<?php
/**
 * Connection state and the server-to-server Coverground client. The token is
 * a read-only credential scoped to the connected subscriber's published
 * routes (ability site:read); it lives in the options table like any API key.
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/** App origin (consent screen + code exchange). Filterable for dev setups. */
function coverground_app_origin(): string {
	return untrailingslashit( apply_filters( 'coverground_app_origin', 'https://app.coverground.eu' ) );
}

/** API origin (the connected /site endpoints). Filterable for dev setups. */
function coverground_api_origin(): string {
	return untrailingslashit( apply_filters( 'coverground_api_origin', 'https://api.coverground.eu' ) );
}

function coverground_is_connected(): bool {
	return (string) get_option( 'coverground_token', '' ) !== '';
}

/** @return array{name: string, slug: string}|null */
function coverground_subscriber(): ?array {
	$subscriber = get_option( 'coverground_subscriber' );

	return is_array( $subscriber ) ? $subscriber : null;
}

/**
 * Store the exchanged credential; called from the connect callback only.
 */
function coverground_store_connection( string $token, array $subscriber ): void {
	update_option( 'coverground_token', $token, false );
	update_option( 'coverground_subscriber', $subscriber, false );
}

/**
 * Forget the connection locally. Called on Disconnect ALWAYS — even when the
 * remote revoke fails — so the site can never be wedged "connected" with a
 * dead token.
 */
function coverground_clear_connection(): void {
	delete_option( 'coverground_token' );
	delete_option( 'coverground_subscriber' );
	delete_option( 'coverground_report' );
	delete_transient( 'coverground_routes' );
}

/**
 * Authenticated GET against the connected /site API. Returns the decoded
 * body, or a WP_Error with a stable code the callers map to user-facing
 * copy: not_connected | unauthorized | not_found | unavailable.
 *
 * @return array|WP_Error
 */
function coverground_api_get( string $path ) {
	$token = (string) get_option( 'coverground_token', '' );
	if ( $token === '' ) {
		return new WP_Error( 'not_connected', __( 'This site is not connected to Coverground.', 'coverground' ), array( 'status' => 400 ) );
	}

	$response = wp_remote_get(
		coverground_api_origin() . '/api/site' . $path,
		array(
			'timeout' => 10,
			'headers' => array(
				'Authorization' => 'Bearer ' . $token,
				'Accept'        => 'application/json',
			),
		)
	);

	if ( is_wp_error( $response ) ) {
		return new WP_Error( 'unavailable', __( 'Coverground is temporarily unavailable. Try again in a moment.', 'coverground' ), array( 'status' => 502 ) );
	}

	$status = wp_remote_retrieve_response_code( $response );
	$body   = json_decode( wp_remote_retrieve_body( $response ), true );

	if ( 401 === $status || 403 === $status ) {
		return new WP_Error( 'unauthorized', __( 'The Coverground connection is no longer valid. Reconnect from the Coverground settings page.', 'coverground' ), array( 'status' => 401 ) );
	}
	if ( 404 === $status ) {
		return new WP_Error( 'not_found', __( 'Route not found — it may no longer be published.', 'coverground' ), array( 'status' => 404 ) );
	}
	if ( $status < 200 || $status >= 300 || ! is_array( $body ) ) {
		return new WP_Error( 'unavailable', __( 'Coverground is temporarily unavailable. Try again in a moment.', 'coverground' ), array( 'status' => 502 ) );
	}

	return $body;
}

/**
 * The published-routes list, transient-cached briefly — it feeds every
 * editor's picker and the staleness checks.
 *
 * @return array|WP_Error
 */
function coverground_get_routes( bool $bypass_cache = false ) {
	if ( ! $bypass_cache ) {
		$cached = get_transient( 'coverground_routes' );
		if ( is_array( $cached ) ) {
			return $cached;
		}
	}

	$body = coverground_api_get( '/routes' );
	if ( is_wp_error( $body ) ) {
		return $body;
	}

	$routes = isset( $body['data'] ) && is_array( $body['data'] ) ? $body['data'] : array();
	set_transient( 'coverground_routes', $routes, 5 * MINUTE_IN_SECONDS );

	return $routes;
}