<?php
/**
 * REST controller for public privacy proof challenges.
 *
 * @package ActionPanelAI
 */

namespace ActionPanelAI\Rest;

use WP_REST_Request;
use WP_REST_Response;
use ActionPanelAI\Services\SettingsRepository;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Signs challenges so the remote service can verify site control.
 */
class PrivacyProofController {
	/**
	 * Create the controller.
	 *
	 * @param SettingsRepository $settings Plugin settings repository.
	 */
	public function __construct(
		private SettingsRepository $settings
	) {
	}

	/**
	 * Return an HMAC signature for a valid public challenge.
	 *
	 * @param WP_REST_Request $request Current REST request.
	 */
	public function handle( WP_REST_Request $request ): WP_REST_Response {
		$challenge = $request->get_param( 'challenge' );
		$challenge = is_string( $challenge ) ? trim( $challenge ) : '';

		if ( '' === $challenge || ! preg_match( '/^[A-Za-z0-9._~\-]{16,256}$/', $challenge ) ) {
			return new WP_REST_Response(
				array(
					'error'   => 'invalid_challenge',
					'message' => __( 'Invalid challenge.', 'actionpanel-ai' ),
				),
				400
			);
		}

		$token = $this->settings->get_privacy_service_token();
		if ( '' === $token ) {
			return new WP_REST_Response(
				array(
					'error'   => 'privacy_not_initialized',
					'message' => __( 'Privacy proof is not initialized.', 'actionpanel-ai' ),
				),
				503
			);
		}

		$digest    = hash_hmac( 'sha256', $challenge, $token );
		$site_host = (string) wp_parse_url( home_url( '/' ), PHP_URL_HOST );

		return new WP_REST_Response(
			array(
				'algorithm' => 'HMAC-SHA256',
				'digest'    => $digest,
				'site_host' => strtolower( $site_host ),
			),
			200
		);
	}

	/**
	 * Sanitize the public privacy-proof challenge parameter.
	 *
	 * @param mixed $value Raw challenge value.
	 */
	public static function sanitize_challenge( mixed $value ): string {
		return is_string( $value ) ? sanitize_text_field( wp_unslash( $value ) ) : '';
	}

	/**
	 * Validate the public privacy-proof challenge parameter.
	 *
	 * @param mixed $value Sanitized challenge value.
	 */
	public static function validate_challenge( mixed $value ): bool {
		return is_string( $value ) && 1 === preg_match( '/^[A-Za-z0-9._~\-]{16,256}$/', trim( $value ) );
	}
}