<?php
namespace Actirise\Includes\Push;

if ( ! defined( 'ABSPATH' ) ) {
	exit; // Exit if accessed directly
}

use Actirise\Includes\Api;
use Actirise\Includes\Logger;
use Actirise\Includes\Options;

/**
 * Outbound reporter for the plugin's push capability.
 *
 * For the Actirise API to consider this site "deliverable" it must know two
 * things about the plugin: where its push-receiver REST route lives (`restUrl`)
 * and that the receiver is reachable (`restApiEnabled`). Both are published in a
 * single call to the dedicated capability endpoint:
 *
 *   PATCH {gateway}/api/wordpress/websites/{uuid}/wordpress_push_capability
 *   Content-Type: application/merge-patch+json
 *   { "restUrl": "https://…/wp-json/actirise/v1/push", "restApiEnabled": true }
 *
 * The path is built from the website's RFC4122 UUID the plugin already stores
 * (`website-uuid`), not from the obfuscated numeric id (`website-id`) nor a full
 * website IRI: the endpoint resolves the site by UUID, and building from the
 * plain UUID also keeps the gateway prefix from being doubled. The call is
 * authenticated with the plugin's existing bearer token —
 * the org-manager JWT obtained from `POST authentication_token` — because the
 * endpoint requires a logged-in user who owns the site (API-key/M2M auth is not
 * accepted here). All requests go through the plugin's existing `Api` client,
 * the same one the verify callback uses.
 *
 * @link       https://actirise.com
 * @since      4.3.0
 * @package    actirise
 * @subpackage actirise/includes/push
 * @author     actirise <wordpress@actirise.com>
 */
final class PushCapabilityReporter {
	/**
	 * Base-uri key of the Actirise\Includes\Api client used for the call.
	 *
	 * The endpoint is reached through the WordPress API gateway base
	 * (ACTIRISE_URL_API_V2), the same base used for
	 * `authentication_token` and `websites/{uuid}/contract`.
	 *
	 * @since 4.3.0
	 * @var   string
	 */
	const ENDPOINT_KEY = 'api';

	/**
	 * Collection segment of the capability endpoint, relative to the API base.
	 *
	 * @since 4.3.0
	 * @var   string
	 */
	const RESOURCE = 'websites';

	/**
	 * Sub-resource segment carrying the push capability of a website.
	 *
	 * @since 4.3.0
	 * @var   string
	 */
	const CAPABILITY = 'wordpress_push_capability';

	/**
	 * Body field carrying the push base URL.
	 *
	 * @since 4.3.0
	 * @var   string
	 */
	const FIELD_REST_URL = 'restUrl';

	/**
	 * Body field carrying the REST-enabled boolean.
	 *
	 * @since 4.3.0
	 * @var   string
	 */
	const FIELD_REST_API_ENABLED = 'restApiEnabled';

	/**
	 * Logger context (file) used for reporter log entries.
	 *
	 * @since 4.3.0
	 * @var   string
	 */
	const LOG_CONTEXT = 'include/push';

	/**
	 * The Actirise API client.
	 *
	 * @since 4.3.0
	 * @var   Api
	 */
	private $api;

	/**
	 * Initialize the reporter.
	 *
	 * @since 4.3.0
	 */
	public function __construct() {
		$this->api = new Api();
	}

	/**
	 * Report the current REST availability and push URL to the API.
	 *
	 * @since 4.3.0
	 * @param bool   $rest_api_enabled Whether the plugin's REST API is reachable.
	 * @param string $rest_url         Full base push URL (rest_url('actirise/v1/push')).
	 * @return bool True when the capability was persisted API-side.
	 */
	public function report( $rest_api_enabled, $rest_url ) {
		return $this->patch_capability(
			array(
				self::FIELD_REST_URL         => (string) $rest_url,
				self::FIELD_REST_API_ENABLED => (bool) $rest_api_enabled,
			)
		);
	}

	/**
	 * Report that the plugin must no longer receive pushes (e.g. on
	 * deactivation): sets `restApiEnabled` to false. As a merge-patch, the
	 * stored `restUrl` is left untouched.
	 *
	 * @since 4.3.0
	 * @return bool True when the capability was persisted API-side.
	 */
	public function report_disabled() {
		return $this->patch_capability(
			array(
				self::FIELD_REST_API_ENABLED => false,
			)
		);
	}

	/**
	 * PATCH the website's push capability with the given merge-patch body.
	 *
	 * @since 4.3.0
	 * @param array<string, mixed> $body The merge-patch body to send.
	 * @return bool True only when the token and website id are known and the
	 *              PATCH did not return a WP_Error.
	 */
	private function patch_capability( $body ) {
		$token = Options::get( 'settings-analytics-token' );

		if ( ! is_string( $token ) || '' === $token ) {
			Logger::add_log( 'Push capability report skipped: no API token', self::LOG_CONTEXT, 'error' );

			return false;
		}

		$website_uuid = Options::get( 'website-uuid' );

		if ( ! is_scalar( $website_uuid ) || '' === (string) $website_uuid ) {
			Logger::add_log( 'Push capability report skipped: no website uuid', self::LOG_CONTEXT, 'error' );

			return false;
		}

		$uri = self::RESOURCE . '/' . (string) $website_uuid . '/' . self::CAPABILITY;

		$response = $this->api->patch( self::ENDPOINT_KEY, $uri, $body, $token );

		if ( is_wp_error( $response ) ) {
			Logger::add_log( 'Push capability report: PATCH failed', self::LOG_CONTEXT, 'error' );

			return false;
		}

		return true;
	}
}