<?php

declare(strict_types=1);

namespace Sentinelo\Scanner\Checks;

// phpcs:disable WordPress.WP.AlternativeFunctions -- backups, snapshots and logs stream files of up to several GB in bounded chunks; WP_Filesystem has no streaming API and may need FTP credentials that a background REST request cannot ask for.

use Sentinelo\AgentCore\Scanner\Check\SslScorer;
use Sentinelo\AgentCore\Scanner\CheckResult;

/**
 * Thin WordPress adapter: reads the TLS certificate via a socket and delegates the
 * scoring to the framework-agnostic SslScorer. The no-HTTPS / unreachable / invalid
 * paths are platform I/O concerns and stay here.
 */
class SslCheck
{
    public function run(): CheckResult
    {
        try {
            if (!is_ssl()) {
                return new CheckResult(
                    'ssl',
                    'fail',
                    0,
                    8,
                    'critical',
                    ['active' => false],
                    'HTTPS n\'est pas actif — c\'est une faille critique'
                );
            }

            $host = parse_url(site_url(), PHP_URL_HOST) ?? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'] ?? 'localhost'));
            $context = stream_context_create(['ssl' => ['capture_peer_cert' => true]]);
            $socket = @stream_socket_client('ssl://' . $host . ':443', $errno, $errstr, 5, STREAM_CLIENT_CONNECT, $context);

            if (!$socket) {
                return new CheckResult(
                    'ssl',
                    'warn',
                    4,
                    8,
                    'high',
                    ['active' => true, 'error' => 'Impossible de récupérer les détails du certificat'],
                    'Vérifiez la validité du certificat SSL'
                );
            }

            $params = stream_context_get_params($socket);
            $cert = openssl_x509_parse($params['options']['ssl']['peer_certificate']);
            fclose($socket);

            if (!$cert) {
                return new CheckResult(
                    'ssl',
                    'warn',
                    4,
                    8,
                    'high',
                    ['active' => true, 'error' => 'Certificat invalide'],
                    'Le certificat SSL semble invalide'
                );
            }

            $validTo = $cert['validTo_time_t'] ?? 0;
            $daysRemaining = (int) round(($validTo - time()) / 86400);
            $protocol = sanitize_text_field(wp_unslash($_SERVER['SSL_PROTOCOL'] ?? 'TLS'));
            $issuer = is_array($cert['issuer'] ?? null) ? ($cert['issuer']['O'] ?? 'Unknown') : 'Unknown';

            return SslScorer::score($daysRemaining, $protocol, $issuer);
        } catch (\Throwable $e) {
            return new CheckResult(
                'ssl',
                'skip',
                8,
                8,
                'info',
                ['error' => $e->getMessage()],
                'Vérification ignorée (exception interne) : ' . $e->getMessage()
            );
        }
    }
}