<?php
/**
 * Adds the response signature to answers for a signed, token-authenticated request.
 *
 * @package Shiftora\Api\Auth
 */

declare(strict_types=1);

namespace Shiftora\Api\Auth;

use Shiftora\Connection\ConnectionManager;
use WP_REST_Request;
use WP_REST_Response;

// Prevent direct file access.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class ResponseSigner {

	public function __construct(
		private readonly ConnectionManager $connections
	) {}

	public function register(): void {
		// After core's own filters (such as _fields) have shaped the data, so the hash is of what is sent.
		add_filter( 'rest_post_dispatch', [ $this, 'sign_response' ], 20, 3 );
	}

	/**
	 * `rest_post_dispatch` hook. WordPress encodes the data with wp_json_encode() and no
	 * flags, so hashing the same encoding here is a hash of the bytes the peer receives.
	 *
	 * @param mixed $response A WP_REST_Response, or whatever an earlier filter returned.
	 * @return mixed
	 */
	public function sign_response( $response, $server = null, $request = null ) {
		// Every REST response on the site passes through here, so the cheap checks come
		// before the data is encoded.
		if ( ! $response instanceof WP_REST_Response
			|| ! $request instanceof WP_REST_Request
			|| ! is_object( $request->get_param( '_shiftora_connection' ) )
			|| ! ResponseSignature::covers( $request->get_route() )
		) {
			return $response;
		}

		$body = wp_json_encode( $response->get_data() );
		if ( ! is_string( $body ) ) {
			return $response;
		}

		foreach ( $this->headers( $request, $response->get_status(), $body ) as $name => $value ) {
			$response->header( $name, $value );
		}

		return $response;
	}

	/**
	 * The signature headers for a response to an authenticated request, or none when the
	 * request carried no verified connection (a public route, or a refused request).
	 *
	 * @return array<string, string>
	 */
	public function headers( WP_REST_Request $request, int $status, string $body ): array {
		$connection        = $request->get_param( '_shiftora_connection' );
		$request_signature = (string) $request->get_header( 'X-Shiftora-Signature' );
		if ( ! is_object( $connection ) || '' === $request_signature ) {
			return [];
		}

		try {
			$secret = $this->connections->get_remote_token( $connection );
		} catch ( \Throwable $e ) {
			return [];
		}

		$timestamp = time();

		return [
			ResponseSignature::TIMESTAMP_HEADER => (string) $timestamp,
			ResponseSignature::SIGNATURE_HEADER => ResponseSignature::sign( $secret, $request_signature, $status, $body, $timestamp ),
		];
	}
}