<?php

namespace PublishDeck\App;

// Exit if accessed directly.
if (! defined('ABSPATH')) {
    exit;
}

use PublishDeck\App\Hooks\Handlers\ActivationHandler;
use PublishDeck\App\Hooks\Handlers\AdminMenu;
use PublishDeck\App\Hooks\Handlers\MaintenanceJobs;
use PublishDeck\App\Hooks\Handlers\SidebarEnqueue;
use PublishDeck\App\Hooks\Handlers\SyncInterceptor;
use PublishDeck\App\Hooks\Handlers\UserCleanup;
use PublishDeck\App\Http\Routes\Api;
use PublishDeck\App\PostType\HubPreview;
use PublishDeck\App\PostType\HubPostType;
use PublishDeck\App\Services\Permissions\Capabilities;
use PublishDeck\App\Services\Permissions\MemberCaps;
use PublishDeck\App\Services\Queue\Scheduler;
use PublishDeck\App\Support\Ssrf;

/** Central application: wires the WordPress hooks, with no service container. */
class Application
{
    private $config;

    public function __construct(array $config)
    {
        $this->config = $config;
    }

    /** Master local-dev escape hatch, turning on both relaxations below; a wp-config constant only. */
    public static function allowLocal(): bool
    {
        // Strict === true, so a truthy misconfig can't silently disable the guards.
        return defined('FSPD_ALLOW_LOCAL') && FSPD_ALLOW_LOCAL === true;
    }

    /** Whether outbound requests verify TLS certificates; kept separate from host relaxation. */
    public static function sslVerify(): bool
    {
        return !(self::allowLocal() || (defined('FSPD_ALLOW_INSECURE_TLS') && FSPD_ALLOW_INSECURE_TLS === true));
    }

    /** Whether private hosts are reachable; host-level only, so HTTPS stays on the master flag. */
    public static function allowLocalTargets(): bool
    {
        return self::allowLocal() || (defined('FSPD_ALLOW_PRIVATE_HOSTS') && FSPD_ALLOW_PRIVATE_HOSTS === true);
    }

    /** Whether a site at this address may be sent its Application Password: HTTPS only, outside local mode. */
    public static function mayReceiveCredentials(string $url): bool
    {
        return self::allowLocal() || stripos($url, 'https://') === 0;
    }

    /** Registers the activation and runtime hooks. */
    public function boot(): void
    {
        $app = $this->config['app'];

        // WordPress passes $network_wide, so a network activation can install every site at once.
        register_activation_hook(FSPD_FILE, static function ($networkWide = false) use ($app): void {
            (new ActivationHandler($app))->run((bool) $networkWide);
        });

        add_action('wp_initialize_site', static function ($site) use ($app): void {
            if (!$site instanceof \WP_Site) {
                return;
            }

            require_once ABSPATH . 'wp-admin/includes/plugin.php';

            if (!is_plugin_active_for_network(plugin_basename(FSPD_FILE))) {
                return;
            }

            switch_to_blog((int) $site->blog_id);

            try {
                (new ActivationHandler($app))->install();
            } finally {
                restore_current_blog();
            }
        }, 20, 1);

        register_deactivation_hook(FSPD_FILE, [Scheduler::class, 'cancelRecurring']);

        // Activation won't re-run for an already-active install, so upgrade on a release or schema bump.
        add_action('admin_init', function () use ($app) {
            $activation = new ActivationHandler($app);
            if ($activation->needsUpgrade()) {
                $activation->run();

                return;
            }

            Capabilities::ensureSeeded($app['capability_type']);
        });

        Ssrf::register();
        (new HubPostType($app))->hooks();
        (new HubPreview($app))->hooks();
        (new MemberCaps($app))->hooks();
        (new Api($app))->hooks();
        (new AdminMenu($app))->hooks();
        (new SidebarEnqueue($app))->hooks();
        (new SyncInterceptor())->hooks();
        (new MaintenanceJobs())->hooks();
        (new UserCleanup())->hooks();
    }
}