<?php
/**
 * Stable form identity across sites.
 *
 * Post IDs differ on every site, so a copied page, a staging push or an imported
 * form would point at the wrong form or none. Each form also carries a random key
 * that travels in exports, and placements can name it: `[accessible_form key="…"]`
 * or the block's `formKey` attribute.
 *
 * @package AccessibleForms
 */

namespace AccessibleForms;

// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- A key lookup must see the current owner; a stale cache could hand one form's key to another.

if ( ! defined( 'ABSPATH' ) ) {
	exit();
}

class FormKey {
	const META = '_accessible_form_key';

	/** A new random key. */
	public static function generate() {
		return 'af_' . bin2hex( random_bytes( 8 ) );
	}

	/** Whether a value has the shape of a key. */
	public static function valid( $key ) {
		return is_string( $key ) && 1 === preg_match( '/^af_[a-f0-9]{16}$/', $key );
	}

	/**
	 * A form's key, created on first use. A copy that carried another form's key
	 * (a plugin that duplicates all post meta, say) gets a key of its own.
	 *
	 * @param int $form_id Form ID.
	 * @return string Key, or '' when the ID is not a form.
	 */
	public static function get( $form_id ) {
		$form_id = (int) $form_id;
		if ( ! $form_id || 'accessible_form' !== get_post_type( $form_id ) ) {
			return '';
		}
		$key = get_post_meta( $form_id, self::META, true );
		if ( self::valid( $key ) && in_array( self::find( $key ), array( 0, $form_id ), true ) ) {
			return $key;
		}
		return self::assign( $form_id );
	}

	/**
	 * Give a form a key: the requested one when it is free on this site, otherwise
	 * a new one.
	 *
	 * @param int    $form_id Form ID.
	 * @param string $key     Preferred key, such as one from an imported file.
	 * @return string The key stored.
	 */
	public static function assign( $form_id, $key = '' ) {
		$owner = self::valid( $key ) ? self::find( $key ) : -1;
		$key   = in_array( $owner, array( 0, (int) $form_id ), true ) ? $key : self::generate();
		update_post_meta( (int) $form_id, self::META, $key );
		return $key;
	}

	/**
	 * The oldest form with this key, or 0. Trashed forms do not count.
	 *
	 * @param string $key Key.
	 * @return int
	 */
	public static function find( $key ) {
		if ( ! self::valid( $key ) ) {
			return 0;
		}
		global $wpdb;
		return (int) $wpdb->get_var(
			$wpdb->prepare(
				"SELECT p.ID FROM {$wpdb->postmeta} m JOIN {$wpdb->posts} p ON p.ID = m.post_id
				WHERE m.meta_key = %s AND m.meta_value = %s AND p.post_type = 'accessible_form' AND p.post_status <> 'trash'
				ORDER BY p.ID ASC LIMIT 1",
				self::META,
				$key
			)
		);
	}

	/**
	 * The form a placement means. A key that names a form here wins over the ID, so
	 * a page copied from another site cannot show a different form that happens to
	 * have the same ID there.
	 *
	 * @param mixed $form_id Placement's form ID.
	 * @param mixed $key     Placement's key.
	 * @return int
	 */
	public static function resolve( $form_id, $key ) {
		if ( ! is_string( $key ) ) {
			return 0;
		}
		$key = trim( $key );
		return '' === $key ? absint( $form_id ) : self::find( $key );
	}
}