<?php
defined( 'ABSPATH' ) || exit;

/**
 * Delivery of confirmed entries to webhook URLs (Zapier, Make, Slack incoming webhooks, custom
 * endpoints, and so on). Most services read entries over plain HTTP, so a single generic POST
 * covers them without needing a separate integration per provider.
 */

/**
 * The configured webhook URLs for a form.
 *
 * @return string[]
 */
function pubforms_webhook_urls( $form ) {
	$urls = array();
	foreach ( explode( "\n", (string) ( $form['settings']['webhook_urls'] ?? '' ) ) as $url ) {
		$url = trim( $url );
		if ( '' === $url || in_array( $url, $urls, true ) ) {
			continue;
		}
		$lower = strtolower( $url );
		if ( 0 === strpos( $lower, 'https://' ) || 0 === strpos( $lower, 'http://' ) ) {
			$urls[] = $url;
		}
	}
	return $urls;
}

/**
 * The JSON payload sent for an entry. Kept pure so integrations and tests can reason about it.
 *
 * @return array
 */
function pubforms_webhook_payload( $form, $entry ) {
	$fields = array();
	foreach ( (array) $entry->items as $item ) {
		$label            = (string) ( $item['label'] ?? '' );
		$value            = (string) ( $item['value'] ?? '' );
		$fields[ $label ] = $value; // Uploaded files are private: the payload carries the file name, never a link.
	}
	return array(
		'event'           => 'entry_created',
		'form_id'         => (int) $form['id'],
		'form_title'      => $form['title'],
		'entry_id'        => (int) $entry->id,
		'created_at'      => (string) ( $entry->created_at ?? '' ),
		'fields'          => $fields,
	);
}

/**
 * Post a payload to one webhook. Extracted so the request itself can be asserted in tests.
 */
function pubforms_send_webhook( $url, $payload ) {
	// wp_safe_remote_post() refuses loopback, private-network and unusual-port targets.
	return wp_safe_remote_post( $url, array(
		'headers' => array(
			'Content-Type'    => 'application/json',
			'X-PubForms-Event' => 'entry_created',
		),
		'body'    => (string) wp_json_encode( $payload ),
		'timeout' => 5,
	) );
}

/**
 * Deliver a confirmed entry to every webhook configured on its form. Best-effort: a failed delivery
 * never fails the submission.
 */
function pubforms_deliver_webhooks( $form, $entry ) {
	if ( ! $form || ! $entry ) {
		return;
	}
	$payload = pubforms_webhook_payload( $form, $entry );
	foreach ( pubforms_webhook_urls( $form ) as $url ) {
		pubforms_send_webhook( $url, $payload );
	}
}