<?php

declare(strict_types=1);

namespace Sentinelo\Auth;

use Sentinelo\Core\Config;
use Sentinelo\Core\Logger;
use WP_REST_Request;
use WP_Error;

class ApiKeyValidator
{
    public static function validate(WP_REST_Request $request): bool|WP_Error
    {
        $apiKey = $request->get_header('X-Sentinelo-API-Key');
        $ip     = sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'] ?? 'unknown'));

        if (empty($apiKey)) {
            Logger::warning('auth', 'Missing API key from ' . $ip);
            return new WP_Error(
                'SENTINELO_unauthorized',
                __('Missing API key.', 'sentinelo'),
                ['status' => 401]
            );
        }

        $storedKey = Config::getApiKey();
        if (empty($storedKey)) {
            Logger::warning('auth', 'No API key configured');
            return new WP_Error(
                'SENTINELO_unauthorized',
                __('No API key configured.', 'sentinelo'),
                ['status' => 401]
            );
        }

        if (!hash_equals($storedKey, $apiKey)) {
            Logger::warning('auth', 'Invalid API key from ' . $ip);
            return new WP_Error(
                'SENTINELO_unauthorized',
                __('Invalid API key.', 'sentinelo'),
                ['status' => 401]
            );
        }

        return true;
    }
}