<?php
/**
 * The WordPress HTTP transport for the SDK.
 *
 * The SDK talks cURL when nothing else is injected, which is right
 * everywhere else it ships and wrong inside WordPress. WordPress has its own
 * HTTP API and a plugin is expected to use it, for reasons that are not
 * bureaucratic:
 *
 *   - a site behind a proxy configures it with WP_PROXY_HOST, and cURL
 *     called directly never sees that;
 *   - `pre_http_request`, `http_request_args` and `block_local_requests`
 *     are how a host, a security plugin or a staging site controls what
 *     leaves the server, and a direct cURL call walks straight past all
 *     three;
 *   - a site with cURL disabled still has working HTTP, because the API
 *     falls back to another transport on its own;
 *   - and the directory does not accept the cURL functions in a plugin's
 *     own code, only in a third party vendor library. This plugin
 *     therefore contains none of them at all, including in the bundled
 *     SDK, rather than relying on them being unreachable.
 *
 * The SDK already has the seam for this - setTransport() - so nothing in it
 * has to be forked. sync-sdk.php keeps all seven copies byte identical and a
 * test asserts it, so a fork here would be found in minutes and would be the
 * wrong fix anyway.
 *
 * @package Affiliatant
 */

defined( 'ABSPATH' ) || exit;

/**
 * Sends the SDK's requests through wp_remote_request().
 */
class Affiliatant_Http {

	/**
	 * The SDK transport callable.
	 *
	 * The SDK hands over cURL-shaped headers, a list of "Name: value"
	 * strings, because that is what its own code path wants. WordPress
	 * wants an associative array, so they are converted here rather than
	 * changed in the SDK: every other copy of that file is correct as it is.
	 *
	 * A transport NEVER throws. The SDK decides what a failure means and
	 * whether it is retryable, and it does that from the status, so a
	 * transport error comes back as status 0 and the SDK raises its own
	 * AffiliatantTransportException from there.
	 *
	 * @param string $method  GET, POST, DELETE.
	 * @param string $url     Absolute URL.
	 * @param array  $headers List of 'Name: value' strings.
	 * @param string $body    Request body, or empty.
	 * @return array{status:int,headers:array,body:string}
	 */
	public static function request( $method, $url, array $headers, $body ) {
		$assoc = array();
		foreach ( $headers as $header ) {
			$at = strpos( (string) $header, ':' );
			if ( false === $at ) {
				continue;
			}
			$name  = trim( substr( (string) $header, 0, $at ) );
			$value = trim( substr( (string) $header, $at + 1 ) );
			if ( '' !== $name ) {
				$assoc[ $name ] = $value;
			}
		}

		$args = array(
			'method'      => strtoupper( (string) $method ),
			'headers'     => $assoc,
			// Matches the SDK's own default and the setting behind it. This
			// can run inside a checkout request on a site with no Action
			// Scheduler, and a tracker that holds a shopper on a blank page
			// is uninstalled the same day.
			'timeout'     => 5,
			// We follow nothing. A redirect from an API is a misconfiguration
			// and following it would repost a signed body to somewhere that
			// was not signed for.
			'redirection' => 0,
			'sslverify'   => true,
			'blocking'    => true,
		);

		if ( '' !== (string) $body ) {
			$args['body'] = (string) $body;
		}

		$response = wp_remote_request( $url, $args );

		if ( is_wp_error( $response ) ) {
			return array(
				'status'  => 0,
				'headers' => array(),
				'body'    => $response->get_error_message(),
			);
		}

		$out = array();
		foreach ( wp_remote_retrieve_headers( $response ) as $name => $value ) {
			$out[ strtolower( (string) $name ) ] = is_array( $value )
				? implode( ', ', $value )
				: (string) $value;
		}

		return array(
			'status'  => (int) wp_remote_retrieve_response_code( $response ),
			'headers' => $out,
			'body'    => (string) wp_remote_retrieve_body( $response ),
		);
	}
}