<?php
namespace QWSpeedCache\Cache;

defined( 'ABSPATH' ) || exit;

/**
 * Advanced cache delivery safety — when a request must never be page-cached.
 * Original policy (quizzes, auth, commerce, payments, REST, admin, multisite edge cases).
 */
class SafetyPolicy {

	/**
	 * Default URI fragments that force a cache miss.
	 *
	 * @return string[]
	 */
	public static function sensitive_uri_fragments() {
		$frags = array(
			'/wp-admin',
			'/wp-login.php',
			'/wp-signup.php',
			'/wp-cron.php',
			'/xmlrpc.php',
			'/cart',
			'/checkout',
			'/my-account',
			'/order-pay',
			'/order-received',
			'/add-to-cart',
			'/wc-api/',
			'/wc-auth/',
			'/customer-logout',
			'/quiz',
			'/quizzes',
			'/lesson',
			'/course',
			'/wp-json/',
			'/feed/',
		);
		// Extensions may add restrictions but cannot remove built-in protections.
		if ( function_exists( 'apply_filters' ) ) {
			$extra = apply_filters( 'qwsc_cache_sensitive_uri_fragments', $frags );
			if ( is_array( $extra ) ) {
				$frags = array_merge( $frags, $extra );
			}
		}
		return array_values( array_unique( $frags ) );
	}

	/**
	 * Cookie name prefixes that force a miss.
	 *
	 * @return string[]
	 */
	public static function sensitive_cookie_prefixes() {
		$cookies = array(
			'wordpress_logged_in_',
			'wp-postpass_',
			'woocommerce_items_in_cart',
			'woocommerce_cart_hash',
			'wp_woocommerce_session_',
			'comment_author_',
		);
		// Extensions may add restrictions but cannot remove built-in protections.
		if ( function_exists( 'apply_filters' ) ) {
			$extra = apply_filters( 'qwsc_cache_sensitive_cookie_prefixes', $cookies );
			if ( is_array( $extra ) ) {
				$cookies = array_merge( $cookies, $extra );
			}
		}
		return array_values( array_unique( $cookies ) );
	}

	/**
	 * Cookies that always force a miss, including for authenticated requests
	 * (cart/session personalization must never be shared).
	 *
	 * @return string[]
	 */
	public static function always_sensitive_cookie_prefixes() {
		return array(
			'wp-postpass_',
			'woocommerce_items_in_cart',
			'woocommerce_cart_hash',
			'wp_woocommerce_session_',
		);
	}

	/**
	 * @param string $uri Request URI.
	 * @return bool
	 */
	public static function uri_is_sensitive( $uri ) {
		$path = Exclusions::path_only( (string) $uri );
		foreach ( self::sensitive_uri_fragments() as $frag ) {
			$frag = (string) $frag;
			if ( '' !== $frag && false !== stripos( $path, $frag ) ) {
				return true;
			}
		}
		return false;
	}

	/**
	 * @param array $cookies Cookie map.
	 * @return bool
	 */
	public static function cookies_are_sensitive( array $cookies ) {
		foreach ( self::sensitive_cookie_prefixes() as $prefix ) {
			$prefix = (string) $prefix;
			if ( '' === $prefix ) {
				continue;
			}
			foreach ( array_keys( $cookies ) as $name ) {
				if ( 0 === strpos( (string) $name, $prefix ) ) {
					return true;
				}
			}
		}
		return false;
	}

	/**
	 * @param array $cookies Cookie map.
	 * @return bool
	 */
	public static function cookies_are_always_sensitive( array $cookies ) {
		foreach ( self::always_sensitive_cookie_prefixes() as $prefix ) {
			foreach ( array_keys( $cookies ) as $name ) {
				if ( 0 === strpos( (string) $name, $prefix ) ) {
					return true;
				}
			}
		}
		return false;
	}

	/**
	 * Full request policy (testable without full Engine instance).
	 *
	 * Args:
	 * - method, uri, cookies, is_admin, is_logged_in, is_preview, is_feed,
	 * - doing_ajax, rest_request, donotcachepage, has_post_password, is_multisite_signup
	 * Authenticated requests always bypass public page cache; private cache is not implemented.
	 *
	 * @param array $args Request context.
	 * @return bool True if page cache is allowed.
	 */
	/**
	 * Same checks as request_is_cacheable, with a stable reason code for headers / admin bar.
	 *
	 * @param array $args Request context.
	 * @return array{allowed:bool,reason:string}
	 */
	public static function request_cache_decision( array $args ) {
		$method = strtoupper( isset( $args['method'] ) ? (string) $args['method'] : 'GET' );
		if ( ! in_array( $method, array( 'GET', 'HEAD' ), true ) ) {
			return array( 'allowed' => false, 'reason' => 'method' );
		}
		if ( ! empty( $args['is_admin'] ) ) {
			return array( 'allowed' => false, 'reason' => 'admin' );
		}
		if ( ! empty( $args['is_feed'] ) ) {
			return array( 'allowed' => false, 'reason' => 'feed' );
		}
		if ( ! empty( $args['is_preview'] ) ) {
			return array( 'allowed' => false, 'reason' => 'preview' );
		}
		if ( ! empty( $args['donotcachepage'] ) ) {
			return array( 'allowed' => false, 'reason' => 'donotcachepage' );
		}
		if ( ! empty( $args['doing_ajax'] ) ) {
			return array( 'allowed' => false, 'reason' => 'ajax' );
		}
		if ( ! empty( $args['rest_request'] ) ) {
			return array( 'allowed' => false, 'reason' => 'rest' );
		}
		if ( ! empty( $args['has_post_password'] ) ) {
			return array( 'allowed' => false, 'reason' => 'password' );
		}
		if ( ! empty( $args['is_multisite_signup'] ) ) {
			return array( 'allowed' => false, 'reason' => 'signup' );
		}

		$uri = isset( $args['uri'] ) ? (string) $args['uri'] : '';
		if ( self::uri_is_sensitive( $uri ) ) {
			return array( 'allowed' => false, 'reason' => 'uri' );
		}

		$cookies = isset( $args['cookies'] ) && is_array( $args['cookies'] ) ? $args['cookies'] : array();

		if ( self::cookies_are_always_sensitive( $cookies ) ) {
			return array( 'allowed' => false, 'reason' => 'cart_cookie' );
		}

		// Fail closed: the Free cache key is shared across users. Until Pro
		// supplies an audited per-user storage/serving boundary, never cache
		// authenticated requests, even if an old premium setting remains saved.
		if ( ! empty( $args['is_logged_in'] ) ) {
			return array( 'allowed' => false, 'reason' => 'logged_in' );
		}
		if ( self::cookies_are_sensitive( $cookies ) ) {
			return array( 'allowed' => false, 'reason' => 'cookie' );
		}

		return array( 'allowed' => true, 'reason' => 'ok' );
	}

	public static function request_is_cacheable( array $args ) {
		$d = self::request_cache_decision( $args );
		return ! empty( $d['allowed'] );
	}

	/**
	 * Device segment for cache keys: "mobile" or "desktop".
	 *
	 * @param array $settings Plugin settings.
	 * @param bool  $is_mobile Whether the request is mobile.
	 * @return string
	 */
	public static function device_segment( array $settings, $is_mobile ) {
		if ( ! empty( $settings['cache_mobile'] ) && $is_mobile ) {
			return 'mobile';
		}
		return 'desktop';
	}
}