<?php
/**
 * REST controllers for the admin UI — oorank/v1 namespace.
 *
 * @package Oorank
 */

defined( 'ABSPATH' ) || exit;

/**
 * Registers REST routes. All routes are nonce + capability gated.
 */
class Oorank_Rest {

	const NAMESPACE = 'oorank/v1';

	/**
	 * Settings store.
	 *
	 * @var Oorank_Settings
	 */
	private $settings;

	/**
	 * Constructor.
	 *
	 * @param Oorank_Settings $settings Settings store.
	 */
	public function __construct( Oorank_Settings $settings ) {
		$this->settings = $settings;
	}

	/**
	 * Register hooks.
	 */
	public function hooks() {
		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
	}

	/**
	 * Register free-core routes, then let Pro add its own.
	 */
	public function register_routes() {
		register_rest_route(
			self::NAMESPACE,
			'/settings',
			array(
				array(
					'methods'             => WP_REST_Server::READABLE,
					'callback'            => array( $this, 'get_settings' ),
					'permission_callback' => array( $this, 'can_manage' ),
				),
				array(
					'methods'             => WP_REST_Server::CREATABLE,
					'callback'            => array( $this, 'update_settings' ),
					'permission_callback' => array( $this, 'can_manage' ),
				),
			)
		);

		/**
		 * Fires after free-core REST routes are registered.
		 *
		 * Extension seam: Pro registers its own routes under oorank/v1 here.
		 *
		 * @param string       $namespace The REST namespace.
		 * @param Oorank_Rest $rest      This controller.
		 */
		do_action( 'oorank_rest_routes', self::NAMESPACE, $this );
	}

	/**
	 * Permission callback. The REST cookie-auth layer
	 * enforces the X-WP-Nonce (wp_rest) check for logged-in requests.
	 *
	 * @return bool
	 */
	public function can_manage() {
		return Oorank_Roles::can();
	}

	/**
	 * GET /settings.
	 *
	 * @return WP_REST_Response
	 */
	public function get_settings() {
		return rest_ensure_response( $this->settings->get() );
	}

	/**
	 * POST /settings.
	 *
	 * @param WP_REST_Request $request Request.
	 * @return WP_REST_Response
	 */
	public function update_settings( WP_REST_Request $request ) {
		$body = $request->get_json_params();
		if ( empty( $body ) ) {
			$body = $request->get_params();
		}
		$saved = $this->settings->update( is_array( $body ) ? $body : array() );

		return rest_ensure_response(
			array(
				'saved'    => true,
				'settings' => $saved,
			)
		);
	}
}