<?php
/**
 * Webhook definition.
 *
 * @package FormPilot
 * @since   1.0.0
 */

declare( strict_types = 1 );

namespace FormPilot\Webhooks;

use FormPilot\Security\OutboundUrl;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * One endpoint a form posts to.
 *
 * Immutable, and built from stored settings rather than from a request: the
 * sanitising happens once, where the settings are saved, so everything
 * downstream can treat these values as clean.
 *
 * @since 1.0.0
 */
final class Webhook {

	/**
	 * Constructor.
	 *
	 * @param string                $key     Stable identifier inside the form.
	 * @param string                $name    Name shown in the log.
	 * @param string                $url     Endpoint receiving the POST.
	 * @param string                $secret  Key the payload is signed with.
	 * @param array<string, string> $headers Extra headers sent with the request.
	 * @param bool                  $enabled Whether deliveries are attempted.
	 */
	public function __construct(
		private string $key = '',
		private string $name = '',
		private string $url = '',
		private string $secret = '',
		private array $headers = array(),
		private bool $enabled = true
	) {}

	/**
	 * Builds a webhook from stored settings.
	 *
	 * @param string               $key  Identifier inside the form.
	 * @param array<string, mixed> $data Stored values.
	 */
	public static function from_array( string $key, array $data ): Webhook {
		return new self(
			key: $key,
			name: (string) ( $data['name'] ?? '' ),
			url: (string) ( $data['url'] ?? '' ),
			secret: (string) ( $data['secret'] ?? '' ),
			headers: is_array( $data['headers'] ?? null ) ? array_map( 'strval', $data['headers'] ) : array(),
			enabled: ! empty( $data['enabled'] )
		);
	}

	/**
	 * Returns the identifier.
	 */
	public function key(): string {
		return $this->key;
	}

	/**
	 * Returns the name shown in the log.
	 *
	 * @return string The name, falling back to the host of the URL.
	 */
	public function name(): string {
		if ( '' !== $this->name ) {
			return $this->name;
		}

		$host = wp_parse_url( $this->url, PHP_URL_HOST );

		return is_string( $host ) ? $host : $this->key;
	}

	/**
	 * Returns the endpoint.
	 */
	public function url(): string {
		return $this->url;
	}

	/**
	 * Returns the signing key.
	 *
	 * @return string The secret, empty when the payload is not signed.
	 */
	public function secret(): string {
		return $this->secret;
	}

	/**
	 * Returns the extra headers.
	 *
	 * @return array<string, string> Values keyed by header name.
	 */
	public function headers(): array {
		return $this->headers;
	}

	/**
	 * Determines whether deliveries should be attempted.
	 *
	 * A webhook without a usable URL is treated as switched off rather than as a
	 * delivery that fails every time and fills the log with the same error.
	 *
	 * @return bool True when the webhook can be delivered to.
	 */
	public function is_active(): bool {
		/*
		 * Screened on the way out as well as on the way in. The stored URL was
		 * checked when it was saved, but settings also arrive over REST, through
		 * imports and from `formpilot/*` filters, so the last word belongs here — next to
		 * the request rather than next to the form that once entered it.
		 */
		return $this->enabled && '' !== $this->url && OutboundUrl::is_safe( $this->url );
	}

	/**
	 * Returns the webhook as an array.
	 *
	 * @return array<string, mixed> The stored shape.
	 */
	public function to_array(): array {
		return array(
			'name'    => $this->name,
			'url'     => $this->url,
			'secret'  => $this->secret,
			'headers' => $this->headers,
			'enabled' => $this->enabled,
		);
	}
}