<?php
/**
 * Google Sheets integration.
 *
 * @package FormPilot
 * @since   1.0.0
 */

declare( strict_types = 1 );

namespace FormPilot\Integrations\Services;

use FormPilot\Integrations\Integration;
use FormPilot\Integrations\IntegrationContext;
use FormPilot\Models\Form;
use FormPilot\Webhooks\Webhook;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Appends a row to a Google spreadsheet.
 *
 * Through an Apps Script web app rather than the Sheets API, and that is a
 * deliberate choice worth explaining.
 *
 * The Sheets API needs OAuth: a client ID and secret that identify the
 * *application*, a consent screen Google has to review, and a refresh token per
 * site. A plugin distributed as a ZIP has nowhere safe to put a client secret —
 * it would sit in the source of every copy — and cannot complete a review on
 * behalf of the sites that install it. Shipping that would mean either leaking a
 * shared credential or asking every site owner to create their own Google Cloud
 * project, which is more work than the alternative.
 *
 * The alternative is a container-bound Apps Script: the site owner pastes a
 * dozen lines into their own spreadsheet, deploys it as a web app, and gets a
 * URL that accepts a POST. The script runs as them, with access to their sheet
 * only, and no credential of ours is involved anywhere. The shared secret below
 * is what stops anyone who guesses the URL from writing rows.
 *
 * @since 1.0.0
 */
final class GoogleSheets extends Integration {

	/**
	 * Returns the slug the configuration is stored under.
	 */
	public function id(): string {
		return 'google_sheets';
	}

	/**
	 * Returns the name shown in the editor.
	 */
	public function label(): string {
		return __( 'Google Sheets', 'devplugins-custom-form-builder' );
	}

	/**
	 * Returns the sentence explaining what to fill in.
	 */
	public function description(): string {
		return __( 'Open your spreadsheet, choose Extensions then Apps Script, paste the script below, and deploy it as a web app that anyone can access. Paste the deployment URL here. The script runs under your own Google account and can only reach that spreadsheet.', 'devplugins-custom-form-builder' );
	}

	/**
	 * Returns the Apps Script the site owner deploys.
	 *
	 * Kept here rather than in the template so the payload shape and the script
	 * that reads it are next to each other and cannot drift apart.
	 */
	public static function script(): string {
		return implode(
			"\n",
			array(
				'function doPost(e) {',
				"  var SECRET = 'paste-the-same-secret-here';",
				'  var body = JSON.parse(e.postData.contents);',
				'',
				'  if (body.secret !== SECRET) {',
				"    return ContentService.createTextOutput('forbidden');",
				'  }',
				'',
				'  var sheet = SpreadsheetApp.getActiveSpreadsheet().getSheets()[0];',
				'',
				'  // First run: write the header row from the keys we were sent.',
				'  if (sheet.getLastRow() === 0) {',
				'    sheet.appendRow(body.columns);',
				'  }',
				'',
				'  sheet.appendRow(body.row);',
				'',
				"  return ContentService.createTextOutput('ok');",
				'}',
			)
		);
	}

	/**
	 * Returns the settings this integration takes, per form.
	 *
	 * @return array<int, array<string, mixed>> The option definitions.
	 */
	public function options(): array {
		return array(
			array(
				'key'         => 'web_app_url',
				'type'        => 'url',
				'label'       => __( 'Web app URL', 'devplugins-custom-form-builder' ),
				'placeholder' => 'https://script.google.com/macros/s/…/exec',
				'required'    => true,
			),
			array(
				'key'         => 'secret',
				'type'        => 'password',
				'label'       => __( 'Shared secret', 'devplugins-custom-form-builder' ),
				'description' => __( 'Any phrase. Put the same one in the script, or anybody who learns the URL can add rows.', 'devplugins-custom-form-builder' ),
				'required'    => true,
			),
			array(
				'key'         => 'include_meta',
				'type'        => 'checkbox',
				'label'       => __( 'Add a date and entry column', 'devplugins-custom-form-builder' ),
			),
		);
	}

	/**
	 * Returns where a submission should be delivered.
	 *
	 * @param Form                 $form   Form being submitted.
	 * @param array<string, mixed> $config Stored values for that form.
	 *
	 * @return Webhook|null The endpoint, or null when there is nothing to send to.
	 */
	public function endpoint( Form $form, array $config ): ?Webhook {
		return $this->target( $this->option( $config, 'web_app_url' ) );
	}

	/**
	 * Builds the row and its header.
	 *
	 * Columns and values are sent as two parallel lists rather than as an object,
	 * because a spreadsheet row is positional: the script needs to know that the
	 * third value belongs under the third heading, which an object with an
	 * unspecified key order cannot promise.
	 *
	 * @param IntegrationContext   $context Submission being delivered.
	 * @param array<string, mixed> $config  Stored values for the form.
	 *
	 * @return array<string, mixed> The payload.
	 */
	public function payload( IntegrationContext $context, array $config ): array {
		$columns = array();
		$row     = array();

		if ( ! empty( $config['include_meta'] ) ) {
			$columns[] = __( 'Submitted', 'devplugins-custom-form-builder' );
			$columns[] = __( 'Entry', 'devplugins-custom-form-builder' );

			$row[] = gmdate( 'c' );
			$row[] = $context->submission_id();
		}

		/*
		 * Every field of the form, answered or not, so the columns line up between
		 * one submission and the next.
		 */
		foreach ( $context->fields() as $field ) {
			$key = $field->field_key();

			$columns[] = '' !== $field->label() ? $field->label() : $key;
			$row[]     = $context->value( $key );
		}

		return array(
			'secret'  => $this->option( $config, 'secret' ),
			'form'    => $context->form()->title(),
			'columns' => $columns,
			'row'     => $row,
		);
	}
}