as soon as the plugin loads.
	 */
	public function register(): void {
		add_filter( 'rest_authentication_errors', array( self::class, 'limit_fallback_login' ), 11 );
		add_filter( 'rest_pre_dispatch', array( $this, 'limit_dispatch' ), 5, 3 );
	}

	/**
	 * Whether the key may run $method on $route (the route as WordPress dispatches it).
	 */
	public static function allows( string $route, string $method ): bool {
		$method = strtoupper( $method );
		if ( 1 === preg_match( self::CORTEX_ROUTE, $route ) ) {
			return true;
		}
		if ( in_array( $method, self::READ_METHODS, true ) ) {
			return 1 === preg_match( self::PRODUCT_READ_ROUTE, $route );
		}
		if ( in_array( $method, self::WRITE_METHODS, true ) ) {
			return 1 === preg_match( self::PRODUCT_WRITE_ROUTE, $route );
		}
		return false;
	}

	/**
	 * Whether $route is one the key may reach with at least one method (login time: the method is only final
	 * once WordPress applies any _method override, so the dispatch check decides the method).
	 */
	public static function route_in_scope( string $route ): bool {
		return 1 === preg_match( self::CORTEX_ROUTE, $route ) || 1 === preg_match( self::PRODUCT_READ_ROUTE, $route );
	}

	/**
	 * Runs after WooCommerce's key authentication (priority 15): our key never logs its owner in outside the
	 * REST front controller (admin-ajax.php, wp-login.php, cron…) or for a route out of scope.
	 *
	 * @param int|false $user_id The user resolved so far.
	 * @return int|false
	 */
	public static function limit_login( $user_id ) {
		if ( empty( $user_id ) || ! self::presented_key_is_ours() ) {
			return $user_id;
		}
		$front_controller = isset( $GLOBALS['pagenow'] ) && 'index.php' === $GLOBALS['pagenow'];
		return $front_controller && self::route_in_scope( RestModule::requested_route() ) ? $user_id : false;
	}

	/**
	 * The login rule again, for a key WooCommerce authenticated late: its authentication_fallback on
	 * rest_authentication_errors (priority 8 since WooCommerce 11.2.2, 10 before, when it rarely has anything left
	 * to do) logs the key's owner in without going through determine_current_user. Runs at 11, before WooCommerce
	 * reads its own verdict at 15: if the logged-in user got there with our key and the route is out of scope, the
	 * request carries on as nobody, and limit_dispatch() answers it with the 403.
	 *
	 * @param \WP_Error|null|bool $result The authentication result so far.
	 * @return \WP_Error|null|bool The same result.
	 */
	public static function limit_fallback_login( $result ) {
		if ( 0 !== get_current_user_id() && self::presented_key_is_ours() && ! self::route_in_scope( RestModule::requested_route() ) ) {
			wp_set_current_user( 0 );
		}
		return $result;
	}

	/**
	 * The authoritative check: the route and method WordPress is about to run, not what the URL looks like.
	 *
	 * @param mixed            $result  Response to short-circuit with, or an empty value to carry on.
	 * @param \WP_REST_Server  $server  Server instance.
	 * @param \WP_REST_Request $request The request being dispatched.
	 * @return mixed
	 */
	public function limit_dispatch( $result, $server, $request ) {
		// WordPress short-circuits on any non-empty value, so only an empty one means "carry on and dispatch".
		if ( ! empty( $result ) || ! self::presented_key_is_ours() || self::allows( $request->get_route(), $request->get_method() ) ) {
			return $result;
		}
		return new \WP_Error(
			'cortexcommerce_key_out_of_scope',
			__( 'The CortexCommerce key can only read products and update a product, and use the CortexCommerce endpoints.', 'cortexcommerce' ),
			array( 'status' => 403 )
		);
	}

