<?php
/**
 * @package PlugixaCrm
 */

declare( strict_types = 1 );

namespace PlugixaCrm\Core\Http;

use PlugixaCrm\Core\ExchangeFeed;
use PlugixaCrm\Core\Settings;
use WP_Error;
use WP_REST_Request;
use WP_REST_Response;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * REST access to the CRM's settings.
 *
 * Thin on purpose: what a setting is, what it defaults to and what counts as a valid value
 * are all questions for Core\Settings. This class only answers who may ask.
 */
final class SettingsController extends RestController {

	public function __construct( private readonly ExchangeFeed $feed ) {}

	protected function entity_type(): string {
		return 'settings';
	}

	/**
	 * Settings are administration, not data. Reading them is fine for anyone who can use the
	 * CRM — the app needs the currency to render an amount. Changing them is not: these are
	 * site-wide and affect every user, so they take the site's own administration capability
	 * rather than the CRM's.
	 *
	 * @param WP_REST_Request $request The request.
	 */
	public function can_manage_settings( WP_REST_Request $request ): bool|WP_Error {
		unset( $request );

		return current_user_can( 'manage_options' ) ? true : $this->forbidden();
	}

	public function register_routes(): void {
		register_rest_route(
			$this->namespace,
			'/settings',
			array(
				array(
					'methods'             => 'GET',
					'callback'            => array( $this, 'show' ),
					'permission_callback' => array( $this, 'can_read' ),
				),
				array(
					'methods'             => 'POST, PUT',
					'callback'            => array( $this, 'update' ),
					'permission_callback' => array( $this, 'can_manage_settings' ),
				),
			)
		);

		// "Update now". The same guard as the settings write, because that is what it is: it rewrites
		// the rate table every figure on the site is converted through.
		register_rest_route(
			$this->namespace,
			'/settings/currency-rates/refresh',
			array(
				'methods'             => 'POST',
				'callback'            => array( $this, 'refresh_rates' ),
				'permission_callback' => array( $this, 'can_manage_settings' ),
			)
		);
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function show( WP_REST_Request $request ): WP_REST_Response {
		unset( $request );

		return $this->ok(
			array(
				'settings'  => Settings::all(),
				// How current the rates are, for the Currency rates screen. Read by anyone who can read
				// settings, like the rates themselves; it holds a date, a time and at worst an error line.
				'rate_feed' => ExchangeFeed::status(),
				/**
				 * The lists a settings control needs to offer a choice.
				 *
				 * Filtered for the same reason the defaults and the sanitizer are: a module owns its
				 * own settings, and the portal's page picker needs the site's pages here without Core
				 * learning that a portal exists. Values are read by the admin app only.
				 *
				 * @param array<string, mixed> $choices Keyed by control.
				 */
				'choices'   => apply_filters(
					'plugixa_crm_settings_choices',
					array(
						'currencies'   => Settings::CURRENCIES,
						'date_formats' => Settings::DATE_FORMATS,
					)
				),
			)
		);
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function update( WP_REST_Request $request ): WP_REST_Response {
		return $this->ok( array( 'settings' => Settings::save( (array) $request->get_json_params() ) ) );
	}

	/**
	 * Fetch today's rates now, rather than at the next scheduled run.
	 *
	 * REFUSED WHILE THE FEED IS SWITCHED OFF. The switch is the consent to contact the ECB at all, and a
	 * button that fetched anyway would make the disclosure in the readme untrue.
	 *
	 * @param WP_REST_Request $request The request.
	 */
	public function refresh_rates( WP_REST_Request $request ): WP_REST_Response|WP_Error {
		unset( $request );

		if ( ! ExchangeFeed::enabled() ) {
			return $this->fail(
				'plugixa_crm_rates_feed_off',
				__( 'Automatic rates are switched off.', 'plugixa-crm' ),
				409
			);
		}

		$rates = $this->feed->refresh();

		if ( $rates instanceof WP_Error ) {
			// 502: the CRM is fine, the server it relies on answered badly or not at all.
			return $this->fail( (string) $rates->get_error_code(), $rates->get_error_message(), 502 );
		}

		return $this->ok(
			array(
				'settings'  => Settings::all(),
				'rate_feed' => ExchangeFeed::status(),
			)
		);
	}
}