<?php
/**
 * GET/POST cortex/v1/sync.
 *
 * @package CortexCommerce
 */

namespace CortexCommerce\Rest;

use CortexCommerce\Sync\SyncRun;
use CortexCommerce\Sync\SyncState;

defined( 'ABSPATH' ) || exit;

/**
 * The Sync screen's data (spec §3.3): GET reads the run state, POST is the Sync now button. Only for a logged-in shop
 * manager on the admin screen: the REST nonce is required here, so the CortexCommerce key (which KeyScope lets reach
 * cortex/v1, and which never carries a nonce) cannot start a run.
 */
final class SyncController {

	public function register_routes(): void {
		register_rest_route(
			RestModule::NAMESPACE,
			'/sync',
			array(
				array(
					'methods'             => 'GET',
					'callback'            => array( $this, 'get' ),
					'permission_callback' => array( self::class, 'permission' ),
				),
				array(
					'methods'             => 'POST',
					'callback'            => array( $this, 'post' ),
					'permission_callback' => array( self::class, 'permission' ),
				),
			)
		);
	}

	/**
	 * @return true|\WP_Error
	 */
	public static function permission( \WP_REST_Request $request ) {
		$nonce = (string) $request->get_header( 'X-WP-Nonce' );
		if ( '' === $nonce || false === wp_verify_nonce( $nonce, 'wp_rest' ) ) {
			return new \WP_Error(
				'cortexcommerce_rest_forbidden',
				__( 'Sorry, you are not allowed to do that.', 'cortexcommerce' ),
				array( 'status' => 403 )
			);
		}
		return RestModule::require_manage_woocommerce();
	}

	public function get(): \WP_REST_Response {
		return new \WP_REST_Response( SyncState::read() );
	}

	public function post(): \WP_REST_Response {
		$result = SyncRun::start( 'button' );
		return new \WP_REST_Response(
			array(
				'result' => $result,
				'state'  => SyncState::read(),
			)
		);
	}
}