<?php
/**
 * Account security endpoints: the password, and what add-ons add (two-factor authentication).
 *
 * @package SpaceBay
 */

namespace SpaceBay\Rest;

use SpaceBay\Auth\Auth;
use SpaceBay\Auth\SignupFields;
use WP_Error;
use WP_REST_Request;
use WP_REST_Response;
use WP_REST_Server;

defined( 'ABSPATH' ) || exit;

/**
 * Lets members change their password. Changes that could lock the owner out
 * ask for the current password again.
 */
final class SecurityController extends Controller {

	/**
	 * Registers the routes.
	 *
	 * @return void
	 */
	public function register_routes() {
		register_rest_route(
			$this->namespace,
			'/me/security',
			array(
				array(
					'methods'             => WP_REST_Server::READABLE,
					'callback'            => array( $this, 'get_item' ),
					'permission_callback' => array( $this, 'permission_signed_in' ),
				),
			)
		);

		register_rest_route(
			$this->namespace,
			'/me/password',
			array(
				array(
					'methods'             => WP_REST_Server::EDITABLE,
					'callback'            => array( $this, 'update_password' ),
					'permission_callback' => array( $this, 'permission_signed_in' ),
					'args'                => array(
						'current'  => array(
							'type'     => 'string',
							'required' => true,
						),
						'password' => array(
							'type'     => 'string',
							'required' => true,
						),
					),
				),
			)
		);
	}

	/**
	 * Requires a logged-in user. Members who wait for approval or are
	 * suspended may still look after the security of their account.
	 *
	 * @return true|WP_Error
	 */
	public function permission_signed_in() {
		if ( is_user_logged_in() ) {
			return true;
		}

		return new WP_Error( 'spacebay_rest_not_logged_in', __( 'Please log in to continue.', 'spacebay' ), array( 'status' => 401 ) );
	}

	/**
	 * Returns the member's security settings.
	 *
	 * @param WP_REST_Request $request Request object.
	 * @return WP_REST_Response
	 */
	public function get_item( $request ) {
		unset( $request );

		return rest_ensure_response( $this->summary() );
	}

	/**
	 * The data of the security page.
	 *
	 * @return array
	 */
	public function summary() {
		/**
		 * Filters the data of the member's security page.
		 *
		 * @since 1.0.0
		 *
		 * @param array $summary Password rules, and add-on data such as "two_factor".
		 * @param int   $user_id Member.
		 */
		return apply_filters(
			'spacebay_security_summary',
			array(
				'min_password' => SignupFields::MIN_PASSWORD,
			),
			get_current_user_id()
		);
	}

	/**
	 * Changes the member's password.
	 *
	 * @param WP_REST_Request $request Request object.
	 * @return WP_REST_Response|WP_Error
	 */
	public function update_password( $request ) {
		$user  = wp_get_current_user();
		$check = Auth::confirm_password( $request['current'] );

		if ( is_wp_error( $check ) ) {
			$check->add_data(
				array(
					'status' => 403,
					'field'  => 'current',
				)
			);

			return $check;
		}

		$password = (string) $request['password'];
		$valid    = SignupFields::check_password( $password, $user->user_email );

		if ( is_wp_error( $valid ) ) {
			return $valid;
		}

		// WordPress ends the member's other sessions and keeps this browser logged in.
		$result = wp_update_user(
			array(
				'ID'        => $user->ID,
				'user_pass' => $password,
			)
		);

		if ( is_wp_error( $result ) ) {
			return new WP_Error( 'spacebay_password_failed', wp_strip_all_tags( $result->get_error_message() ), array( 'status' => 400 ) );
		}

		return rest_ensure_response(
			array(
				'changed' => true,
				// The page must load again, because the security token of this session changed.
				'reload'  => true,
			)
		);
	}
}