<?php
/**
 * HTTP client for the hub.
 *
 * @package Rahkar\WP
 */

declare( strict_types = 1 );

namespace Rahkar\WP\Modules\HubConnector;

defined( 'ABSPATH' ) || exit;

/**
 * Talks to the hub's ingest API (EVENTS-v1.md §3).
 *
 * Signed requests carry an HMAC over the exact bytes sent, compressed or not, so
 * the body is compressed first and signed second. Nothing here runs on a page
 * view: the only callers are the flush job and the connection screen.
 */
final class HubClient {

	/**
	 * Default hub. `RAHKAR_HUB_URL` in wp-config.php overrides it for development
	 * and staging.
	 */
	public const DEFAULT_URL = 'https://marketing.rahkarnet.com';

	/**
	 * Bodies smaller than this are not worth compressing.
	 */
	private const GZIP_FROM = 2048;

	/**
	 * Base URL of the hub, without a trailing slash.
	 */
	public static function baseUrl(): string {
		$url = defined( 'RAHKAR_HUB_URL' ) && is_string( RAHKAR_HUB_URL ) && '' !== RAHKAR_HUB_URL ? RAHKAR_HUB_URL : self::DEFAULT_URL;

		return untrailingslashit( $url );
	}

	/**
	 * HTTPS is required, except for an explicitly configured local hub.
	 */
	public static function urlIsAllowed(): bool {
		$url    = self::baseUrl();
		$scheme = (string) wp_parse_url( $url, PHP_URL_SCHEME );
		$host   = strtolower( (string) wp_parse_url( $url, PHP_URL_HOST ) );

		if ( 'https' === $scheme ) {
			return true;
		}

		$local = in_array( $host, [ 'localhost', '127.0.0.1', '::1' ], true ) || str_ends_with( $host, '.test' ) || str_ends_with( $host, '.local' );

		return 'http' === $scheme && $local && defined( 'RAHKAR_HUB_URL' );
	}

	/**
	 * Unsigned request, used only for pairing.
	 *
	 * @param string               $path Path under /api/ingest/v1/.
	 * @param array<string, mixed> $body JSON body.
	 */
	public function postUnsigned( string $path, array $body ): HubResponse {
		return $this->send( 'POST', $path, (string) wp_json_encode( $body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES ), null, 0 );
	}

	/**
	 * Signed request.
	 *
	 * @param string      $method      HTTP method.
	 * @param string      $path        Path under /api/ingest/v1/.
	 * @param string      $json        Body, already encoded; empty for GET.
	 * @param Credentials $credentials Store id and key.
	 * @param int         $clockOffset Seconds to add to the local clock.
	 */
	public function signed( string $method, string $path, string $json, Credentials $credentials, int $clockOffset ): HubResponse {
		return $this->send( $method, $path, $json, $credentials, $clockOffset );
	}

	/**
	 * Perform a request.
	 *
	 * @param string           $method      HTTP method.
	 * @param string           $path        Path under /api/ingest/v1/.
	 * @param string           $json        Body.
	 * @param Credentials|null $credentials Sign with these, when given.
	 * @param int              $clockOffset Seconds to add to the local clock.
	 */
	private function send( string $method, string $path, string $json, ?Credentials $credentials, int $clockOffset ): HubResponse {
		if ( ! self::urlIsAllowed() ) {
			return HubResponse::transportError( __( 'آدرس هاب باید HTTPS باشد.', 'rahkar-toolkit' ) );
		}

		$headers = [
			'Accept'       => 'application/json',
			'Content-Type' => 'application/json',
			'User-Agent'   => 'RahkarToolkit/' . RAHKAR_WP_VERSION . '; ' . home_url(),
		];
		$body    = $json;

		if ( strlen( $body ) >= self::GZIP_FROM && function_exists( 'gzencode' ) ) {
			$compressed = gzencode( $body, 6 );

			if ( false !== $compressed ) {
				$body                        = $compressed;
				$headers['Content-Encoding'] = 'gzip';
			}
		}

		if ( null !== $credentials ) {
			$timestamp                 = (string) ( time() + $clockOffset );
			$headers['X-RF-Store']     = $credentials->storeId;
			$headers['X-RF-Timestamp'] = $timestamp;
			$headers['X-RF-Signature'] = 'v1=' . hash_hmac( 'sha256', $timestamp . '.' . $body, $credentials->secret );
		}

		$args = [
			'method'      => $method,
			'timeout'     => 15,
			'redirection' => 0,
			'headers'     => $headers,
		];

		if ( 'GET' !== $method ) {
			$args['body'] = $body;
		}

		$response = wp_remote_request( self::baseUrl() . '/api/ingest/v1/' . ltrim( $path, '/' ), $args );

		if ( is_wp_error( $response ) ) {
			return HubResponse::transportError( $response->get_error_message() );
		}

		$decoded = json_decode( (string) wp_remote_retrieve_body( $response ), true );

		return new HubResponse(
			(int) wp_remote_retrieve_response_code( $response ),
			is_array( $decoded ) ? $decoded : [],
			(int) wp_remote_retrieve_header( $response, 'retry-after' )
		);
	}
}