<?php
/**
 * Set/read _saddle_analytics_v and _saddle_analytics_s — PHP-side only, never
 * JavaScript. Used only in cookie mode (remember_visitors); cookieless mode
 * expires them.
 * JS-set cookies are capped to 7 days by Safari ITP; a PHP Set-Cookie header
 * is what keeps 365-day attribution honest.
 */

defined( 'ABSPATH' ) || exit;

final class Saddle_Analytics_Cookie {

	const VISITOR      = '_saddle_analytics_v';
	const SESSION      = '_saddle_analytics_s';
	const VISITOR_LIFE = 365 * DAY_IN_SECONDS;
	const SESSION_LIFE = 30 * MINUTE_IN_SECONDS; // Sliding: re-sent on every hit.

	public static function visitor(): ?string {
		return self::read( self::VISITOR );
	}

	public static function session(): ?string {
		return self::read( self::SESSION );
	}

	/** A cookie's value only if it is one of our 32-hex ids; anything else is ignored. */
	public static function read( string $name ): ?string {
		$id = isset( $_COOKIE[ $name ] ) ? sanitize_key( wp_unslash( (string) $_COOKIE[ $name ] ) ) : null;
		return Saddle_Analytics_Step_Visitor::valid_id( $id ) ? $id : null;
	}

	/** Send both cookies on the current response. Safe to call before output. */
	public static function send( string $visitor_id, string $session_id ): void {
		if ( headers_sent() ) {
			return;
		}
		self::set( self::VISITOR, $visitor_id, time() + self::VISITOR_LIFE );
		self::set( self::SESSION, $session_id, time() + self::SESSION_LIFE );
	}

	/**
	 * Cookieless mode: expire either cookie if the browser still sends it, so
	 * switching modes leaves nothing behind on the visitor's device.
	 */
	public static function expire(): void {
		self::expire_names( array( self::VISITOR, self::SESSION ) );
	}

	/** Expire the named cookies the browser sent, with the same path/domain rules they were set with. */
	public static function expire_names( array $names ): void {
		if ( headers_sent() ) {
			return;
		}
		foreach ( $names as $name ) {
			if ( isset( $_COOKIE[ $name ] ) ) {
				self::set( (string) $name, '', time() - YEAR_IN_SECONDS );
			}
		}
	}

	private static function set( string $name, string $value, int $expires ): void {
		setcookie(
			$name,
			$value,
			array(
				'expires'  => $expires,
				'path'     => defined( 'COOKIEPATH' ) && COOKIEPATH ? COOKIEPATH : '/',
				'domain'   => defined( 'COOKIE_DOMAIN' ) && COOKIE_DOMAIN ? COOKIE_DOMAIN : '',
				'secure'   => is_ssl(),
				'httponly' => true,
				'samesite' => 'Lax',
			)
		);
	}
}