<?php
/**
 * Request-scoped diagnostic metadata used by structured log records.
 *
 * @package admin-optimizer
 */

namespace Yipresser\AdminOptimizer\Support;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Captures request-scoped diagnostic metadata.
 */
final class AO_Request_Context {
	private static ?string $request_id = null;

	/**
	 * Get a stable, per-request random identifier, generated once and
	 * memoized for the life of the request.
	 *
	 * @return string
	 */
	public static function request_id(): string {
		if ( null === self::$request_id ) {
			try {
				self::$request_id = bin2hex( random_bytes( 16 ) );
			} catch ( \Throwable $exception ) {
				self::$request_id = substr( hash( 'sha256', uniqid( '', true ) ), 0, 32 );
			}
		}
		return self::$request_id;
	}

	/**
	 * Get the current WordPress user ID, or null when there is none.
	 *
	 * @return int|null
	 */
	public static function user_id(): ?int {
		$user_id = function_exists( 'get_current_user_id' ) ? (int) get_current_user_id() : 0;
		return $user_id > 0 ? $user_id : null;
	}

	/**
	 * Get the current request's sanitized path.
	 *
	 * @param AO_Log_Sanitizer $sanitizer Sanitizer used to clean the raw request URI.
	 *
	 * @return string|null
	 */
	public static function url( AO_Log_Sanitizer $sanitizer ): ?string {
		$uri = isset( $_SERVER['REQUEST_URI'] ) ? wp_unslash( (string) $_SERVER['REQUEST_URI'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		return $sanitizer->request_path( $uri );
	}

	/**
	 * Get the current request's client IP address, honoring trusted proxy
	 * headers when the `adminoptim_block_login_trust_proxy_headers` filter
	 * opts in (default: not trusted — REMOTE_ADDR only). Originally
	 * Block_Login::get_ip_address(); relocated here so it's callable by any
	 * module (e.g. Security Monitor) without requiring Block Login itself
	 * to be active/booted. The filter name is kept as-is: a site's existing
	 * proxy-trust configuration for Block Login should govern every
	 * module's IP resolution, not be reconfigured per module.
	 *
	 * @return string Resolved IP address, or '' if none could be resolved.
	 */
	public static function ip(): string {
		$remote_addr = '';
		if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
			$remote_addr = trim( sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) );
		}

		if ( $remote_addr && filter_var( $remote_addr, FILTER_VALIDATE_IP ) ) {
			$trusted_proxy = apply_filters( 'adminoptim_block_login_trust_proxy_headers', false, $remote_addr );
			if ( ! $trusted_proxy ) {
				return $remote_addr;
			}
		}

		$header_keys = [ 'HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED' ];
		foreach ( $header_keys as $header_key ) {
			if ( empty( $_SERVER[ $header_key ] ) ) {
				continue;
			}

			$header_value = trim( sanitize_text_field( wp_unslash( $_SERVER[ $header_key ] ) ) );
			if ( '' === $header_value ) {
				continue;
			}

			if ( 'HTTP_FORWARDED' === $header_key && preg_match( '/for=(?:"?\[?)([^\]";,\s]+)(?:\]?"?)/i', $header_value, $matches ) ) {
				$ip_candidate = trim( $matches[1] );
			} else {
				$ip_candidate = trim( explode( ',', $header_value )[0] );
			}

			if ( filter_var( $ip_candidate, FILTER_VALIDATE_IP ) ) {
				return $ip_candidate;
			}
		}

		if ( $remote_addr && filter_var( $remote_addr, FILTER_VALIDATE_IP ) ) {
			return $remote_addr;
		}

		return '';
	}
}