<?php
/**
 * REST endpoint used by WPXLab to verify the site address during connection.
 *
 * @package Keepwatch
 */

namespace Keepwatch\Cloud;

defined( 'ABSPATH' ) || exit;

/**
 * GET /wp-json/keepwatch/v1/verify?challenge=…
 * Public by design (the Hub calls it), but it only signs while an administrator's connect request is in progress
 * (5-minute window) and only the fixed "keepwatch-verify" message for this host. It reveals nothing else.
 */
final class VerifyEndpoint {

	/**
	 * Register the route.
	 */
	public function register(): void {
		add_action( 'rest_api_init', array( $this, 'routes' ) );
	}

	/**
	 * Route definition.
	 */
	public function routes(): void {
		register_rest_route(
			'keepwatch/v1',
			'/verify',
			array(
				'methods'             => 'GET',
				'callback'            => array( $this, 'handle' ),
				'permission_callback' => '__return_true',
				'args'                => array(
					'challenge' => array(
						'type'     => 'string',
						'required' => true,
						'pattern'  => '^[a-f0-9]{32}$',
					),
				),
			)
		);
	}

	/**
	 * Handle the request.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @return \WP_REST_Response
	 */
	public function handle( $request ) {
		$signature = ( new Connection( Connection::client() ) )->sign_challenge( (string) $request->get_param( 'challenge' ) );

		if ( null === $signature ) {
			return new \WP_REST_Response( array( 'error' => 'not_connecting' ), 404 );
		}

		$response = new \WP_REST_Response( array( 'signature' => $signature ), 200 );
		$response->header( 'Cache-Control', 'no-store' );
		return $response;
	}
}