<?php
/**
 * Query string a peer sent through the admin-ajax proxy, for the signature check.
 *
 * @package Shiftora\Api\Auth
 */

declare(strict_types=1);

namespace Shiftora\Api\Auth;

use Shiftora\Support\ServerVars;

// Prevent direct file access.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class ForwardedQuery {

	private const MAX_LENGTH = 8192;

	private static ?string $forwarded = null;

	/**
	 * Not run through sanitize_text_field(): that strips %xx octets, and the signature covers
	 * the query byte for byte. A strict charset check keeps the raw value without letting
	 * anything odd reach the signed string.
	 */
	public static function validate( string $query ): ?string {
		if ( strlen( $query ) > self::MAX_LENGTH || 1 !== preg_match( '/\A[A-Za-z0-9_\-.~%=&+,\[\];:@!*\/]*\z/', $query ) ) {
			return null;
		}

		return $query;
	}

	/** Null clears it, so a direct REST call reads the real query string again. */
	public static function set( ?string $query ): void {
		self::$forwarded = $query;
	}

	/**
	 * What the signature covers: the proxied query when there is one, otherwise the request's own.
	 * Null when the request carries a query this class would not sign; the caller must refuse
	 * it, because WordPress still parses that query and a signature over '' would not cover it.
	 */
	public static function current(): ?string {
		return self::$forwarded ?? ServerVars::query_string();
	}
}