<?php

if ( ! class_exists( 'AM_REST_Controller' ) ) {

	class AM_REST_Controller extends WP_REST_Controller {

		public function filter_consumer_key( $option ) {
			$script_tag = $option;
			if ( isset( $script_tag['consumer_key'] ) ) {
				unset( $script_tag['consumer_key'] );
			}
			return $script_tag;
		}

		public function get_consumer_key() {
			$consumer_key = $this->get_consumer_key_from_basic_authentication();

			if ( $consumer_key ) {
				return $consumer_key;
			}

			return $this->get_consumer_key_from_oauth_authentication();
		}

		private function get_consumer_key_from_basic_authentication() {
			$consumer_key    = '';
			$consumer_secret = '';

			// If the $_GET parameters are present, use those first.
			if ( ! empty( $_GET['consumer_key'] ) && ! empty( $_GET['consumer_secret'] ) ) { // WPCS: CSRF ok.
				$consumer_key    = $_GET['consumer_key']; // WPCS: CSRF ok, sanitization ok.
				$consumer_secret = $_GET['consumer_secret']; // WPCS: CSRF ok, sanitization ok.
			}

			// If the above is not present, we will do full basic auth.
			if ( ! $consumer_key && ! empty( $_SERVER['PHP_AUTH_USER'] ) && ! empty( $_SERVER['PHP_AUTH_PW'] ) ) {
				$consumer_key    = $_SERVER['PHP_AUTH_USER']; // WPCS: CSRF ok, sanitization ok.
				$consumer_secret = $_SERVER['PHP_AUTH_PW']; // WPCS: CSRF ok, sanitization ok.
			}

			// Stop if don't have any key.
			if ( ! $consumer_key || ! $consumer_secret ) {
				return false;
			}

			return $consumer_key;
		}

		private function get_consumer_key_from_oauth_authentication() {
			$params = array_merge( $_GET, $_POST ); // WPCS: CSRF ok.
			$params = wp_unslash( $params );
			$header = $this->get_authorization_header();

			if ( ! empty( $header ) ) {
				// Trim leading spaces.
				$header        = trim( $header );
				$header_params = $this->parse_header( $header );

				if ( ! empty( $header_params ) ) {
					$params = array_merge( $params, $header_params );
				}
			}

			return isset( $params['oauth_consumer_key'] ) ? $params['oauth_consumer_key'] : null;
		}

		private function get_authorization_header() {
			if ( ! empty( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
				return wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ); // WPCS: sanitization ok.
			}

			if ( function_exists( 'getallheaders' ) ) {
				$headers = getallheaders();
				// Check for the authoization header case-insensitively.
				foreach ( $headers as $key => $value ) {
					if ( 'authorization' === strtolower( $key ) ) {
						return $value;
					}
				}
			}

			return '';
		}

		private function parse_header( $header ) {
			if ( 'OAuth ' !== substr( $header, 0, 6 ) ) {
				return array();
			}

			// From OAuth PHP library, used under MIT license.
			$params = array();
			if ( preg_match_all( '/(oauth_[a-z_-]*)=(:?"([^"]*)"|([^,]*))/', $header, $matches ) ) {
				foreach ( $matches[1] as $i => $h ) {
					$params[ $h ] = urldecode( empty( $matches[3][ $i ] ) ? $matches[4][ $i ] : $matches[3][ $i ] );
				}
				if ( isset( $params['realm'] ) ) {
					unset( $params['realm'] );
				}
			}

			return $params;
		}

		/**
		 * Check whether a given request has permission to read tax classes.
		 *
		 * @param  WP_REST_Request $request Full details about the request.
		 * @return WP_Error|boolean
		 */
		public function get_items_permissions_check( $request ) {
			if ( ! wc_rest_check_manager_permissions( 'settings', 'read' ) ) {
				return new WP_Error( 'woocommerce_rest_cannot_view', __( 'Sorry, you cannot list resources.', 'woocommerce' ), array( 'status' => rest_authorization_required_code() ) );
			}

			return true;
		}

		/**
		 * Check if a given request has access create tax classes.
		 *
		 * @param WP_REST_Request $request Full details about the request.
		 *
		 * @return bool|WP_Error
		 */
		public function create_item_permissions_check( $request ) {
			if ( ! wc_rest_check_manager_permissions( 'settings', 'create' ) ) {
				return new WP_Error( 'woocommerce_rest_cannot_create', __( 'Sorry, you are not allowed to create resources.', 'woocommerce' ), array( 'status' => rest_authorization_required_code() ) );
			}

			return true;
		}

		/**
		 * Check if a given request has access delete a tax.
		 *
		 * @param WP_REST_Request $request Full details about the request.
		 *
		 * @return bool|WP_Error
		 */
		public function delete_item_permissions_check( $request ) {
			if ( ! wc_rest_check_manager_permissions( 'settings', 'delete' ) ) {
				return new WP_Error( 'woocommerce_rest_cannot_delete', __( 'Sorry, you are not allowed to delete this resource.', 'woocommerce' ), array( 'status' => rest_authorization_required_code() ) );
			}

			return true;
		}
	}
}