<?php

declare(strict_types=1);

namespace Sentinelo\Backup;

use Sentinelo\Adapter\Wp\WpBackupRepository;
use Sentinelo\Adapter\Wp\WpLogger;
use Sentinelo\Adapter\Wp\WpObjectStorage;
use Sentinelo\AgentCore\Backup\ArchiveVerifier;
use Sentinelo\AgentCore\Backup\BackupRepository;
use Sentinelo\AgentCore\Port\Logger;
use Sentinelo\AgentCore\Port\ObjectStorage;

/**
 * Confirms that a completed backup's archive really is in cloud storage, at the size
 * we recorded.
 *
 * This exists because "the upload call succeeded" is not the same as "the object is
 * there". Addressed without path-style URLs, Backblaze B2 answers a silent 301 and the
 * object lands nowhere while the PUT reports success — the project's first documented
 * pitfall. A backup row marked completed, pointing at an object that does not exist,
 * is discovered at restore time, which is the worst possible moment.
 *
 * Goes through the {@see ObjectStorage} port. It previously carried its OWN copy of
 * the AWS SigV4 signing code — including the clock race that produced intermittent
 * 403s, and a region hardcoded to us-west-004 regardless of the site's credentials.
 * That copy is gone; signing now happens once, in AgentCore\Storage, verified against
 * the AWS SDK.
 */
class BackupVerifier
{
    private BackupRepository $backups;
    private ObjectStorage $storage;
    private Logger $logger;

    public function __construct(
        ?BackupRepository $backups = null,
        ?ObjectStorage $storage = null,
        ?Logger $logger = null,
    ) {
        $this->backups = $backups ?? new WpBackupRepository();
        $this->storage = $storage ?? new WpObjectStorage();
        $this->logger = $logger ?? new WpLogger();
    }

    /**
     * @return bool true when the object exists and matches the recorded size
     */
    public function verify(int $backupId): bool
    {
        $backup = $this->backups->findById($backupId);

        if (!$backup || empty($backup->cloud_path)) {
            $this->logger->log('warning', 'backup', "Cannot verify backup #{$backupId}: no cloud path recorded");

            return false;
        }

        $result = (new ArchiveVerifier($this->storage))->verify(
            (string) $backup->cloud_path,
            (int) ($backup->file_size_bytes ?? 0)
        );

        // Only a PROVEN mismatch condemns the backup. An inconclusive result means the
        // storage did not answer — marking the record failed on that would destroy a
        // perfectly good restore point over a network hiccup.
        if ($result->isCorrupt()) {
            $this->logger->log('error', 'backup', "Backup #{$backupId} verification failed: {$result->reason}");
            $this->backups->markVerificationFailed($backupId, (string) $result->reason);

            return false;
        }

        if ($result->isInconclusive()) {
            $this->logger->log('warning', 'backup', "Backup #{$backupId} non vérifié : {$result->reason}");

            return false;
        }

        $this->logger->log('info', 'backup', "Backup #{$backupId} vérifié ({$result->sizeBytes} octets)");

        return true;
    }
}