<?php
/**
 * Encrypted storage for the plugin's AdPriva connection.
 *
 * @package AdPriva
 */

declare( strict_types=1 );

defined( 'ABSPATH' ) || exit;

/**
 * Persists the OAuth connection (tokens encrypted at rest) in a single option.
 */
class Adpriva_Tokens {

	const OPTION = 'adpriva_connection';

	/**
	 * Merge connection fields and persist them. Access/refresh tokens are
	 * encrypted; other fields fall back to the existing stored values.
	 *
	 * @param array<string, mixed> $data Fields such as access_token, refresh_token,
	 *                                    placement_key, domain, scope, expires_in.
	 * @return void
	 */
	public static function save( array $data ) {
		$existing = self::raw();
		$key      = self::key();

		$connection = array(
			'access'        => isset( $data['access_token'] )
				? Adpriva_Crypto::encrypt( (string) $data['access_token'], $key )
				: ( isset( $existing['access'] ) ? $existing['access'] : '' ),
			'refresh'       => isset( $data['refresh_token'] )
				? Adpriva_Crypto::encrypt( (string) $data['refresh_token'], $key )
				: ( isset( $existing['refresh'] ) ? $existing['refresh'] : '' ),
			'placement_key' => isset( $data['placement_key'] ) ? sanitize_text_field( (string) $data['placement_key'] ) : ( isset( $existing['placement_key'] ) ? $existing['placement_key'] : '' ),
			'domain'        => isset( $data['domain'] ) ? sanitize_text_field( (string) $data['domain'] ) : ( isset( $existing['domain'] ) ? $existing['domain'] : '' ),
			'scope'         => isset( $data['scope'] ) ? sanitize_text_field( (string) $data['scope'] ) : ( isset( $existing['scope'] ) ? $existing['scope'] : '' ),
			'expires_at'    => isset( $data['expires_in'] ) ? ( time() + (int) $data['expires_in'] ) : ( isset( $existing['expires_at'] ) ? $existing['expires_at'] : 0 ),
			'connected_at'  => isset( $existing['connected_at'] ) ? $existing['connected_at'] : time(),
		);

		update_option( self::OPTION, $connection, false );
	}

	/**
	 * Remove the stored connection.
	 *
	 * @return void
	 */
	public static function clear() {
		delete_option( self::OPTION );
	}

	/**
	 * Whether a connection with an access token exists.
	 *
	 * @return bool
	 */
	public static function is_connected() {
		$raw = self::raw();
		return ! empty( $raw['access'] );
	}

	/**
	 * The decrypted access token, or '' when not connected.
	 *
	 * @return string
	 */
	public static function access_token() {
		$raw = self::raw();
		return empty( $raw['access'] ) ? '' : Adpriva_Crypto::decrypt( $raw['access'], self::key() );
	}

	/**
	 * The decrypted refresh token, or '' when not connected.
	 *
	 * @return string
	 */
	public static function refresh_token() {
		$raw = self::raw();
		return empty( $raw['refresh'] ) ? '' : Adpriva_Crypto::decrypt( $raw['refresh'], self::key() );
	}

	/**
	 * The provisioned placement key (UUID), or '' when not connected.
	 *
	 * @return string
	 */
	public static function placement_key() {
		$raw = self::raw();
		return isset( $raw['placement_key'] ) ? (string) $raw['placement_key'] : '';
	}

	/**
	 * The connected site domain, or '' when not connected.
	 *
	 * @return string
	 */
	public static function domain() {
		$raw = self::raw();
		return isset( $raw['domain'] ) ? (string) $raw['domain'] : '';
	}

	/**
	 * The raw stored option (tokens still encrypted).
	 *
	 * @return array<string, mixed>
	 */
	public static function raw() {
		$value = get_option( self::OPTION, array() );
		return is_array( $value ) ? $value : array();
	}

	/**
	 * Key material for token encryption, derived from the site's auth salt.
	 *
	 * @return string
	 */
	private static function key() {
		return wp_salt( 'auth' );
	}
}