<?php
/**
 * Shared access-token caching.
 *
 * @package TurtleReport
 */

namespace TurtleReport\Auth;

defined( 'ABSPATH' ) || exit;

/**
 * Caches access tokens in a transient until shortly before they expire.
 *
 * Subclasses only implement request_token(). Access tokens live for about an
 * hour and are never sent to the browser.
 */
abstract class AbstractCredentials implements Credentials {

	/**
	 * {@inheritDoc}
	 *
	 * @param bool $force_refresh Ignore the cached token.
	 * @return string
	 */
	public function access_token( $force_refresh = false ) {
		$key = 'turtlereport_at_' . md5( $this->id() );
		if ( ! $force_refresh ) {
			$token = get_transient( $key );
			if ( is_string( $token ) && '' !== $token ) {
				return $token;
			}
		}
		$response = $this->request_token();
		$ttl      = isset( $response['expires_in'] ) ? (int) $response['expires_in'] - 120 : 3000;
		\TurtleReport\Support\TransientStore::set( $key, (string) $response['access_token'], max( 60, $ttl ) );
		return (string) $response['access_token'];
	}

	/**
	 * Deletes the cached access token.
	 *
	 * @return void
	 */
	public function forget_token() {
		delete_transient( 'turtlereport_at_' . md5( $this->id() ) );
	}

	/**
	 * Requests a new token from Google.
	 *
	 * @return array Token response with access_token and expires_in.
	 * @throws \TurtleReport\Auth\ApiException When Google refuses.
	 */
	abstract protected function request_token();
}