<?php
/**
 * The revocation endpoint (RFC 7009; spec 4.9). Required in the metadata from
 * day one (spec 3.2). Account Tokens arrive with sign-in in Phase 2; until
 * then there is nothing to revoke, and RFC 7009 §2.2 answers 200 for a token
 * the server does not know, so an authenticated request gets 200.
 *
 * @package AgentAdapt
 */

defined( 'ABSPATH' ) || exit;

/**
 * Revocation endpoint.
 */
final class AgentAdapt_Revocation {

	/**
	 * POST /agent-adapt/oauth/revoke
	 */
	public static function handle(): void {
		if ( 'POST' !== AgentAdapt_Http::method() ) {
			AgentAdapt_Http::json( 405, array( 'error' => 'invalid_request' ), array( 'Allow' => 'POST', 'Cache-Control' => 'no-store' ) );
		}
		if ( AgentAdapt_Http::token_in_query() ) {
			AgentAdapt_Http::oauth_error( 400, 'invalid_request', 'credentials are never accepted in the URL' );
		}
		$form  = AgentAdapt_Http::form();
		$agent = AgentAdapt_Client_Auth::authenticate( $form );
		if ( is_wp_error( $agent ) ) {
			if ( 'rate_limited' === $agent->get_error_code() ) {
				AgentAdapt_Http::rate_limited( 3600 );
			}
			AgentAdapt_Http::oauth_error( 401, 'invalid_client', $agent->get_error_message() );
		}
		if ( empty( $form['token'] ) ) {
			AgentAdapt_Http::oauth_error( 400, 'invalid_request', 'token is required' );
		}
		/**
		 * Revoke an Account Token issued to this agent (Phase 2 attaches here).
		 *
		 * @param string              $token Token.
		 * @param array<string,mixed> $agent Authenticated agent.
		 */
		do_action( 'agentadapt_revoke_token', (string) $form['token'], $agent );
		AgentAdapt_Http::json( 200, array(), array( 'Cache-Control' => 'no-store' ) );
	}
}