<?php
defined( 'ABSPATH' ) || exit;

/**
 * The post meta of §12. Two groups with different owners:
 * the editor's choices (switch, voice) are writable over REST by whoever can
 * edit the post; the service's answers (status, path, hash) are readable in
 * the editor but written only by this plugin's own PHP.
 */
final class Readerr_Meta {
	public const ENABLED  = '_readerr_enabled';
	public const VOICE    = '_readerr_voice';
	public const STATUS   = '_readerr_status';
	public const PATH     = '_readerr_path';
	public const HASH     = '_readerr_hash';
	public const DURATION_MS = '_readerr_duration_ms';
	public const QUEUED_AT   = '_readerr_queued_at';
	/**
	 * The editor's choice for one save only: '' follows the portal's
	 * on_update setting, keep/regenerate overrides it. Readerr_Sync::on_save()
	 * reads it and deletes it before deciding anything.
	 */
	public const ON_SAVE     = '_readerr_on_save';
	public const ON_SAVE_CHOICES = array( 'keep', 'regenerate' );
	public const STATUSES = array( 'queued', 'published', 'needs_review', 'quota_exceeded', 'text_too_long', 'error' );
	public const SERVICE_OWNED = array( self::STATUS, self::PATH, self::HASH );

	/**
	 * Internal bookkeeping for the ingest retry counter — never registered
	 * with register_post_meta(), so it never shows up over REST.
	 */
	public const INGEST_ATTEMPT = '_readerr_ingest_attempt';

	/**
	 * When the service first answered `needs_review` for the post's current
	 * version: the start of the two weeks in which a release from the admin
	 * panel still reaches the post. Internal bookkeeping, like INGEST_ATTEMPT —
	 * never registered, so never over REST.
	 */
	public const REVIEW_SINCE = '_readerr_review_since';

	/**
	 * The voice the current audio was asked for, stored with the hash when the
	 * service accepts an ingest: a new voice always means new audio, and the
	 * hash alone cannot tell a voice change from a text change. Internal
	 * bookkeeping, never registered. Missing on audio made before 0.5.0.
	 */
	public const AUDIO_VOICE = '_readerr_audio_voice';

	private const PATH_PATTERN  = '#^/[A-Za-z0-9_-]+/[0-9A-HJKMNP-TV-Z]{26}\.mp3$#';
	private const VOICE_PATTERN = '/^[A-Za-z0-9][A-Za-z0-9:_.-]{0,63}$/';

	public static function register(): void {
		add_action( 'init', array( self::class, 'register_meta' ) );
		add_filter( 'rest_request_before_callbacks', array( self::class, 'drop_service_owned' ), 10, 3 );
	}

	/**
	 * Strip the service-owned keys from a post write before core sees them.
	 *
	 * core-data merges a meta edit into the whole edited meta object, so every
	 * save carries the editor's copy of status/path/hash. Core skips a key only
	 * when the sent value equals the stored one; a stale copy (the ingest wrote
	 * the hash after the editor loaded the post) reaches the auth_callback,
	 * which refuses, and the whole save fails with 403 — so the editor's own
	 * change is never saved and never sent.
	 */
	public static function drop_service_owned( $response, $handler, WP_REST_Request $request ) {
		if ( 'GET' === $request->get_method() || ! preg_match( '#^/wp/v2/posts(/|$)#', $request->get_route() ) ) {
			return $response;
		}
		$meta = $request->get_param( 'meta' );
		if ( is_array( $meta ) && array_intersect_key( $meta, array_flip( self::SERVICE_OWNED ) ) ) {
			$request->set_param( 'meta', array_diff_key( $meta, array_flip( self::SERVICE_OWNED ) ) );
		}
		return $response;
	}

	public static function register_meta(): void {
		$can_edit = static fn( $allowed, $meta_key, $post_id ) => current_user_can( 'edit_post', $post_id );
		$nobody   = static fn() => false;

		// The editor's choices and the service's answers are for the editor
		// (context=edit), not for an anonymous GET of the post - the hash and a
		// held file's path included. The block editor loads posts with
		// context=edit, so the sidebar still reads and writes all of them.
		$edit_only = array( 'schema' => array( 'context' => array( 'edit' ) ) );
		// [Δ] Tri-state: '' follows the portal default, so changing the default
		// reaches every post an editor never touched.
		self::meta( self::ENABLED, $can_edit, static fn( $v ) => in_array( $v, array( 'yes', 'no' ), true ) ? $v : '', $edit_only );
		self::meta( self::VOICE, $can_edit, static fn( $v ) => preg_match( self::VOICE_PATTERN, (string) $v ) ? (string) $v : '', $edit_only );
		self::meta( self::ON_SAVE, $can_edit, static fn( $v ) => in_array( $v, self::ON_SAVE_CHOICES, true ) ? $v : '', $edit_only );
		self::meta( self::STATUS, $nobody, array( self::class, 'sanitize_status' ), $edit_only );
		self::meta( self::PATH, $nobody, array( self::class, 'sanitize_path' ), $edit_only );
		self::meta( self::HASH, $nobody, 'sanitize_text_field', $edit_only );

		// Plan R11: written by Readerr_Sync only, read by Readerr_Render; never
		// in REST, so no editor save carries a stale copy of either.
		self::meta( self::DURATION_MS, $nobody, static fn( $v ) => (string) max( 0, (int) $v ), false );
		self::meta( self::QUEUED_AT, $nobody, static fn( $v ) => (string) max( 0, (int) $v ), false );
	}

	private static function meta( string $key, callable $auth, callable $sanitize, $show_in_rest = true ): void {
		register_post_meta(
			'post',
			$key,
			array(
				'type'              => 'string',
				'single'            => true,
				'default'           => '',
				'show_in_rest'      => $show_in_rest,
				'auth_callback'     => $auth,
				'sanitize_callback' => $sanitize,
			)
		);
	}

	public static function sanitize_status( $value ): string {
		return in_array( $value, self::STATUSES, true ) ? $value : '';
	}

	/** Only a bare path of our own shape — never a URL (§2.6). */
	public static function sanitize_path( $value ): string {
		return preg_match( self::PATH_PATTERN, (string) $value ) ? (string) $value : '';
	}
}