<?php

declare(strict_types=1);

namespace AdsDestroyer\Security;

/**
 * Nonce service for handling WordPress security nonces.
 *
 * All plugin nonces are created and verified here, so an action name is always
 * prefixed the same way on both sides.
 * 
 * @since 1.0.0
 */
final class NonceService {
    
    private string $action;
    
    /**
     * Constructor.
     * 
     * @since 1.0.0
     * @param string $action Base action name for nonces.
     */
    public function __construct(string $action = 'adsd') {
        $this->action = $action;
    }
    
    /**
     * Create a nonce for a specific action.
     * 
     * @since 1.0.0
     * @param string $specific_action Specific action name.
     * @return string Generated nonce.
     */
    public function create_nonce(string $specific_action = ''): string {
        return wp_create_nonce($this->get_action_name($specific_action));
    }
    
    /**
     * Verify a nonce for a specific action.
     * 
     * @since 1.0.0
     * @param string $nonce Nonce to verify.
     * @param string $specific_action Specific action name.
     * @return bool True if nonce is valid, false otherwise.
     */
    public function verify_nonce(string $nonce, string $specific_action = ''): bool {
        return wp_verify_nonce($nonce, $this->get_action_name($specific_action)) !== false;
    }

    /**
     * Verify nonce of a REST request.
     * 
     * @since 1.0.0
     * @param \WP_REST_Request $request REST request object
     * @return bool True if nonce is valid, false otherwise
     */
    public function verify_request(\WP_REST_Request $request): bool {
        $nonce = $request->get_header('X-WP-Nonce');
        if (!is_string($nonce)) {
            $nonce = $request->get_param('_wpnonce');
        }

        $nonce = is_string($nonce) ? $nonce : '';

        // REST requests normally carry the standard `wp_rest` nonce.
        if (wp_verify_nonce($nonce, 'wp_rest') !== false) {
            return true;
        }

        return $this->verify_nonce($nonce);
    }
    
    /**
     * Get the full action name.
     * 
     * @since 1.0.0
     * @param string $specific_action Specific action name.
     * @return string Full action name.
     */
    private function get_action_name(string $specific_action): string {
        if (empty($specific_action)) {
            return $this->action;
        }
        
        return $this->action . '_' . $specific_action;
    }
}