<?php

/**
 * Provisions the WooCommerce REST key Afileasy uses to publish coupons.
 */

namespace Afileasy\WooCommerce;

if (! defined('ABSPATH')) {
    exit;
}

/**
 * Coupons travel in the opposite direction of everything else in this plugin:
 * Afileasy writes them into the store through the WooCommerce REST API. Rather
 * than asking the merchant to create keys under WooCommerce → Settings →
 * Advanced → REST API, the plugin mints one itself — the same way WooCommerce's
 * own screen does — and hands it to Afileasy with the store URL.
 *
 * The pair is stored locally so it is only created once; the plaintext secret
 * cannot be recovered from WooCommerce afterwards.
 */
class ApiKey
{
    private const OPTION = 'afileasy_api_key';

    /**
     * The credentials, creating them on first use (or after the merchant
     * revoked the key in WooCommerce). Null when no suitable user exists or
     * the row could not be written.
     *
     * @return array{key_id: int, consumer_key: string, consumer_secret: string}|null
     */
    public static function ensure(): ?array
    {
        $stored = get_option(self::OPTION);

        if (is_array($stored) && ! empty($stored['consumer_key']) && self::exists((int) ($stored['key_id'] ?? 0))) {
            return $stored;
        }

        return self::create();
    }

    /**
     * The stored pair, without creating one. Null when never provisioned.
     *
     * @return array{key_id: int, consumer_key: string, consumer_secret: string}|null
     */
    public static function get(): ?array
    {
        $stored = get_option(self::OPTION);

        return is_array($stored) && ! empty($stored['consumer_key']) ? $stored : null;
    }

    /**
     * Delete the key from WooCommerce, so uninstalling leaves no credential
     * behind.
     */
    public static function revoke(): void
    {
        global $wpdb;

        $stored = get_option(self::OPTION);

        if (is_array($stored) && ! empty($stored['key_id'])) {
            $wpdb->delete($wpdb->prefix.'woocommerce_api_keys', ['key_id' => (int) $stored['key_id']], ['%d']);
        }

        delete_option(self::OPTION);
    }

    /**
     * @return array{key_id: int, consumer_key: string, consumer_secret: string}|null
     */
    private static function create(): ?array
    {
        global $wpdb;

        $user_id = self::resolveUserId();

        if (! $user_id) {
            return null;
        }

        $consumer_key = 'ck_'.wc_rand_hash();
        $consumer_secret = 'cs_'.wc_rand_hash();

        $inserted = $wpdb->insert(
            $wpdb->prefix.'woocommerce_api_keys',
            [
                'user_id' => $user_id,
                'description' => __('Afileasy', 'afileasy-for-woocommerce'),
                'permissions' => 'read_write',
                'consumer_key' => wc_api_hash($consumer_key),
                'consumer_secret' => $consumer_secret,
                'truncated_key' => substr($consumer_key, -7),
            ],
            ['%d', '%s', '%s', '%s', '%s', '%s']
        );

        if (! $inserted) {
            return null;
        }

        $credentials = [
            'key_id' => (int) $wpdb->insert_id,
            'consumer_key' => $consumer_key,
            'consumer_secret' => $consumer_secret,
        ];

        update_option(self::OPTION, $credentials, false);

        return $credentials;
    }

    private static function exists(int $key_id): bool
    {
        global $wpdb;

        if ($key_id <= 0) {
            return false;
        }

        $found = $wpdb->get_var($wpdb->prepare(
            "SELECT key_id FROM {$wpdb->prefix}woocommerce_api_keys WHERE key_id = %d",
            $key_id
        ));

        return $found !== null;
    }

    /**
     * The key inherits its owner's capabilities, so it must belong to someone
     * who can manage WooCommerce — the merchant connecting the store, or the
     * oldest administrator when running without a current user (cron).
     */
    private static function resolveUserId(): int
    {
        $current = get_current_user_id();

        if ($current && user_can($current, 'manage_woocommerce')) {
            return (int) $current;
        }

        $admins = get_users([
            'role' => 'administrator',
            'number' => 1,
            'orderby' => 'ID',
            'order' => 'ASC',
            'fields' => 'ID',
        ]);

        return $admins ? (int) $admins[0] : 0;
    }
}