<?php
/**
 * Where Admin Optimizer keeps credentials: WordPress's Secrets API when the
 * site has it, a bundled libsodium store when it does not.
 *
 * @package admin-optimizer
 */

namespace Yipresser\AdminOptimizer\Support;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Facade used by modules to store passwords, API keys and tokens.
 *
 * Settings keep a reference (`secret:admin-optimizer/smtp-primary`) instead of the
 * value; resolve() turns a stored setting back into the value and passes legacy
 * plain-text or `enc:` values straight through, so existing configuration keeps
 * working until its owner migrates it.
 *
 * Deliberately not a global polyfill of wp_set_secret()/wp_get_secret(): defining
 * those names would tell other plugins the host provides core's guarantees
 * (providers, read-only mode, rotation tooling), which this fallback does not.
 *
 * When a site upgrades to a WordPress that ships the Secrets API, secrets held by
 * the fallback are copied into core and removed from the fallback, one at a time,
 * only after core returns the same value (see maybe_migrate_to_core()).
 *
 * No method checks capabilities; callers decide who may set or reveal a secret.
 */
final class AO_Secrets {

	/** Namespace every Admin Optimizer secret name starts with. */
	const NAMESPACE_PREFIX = 'admin-optimizer';

	/** Marks a setting value that points at a secret instead of containing one. */
	const REF_PREFIX = 'secret:';

	/** Option set once every fallback secret has moved into core. */
	const MIGRATED_OPTION = 'adminoptim_secrets_migrated';

	/** Transient that backs off a failed migration attempt. */
	const MIGRATE_RETRY_TRANSIENT = 'adminoptim_secrets_migrate_retry';

	/**
	 * Preferred backend (core when available).
	 *
	 * @var AO_Secrets_Backend|null
	 */
	private static $primary = null;

	/**
	 * Bundled fallback store.
	 *
	 * @var AO_Secrets_Fallback_Store|null
	 */
	private static $fallback = null;

	/**
	 * Hook the one-time move into core's API.
	 *
	 * @return void
	 */
	public static function register(): void {
		add_action( 'admin_init', [ self::class, 'maybe_migrate_to_core' ] );
	}

	/**
	 * Replace the backends (tests); pass nulls to restore detection.
	 *
	 * @param AO_Secrets_Backend|null        $primary  Preferred backend.
	 * @param AO_Secrets_Fallback_Store|null $fallback Fallback store.
	 *
	 * @return void
	 */
	public static function use_backends( ?AO_Secrets_Backend $primary, ?AO_Secrets_Fallback_Store $fallback ): void {
		self::$primary  = $primary;
		self::$fallback = $fallback;
	}

	/**
	 * The store new secrets are written to.
	 *
	 * @return AO_Secrets_Backend
	 */
	public static function backend(): AO_Secrets_Backend {
		if ( null === self::$primary ) {
			self::$primary = AO_Secrets_Core_Backend::is_available() ? new AO_Secrets_Core_Backend() : self::fallback();
		}

		return self::$primary;
	}

	/**
	 * The bundled fallback store (also the source when moving into core).
	 *
	 * @return AO_Secrets_Fallback_Store
	 */
	public static function fallback(): AO_Secrets_Fallback_Store {
		if ( null === self::$fallback ) {
			self::$fallback = new AO_Secrets_Fallback_Store();
		}

		return self::$fallback;
	}

	/**
	 * Whether secrets are held by WordPress core rather than the bundled store.
	 *
	 * @return bool
	 */
	public static function uses_core(): bool {
		return self::backend() !== self::fallback();
	}

	/**
	 * Setting value that points at a secret.
	 *
	 * @param string $name Secret name.
	 *
	 * @return string
	 */
	public static function reference( string $name ): string {
		return self::REF_PREFIX . $name;
	}

	/**
	 * Secret name behind a setting value, or null if it is not a reference.
	 *
	 * @param mixed $stored Stored setting value.
	 *
	 * @return string|null
	 */
	public static function name_from_reference( $stored ): ?string {
		if ( ! is_string( $stored ) || ! str_starts_with( $stored, self::REF_PREFIX ) ) {
			return null;
		}