	/**
	 * Whether this request presents the key the plugin minted, in any form WooCommerce accepts.
	 */
	public static function presented_key_is_ours(): bool {
		$presented = self::presented_consumer_keys();
		if ( array() === $presented || ! function_exists( 'wc_api_hash' ) ) {
			return false;
		}
		foreach ( array( Options::key_id(), Options::pending_key_id() ) as $key_id ) {
			$ours = self::key_hash( $key_id );
			if ( '' === $ours ) {
				continue;
			}
			foreach ( $presented as $consumer_key ) {
				// Exactly WooCommerce's own lookup: WC_REST_Authentication::get_user_data_by_consumer_key().
				if ( hash_equals( $ours, wc_api_hash( sanitize_text_field( $consumer_key ) ) ) ) {
					return true;
				}
			}
		}
		return false;
	}

	/**
	 * Every consumer key the request presents, in every form WooCommerce reads one from: the consumer_key query
	 * arg, HTTP basic auth, and OAuth 1.0a (query, body or Authorization header, parsed by WooCommerce itself).
	 * A superset is safe: these are only ever hashed and compared with our key, never stored or output.
	 *
	 * @return array<int, string>
	 */
	private static function presented_consumer_keys(): array {
		// phpcs:disable WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput -- credentials are only hashed and compared (after WooCommerce's own sanitize_text_field), never stored or output.
		$candidates = array(
			isset( $_GET['consumer_key'] ) ? $_GET['consumer_key'] : null,
			isset( $_SERVER['PHP_AUTH_USER'] ) ? $_SERVER['PHP_AUTH_USER'] : null,
		);
		// phpcs:enable

		$wc_auth = self::woocommerce_authentication();
		if ( null !== $wc_auth ) {
			$oauth = $wc_auth->get_oauth_parameters();
			if ( is_array( $oauth ) && isset( $oauth['oauth_consumer_key'] ) ) {
				$candidates[] = $oauth['oauth_consumer_key'];
			}
			$header = (string) $wc_auth->get_authorization_header();
			if ( 1 === preg_match( '/^\s*Basic\s+(\S+)/i', $header, $match ) ) {
				// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- decoding HTTP Basic credentials.
				$decoded = base64_decode( $match[1], true );
				if ( false !== $decoded && false !== strpos( $decoded, ':' ) ) {
					$candidates[] = (string) strstr( $decoded, ':', true );
				}
			}
		}

		$keys = array();
		foreach ( $candidates as $candidate ) {
			if ( is_string( $candidate ) && '' !== $candidate ) {
				$keys[] = $candidate;
				$keys[] = wp_unslash( $candidate );
			}
		}
		return array_values( array_unique( $keys ) );
	}

	/**
	 * WooCommerce's own authenticator, used only for its public, side-effect-free parsers. Built without its
	 * constructor, which would register a second copy of WooCommerce's authentication filters.
	 */
	private static function woocommerce_authentication(): ?\WC_REST_Authentication {
		static $instance = null;
		if ( null === $instance && class_exists( 'WC_REST_Authentication' ) ) {
			$instance = ( new \ReflectionClass( 'WC_REST_Authentication' ) )->newInstanceWithoutConstructor();
		}
		return $instance;
	}

	/**
	 * The stored hash of a key's consumer key, or "" when there is no such key. Looked up once per key per request.
	 */
	private static function key_hash( int $key_id ): string {
		static $hashes = array();
		if ( $key_id <= 0 ) {
			return '';
		}
		if ( ! isset( $hashes[ $key_id ] ) ) {
			global $wpdb;
			// By id alone: an admin may rename the key in WooCommerce's settings, and it must stay in scope.
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- WooCommerce's keys table has no API; runs only when a request presents a consumer key, then memoised.
			$hash              = $wpdb->get_var( $wpdb->prepare( "SELECT consumer_key FROM {$wpdb->prefix}woocommerce_api_keys WHERE key_id = %d", $key_id ) );
			$hashes[ $key_id ] = is_string( $hash ) ? $hash : '';
		}
		return $hashes[ $key_id ];
	}
}