<?php
/**
 * The visitor's Vimine session: tokens live SERVER-SIDE in a transient keyed by a random id that travels in
 * an HttpOnly cookie (never the tokens themselves). Works for anonymous visitors and WordPress users alike.
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

final class Vimine_Session {

    public const COOKIE = 'vimine_session';
    private const TTL   = 30 * DAY_IN_SECONDS; // the refresh token's absolute lifetime

    private static ?array $cache = null;

    /** @return array|null { access_token, refresh_token, expires_at, scope, sub } */
    public static function get(): ?array {
        if ( null !== self::$cache ) {
            return self::$cache ?: null;
        }
        $id = self::id();
        if ( '' === $id ) {
            self::$cache = [];
            return null;
        }
        $data        = get_transient( 'vimine_sess_' . $id );
        self::$cache = is_array( $data ) ? $data : [];
        return self::$cache ?: null;
    }

    public static function is_signed_in(): bool {
        return null !== self::get();
    }

    /** Start (or replace) the session from a token response. */
    public static function start( array $tokens ): void {
        $id   = bin2hex( random_bytes( 16 ) );
        $data = self::from_tokens( $tokens );
        set_transient( 'vimine_sess_' . $id, $data, self::TTL );
        self::cookie( $id, time() + self::TTL );
        self::$cache = $data;
    }

    /** Update the stored tokens after a refresh. */
    public static function update( array $tokens ): void {
        $id = self::id();
        if ( '' === $id ) {
            return;
        }
        $data = self::from_tokens( $tokens, self::get() ?? [] );
        set_transient( 'vimine_sess_' . $id, $data, self::TTL );
        self::$cache = $data;
    }

    public static function end(): void {
        $id = self::id();
        if ( '' !== $id ) {
            delete_transient( 'vimine_sess_' . $id );
        }
        self::cookie( '', time() - HOUR_IN_SECONDS );
        self::$cache = [];
    }

    /** A valid access token, refreshed when it is about to expire; null when signed out (or the refresh died). */
    public static function access_token(): ?string {
        $s = self::get();
        if ( ! $s ) {
            return null;
        }
        if ( ( $s['expires_at'] ?? 0 ) - 30 > time() ) {
            return $s['access_token'];
        }
        if ( empty( $s['refresh_token'] ) ) {
            self::end();
            return null;
        }
        $client = new Vimine_Client();
        $res    = $client->refresh( $s['refresh_token'] );
        if ( is_wp_error( $res ) ) {
            self::end();
            return null;
        }
        self::update( $res );
        return $res['access_token'];
    }

    /**
     * The response carries what belongs to this member (their card, their events, their sign-out link): no shared
     * cache may keep it for the next visitor. Page caches that honour `DONOTCACHEPAGE` skip the page, and the
     * response says so to proxies while its headers can still be sent.
     */
    public static function personal(): void {
        if ( ! defined( 'DONOTCACHEPAGE' ) ) {
            // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- the page caches' shared signal (WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed Cache…), not a name of this plugin's.
            define( 'DONOTCACHEPAGE', true );
        }
        if ( ! headers_sent() ) {
            nocache_headers();
        }
    }

    private static function id(): string {
        return isset( $_COOKIE[ self::COOKIE ] ) ? sanitize_key( wp_unslash( $_COOKIE[ self::COOKIE ] ) ) : '';
    }

    private static function from_tokens( array $t, array $prev = [] ): array {
        return [
            'access_token'  => (string) ( $t['access_token'] ?? '' ),
            'refresh_token' => (string) ( $t['refresh_token'] ?? ( $prev['refresh_token'] ?? '' ) ),
            'expires_at'    => time() + (int) ( $t['expires_in'] ?? 600 ),
            'scope'         => (string) ( $t['scope'] ?? ( $prev['scope'] ?? '' ) ),
            'sub'           => (string) ( $t['sub'] ?? ( $prev['sub'] ?? '' ) ),
        ];
    }

    // A refresh that fails while a shortcode renders ends the session after the headers have gone: the transient is
    // gone all the same, and the stale cookie then names nothing.
    private static function cookie( string $value, int $expires ): void {
        if ( ! headers_sent() ) {
            setcookie( self::COOKIE, $value, [
                'expires'  => $expires,
                'path'     => '/',
                'secure'   => is_ssl(),
                'httponly' => true,
                'samesite' => 'Lax',
            ] );
        }
        $_COOKIE[ self::COOKIE ] = $value;
    }
}