<?php

declare(strict_types=1);

namespace Sentinelo\Auth;

use Sentinelo\Adapter\Wp\WpCache;
use Sentinelo\AgentCore\Auth\RateLimitWindow;
use Sentinelo\AgentCore\Port\Cache;
use WP_Error;
use WP_REST_Request;

/**
 * WordPress binding of the shared rate-limit window.
 *
 * The decision arithmetic lives in {@see RateLimitWindow}; this class supplies the
 * caller identity and the storage (through the {@see Cache} port). Runs BEFORE API-key
 * validation — see RestController::authenticateRequest — so invalid-key floods are
 * throttled too.
 */
class RateLimiter
{
    private const LIMIT = 60;
    private const WINDOW = 60;

    public static function check(WP_REST_Request $request, ?Cache $cache = null): bool|WP_Error
    {
        $cache ??= new WpCache();

        // Key the bucket on the IP only: keying on the API key would give a
        // key-guessing attacker a fresh bucket per guess.
        $ip = sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'] ?? 'unknown'));
        $key = 'rate_' . md5($ip);

        $stored = $cache->get($key);
        $bucket = is_array($stored) ? $stored : null;

        $decision = (new RateLimitWindow(self::LIMIT, self::WINDOW))->hit($bucket, time());

        $cache->set($key, $decision['bucket'], $decision['ttl']);

        if ($decision['allowed']) {
            return true;
        }

        return new WP_Error(
            'SENTINELO_rate_limited',
            __('Too many requests. Please try again later.', 'sentinelo'),
            [
                'status'      => 429,
                'retry_after' => $decision['retryAfter'],
            ]
        );
    }
}