<?php
/**
 * Google services bound to one connection.
 *
 * @package TurtleReport
 */

namespace TurtleReport\Google;

use TurtleReport\Auth\ApiException;
use TurtleReport\Auth\Credentials;
use TurtleReport\Auth\Scopes;

defined( 'ABSPATH' ) || exit;

/**
 * Hands out API wrappers for one connection, checking access first.
 */
final class Services {

	/**
	 * Credentials strategy.
	 *
	 * @var Credentials
	 */
	private $credentials;

	/**
	 * HTTP client.
	 *
	 * @var HttpClient
	 */
	private $http;

	/**
	 * Constructor.
	 *
	 * @param Credentials $credentials Credentials strategy.
	 * @param HttpClient  $http        HTTP client.
	 */
	public function __construct( Credentials $credentials, HttpClient $http ) {
		$this->credentials = $credentials;
		$this->http        = $http;
	}

	/**
	 * Credentials in use.
	 *
	 * @return Credentials
	 */
	public function credentials() {
		return $this->credentials;
	}

	/**
	 * Search Console API.
	 *
	 * @return SearchConsole
	 * @throws ApiException When the connection lacks the permission.
	 */
	public function search_console() {
		$this->require_scope( Scopes::SEARCH_CONSOLE, __( 'This connection doesn\'t have Search Console permission. Reconnect it and tick the Search Console box.', 'turtlereport' ) );
		return new SearchConsole( $this->http );
	}

	/**
	 * GA4 APIs.
	 *
	 * @return Analytics
	 * @throws ApiException When the connection lacks the permission.
	 */
	public function analytics() {
		$this->require_scope( Scopes::ANALYTICS, __( 'This connection doesn\'t have Google Analytics permission. Reconnect it and tick the Analytics box.', 'turtlereport' ) );
		return new Analytics( $this->http );
	}

	/**
	 * Business Profile APIs.
	 *
	 * @return BusinessProfile
	 * @throws ApiException When the connection can't read Business Profile.
	 */
	public function business_profile() {
		if ( ! $this->credentials->supports( Scopes::BUSINESS_PROFILE ) ) {
			throw new ApiException( __( 'This connection can\'t read Business Profile. Use a Google sign-in connection with Business Profile access turned on.', 'turtlereport' ), ApiException::UNSUPPORTED ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Caught by the plugin; escaped where the message is shown.
		}
		return new BusinessProfile( $this->http );
	}

	/**
	 * Throws when a scope wasn't granted.
	 *
	 * @param string $scope   Scope URL.
	 * @param string $message Message to show.
	 * @return void
	 * @throws ApiException When the scope is missing. Its own reason, so a connection
	 *                      that works but lacks one permission isn't flagged as broken.
	 */
	private function require_scope( $scope, $message ) {
		if ( ! $this->credentials->supports( $scope ) ) {
			throw new ApiException( $message, ApiException::MISSING_SCOPE ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Caught by the plugin; escaped where the message is shown.
		}
	}
}