<?php
/**
 * @package PlugixaCrm
 */

declare( strict_types = 1 );

namespace PlugixaCrm\Modules\Stream\Http;

use PlugixaCrm\Core\Entities\EntityRegistry;
use PlugixaCrm\Core\Entities\RecordLoader;
use PlugixaCrm\Core\Http\RestController;
use PlugixaCrm\Core\Security\Capabilities;
use PlugixaCrm\Modules\Stream\Services\StreamService;
use WP_Error;
use WP_REST_Request;
use WP_REST_Response;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * REST routes for a record's stream.
 *
 * POLYMORPHIC AND AUTHORISED AGAINST THE PARENT, the same shape as `EntityTagsController` and
 * `RecordAccessController` — the entity is in the URL, checked against the registry, and the record
 * is loaded so that record-level ACL gets a chance to say no.
 *
 * THE STREAM IS THE RECORD. A record's feed carries its field values in the open — what the amount
 * was changed from, who it was taken off, what somebody wrote about it. Authorising it as anything
 * less than READ ON THE RECORD ITSELF would make it a way to read records you cannot open, one
 * entry at a time. Posting and following are `edit` and `read` respectively: writing on a record is
 * changing it, but watching one you may already read costs nobody anything.
 */
final class StreamController extends RestController {

	public function __construct(
		private readonly StreamService $stream,
		private readonly EntityRegistry $entities,
		private readonly RecordLoader $records
	) {}

	/**
	 * Only ever a fallback; the real entity comes from the URL.
	 */
	protected function entity_type(): string {
		return 'stream';
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function can_read( WP_REST_Request $request ): bool|WP_Error {
		return $this->authorise( 'read', $request );
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function can_edit( WP_REST_Request $request ): bool|WP_Error {
		return $this->authorise( 'edit', $request );
	}

	/**
	 * @param string          $action  read|edit.
	 * @param WP_REST_Request $request The request.
	 */
	private function authorise( string $action, WP_REST_Request $request ): bool|WP_Error {
		$entity_type = (string) $request['entity_type'];

		if ( ! $this->entities->has( $entity_type ) || ! $this->stream->streams( $entity_type ) ) {
			return $this->fail(
				'plugixa_crm_no_stream',
				__( 'That record type has no stream.', 'plugixa-crm' ),
				404
			);
		}

		$record = $this->records->load( $entity_type, (int) $request['entity_id'] );

		if ( null === $record ) {
			return $this->fail(
				'plugixa_crm_not_found',
				__( 'That record does not exist.', 'plugixa-crm' ),
				404
			);
		}

		return Capabilities::user_can( $action, $entity_type, $record ) ? true : $this->forbidden();
	}

	public function register_routes(): void {
		register_rest_route(
			$this->namespace,
			'/stream/(?P<entity_type>[a-z_]+)/(?P<entity_id>\d+)',
			array(
				array(
					'methods'             => 'GET',
					'callback'            => array( $this, 'index' ),
					'permission_callback' => array( $this, 'can_read' ),
				),
				array(
					'methods'             => 'POST',
					'callback'            => array( $this, 'store' ),
					'permission_callback' => array( $this, 'can_edit' ),
				),
			)
		);

		// Own scope: following subscribes only the signed-in user to a record's stream and changes nothing
		// on the record, so it needs read on that record.
		register_rest_route(
			$this->namespace,
			'/stream/(?P<entity_type>[a-z_]+)/(?P<entity_id>\d+)/follow',
			array(
				array(
					'methods'             => 'POST',
					'callback'            => array( $this, 'follow' ),
					'permission_callback' => array( $this, 'can_read' ),
				),
				array(
					'methods'             => 'DELETE',
					'callback'            => array( $this, 'unfollow' ),
					'permission_callback' => array( $this, 'can_read' ),
				),
			)
		);
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function index( WP_REST_Request $request ): WP_REST_Response {
		$entity_type = (string) $request['entity_type'];
		$entity_id   = (int) $request['entity_id'];

		return $this->ok(
			array(
				'entries'   => $this->stream->for_record( $entity_type, $entity_id ),
				'followers' => $this->stream->followers( $entity_type, $entity_id ),
				'following' => $this->stream->is_following( $entity_type, $entity_id, get_current_user_id() ),
			)
		);
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function store( WP_REST_Request $request ): WP_REST_Response|WP_Error {
		$body = (array) $request->get_json_params();

		$entry = $this->stream->post(
			(string) $request['entity_type'],
			(int) $request['entity_id'],
			(string) ( $body['body'] ?? '' )
		);

		if ( $entry instanceof WP_Error ) {
			return $entry;
		}

		return $this->index( $request );
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function follow( WP_REST_Request $request ): WP_REST_Response {
		$this->stream->follow(
			(string) $request['entity_type'],
			(int) $request['entity_id'],
			get_current_user_id()
		);

		return $this->index( $request );
	}

	/**
	 * @param WP_REST_Request $request The request.
	 */
	public function unfollow( WP_REST_Request $request ): WP_REST_Response {
		$this->stream->unfollow(
			(string) $request['entity_type'],
			(int) $request['entity_id'],
			get_current_user_id()
		);

		return $this->index( $request );
	}
}