<?php
/**
 * Session Manager — generates and persists a privacy-safe visitor session key.
 *
 * Uses a cookie-based key (no personal data stored).
 * Falls back to a per-request fingerprint for cookieless environments.
 *
 * @package PulseViews\Analytics
 */

declare( strict_types=1 );

namespace PulseViews\Analytics;

if ( ! defined( 'ABSPATH' ) ) {
    exit; // Exit if accessed directly.
}

final class SessionManager {

    private const COOKIE_NAME = 'pulseviews_sess';

    public function get_or_create( int $ttl_seconds = 1800 ): string {
        // If session interval is 0, always generate a unique transient key per request
        if ( $ttl_seconds <= 0 ) {
            return $this->generate_key();
        }

        // Return existing cookie session if present and valid.
        if ( isset( $_COOKIE[ self::COOKIE_NAME ] ) ) {
            $val = sanitize_text_field( wp_unslash( $_COOKIE[ self::COOKIE_NAME ] ) );
            if ( $this->is_valid_session_key( $val ) ) {
                return $val;
            }
        }

        $key = $this->generate_key();
        $this->set_cookie( $key, $ttl_seconds );

        return $key;
    }

    private function generate_key(): string {
        return bin2hex( random_bytes( 16 ) );
    }

    private function is_valid_session_key( string $key ): bool {
        return (bool) preg_match( '/^[a-f0-9]{32}$/', $key );
    }

    private function set_cookie( string $key, int $ttl_seconds ): void {
        if ( headers_sent() || $ttl_seconds <= 0 ) {
            return;
        }

        setcookie( self::COOKIE_NAME, $key, [
            'expires'  => time() + $ttl_seconds,
            'path'     => '/',
            'secure'   => is_ssl(),
            'httponly' => true,
            'samesite' => 'Lax',
        ] );
    }
}