<?php
/**
 * Turns "the other site refused our credentials" into one stable admin error.
 *
 * @package Shiftora\Support
 */

declare(strict_types=1);

namespace Shiftora\Support;

use Throwable;
use WP_Error;

// Prevent direct file access.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * A reinstall or key reset on either site leaves the other holding a secret the
 * remote no longer knows. The remote's own wording ("Invalid or missing
 * authentication credentials") says nothing about the fix, so the admin gets the
 * fix instead. Reporting only: nothing here decides what counts as authenticated.
 */
final class ConnectionRejection {

	public const ERROR_CODE = 'shiftora_connection_rejected';

	/** Remote codes the auth layer answers with when the token or signature does not check out. */
	private const AUTH_CODES = [
		'shiftora_unauthorized',
		'shiftora_signature_missing',
		'shiftora_signature_expired',
		'shiftora_signature_mismatch',
	];

	/** The mapped error, or null when the failure is anything other than a credential rejection. */
	public static function from_exception( Throwable $e, int $connection_id ): ?WP_Error {
		if ( ! $e instanceof HttpRequestException || ! self::is_rejection( $e->http_status(), $e->remote_code() ) ) {
			return null;
		}

		return new WP_Error(
			self::ERROR_CODE,
			__( 'The other site no longer accepts this connection. This happens when Shiftora is reinstalled or its key is reset on either site. Delete this connection on both sites, then connect again with fresh Connection Info.', 'shiftora' ),
			[
				'status'        => 502,
				'connection_id' => $connection_id,
				'hint'          => __( 'If it still fails, clear any page or security cache on the other site (for example a caching or firewall plugin) and try again.', 'shiftora' ),
			]
		);
	}

	/** A 401 is always a rejection; a 403 only when it carries one of the auth layer's codes. */
	public static function is_rejection( int $http_status, string $remote_code ): bool {
		return 401 === $http_status
			|| ( 403 === $http_status && in_array( $remote_code, self::AUTH_CODES, true ) );
	}
}