<?php
/**
 * Backend API client. Contract: docs/03-api-contract.md (source of truth).
 * Auth: Bearer license key (option 'refrank_license_key'). All calls via wp_remote_*.
 *
 * Every method returns either an associative array of `data` on success, or a
 * WP_Error whose code is the backend error code (bad_license, tier_limit,
 * gsc_not_connected, rate_limit, validation, ...) so the admin layer can render
 * an actionable notice.
 */

defined( 'ABSPATH' ) || exit;

class Refrank_API_Client {

	const TIMEOUT = 15;

	public static function api_base() {
		// Fixed to the REFRANK_API_BASE constant (default api.refreshrank.com,
		// overridable only in wp-config.php). Deliberately NOT a get_option()
		// override: a stored option would let any update_option() vector
		// redirect the license key + post content to an arbitrary host.
		return untrailingslashit( REFRANK_API_BASE );
	}

	public static function license_key() {
		return (string) get_option( 'refrank_license_key', '' );
	}

	/** Low-level request. $auth=true attaches the Bearer license key. */
	private static function request( $method, $path, $body = null, $auth = true ) {
		$args = array(
			'method'  => $method,
			'timeout' => self::TIMEOUT,
			'headers' => array( 'Accept' => 'application/json' ),
		);
		if ( $auth ) {
			$key = self::license_key();
			if ( '' === $key ) {
				return new WP_Error( 'bad_license', __( 'No license key set.', 'refreshrank' ) );
			}
			$args['headers']['Authorization'] = 'Bearer ' . $key;
		}
		if ( null !== $body ) {
			$args['headers']['Content-Type'] = 'application/json';
			$args['body']                    = wp_json_encode( $body );
		}

		$res = wp_remote_request( self::api_base() . $path, $args );
		if ( is_wp_error( $res ) ) {
			return new WP_Error( 'network', __( 'Could not reach the RefreshRank service.', 'refreshrank' ) );
		}

		$code = wp_remote_retrieve_response_code( $res );
		$json = json_decode( wp_remote_retrieve_body( $res ), true );

		if ( ! is_array( $json ) ) {
			return new WP_Error( 'bad_response', __( 'Unexpected response from the service.', 'refreshrank' ) );
		}
		if ( empty( $json['ok'] ) ) {
			$err = isset( $json['error'] ) ? $json['error'] : array();
			return new WP_Error(
				isset( $err['code'] ) ? $err['code'] : 'error',
				isset( $err['message'] ) ? $err['message'] : __( 'Request failed.', 'refreshrank' ),
				array( 'status' => $code )
			);
		}
		return isset( $json['data'] ) ? $json['data'] : array();
	}

	// --- endpoints (docs/03) ---------------------------------------------
	public static function activate( $license_key, $site_url ) {
		return self::request( 'POST', '/license/activate', array(
			'license_key' => $license_key,
			'site_url'    => $site_url,
		), false );
	}

	public static function license_status() {
		return self::request( 'GET', '/license/status' );
	}

	/** Mint a free account + first site in one call (docs/03 §Free signup). */
	public static function register_free( $site_url ) {
		return self::request( 'POST', '/license/register-free', array(
			'site_url' => $site_url,
		), false );
	}

	/**
	 * Redeem a promo code. Sends the current license key as bearer when one
	 * exists so the code stacks onto (upgrades) the account; otherwise the
	 * backend mints a fresh account for the code's tier.
	 */
	public static function redeem_code( $code ) {
		return self::request( 'POST', '/license/redeem', array(
			'code' => $code,
		), '' !== self::license_key() );
	}

	public static function gsc_connect_url() {
		$data = self::request( 'GET', '/sites/' . rawurlencode( self::site_id() ) . '/gsc/connect' );
		return is_wp_error( $data ) ? $data : ( isset( $data['auth_url'] ) ? $data['auth_url'] : '' );
	}

	public static function gsc_status() {
		return self::request( 'GET', '/sites/' . rawurlencode( self::site_id() ) . '/gsc/status' );
	}

	public static function sync() {
		return self::request( 'POST', '/sites/' . rawurlencode( self::site_id() ) . '/sync' );
	}

	public static function decay_queue( $limit = 50, $offset = 0, $sort = 'potential' ) {
		$q = http_build_query( array( 'limit' => $limit, 'offset' => $offset, 'sort' => $sort ) );
		return self::request( 'GET', '/sites/' . rawurlencode( self::site_id() ) . '/decay?' . $q );
	}

	public static function create_rewrite( $args ) {
		return self::request( 'POST', '/rewrites', $args );
	}

	public static function get_rewrite( $job_id ) {
		return self::request( 'GET', '/rewrites/' . rawurlencode( $job_id ) );
	}

	/**
	 * Mint a shareable white-label client report link (Agency tier). Branding
	 * fields are persisted server-side and reused on future reports.
	 */
	public static function create_report( $brand ) {
		return self::request( 'POST', '/sites/' . rawurlencode( self::site_id() ) . '/report', $brand );
	}

	private static function site_id() {
		return (string) get_option( 'refrank_site_id', '' );
	}
}