<?php
/**
 * Cookie-authenticated, capability- and nonce-protected admin REST API.
 *
 * @package Waitlistize
 */

namespace Waitlistize\Rest;

use Waitlistize\Auth\ConnectionManager;
use WP_Error;
use WP_REST_Request;
use WP_REST_Response;

final class ConnectionController {
	public function register(): void {
		foreach ( array(
			'status'     => 'GET',
			'start'      => 'POST',
			'poll'       => 'POST',
			'check'      => 'POST',
			'disconnect' => 'POST',
		) as $action => $method ) {
			register_rest_route(
				'waitlistize/v1',
				'/connection/' . $action,
				array(
					'methods'             => $method,
					'permission_callback' => array( $this, 'permission' ),
					'callback'            => function ( WP_REST_Request $request ) use ( $action ) {
						$manager = new ConnectionManager();
						$result  = 'start' === $action ? $manager->start( $request->get_param( 'account_slug' ) ) : $manager->$action();
						if ( is_wp_error( $result ) ) {
							return $result;
						}
						return new WP_REST_Response(
							$result,
							200,
							array(
								'Cache-Control' => 'no-store, private',
								'Pragma'        => 'no-cache',
							)
						);
					},
				)
			);
		}
	}

	public function permission( WP_REST_Request $request ): bool|WP_Error {
		if ( ! current_user_can( 'manage_options' ) ) {
			return new WP_Error( 'rest_forbidden', __( 'Administrator permission is required.', 'waitlistize' ), array( 'status' => 403 ) );
		}
		if ( ! wp_verify_nonce( $request->get_header( 'X-WP-Nonce' ), 'wp_rest' ) ) {
			return new WP_Error( 'rest_cookie_invalid_nonce', __( 'Security check failed. Reload this page.', 'waitlistize' ), array( 'status' => 403 ) );
		}
		return true;
	}
}