<?php
/**
 * The REST endpoint Telegram calls. Only a request carrying the secret header Orderchirp gave
 * Telegram in setWebhook is accepted; anything else is a 403 and touches nothing.
 *
 * @package Orderchirp
 */

namespace Orderchirp;

defined( 'ABSPATH' ) || exit;

final class Webhook {

	const REST_NAMESPACE = 'orderchirp/v1';
	const ROUTE          = '/telegram';

	/**
	 * Hook in.
	 */
	public function register() {
		add_action( 'rest_api_init', array( $this, 'routes' ) );
	}

	/**
	 * Register the route.
	 */
	public function routes() {
		register_rest_route(
			self::REST_NAMESPACE,
			self::ROUTE,
			array(
				'methods'             => 'POST',
				'callback'            => array( $this, 'receive' ),
				'permission_callback' => array( __CLASS__, 'authorised' ),
			)
		);
	}

	/**
	 * The full webhook URL.
	 *
	 * @return string
	 */
	public static function url() {
		return rest_url( self::REST_NAMESPACE . self::ROUTE );
	}

	/**
	 * Whether the request carries Telegram's secret header.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @return bool
	 */
	public static function authorised( $request ) {
		$sent = (string) $request->get_header( 'x_telegram_bot_api_secret_token' );
		return '' !== $sent && hash_equals( Settings::webhook_token( Settings::secret() ), $sent );
	}

	/**
	 * Handle an update. Always answers 200 once authorised, so Telegram never re-sends an update
	 * that failed for a reason a retry cannot fix.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @return \WP_REST_Response
	 */
	public function receive( $request ) {
		$update = $request->get_json_params();
		$result = 'ignored';
		if ( is_array( $update ) ) {
			try {
				$result = Updates_Handler::handle( $update );
			} catch ( \Throwable $e ) {
				$result = 'error';
				// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- surfaced to the site's own error log only.
				error_log( 'Orderchirp: could not handle a Telegram update: ' . $e->getMessage() );
			}
		}
		return new \WP_REST_Response( array( 'ok' => true, 'result' => $result ), 200 );
	}
}