<?php
/**
 * Public pairing challenge endpoint.
 *
 * @package TwoUA_SEO_Release_Guard
 */

declare(strict_types=1);

namespace TwoUA\SeoReleaseGuard;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Serves the short-lived verification token as exact plain text.
 */
final class ChallengeEndpoint {
	private const ROUTE = '/2ua/v1/challenge';

	public function register_hooks(): void {
		add_action( 'rest_api_init', array( $this, 'register_route' ) );
		add_filter( 'rest_pre_serve_request', array( $this, 'serve_plain_text' ), 10, 4 );
	}

	public function register_route(): void {
		register_rest_route(
			'2ua/v1',
			'/challenge',
			array(
				'methods'             => 'GET',
				'callback'            => array( $this, 'challenge' ),
				'permission_callback' => '__return_true',
			)
		);
	}

	/**
	 * WordPress REST callbacks have an intentionally untyped response contract.
	 *
	 * @return \WP_REST_Response|\WP_Error
	 */
	public function challenge() {
		$token = $this->token();
		if ( '' === $token ) {
			return new \WP_Error(
				'two_ua_challenge_unavailable',
				esc_html__( 'No 2UA verification challenge is active.', '2ua-seo-release-guard' ),
				array( 'status' => 404 )
			);
		}

		return new \WP_REST_Response( 'ready', 200 );
	}

	/**
	 * Outputs the exact token expected by the 2UA public-host probe.
	 *
	 * WordPress supplies REST result, request, and server objects dynamically.
	 *
	 * @param bool  $served  Whether the response was already served.
	 * @param mixed $result  REST response result.
	 * @param mixed $request REST request object.
	 * @param mixed $server  REST server object.
	 */
	public function serve_plain_text( bool $served, $result, $request, $server ): bool {
		if ( ! is_object( $request ) || ! method_exists( $request, 'get_route' ) ) {
			return $served;
		}
		if ( self::ROUTE !== $request->get_route() || '' === $this->token() ) {
			return $served;
		}

		$server->send_header( 'Content-Type', 'text/plain; charset=utf-8' );
		$server->send_header( 'Cache-Control', 'no-store, max-age=0' );
		echo esc_html( $this->token() );

		return true;
	}

	private function token(): string {
		$token = get_option( Options::VERIFICATION_TOKEN, '' );

		return is_string( $token ) && strlen( $token ) >= 32 ? $token : '';
	}
}