<?php
/**
 * Saves the manual-backup retention number from the Settings screen.
 *
 * @package Shiftora\Backup
 */

declare(strict_types=1);

namespace Shiftora\Backup;

use WP_Error;

// Prevent direct file access.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Its own form and nonce, apart from TransferSettings, whose save() resets any
 * field it does not receive (the TLS checkbox among them).
 */
final class BackupSettings {

	public const NONCE_ACTION = 'shiftora_backup_settings';

	/**
	 * @param array<string, mixed> $request Submitted fields, i.e. $_POST.
	 *
	 * @return bool|WP_Error True when saved, otherwise why not.
	 */
	public function save( array $request ): bool|WP_Error {
		if ( ! current_user_can( 'manage_options' ) ) {
			return new WP_Error(
				'shiftora_settings_forbidden',
				__( 'You do not have permission to change this setting.', 'shiftora' )
			);
		}

		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( (string) ( $request['_wpnonce'] ?? '' ) ) ), self::NONCE_ACTION ) ) {
			return new WP_Error(
				'shiftora_settings_forbidden',
				__( 'This request could not be verified. Please reload the page and try again.', 'shiftora' ),
				[ 'status' => 403 ]
			);
		}

		$raw = $request[ BackupCleaner::RETENTION_OPTION ] ?? null;

		if ( null === $raw || ! is_numeric( $raw ) ) {
			return true; // Left blank: keep whatever is stored.
		}

		$value = max( BackupCleaner::MIN_RETENTION, min( BackupCleaner::MAX_RETENTION, (int) $raw ) );

		if ( BackupCleaner::DEFAULT_RETENTION === $value ) {
			delete_option( BackupCleaner::RETENTION_OPTION );
		} else {
			update_option( BackupCleaner::RETENTION_OPTION, $value );
		}

		return true;
	}
}