<?php

declare(strict_types=1);

namespace Sentinelo\Scanner\Checks;

use Sentinelo\AgentCore\Scanner\Check\SensitiveFilesScorer;
use Sentinelo\AgentCore\Scanner\CheckResult;

/**
 * Thin WordPress adapter: probes a handful of well-known sensitive paths over HTTP
 * and delegates exposure detection + scoring to the framework-agnostic
 * SensitiveFilesScorer.
 */
class SensitiveFilesCheck
{
    /** High-signal paths that should never be publicly reachable. */
    private const PATHS = [
        '.git/config',
        '.git/HEAD',
        '.env',
        'wp-config.php.bak',
        'wp-config.php.save',
        'wp-config.php~',
        '.htaccess.bak',
    ];

    public function run(): CheckResult
    {
        try {
            $responses = [];
            foreach (self::PATHS as $path) {
                $response = wp_remote_get(site_url('/' . $path), [
                    'timeout'     => 8,
                    'redirection' => 0,
                ]);
                if (is_wp_error($response)) {
                    continue;
                }
                $responses[] = [
                    'path' => $path,
                    'code' => (int) wp_remote_retrieve_response_code($response),
                    'body' => (string) wp_remote_retrieve_body($response),
                ];
            }

            return SensitiveFilesScorer::score($responses);
        } catch (\Throwable $e) {
            return new CheckResult(
                'sensitive_files',
                'skip',
                6,
                6,
                'info',
                ['error' => $e->getMessage()],
                'Vérification ignorée (exception interne) : ' . $e->getMessage()
            );
        }
    }
}