<?php
/**
 * Calls the Verified.net API, with a 24-hour cache and fail-open behaviour.
 *
 * Submitted values are never logged or stored in plain text: cache keys are hashes, and only the
 * recommendation (action, reasons, typo suggestion) is cached.
 *
 * @package VerifiedNet
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * API client.
 */
class Verified_Net_Client {

	const CACHE_TTL = DAY_IN_SECONDS;

	/**
	 * Check an email address or phone number.
	 *
	 * @param string $type    'email' or 'phone'.
	 * @param string $value   The submitted value.
	 * @param string $country Default country for phone numbers without a country code.
	 * @return array|null { action, reasons, suggestion (suggested email domain) } or null when no answer is available (fail open).
	 */
	public static function check( $type, $value, $country = '' ) {
		$options = verified_net_options();
		$api_key = trim( (string) $options['api_key'] );
		$value   = trim( (string) $value );
		if ( '' === $api_key || '' === $value || ! in_array( $type, array( 'email', 'phone' ), true ) ) {
			return null;
		}

		$normalized = 'email' === $type ? strtolower( $value ) : $value;
		$cache_key  = 'verified_net_' . substr( hash( 'sha256', $type . '|' . $normalized . '|' . $country ), 0, 40 );
		$cached     = get_transient( $cache_key );
		if ( is_array( $cached ) ) {
			return $cached;
		}

		// After a network error, an outage or an account problem, skip the API for a short while
		// so form submissions aren't slowed down by repeated timeouts.
		if ( get_transient( 'verified_net_paused' ) ) {
			return null;
		}

		$body = 'email' === $type ? array( 'address' => $value ) : array( 'number' => $value );
		if ( 'phone' === $type && '' !== $country ) {
			$body['default_country'] = $country;
		}

		$response = wp_remote_post(
			VERIFIED_NET_API_BASE . '/v1/' . $type,
			array(
				'timeout'     => (int) apply_filters( 'verified_net_timeout', 5 ),
				'redirection' => 0,
				'headers'     => array(
					'Authorization' => 'Bearer ' . $api_key,
					'Content-Type'  => 'application/json',
					'Accept'        => 'application/json',
					'User-Agent'    => 'verified-net-wordpress/' . VERIFIED_NET_VERSION . '; WordPress/' . get_bloginfo( 'version' ),
				),
				'body'        => wp_json_encode( $body ),
			)
		);

		if ( is_wp_error( $response ) ) {
			self::record_problem( 'unreachable', MINUTE_IN_SECONDS );
			return null;
		}

		$code = (int) wp_remote_retrieve_response_code( $response );
		if ( 200 !== $code ) {
			if ( 401 === $code || 403 === $code ) {
				self::record_problem( 'invalid_key', 5 * MINUTE_IN_SECONDS );
			} elseif ( 402 === $code ) {
				self::record_problem( 'no_credits', 5 * MINUTE_IN_SECONDS );
			} elseif ( 429 === $code ) {
				self::record_problem( 'rate_limited', 10 );
			} elseif ( $code >= 500 ) {
				self::record_problem( 'unreachable', MINUTE_IN_SECONDS );
			}
			return null;
		}

		$data = json_decode( wp_remote_retrieve_body( $response ), true );
		if ( ! is_array( $data ) || empty( $data['recommendation']['action'] ) ) {
			return null;
		}

		$action = (string) $data['recommendation']['action'];
		if ( ! in_array( $action, array( 'accept', 'review', 'reject' ), true ) ) {
			return null;
		}
		$reasons = array();
		if ( isset( $data['recommendation']['reasons'] ) && is_array( $data['recommendation']['reasons'] ) ) {
			$reasons = array_map( 'sanitize_key', $data['recommendation']['reasons'] );
		}
		// Only the suggested domain is kept, so the cache never holds an address.
		$suggestion = '';
		if ( 'email' === $type && ! empty( $data['did_you_mean'] ) && is_string( $data['did_you_mean'] ) && false !== strpos( $data['did_you_mean'], '@' ) ) {
			$suggestion = strtolower( (string) preg_replace( '/[^A-Za-z0-9.\-]/', '', substr( strrchr( $data['did_you_mean'], '@' ), 1 ) ) );
		}

		$result = array(
			'action'     => $action,
			'reasons'    => $reasons,
			'suggestion' => $suggestion,
		);
		set_transient( $cache_key, $result, self::CACHE_TTL );
		if ( get_option( 'verified_net_problem' ) ) {
			delete_option( 'verified_net_problem' );
		}
		return $result;
	}

	/**
	 * Fetch the account (free) to test the API key.
	 *
	 * @param string $api_key API key to test.
	 * @return array|WP_Error Account data or an error.
	 */
	public static function account( $api_key ) {
		$response = wp_remote_get(
			VERIFIED_NET_API_BASE . '/v1/account',
			array(
				'timeout'     => 10,
				'redirection' => 0,
				'headers'     => array(
					'Authorization' => 'Bearer ' . $api_key,
					'Accept'        => 'application/json',
					'User-Agent'    => 'verified-net-wordpress/' . VERIFIED_NET_VERSION,
				),
			)
		);
		if ( is_wp_error( $response ) ) {
			return $response;
		}
		$code = (int) wp_remote_retrieve_response_code( $response );
		$data = json_decode( wp_remote_retrieve_body( $response ), true );
		if ( 200 !== $code || ! is_array( $data ) ) {
			$message = isset( $data['error']['message'] ) ? (string) $data['error']['message'] : 'HTTP ' . $code;
			return new WP_Error( 'verified_net_http_' . $code, $message );
		}
		delete_option( 'verified_net_problem' );
		delete_transient( 'verified_net_paused' );
		return $data;
	}

	/**
	 * Remember a problem for the admin notice (a code and a time only, never submitted values)
	 * and pause API calls for a while.
	 *
	 * @param string $problem Problem code.
	 * @param int    $pause   Seconds to pause.
	 */
	private static function record_problem( $problem, $pause ) {
		set_transient( 'verified_net_paused', 1, $pause );
		update_option(
			'verified_net_problem',
			array(
				'code' => $problem,
				'time' => time(),
			),
			false
		);
	}
}