<?php
/**
 * AJAX submission endpoint.
 *
 * @package FormPilot
 * @since   1.0.0
 */

declare( strict_types = 1 );

namespace FormPilot\Frontend;

use FormPilot\Contracts\Hookable;
use FormPilot\Models\Form;
use FormPilot\MultiStep\ProgressStore;
use FormPilot\Security\Request;
use FormPilot\Security\SecurityManager;
use FormPilot\Services\SubmissionMessages;
use FormPilot\Submissions\SubmissionProcessor;
use WP_Error;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Receives a submitted form over AJAX and stores it.
 *
 * The endpoint answers logged in visitors and guests alike, and always replies
 * with JSON so the script never has to parse markup. Everything past the nonce
 * check is handled by {@see SubmissionProcessor}, which the REST endpoint uses
 * as well.
 *
 * @since 1.0.0
 */
final class SubmissionHandler implements Hookable {

	/**
	 * AJAX action name.
	 */
	public const ACTION = 'formpilot_submit_form';

	/**
	 * Constructor.
	 *
	 * @param SubmissionProcessor $processor Pipeline storing the submission.
	 * @param SubmissionMessages  $messages  Resolver for the confirmation text.
	 * @param ProgressStore       $progress  Store holding saved progress.
	 */
	public function __construct(
		private SubmissionProcessor $processor,
		private SubmissionMessages $messages,
		private ProgressStore $progress
	) {}

	/**
	 * Registers the module hooks.
	 */
	public function register_hooks(): void {
		add_action( 'wp_ajax_' . self::ACTION, array( $this, 'handle' ) );
		add_action( 'wp_ajax_nopriv_' . self::ACTION, array( $this, 'handle' ) );
	}

	/**
	 * Handles a submission request.
	 */
	public function handle(): void {
		if ( ! SecurityManager::verify_public_request( FormRenderer::NONCE_ACTION, FormRenderer::NONCE_FIELD ) ) {
			wp_send_json_error(
				array(
					'code'    => 'invalid_nonce',
					'message' => __( 'This form has expired. Please reload the page and try again.', 'devplugins-custom-form-builder' ),
				),
				403
			);
		}

		$form_id = Request::int( 'formpilot_form_id' );
		$post_id = Request::int( 'formpilot_post_id' );

		$result = $this->processor->process(
			$form_id,
			$this->submitted_values(),
			$this->processor->context( $post_id )
		);

		if ( $result instanceof WP_Error ) {
			$data = $result->get_error_data();
			$data = is_array( $data ) ? $data : array();

			wp_send_json_error(
				array(
					'code'    => $result->get_error_code(),
					'message' => $result->get_error_message(),
					'errors'  => $data['errors'] ?? array(),
				),
				(int) ( $data['status'] ?? 400 )
			);
		}

		/*
		 * The draft has served its purpose. Keeping it would leave a copy of the
		 * answers sitting in a transient behind a link that still works, next to
		 * the entry that was just stored properly.
		 */
		$this->progress->forget( Request::text( 'formpilot_token' ) );

		$form = $this->processor->form( $form_id );

		/**
		 * Filters the payload returned after a successful submission.
		 *
		 * @since 1.0.0
		 *
		 * @param array<string, mixed> $payload       Response payload.
		 * @param int                  $submission_id Stored submission ID.
		 * @param Form|null            $form          Form that was submitted.
		 */
		$payload = (array) apply_filters(
			'formpilot_submission_response',
			array(
				'message'       => $this->messages->success( $form ),
				'submission_id' => $result,
				'redirect'      => '',
			),
			$result,
			$form
		);

		wp_send_json_success( $payload );
	}

	/**
	 * Returns the unslashed values submitted for the fields.
	 *
	 * Sanitisation happens per field in the validator, which knows the type each
	 * value belongs to.
	 *
	 * @return array<string, mixed> Raw values keyed by field key.
	 */
	private function submitted_values(): array {
		$raw = Request::raw( FieldView::NAME_PREFIX, 'post' );

		return is_array( $raw ) ? $raw : array();
	}
}