<?php
/**
 * Keeps the operator signed in across the moment a pull replaces this site's accounts.
 *
 * @package Shiftora\Migration
 */

declare(strict_types=1);

namespace Shiftora\Migration;

// Prevent direct file access.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * A pull swaps the users table in one rename at the end of the database stage, and the
 * browser's cookie names an account that no longer exists. The worker that did the swap
 * has no browser to answer, so at start the operator's page is handed a one-time secret.
 * When its polls lose the session it presents that secret, and this signs it in as the
 * same username in the new users table, if that account exists and administers the site.
 *
 * The secret is issued only for a pull that replaces the account tables, stored only as
 * a hash under an option this plugin's protected prefix carries across the swap, bound
 * to one migration and one username, usable only once the swap has happened, spent on
 * first use, and gone a quarter of an hour after the swap, twelve hours after start at
 * the latest, or as soon as the operator signs out or resets a password.
 */
final class SessionHandoff {

	public const TTL = 12 * HOUR_IN_SECONDS;

	/** How long the secret stays usable once the accounts have been replaced. */
	public const TTL_AFTER_SWAP = 15 * MINUTE_IN_SECONDS;

	/** Every issued handoff's migration id, so a sign-out can revoke them all without a table scan. */
	private const INDEX = 'shiftora_session_handoffs';

	/** Whether this table list replaces the accounts: the operator's session goes with them. */
	public static function replaces_accounts( array $tables ): bool {
		foreach ( $tables as $table ) {
			if ( is_string( $table ) && 1 === preg_match( '/(^|_)(users|usermeta)$/', $table ) ) {
				return true;
			}
		}

		return false;
	}

	/** @return string|null The secret the page keeps, or null when there is no operator to hand it to. */
	public static function issue( int $migration_id, string $user_login ): ?string {
		if ( $migration_id < 1 || '' === $user_login ) {
			return null;
		}

		$secret = bin2hex( random_bytes( 32 ) );
		update_option(
			self::option_name( $migration_id ),
			[
				'hash'    => hash( 'sha256', $secret ),
				'login'   => $user_login,
				'expires' => time() + self::TTL,
				'swapped' => false,
			],
			false
		);
		self::remember( $migration_id );

		return $secret;
	}

	/** The accounts have been replaced: the secret may now be claimed, and not for long. */
	public static function mark_swapped( int $migration_id ): void {
		$row = get_option( self::option_name( $migration_id ) );
		if ( ! is_array( $row ) ) {
			return;
		}

		$row['swapped'] = true;
		$row['expires'] = min( (int) ( $row['expires'] ?? 0 ), time() + self::TTL_AFTER_SWAP );
		update_option( self::option_name( $migration_id ), $row, false );
	}

	/** Whether this secret is the one issued for this migration and still current. */
	public static function verify( int $migration_id, string $secret ): bool {
		$row = get_option( self::option_name( $migration_id ) );
		if ( ! is_array( $row ) || ! is_string( $row['hash'] ?? null ) || '' === $secret ) {
			return false;
		}

		if ( (int) ( $row['expires'] ?? 0 ) < time() ) {
			self::forget( $migration_id );
			return false;
		}

		return hash_equals( $row['hash'], hash( 'sha256', $secret ) );
	}

	/**
	 * Spends the secret and signs the browser in as the operator's username, when that
	 * account exists in the users table now in place and may manage this site.
	 *
	 * Before the swap the answer is `pending` and the secret is kept: the page asked a
	 * moment early and asks again.
	 *
	 * @return array{signed_in: bool, pending: bool, user_login: string}
	 */
	public static function claim( int $migration_id, string $secret ): array {
		$row = get_option( self::option_name( $migration_id ) );
		if ( ! self::verify( $migration_id, $secret ) || ! is_array( $row ) ) {
			return [ 'signed_in' => false, 'pending' => false, 'user_login' => '' ];
		}

		$login = (string) ( $row['login'] ?? '' );
		if ( empty( $row['swapped'] ) ) {
			return [ 'signed_in' => false, 'pending' => true, 'user_login' => $login ];
		}

		// Single use: spent before anything else happens, so a failure below cannot be
		// retried, and two requests racing on the same secret cannot both get a cookie.
		if ( ! self::forget( $migration_id ) ) {
			return [ 'signed_in' => false, 'pending' => false, 'user_login' => '' ];
		}

		$user = '' !== $login ? get_user_by( 'login', $login ) : false;
		if ( ! $user || ! user_can( $user, 'manage_options' ) ) {
			return [ 'signed_in' => false, 'pending' => false, 'user_login' => $login ];
		}

		wp_set_auth_cookie( (int) $user->ID, false, is_ssl() );
		wp_set_current_user( (int) $user->ID );
		// What wp_signon() fires, so security plugins see this sign-in like any other.
		do_action( 'wp_login', $user->user_login, $user ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- WordPress's own sign-in hook, fired exactly as wp_signon() fires it; a prefixed name would hide this sign-in from security plugins.

		return [ 'signed_in' => true, 'pending' => false, 'user_login' => $login ];
	}

	/** @return bool Whether there was a handoff to forget. */
	public static function forget( int $migration_id ): bool {
		$index = array_values( array_diff( self::index(), [ $migration_id ] ) );
		if ( [] === $index ) {
			delete_option( self::INDEX );
		} else {
			update_option( self::INDEX, $index, false );
		}

		return delete_option( self::option_name( $migration_id ) );
	}

	/** Every outstanding handoff goes when the operator signs out or a password is reset. */
	public static function forget_all(): void {
		foreach ( self::index() as $migration_id ) {
			delete_option( self::option_name( (int) $migration_id ) );
		}
		delete_option( self::INDEX );
	}

	private static function remember( int $migration_id ): void {
		$index = self::index();
		if ( ! in_array( $migration_id, $index, true ) ) {
			$index[] = $migration_id;
		}
		update_option( self::INDEX, $index, false );
	}

	/** @return int[] */
	private static function index(): array {
		$index = get_option( self::INDEX, [] );

		return is_array( $index ) ? array_map( 'intval', $index ) : [];
	}

	/** Under the plugin's own prefix, which the pull carries into the swapped options table (ProtectedOptions). */
	private static function option_name( int $migration_id ): string {
		return 'shiftora_session_handoff_' . $migration_id;
	}
}