<?php
/**
 * Base REST controller.
 *
 * @package ProfitEngine
 */

declare( strict_types=1 );

namespace ProfitEngine\Rest;

use ProfitEngine\Support\Capabilities;
use WP_REST_Request;

defined( 'ABSPATH' ) || exit;

/**
 * Shared behaviour for every PPE REST controller.
 *
 * Centralises the namespace and the permission check so no endpoint can be
 * registered without capability enforcement.
 */
abstract class AbstractController {

	/**
	 * REST namespace shared by all controllers.
	 */
	protected string $namespace = 'profit-engine/v1';

	/**
	 * Register this controller's routes.
	 */
	abstract public function register_routes(): void;

	/**
	 * Standard permission callback: require the management capability.
	 *
	 * WordPress' REST cookie authentication also validates the `wp_rest` nonce
	 * for cookie-authenticated requests, so both authn and authz are covered.
	 *
	 * @return bool
	 */
	public function check_permission(): bool {
		return Capabilities::current_user_can();
	}

	/**
	 * Convenience: read a sanitised integer request param.
	 *
	 * @param WP_REST_Request $request Request.
	 * @param string          $key      Param name.
	 * @param int             $fallback Value when the param is absent.
	 */
	protected function int_param( WP_REST_Request $request, string $key, int $fallback = 0 ): int {
		$value = $request->get_param( $key );
		return null === $value ? $fallback : (int) $value;
	}
}