<?php
/**
 * Registration of the plugin's post meta.
 *
 * @package Kordiam
 */

declare( strict_types=1 );

namespace Kordiam\Meta;

use Kordiam\Contracts\ServiceProvider;
use Kordiam\Support\MetaKeys;
use WP_Post;
use WP_REST_Response;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Registers the meta the block editor panel reads, as plain (not JSON-encoded) strings.
 *
 * The show_in_rest flag makes the values publicly readable and auth_callback only guards
 * writes, so reads are closed separately in strip_meta_from_public_reads().
 */
final class PostMetaServiceProvider implements ServiceProvider {

	/**
	 * Post type the plugin's meta belongs to.
	 *
	 * @var string
	 */
	private const POST_TYPE = 'post';

	/**
	 * Registering the meta on init.
	 */
	public function register(): void {
		add_action( 'init', array( $this, 'register_meta' ) );

		// Priority 20: after anything adding fields at the default priority.
		add_filter( 'rest_prepare_' . self::POST_TYPE, array( $this, 'strip_meta_from_public_reads' ), 20, 3 );
	}

	/**
	 * Registering each exposed meta key.
	 */
	public function register_meta(): void {
		foreach ( MetaKeys::rest_exposed() as $meta_key ) {
			register_post_meta(
				self::POST_TYPE,
				$meta_key,
				array(
					'type'              => 'string',
					'single'            => true,
					'default'           => '',
					'show_in_rest'      => true,
					'sanitize_callback' => array( $this, 'sanitize' ),
					'auth_callback'     => array( $this, 'may_edit' ),
				)
			);
		}
	}

	/**
	 * Removing the plugin's meta from a response its reader may not edit the post behind.
	 *
	 * @param WP_REST_Response|mixed $response Response being prepared.
	 * @param WP_Post|mixed          $post     Post it describes.
	 * @param mixed                  $request  Current request, part of the filter signature.
	 *
	 * @return WP_REST_Response|mixed The response.
	 */
	public function strip_meta_from_public_reads( $response, $post, $request = null ) {
		unset( $request );

		if ( ! $response instanceof WP_REST_Response || ! $post instanceof WP_Post ) {
			return $response;
		}

		if ( current_user_can( 'edit_post', (int) $post->ID ) ) {
			return $response;
		}

		$data = $response->get_data();

		if ( ! is_array( $data ) || ! isset( $data['meta'] ) || ! is_array( $data['meta'] ) ) {
			return $response;
		}

		foreach ( MetaKeys::rest_exposed() as $meta_key ) {
			unset( $data['meta'][ $meta_key ] );
		}

		$response->set_data( $data );

		return $response;
	}

	/**
	 * Sanitising a value on the way into the database. All these keys hold plain text.
	 *
	 * @param mixed $value Value being stored.
	 *
	 * @return string The sanitised value.
	 */
	public function sanitize( $value ): string {
		if ( ! is_scalar( $value ) ) {
			return '';
		}

		return sanitize_text_field( (string) $value );
	}

	/**
	 * Deciding whether the current user may change a post's Kordiam meta.
	 *
	 * @param bool   $allowed  Whether access is currently allowed.
	 * @param string $meta_key Meta key being accessed.
	 * @param int    $post_id  Post the meta belongs to.
	 *
	 * @return bool Whether the write is allowed.
	 */
	public function may_edit( $allowed, $meta_key, $post_id ): bool {
		unset( $allowed, $meta_key );

		return current_user_can( 'edit_post', (int) $post_id );
	}
}