<?php
defined( 'ABSPATH' ) || exit;

/**
 * Handles reading and writing plugin settings in wp_options.
 * API key encryption/decryption lives here — the key is NEVER returned raw.
 */
class AccessMate_Settings {

    private const OPTION_KEY = 'accessmate_settings';

    /** Canonical whitelist of WCAG standards the axe-core scanner can filter by. */
    public const VALID_RULESETS = [
        'wcag20a', 'wcag20aa', 'wcag20aaa',
        'wcag21a', 'wcag21aa', 'wcag21aaa',
        'wcag22aa', 'section508', 'best-practice',
    ];

    public static function get(): array {
        $s = get_option( self::OPTION_KEY, [] );

        // Migrate legacy single-string ruleset (pre multi-select) to an array.
        if ( isset( $s['default_rulesets'] ) ) {
            $default_rulesets = $s['default_rulesets'];
        } elseif ( isset( $s['default_ruleset'] ) && is_string( $s['default_ruleset'] ) ) {
            $default_rulesets = [ $s['default_ruleset'] ];
        } else {
            $default_rulesets = [ 'wcag22aa' ];
        }

        return [
            'ai_provider'      => $s['ai_provider']    ?? 'none',
            'ai_key_set'       => ! empty( $s['ai_key'] ),  // boolean — raw key never leaves PHP
            'ai_model'         => $s['ai_model']        ?? '',
            'scan_schedule'    => $s['scan_schedule']   ?? 'weekly',
            'default_rulesets' => $default_rulesets,
            'email_alerts'     => $s['email_alerts']    ?? true,
        ];
    }

    /**
     * Save settings. If $raw_key is empty the previously stored key is preserved.
     */
    public static function save(
        string $provider,
        string $raw_key,
        string $model,
        string $schedule,
        array $default_rulesets = [ 'wcag22aa' ],
        bool $email_alerts = true
    ): void {
        $current = get_option( self::OPTION_KEY, [] );

        $default_rulesets = array_values( array_unique( array_intersect( $default_rulesets, self::VALID_RULESETS ) ) );
        if ( empty( $default_rulesets ) ) {
            $default_rulesets = [ 'wcag22aa' ];
        }

        update_option( self::OPTION_KEY, [
            'ai_provider'      => $provider,
            'ai_key'           => $raw_key
                ? AccessMate_AI_Proxy::encrypt_key( $raw_key )
                : ( $current['ai_key'] ?? '' ),
            'ai_model'         => $model,
            'scan_schedule'    => $schedule,
            'default_rulesets' => $default_rulesets,
            'email_alerts'     => $email_alerts,
        ]);
    }

    public static function get_raw_key(): string {
        $s = get_option( self::OPTION_KEY, [] );
        if ( empty( $s['ai_key'] ) ) return '';
        return AccessMate_AI_Proxy::decrypt_key( $s['ai_key'] );
    }
}