<?php
/**
 * @package PlugixaCrm
 */

declare( strict_types = 1 );

namespace PlugixaCrm\Core\Integrations;

use PlugixaCrm\Core\Security\Secrets;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Where a connector's API keys and tokens live.
 *
 * ONE OPTION PER CONNECTOR, ENCRYPTED WHOLE. Not a table, because this is configuration rather than
 * data — there is exactly one row per connector, it is read on almost every request that touches an
 * integration, and `get_option()` is already cached. Not the shared `plugixa_crm_settings` option
 * either: that one is autoloaded on every page load of the entire site, and putting a bag of OAuth
 * refresh tokens in it would mean loading them into memory to render a blog post.
 *
 * THE WHOLE BAG IS ENCRYPTED, NOT THE SECRET FIELDS. A connector's shape is its own business, and
 * asking each one to declare which of its fields are sensitive is a question somebody eventually
 * answers wrongly — usually about the field that turns out to be a bearer token with a boring name.
 * Encrypting everything removes the question. The cost is that these values cannot be queried in SQL,
 * which is correct: nothing should ever be looking for a site by its API key.
 *
 * A ROTATED SALT IS NOT AN ERROR, AND THIS IS THE PART CALLERS GET WRONG. {@see Secrets::decrypt()}
 * returns null when the key no longer derives — which is what a site owner rotating salts after a
 * suspected breach is *supposed* to cause. {@see get()} therefore returns an empty array and
 * {@see needs_reconnect()} returns true, so the screen can say "sign in again" instead of the plugin
 * throwing on every admin page. An integration that stops syncing is a support ticket; a fatal is an
 * outage, and the outage would arrive precisely when somebody was already dealing with a breach.
 */
final class Credentials {

	/**
	 * Option prefix. The connector id completes it.
	 *
	 * `Uninstaller` drops tables by prefix but knows nothing about options, so
	 * {@see \PlugixaCrm\Modules\Integrations\Module} sweeps these on `plugixa_crm_uninstall` using
	 * the same prefix. Changing it here without changing the sweep leaves credentials on disk after
	 * the plugin is deleted.
	 */
	public const PREFIX = 'plugixa_crm_integration_';

	/**
	 * The stored values for one connector, decrypted.
	 *
	 * @param string $integration Connector id.
	 *
	 * @return array<string, string> Empty when nothing is stored OR when it cannot be read.
	 */
	public function get( string $integration ): array {
		$stored = get_option( self::option( $integration ), '' );

		if ( ! is_string( $stored ) || '' === $stored ) {
			return array();
		}

		$json = Secrets::decrypt( $stored );

		if ( null === $json ) {
			return array();
		}

		$values = json_decode( $json, true );

		return is_array( $values ) ? array_map( 'strval', $values ) : array();
	}

	/**
	 * Whether something is stored that can no longer be read.
	 *
	 * The distinction {@see get()} cannot express on its own: an empty array means both "never
	 * connected" and "connected, but the salts moved". Those need opposite messages — one is an
	 * invitation, the other is an apology — so the screen asks this to tell them apart.
	 *
	 * @param string $integration Connector id.
	 */
	public function needs_reconnect( string $integration ): bool {
		$stored = get_option( self::option( $integration ), '' );

		if ( ! is_string( $stored ) || '' === $stored ) {
			return false;
		}

		return null === Secrets::decrypt( $stored );
	}

	/**
	 * Store a connector's values, replacing whatever was there.
	 *
	 * @param string                $integration Connector id.
	 * @param array<string, string> $values      Field key => value.
	 *
	 * @return bool False when this host cannot encrypt at all, which is the one case that must not
	 *              silently fall back to plaintext.
	 */
	public function put( string $integration, array $values ): bool {
		if ( ! Secrets::available() ) {
			return false;
		}

		$json = wp_json_encode( array_map( 'strval', $values ) );

		if ( ! is_string( $json ) ) {
			return false;
		}

		$sealed = Secrets::encrypt( $json );

		if ( '' === $sealed ) {
			return false;
		}

		// autoload 'no': these are read when an integration runs, not when a visitor loads a page.
		update_option( self::option( $integration ), $sealed, false );

		return true;
	}

	/**
	 * Merge values over what is stored.
	 *
	 * The connect form's real shape: somebody re-saving a connection to change the account name has
	 * not retyped the API key, and the client sends a placeholder rather than the real one. Callers
	 * drop the untouched keys and merge the rest, so a partial save cannot blank a secret.
	 *
	 * @param string                $integration Connector id.
	 * @param array<string, string> $values      Field key => value.
	 */
	public function merge( string $integration, array $values ): bool {
		return $this->put( $integration, array_merge( $this->get( $integration ), $values ) );
	}

	/**
	 * Forget one connector's credentials.
	 *
	 * @param string $integration Connector id.
	 */
	public function forget( string $integration ): void {
		delete_option( self::option( $integration ) );
	}

	/**
	 * Whether anything at all is stored, readable or not.
	 *
	 * @param string $integration Connector id.
	 */
	public function stored( string $integration ): bool {
		$value = get_option( self::option( $integration ), '' );

		return is_string( $value ) && '' !== $value;
	}

	/**
	 * @param string $integration Connector id.
	 */
	private static function option( string $integration ): string {
		return self::PREFIX . sanitize_key( $integration );
	}
}