<?php
/**
 * Fetch a JSON document from a URL a Personal Agent controls (its client
 * metadata, its JWKS). Every such fetch goes to an address someone else chose,
 * so (Guides, "Fetching metadata safely"):
 *
 *   - HTTPS only, certificate verified;
 *   - wp_safe_remote_get(), which refuses loopback / private / link-local
 *     hosts (residual risk: it validates the host it resolves, not the socket
 *     it later connects, so DNS rebinding is not fully closed; documented in
 *     PLAN.md §5.4 rule 7);
 *   - no redirects followed: the spec wants client_id fetched without them,
 *     and a jwks_uri must sit on the client_id's own domain anyway;
 *   - 100 KB and 5 s caps; no cookies or credentials sent;
 *   - cache lifetime from Cache-Control, clamped to [1 minute, 1 day].
 *
 * @package AgentAdapt
 */

defined( 'ABSPATH' ) || exit;

/**
 * Safe JSON fetcher.
 */
final class AgentAdapt_Fetcher {

	public const MAX_BYTES = 102400;
	public const TIMEOUT   = 5;
	public const MIN_TTL   = 60;
	public const MAX_TTL   = DAY_IN_SECONDS;
	public const DEFAULT_TTL = HOUR_IN_SECONDS;

	/**
	 * GET a JSON object.
	 *
	 * @param string $url HTTPS URL.
	 * @return array{json: array<string,mixed>, ttl: int}|WP_Error
	 */
	public static function get_json( string $url ) {
		if ( ! self::is_https_url( $url ) ) {
			return new WP_Error( 'fetch_url', 'not an https URL' );
		}
		$res = wp_safe_remote_get(
			$url,
			array(
				'timeout'             => self::TIMEOUT,
				'redirection'         => 0,
				'limit_response_size' => self::MAX_BYTES,
				'cookies'             => array(),
				'headers'             => array( 'Accept' => 'application/json' ),
				'user-agent'          => 'AgentAdapt/' . AGENTADAPT_VERSION . ' (+' . home_url( '/' ) . ')',
			)
		);
		if ( is_wp_error( $res ) ) {
			return new WP_Error( 'fetch_failed', $res->get_error_message() );
		}
		$code = (int) wp_remote_retrieve_response_code( $res );
		if ( 200 !== $code ) {
			return new WP_Error( 'fetch_status', 'HTTP ' . $code );
		}
		$body = (string) wp_remote_retrieve_body( $res );
		if ( strlen( $body ) >= self::MAX_BYTES ) {
			return new WP_Error( 'fetch_size', 'response too large' );
		}
		try {
			$json = json_decode( $body, true, 32, JSON_THROW_ON_ERROR );
		} catch ( Throwable $e ) {
			return new WP_Error( 'fetch_json', 'not JSON' );
		}
		if ( ! is_array( $json ) || array_is_list( $json ) ) {
			return new WP_Error( 'fetch_json', 'not a JSON object' );
		}
		return array( 'json' => $json, 'ttl' => self::ttl( (string) wp_remote_retrieve_header( $res, 'cache-control' ) ) );
	}

	/**
	 * Cache lifetime from a Cache-Control header, clamped.
	 *
	 * @param string $cache_control Header value.
	 */
	public static function ttl( string $cache_control ): int {
		if ( preg_match( '/(?:^|,)\s*no-(?:store|cache)\b/i', $cache_control ) ) {
			return self::MIN_TTL;
		}
		if ( preg_match( '/max-age\s*=\s*(\d+)/i', $cache_control, $m ) ) {
			return max( self::MIN_TTL, min( self::MAX_TTL, (int) $m[1] ) );
		}
		return self::DEFAULT_TTL;
	}

	/**
	 * Absolute https URL with a host, no userinfo, no fragment.
	 *
	 * @param string $url URL.
	 */
	public static function is_https_url( string $url ): bool {
		if ( strlen( $url ) > 512 ) {
			return false;
		}
		$p = wp_parse_url( $url );
		return is_array( $p ) && 'https' === strtolower( $p['scheme'] ?? '' ) && ! empty( $p['host'] )
			&& ! isset( $p['user'] ) && ! isset( $p['pass'] ) && ! isset( $p['fragment'] );
	}
}