		$name = substr( $stored, strlen( self::REF_PREFIX ) );

		return AO_Secrets_Fallback_Store::is_valid_name( $name ) ? $name : null;
	}

	/**
	 * Turn a stored setting back into its value.
	 *
	 * A reference is looked up; anything else (legacy plain text or `enc:` values)
	 * is returned unchanged for the caller's existing handling.
	 *
	 * @param mixed $stored Stored setting value.
	 *
	 * @return string|\WP_Error The value ('' if the secret is missing), or an error when it exists but cannot be read.
	 */
	public static function resolve( $stored ) {
		$name = self::name_from_reference( $stored );
		if ( null === $name ) {
			return is_string( $stored ) ? $stored : '';
		}

		$value = self::get( $name );

		return null === $value ? '' : $value;
	}

	/**
	 * Read a secret.
	 *
	 * @param string $name Secret name.
	 *
	 * @return string|null|\WP_Error Plaintext, null if missing, WP_Error if unreadable.
	 */
	public static function get( string $name ) {
		$value = self::backend()->get( $name );

		// Not in core yet but still in the fallback store (the site just upgraded): move it now.
		if ( null === $value && self::uses_core() ) {
			$value = self::migrate_one( $name );
		}

		return $value;
	}

	/**
	 * Store a secret.
	 *
	 * @param string $name  Secret name.
	 * @param string $value Plaintext value.
	 *
	 * @return true|\WP_Error
	 */
	public static function set( string $name, string $value ) {
		$result = self::backend()->set( $name, $value );

		// A newer value in core must not be shadowed by an older fallback copy.
		if ( true === $result && self::uses_core() ) {
			self::fallback()->delete( $name );
		}

		return $result;
	}

	/**
	 * Delete a secret from every store.
	 *
	 * @param string $name Secret name.
	 *
	 * @return true|\WP_Error
	 */
	public static function delete( string $name ) {
		$result = self::backend()->delete( $name );
		if ( self::uses_core() ) {
			self::fallback()->delete( $name );
		}

		return $result;
	}

	/**
	 * Whether a secret exists, readable or not.
	 *
	 * @param string $name Secret name.
	 *
	 * @return bool
	 */
	public static function exists( string $name ): bool {
		return null !== self::get( $name );
	}

	/**
	 * Move one secret from the fallback store into core.
	 *
	 * Only deletes the fallback copy after core hands back the same value.
	 *
	 * @param string $name Secret name.
	 *
	 * @return string|null|\WP_Error The value now held by core, null if the fallback has none, WP_Error on any failure (fallback copy kept).
	 */
	private static function migrate_one( string $name ) {
		$legacy = self::fallback()->get( $name );
		if ( null === $legacy || is_wp_error( $legacy ) ) {
			return $legacy;
		}

		$stored = self::backend()->set( $name, $legacy );
		if ( is_wp_error( $stored ) ) {
			return $stored;
		}

		if ( self::backend()->get( $name ) !== $legacy ) {
			return new \WP_Error( 'adminoptim_secret_migration_unverified', __( 'A secret could not be verified after moving it, so the original was kept.', 'admin-optimizer' ) );
		}

		self::fallback()->delete( $name );

		return $legacy;
	}

	/**
	 * Move every remaining fallback secret into core, once core is available.
	 *
	 * Runs for administrators on admin_init, does nothing after it has finished,
	 * and backs off for an hour after a failed run. Secrets that cannot be read
	 * (for example after a key change) are left where they are.
	 *
	 * @return void
	 */
	public static function maybe_migrate_to_core(): void {
		if ( ! self::uses_core() || get_option( self::MIGRATED_OPTION ) || get_transient( self::MIGRATE_RETRY_TRANSIENT ) || ! current_user_can( 'manage_options' ) ) {
			return;
		}

		$failed = false;
		foreach ( self::fallback()->list_names() as $name ) {
			if ( is_wp_error( self::migrate_one( $name ) ) ) {
				$failed = true;
			}
		}

		if ( $failed ) {
			set_transient( self::MIGRATE_RETRY_TRANSIENT, 1, HOUR_IN_SECONDS );
			return;
		}

		// Nothing left in the fallback store: its wrapped root key is no longer needed.
		delete_option( AO_Secrets_Fallback_Store::ROOT_OPTION );
		update_option( self::MIGRATED_OPTION, 1, false );
	}
}