<?php
/**
 * Editor-only projected service reads. No visitor API or booking POST in W2.
 *
 * @package Waitlistize
 */
namespace Waitlistize\Rest;

use Waitlistize\Api\Services;
use WP_Error;
use WP_REST_Request;
use WP_REST_Response;

final class ServicesController {
	public function register(): void {
		foreach ( array( 'embed-context', 'embed-services' ) as $endpoint ) {
			register_rest_route(
				'waitlistize/v1',
				'/' . $endpoint,
				array(
					'methods'             => 'GET',
					'permission_callback' => array( $this, 'permission' ),
					'callback'            => array( $this, str_replace( '-', '_', $endpoint ) ),
				)
			);
		}
	}

	public function permission( WP_REST_Request $request ): bool|WP_Error {
		if ( ( ! current_user_can( 'edit_posts' ) && ! current_user_can( 'edit_pages' ) ) || ! wp_verify_nonce( $request->get_header( 'X-WP-Nonce' ), 'wp_rest' ) ) {
			return new WP_Error( 'rest_forbidden', __( 'Editor permission and a valid security token are required.', 'waitlistize' ), array( 'status' => 403 ) );
		}
		return true;
	}

	public function embed_context( WP_REST_Request $request ): WP_REST_Response|WP_Error {
		$params = $request->get_query_params();
		unset( $params['rest_route'], $params['_locale'] );
		if ( $params ) {
			return Services::error( 'embed_parameters', 400 );
		}
		return $this->response( array( 'accountId' => ( new Services() )->account_id() ) );
	}

	public function embed_services( WP_REST_Request $request ): WP_REST_Response|WP_Error {
		$params = $request->get_query_params();
		// WordPress plain permalinks and editor apiFetch add local routing/locale keys.
		unset( $params['rest_route'], $params['_locale'] );
		if ( array_diff_key( $params, array_flip( array( 'connection_account_id', 'page', 'per_page', 'locale', 'service_id' ) ) ) ) {
			return Services::error( 'embed_parameters', 400 );
		}
		foreach ( array( 'connection_account_id', 'page', 'per_page', 'service_id' ) as $key ) {
			if ( isset( $params[ $key ] ) && ( ! is_scalar( $params[ $key ] ) || ! preg_match( '/\A[1-9][0-9]{0,9}\z/', (string) $params[ $key ] ) ) ) {
				return Services::error( 'embed_parameters', 400 );
			}
		}
		$api    = new Services();
		$locale = $params['locale'] ?? 'auto';
		if ( ! is_string( $locale ) ) {
			return Services::error( 'embed_parameters', 400 );
		}
		$result = isset( $params['service_id'] ) ? $api->detail( (int) ( $params['connection_account_id'] ?? 0 ), (int) $params['service_id'], $locale ) : $api->catalog( (int) ( $params['connection_account_id'] ?? 0 ), (int) ( $params['page'] ?? 1 ), (int) ( $params['per_page'] ?? 50 ), $locale );
		return is_wp_error( $result ) ? $result : $this->response( $result );
	}

	private function response( array $data ): WP_REST_Response {
		return new WP_REST_Response(
			$data,
			200,
			array(
				'Cache-Control' => 'no-store, private',
				'Pragma'        => 'no-cache',
			)
		);
	}
}