<?php
/**
 * Reads the OAuth result (code, state, error) from a callback address pasted by the owner.
 *
 * Marketplaces only accept public callback addresses, so when the plugin runs on a local copy the browser
 * lands on the live site's callback address; the owner copies that address back into the plugin.
 *
 * @package Tidelist
 */

namespace Tidelist\Channel;

/**
 * Reads the OAuth result from a pasted callback address.
 */
final class CallbackUrl {

	/**
	 * Parses a full callback URL (or just its query string).
	 *
	 * @param string $pasted Text pasted by the owner.
	 * @return array{code:string, state:string, error:string}
	 */
	public static function parse( string $pasted ): array {
		$pasted = trim( $pasted );
		$query  = (string) parse_url( $pasted, PHP_URL_QUERY ); // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- pure class, also used without WordPress.
		if ( '' === $query && false === strpos( $pasted, '://' ) ) {
			$query = ltrim( $pasted, '?' );
		}
		parse_str( $query, $params );
		$clean = static function ( $value ): string {
			return is_string( $value ) ? (string) preg_replace( '/[^A-Za-z0-9\-\._~]/', '', $value ) : '';
		};
		return array(
			'code'  => $clean( $params['code'] ?? '' ),
			'state' => $clean( $params['state'] ?? '' ),
			'error' => $clean( $params['error'] ?? '' ),
		);
	}
}