<?php
/**
 * Requests to the FAMMRO API.
 *
 * Requests after the connection are signed with the Ed25519 key of this website. FAMMRO checks the
 * signature with the public key it received when the website was connected.
 *
 * @package Fammro
 */

namespace Fammro;

defined( 'ABSPATH' ) || exit;

/**
 * HTTP client for FAMMRO.
 */
final class Api {

	private const TIMEOUT = 15;

	/**
	 * Base URL of the API without trailing slash. Empty when the configured host is not HTTPS.
	 */
	public static function base(): string {
		return self::https_base( (string) FAMMRO_API_BASE );
	}

	/**
	 * Base URL of the console without trailing slash.
	 */
	public static function console_base(): string {
		return self::https_base( (string) FAMMRO_CONSOLE_BASE );
	}

	/**
	 * Host names FAMMRO may redirect to.
	 *
	 * @return string[]
	 */
	public static function hosts(): array {
		$hosts = array();
		foreach ( array( self::base(), self::console_base() ) as $url ) {
			$host = wp_parse_url( $url, PHP_URL_HOST );
			if ( is_string( $host ) && '' !== $host ) {
				$hosts[] = strtolower( $host );
			}
		}
		return array_values( array_unique( $hosts ) );
	}

	/**
	 * Unsigned JSON request (token exchange, shop registration).
	 *
	 * @param string $path Path below the API base, starting with a slash.
	 * @param array  $body Request body.
	 * @return array{status: int, body: array}|null Null on network failure.
	 */
	public static function post( string $path, array $body ): ?array {
		return self::request( 'POST', $path, self::encode( $body ), array() );
	}

	/**
	 * Signed request for an existing connection.
	 *
	 * @param string     $method HTTP method.
	 * @param string     $path   Path below the API base, starting with a slash.
	 * @param array|null $body   Request body, null for none.
	 * @return array{status: int, body: array}|null Null on network failure or without connection.
	 */
	public static function signed( string $method, string $path, ?array $body = null ): ?array {
		$connection = Store::connection();
		if ( null === $connection ) {
			return null;
		}
		$method    = strtoupper( $method );
		$raw       = null === $body ? '' : self::encode( $body );
		$timestamp = (string) (int) floor( microtime( true ) * 1000 );
		$nonce     = bin2hex( random_bytes( 16 ) );
		$canonical = implode(
			"\n",
			array( 'v1', $method, wp_parse_url( self::base() . $path, PHP_URL_PATH ) . self::query( $path ), $timestamp, $nonce, hash( 'sha256', $raw ) )
		);
		try {
			$signature = sodium_crypto_sign_detached( $canonical, $connection['secret_key'] );
		} catch ( \SodiumException $e ) {
			return null;
		}

		return self::request(
			$method,
			$path,
			$raw,
			array(
				'x-fammro-installation'   => $connection['installation_id'],
				'x-fammro-timestamp'      => $timestamp,
				'x-fammro-nonce'          => $nonce,
				'x-fammro-signature'      => base64_encode( $signature ), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Signature transport format.
				'x-fammro-plugin-version' => FAMMRO_VERSION,
			)
		);
	}

	/**
	 * Public key in SPKI (DER) form, base64 encoded, as FAMMRO expects it.
	 *
	 * @param string $public_key Raw 32 byte Ed25519 public key.
	 */
	public static function spki( string $public_key ): string {
		return base64_encode( hex2bin( '302a300506032b6570032100' ) . $public_key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Key transport format.
	}

	/**
	 * Perform the request.
	 *
	 * @param string $method  HTTP method.
	 * @param string $path    Path below the API base.
	 * @param string $raw     Raw body.
	 * @param array  $headers Extra headers.
	 * @return array{status: int, body: array}|null
	 */
	private static function request( string $method, string $path, string $raw, array $headers ): ?array {
		$base = self::base();
		if ( '' === $base || ! str_starts_with( $path, '/' ) ) {
			return null;
		}
		$args = array(
			'method'      => $method,
			'timeout'     => self::TIMEOUT,
			'redirection' => 0,
			'headers'     => array_merge(
				array(
					'Accept'       => 'application/json',
					'Content-Type' => 'application/json',
				),
				$headers
			),
			'user-agent'  => 'FAMMRO-WordPress/' . FAMMRO_VERSION . '; ' . home_url( '/' ),
		);
		if ( '' !== $raw ) {
			$args['body'] = $raw;
		}
		$response = wp_remote_request( $base . $path, $args );
		if ( is_wp_error( $response ) ) {
			return null;
		}
		$decoded = json_decode( (string) wp_remote_retrieve_body( $response ), true );

		return array(
			'status' => (int) wp_remote_retrieve_response_code( $response ),
			'body'   => is_array( $decoded ) ? $decoded : array(),
		);
	}

	/**
	 * JSON exactly as the API re-serialises it for the signature (no escaped slashes or unicode).
	 *
	 * @param array $body Body.
	 */
	private static function encode( array $body ): string {
		$json = wp_json_encode( empty( $body ) ? new \stdClass() : $body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE );
		return false === $json ? '{}' : $json;
	}

	/**
	 * Query part of a path including the question mark.
	 *
	 * @param string $path Path.
	 */
	private static function query( string $path ): string {
		$position = strpos( $path, '?' );
		return false === $position ? '' : substr( $path, $position );
	}

	/**
	 * HTTPS base URL or empty string.
	 *
	 * @param string $url Configured URL.
	 */
	private static function https_base( string $url ): string {
		$url = untrailingslashit( trim( $url ) );
		return str_starts_with( $url, 'https://' ) && false !== wp_parse_url( $url ) ? $url : '';
	}
}