<?php
/**
 * Tokens, and how long they are worth keeping.
 *
 * @package SharelyAI
 */

namespace SharelyAI;

defined( 'ABSPATH' ) || exit;

/**
 * The sync bearer: minted from the API key, cached, and dropped when refused.
 *
 * Minting is a network call, and a full sync makes hundreds of requests, so the
 * token is cached. It is cached in a transient rather than an option because it
 * expires on its own and losing it costs one extra call.
 *
 * This token carries no roles, which is what makes it the *sync* credential: it
 * sees everything and may write. It must never reach a browser. The visitor
 * token and the search bearer are different objects and arrive with P4.
 */
final class Credentials {

	/**
	 * The workspace is part of the key: a bearer minted for one workspace is no
	 * use to another, and reusing it is how a reconnected site talks to the
	 * wrong place. See the same note in `Roles`.
	 */
	private const TRANSIENT = 'sharelyai_sync_bearer';

	/**
	 * Kept well short of the token's own hour, so a long sync cannot have one
	 * expire mid-run and fail a batch for no reason.
	 */
	private const TTL = 1800;

	/**
	 * Constructor.
	 *
	 * @param Connection $connection Credentials and endpoints.
	 */
	public function __construct( private Connection $connection ) {}

	/**
	 * A bearer for writing, minting one if there is none cached.
	 *
	 * @return array{ok:bool, token:string, code:string, message:string}
	 */
	public function sync_bearer(): array {
		$cached = get_transient( $this->cache_key() );
		if ( is_string( $cached ) && '' !== $cached ) {
			return $this->ok( $cached );
		}
		return $this->mint();
	}

	/**
	 * Throws the cached token away.
	 *
	 * Called when the platform refuses one: a token the workspace no longer
	 * accepts is worse than no token, because every retry reuses it.
	 */
	public function forget(): void {
		delete_transient( $this->cache_key() );
		delete_transient( self::TRANSIENT );
	}

	/**
	 * Mints a fresh bearer, replacing anything cached.
	 *
	 * @return array{ok:bool, token:string, code:string, message:string}
	 */
	public function mint(): array {
		$result = ( new Client( $this->connection ) )->mint_bearer();
		if ( ! $result['ok'] ) {
			return array(
				'ok'      => false,
				'token'   => '',
				'code'    => (string) $result['code'],
				'message' => (string) $result['message'],
			);
		}

		$token = is_array( $result['data'] ) ? (string) ( $result['data']['token'] ?? '' ) : '';
		if ( '' === $token ) {
			return array(
				'ok'      => false,
				'token'   => '',
				'code'    => 'NO_TOKEN',
				'message' => __( 'Sharely returned no token.', 'sharelyai' ),
			);
		}

		set_transient( $this->cache_key(), $token, self::TTL );
		return $this->ok( $token );
	}

	/**
	 * A successful result.
	 *
	 * @param string $token The bearer.
	 *
	 * @return array{ok:bool, token:string, code:string, message:string}
	 */
	private function ok( string $token ): array {
		return array(
			'ok'      => true,
			'token'   => $token,
			'code'    => '',
			'message' => '',
		);
	}

	/**
	 * The cache key for the workspace this connection points at.
	 */
	private function cache_key(): string {
		return self::TRANSIENT . '_' . md5( $this->connection->workspace_id() );
	}
}