<?php
defined( 'ABSPATH' ) || exit;

/**
 * Customer-panel spec §6.1: the account's access state, mirrored from
 * GET /v1/quota into a transient so rendering a page never waits on the
 * service. Checked once a day by WP-Cron and again on every settings-screen
 * visit (Readerr_Settings::render_page() already calls the service for the
 * quota line, so that same response updates this transient too — a
 * purchase shows its effect without waiting for the cron tick).
 */
final class Readerr_Access {
	public const TRANSIENT  = 'readerr_access';
	public const CRON_HOOK  = 'readerr_access_check';
	/** Spec §6.1, verbatim — a fixed address, not a per-portal setting. */
	public const BILLING_URL = 'https://readerr.app/app/billing';

	private const STATES = array( 'active', 'grace', 'lapsed' );

	/**
	 * P11: no successful check in this long is treated as lapsed even
	 * without an explicit 401 — an unreachable service must not leave a
	 * cancelled account's player running forever.
	 */
	private const STALE_S = 7 * DAY_IN_SECONDS;

	/**
	 * Comfortably longer than STALE_S: STALE_S (not the transient's own
	 * expiry) is what decides "lapsed", so this only needs to outlive it,
	 * not equal it.
	 */
	private const STORAGE_TTL_S = 30 * DAY_IN_SECONDS;

	public static function register(): void {
		add_action( 'init', array( self::class, 'schedule' ) );
		add_action( self::CRON_HOOK, array( self::class, 'refresh' ) );
		// Fired by Readerr_Client::request() on any 401: a revoked or
		// disabled key is a definitive "lapsed", not a transport failure,
		// wherever in the plugin the call that hit it came from.
		add_action( 'readerr_unauthorized', array( self::class, 'lapse' ) );
	}

	public static function schedule(): void {
		if ( ! wp_next_scheduled( self::CRON_HOOK ) ) {
			wp_schedule_event( time(), 'daily', self::CRON_HOOK );
		}
	}

	public static function deactivate(): void {
		wp_clear_scheduled_hook( self::CRON_HOOK );
	}

	/** WP-Cron's own entry point: fetch and store, ignoring transport failures. */
	public static function refresh(): void {
		$client = Readerr_Client::from_settings();
		if ( $client ) {
			self::apply_response( $client->quota() );
		}
	}

	/**
	 * Shared by refresh() and the settings screen, which makes this same
	 * call already (to show the quota line) — one request instead of two.
	 */
	public static function apply_response( array $response ): void {
		if ( 200 === $response['status'] && is_array( $response['body'] ) ) {
			$state = $response['body']['access'] ?? null;
			if ( in_array( $state, self::STATES, true ) ) {
				$ends_at = $response['body']['access_ends_at'] ?? null;
				self::store( $state, is_string( $ends_at ) ? $ends_at : null );
			}
			// A 200 without a recognisable 'access' key (an older service)
			// leaves the transient untouched rather than guessing.
			return;
		}
		if ( 401 === $response['status'] ) {
			self::lapse();
		}
		// Any other outcome (network failure, 429/5xx, malformed body): the
		// checked_at we already have keeps ageing towards STALE_S (P11)
		// instead of being refreshed by a call that told us nothing.
	}

	public static function lapse(): void {
		self::store( 'lapsed', null );
	}

	private static function store( string $state, ?string $ends_at ): void {
		// The effective state, not the stored one: a player hidden by
		// staleness (P11) was cached without the player, so recovering from
		// it must purge like any other way out of "lapsed".
		$previous_state = self::state();
		set_transient(
			self::TRANSIENT,
			array( 'state' => $state, 'ends_at' => $ends_at, 'checked_at' => time() ),
			self::STORAGE_TTL_S
		);
		// Spec §6.1: only a transition into or out of "lapsed" purges pages —
		// the same state written again (the common case, once a day) must not.
		if ( $state !== $previous_state && ( 'lapsed' === $state || 'lapsed' === $previous_state ) ) {
			Readerr_Cache::purge_all();
		}
	}

	/**
	 * The effective state, staleness folded in (P11). Defaults to "active":
	 * a fresh install with no check yet must not hide a player that was
	 * never shown to be gone.
	 */
	public static function state(): string {
		$data = get_transient( self::TRANSIENT );
		if ( ! is_array( $data ) || ! isset( $data['state'], $data['checked_at'] ) ) {
			return 'active';
		}
		if ( time() - (int) $data['checked_at'] > self::STALE_S ) {
			return 'lapsed';
		}
		return in_array( $data['state'], self::STATES, true ) ? $data['state'] : 'active';
	}

	/** The grace period's end (ISO 8601 UTC, as the service sent it), or null. */
	public static function ends_at(): ?string {
		$data = get_transient( self::TRANSIENT );
		return is_array( $data ) && is_string( $data['ends_at'] ?? null ) ? $data['ends_at'] : null;
	}
}