<?php
/**
 * F-PERF-05: what the Speed test screen needs, and the owner's own Google key.
 *
 * @package ForensixDigital
 */

declare(strict_types=1);

namespace ForensixDigital\Apps\Perf;

defined( 'ABSPATH' ) || exit;

use ForensixDigital\Rest\Api;
use ForensixDigital\Services\Permissions\Capabilities;
use ForensixDigital\Services\Security\Vault;

/**
 * GET forensix/v1/speed tells the screen how to run a test; POST forensix/v1/speed/key saves or
 * removes the owner's own PageSpeed Insights key (stored encrypted, used only for speed tests).
 *
 * Without an own key, the test runs through forensix.digital, which has its own Google limit;
 * when that is not available the browser asks Google without a key. Nothing runs until the owner
 * presses the button, and only the page address and this site's address are sent.
 */
final class SpeedRoutes {

	public const KEY   = 'forensix_speed_psi_key';
	public const PROXY = 'https://forensix.digital/wp-json/forensix/v1/psi/free';

	/**
	 * Registers the routes.
	 */
	public function register_routes(): void {
		register_rest_route(
			Api::NAMESPACE,
			'/speed',
			array(
				'methods'             => 'GET',
				'callback'            => array( $this, 'show' ),
				'permission_callback' => static fn(): bool => current_user_can( Capabilities::VIEW_FINDINGS ),
			)
		);
		register_rest_route(
			Api::NAMESPACE,
			'/speed/key',
			array(
				'methods'             => 'POST',
				'callback'            => array( $this, 'save_key' ),
				'permission_callback' => static fn(): bool => current_user_can( Capabilities::MANAGE_SETTINGS ),
				'args'                => array(
					'key' => array(
						'type'    => 'string',
						'default' => '',
					),
				),
			)
		);
	}

	/**
	 * The owner's own key, '' when none is saved.
	 */
	public static function own_key(): string {
		$locked = get_option( self::KEY, '' );
		return is_string( $locked ) && '' !== $locked ? Vault::default()->unlock( $locked ) : '';
	}

	/**
	 * Whether the text looks like a Google API key.
	 *
	 * @param string $key Key.
	 */
	public static function valid_key( string $key ): bool {
		return 1 === preg_match( '/^[A-Za-z0-9_-]{30,60}$/', $key );
	}

	/**
	 * How the browser runs a test: the own key, or the address to send it to on forensix.digital.
	 *
	 * @return array<string, mixed>
	 */
	public static function present(): array {
		$key   = self::own_key();
		$proxy = array(
			'url'  => self::PROXY,
			'site' => home_url( '/' ),
			'key'  => '',
		);
		/**
		 * Filters where the Speed test runs when there is no own key. The Pro add-on sends licensed
		 * sites to its licence route. Return null to ask Google without a key.
		 *
		 * @param array<string, string>|null $proxy url, site and licence key ('' for free sites).
		 */
		$proxy = apply_filters( 'forensix_speed_proxy', $proxy );
		return array(
			'hasKey'  => '' !== $key,
			'key'     => current_user_can( Capabilities::MANAGE_SETTINGS ) ? $key : '',
			'canEdit' => current_user_can( Capabilities::MANAGE_SETTINGS ),
			'proxy'   => is_array( $proxy ) && isset( $proxy['url'] ) ? $proxy : null,
		);
	}

	/**
	 * GET /speed.
	 */
	public function show(): \WP_REST_Response {
		return new \WP_REST_Response( self::present(), 200 );
	}

	/**
	 * POST /speed/key: an empty key removes it.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @phpstan-param \WP_REST_Request<array<string, mixed>> $request
	 * @return \WP_REST_Response|\WP_Error
	 */
	public function save_key( \WP_REST_Request $request ) {
		$key = trim( (string) $request['key'] );
		if ( '' === $key ) {
			delete_option( self::KEY );
			return new \WP_REST_Response( self::present(), 200 );
		}
		if ( ! self::valid_key( $key ) ) {
			return new \WP_Error( 'forensix_bad_key', __( 'This does not look like a Google API key.', 'forensix-digital' ), array( 'status' => 400 ) );
		}
		update_option( self::KEY, Vault::default()->lock( $key ), false );
		return new \WP_REST_Response( self::present(), 200 );
	}
}