<?php
/**
 * Fixed L1 transport. Never logs upstream bodies, headers or credentials.
 *
 * @package Waitlistize
 */

namespace Waitlistize\Api;

use WP_Error;

final class Client {
	public const CLIENT_ID = 'waitlistize-wordpress';
	public const PREFIX    = '/api/v1/integrations/wordpress/';

	/** Only wp-config.php / deployment configuration may set the origin. */
	public function origin(): string|WP_Error {
		$url   = defined( 'WAITLISTIZE_API_BASE_URL' ) ? WAITLISTIZE_API_BASE_URL : 'https://waitlistize.com';
		$parts = is_string( $url ) ? wp_parse_url( $url ) : false;
		$local = 'local' === wp_get_environment_type() && defined( 'WAITLISTIZE_ALLOW_INSECURE_LOCAL_API' ) && WAITLISTIZE_ALLOW_INSECURE_LOCAL_API;
		if ( ! $parts || empty( $parts['host'] ) || isset( $parts['user'], $parts['pass'] ) || isset( $parts['user'] ) || isset( $parts['query'] ) || isset( $parts['fragment'] ) || ! in_array( $parts['path'] ?? '', array( '', '/' ), true ) ) {
			return new WP_Error( 'configuration', __( 'Invalid trusted Waitlistize API configuration.', 'waitlistize' ) );
		}
		if ( 'https' !== ( $parts['scheme'] ?? '' ) && ! ( $local && 'http' === ( $parts['scheme'] ?? '' ) && in_array( $parts['host'], array( 'localhost', '127.0.0.1', '[::1]' ), true ) ) ) {
			return new WP_Error( 'configuration', __( 'The Waitlistize API requires HTTPS.', 'waitlistize' ) );
		}
		return rtrim( $url, '/' );
	}

	/** Validate browser destinations independently of the response payload. */
	public function verification_url( string $url, string $code, bool $complete ): bool {
		$origin = $this->origin();
		if ( is_wp_error( $origin ) ) {
			return false;
		}
		$expected = $origin . '/connect/wordpress';
		if ( ! $complete ) {
			return hash_equals( $expected, $url );
		}
		$parts = wp_parse_url( $url );
		if ( ! $parts || isset( $parts['fragment'] ) || ! str_starts_with( $url, $expected . '?' ) ) {
			return false;
		}
		parse_str( $parts['query'] ?? '', $query );
		return array( 'user_code' => $code ) === $query;
	}

	/** @return array{status:int,data:array,retry_after:int}|WP_Error */
	public function request( string $endpoint, array $body = array(), string $token = '' ): array|WP_Error {
		if ( ! in_array( $endpoint, array( 'device-authorization', 'token', 'account', 'revoke' ), true ) ) {
			return new WP_Error( 'configuration', __( 'Unsupported API endpoint.', 'waitlistize' ) );
		}
		$origin = $this->origin();
		if ( is_wp_error( $origin ) ) {
			return $origin;
		}
		$headers = array(
			'Accept'       => 'application/json',
			'Content-Type' => 'application/json',
		);
		if ( '' !== $token ) {
			$headers['Authorization'] = 'Bearer ' . $token;
		}
		$response = wp_remote_request(
			$origin . self::PREFIX . $endpoint,
			array(
				'method'              => 'account' === $endpoint ? 'GET' : 'POST',
				'headers'             => $headers,
				'body'                => 'account' === $endpoint ? null : wp_json_encode( $body ),
				'timeout'             => 12,
				'redirection'         => 0,
				'sslverify'           => true,
				'limit_response_size' => 65536,
				'cookies'             => array(),
			)
		);
		if ( is_wp_error( $response ) ) {
			return new WP_Error( 'unavailable', __( 'Waitlistize is temporarily unavailable.', 'waitlistize' ) );
		}
		$data  = json_decode( wp_remote_retrieve_body( $response ), true );
		$retry = wp_remote_retrieve_header( $response, 'retry-after' );
		return array(
			'status'      => (int) wp_remote_retrieve_response_code( $response ),
			'data'        => is_array( $data ) ? $data : array(),
			'retry_after' => is_numeric( $retry ) ? max( 1, (int) $retry ) : max( 5, (int) strtotime( (string) $retry ) - time() ),
		);
	}
}