<?php
/**
 * Fetches the site's own pages for a scan (S-SCAN).
 *
 * @package ForensixDigital
 */

declare(strict_types=1);

namespace ForensixDigital\Services\Scan;

defined( 'ABSPATH' ) || exit;

use ForensixDigital\Services\Http\Http;

/**
 * Requests pages with the scan token so they carry source markers (D-21). Some hosts cannot
 * reach their own public address from inside; then requests go to 127.0.0.1 with the site's
 * host name kept for TLS and virtual hosts (loopback mode).
 */
final class Fetcher {

	public const DIRECT   = 'direct';
	public const LOOPBACK = 'loopback';

	private const TIMEOUT = 15;

	/**
	 * Creates the fetcher.
	 *
	 * @param Http   $http Outbound gateway.
	 * @param string $mode DIRECT or LOOPBACK.
	 */
	public function __construct( private Http $http, private string $mode = self::DIRECT ) {}

	/**
	 * Finds a way to reach the site. Returns the mode, or null when the site cannot reach itself.
	 *
	 * @param string $url A page of the site, usually the front page.
	 */
	public function probe( string $url ): ?string {
		foreach ( array( self::DIRECT, self::LOOPBACK ) as $mode ) {
			$this->mode = $mode;
			$response   = $this->fetch( $url );
			if ( $response['status'] > 0 ) {
				return $mode;
			}
		}
		$this->mode = self::DIRECT;
		return null;
	}

	/**
	 * Fetches one page. Redirects are not followed; the caller decides what they mean.
	 *
	 * @param string $url Page URL.
	 * @return array{status: int, headers: array<string, string>, body: string, error: string}
	 */
	public function fetch( string $url ): array {
		// The scan token and the loopback route are only for the site itself. An address on
		// another host (for example a sitemap listed in robots.txt) is fetched like any other page.
		if ( ! self::is_own( $url ) ) {
			return $this->http->request(
				'GET',
				$url,
				array(
					'timeout' => self::TIMEOUT,
					'headers' => array( 'Cache-Control' => 'no-cache' ),
				)
			);
		}

		$args = array(
			'method'  => 'GET',
			'timeout' => self::TIMEOUT,
			'headers' => array(
				ScanToken::HEADER => ScanToken::current(),
				'Cache-Control'   => 'no-cache',
			),
		);
		if ( self::LOOPBACK !== $this->mode ) {
			return $this->http->request( 'GET', $url, $args );
		}

		$parts = wp_parse_url( $url );
		if ( ! is_array( $parts ) || ! isset( $parts['host'], $parts['scheme'] ) ) {
			return $this->http->request( 'GET', $url, $args );
		}
		$port = $parts['port'] ?? ( 'https' === $parts['scheme'] ? 443 : 80 );

		$resolve = static function ( $handle ) use ( $parts, $port ): void {
			// phpcs:ignore WordPress.WP.AlternativeFunctions.curl_curl_setopt -- Requests exposes the handle only here.
			curl_setopt( $handle, CURLOPT_RESOLVE, array( $parts['host'] . ':' . $port . ':127.0.0.1' ) );
		};

		$args['sslverify'] = false;
		add_action( 'http_api_curl', $resolve );
		try {
			return $this->http->request( 'GET', $url, $args );
		} finally {
			remove_action( 'http_api_curl', $resolve );
		}
	}

	/**
	 * Whether an address is on the site's own host.
	 *
	 * @param string $url Address.
	 */
	private static function is_own( string $url ): bool {
		$own  = wp_parse_url( home_url(), PHP_URL_HOST );
		$host = wp_parse_url( $url, PHP_URL_HOST );
		return is_string( $own ) && is_string( $host ) && strtolower( $own ) === strtolower( $host );
	}

	/**
	 * Current mode.
	 */
	public function mode(): string {
		return $this->mode;
	}
}