<?php
/**
 * The HTTP request the buyer actually made.
 *
 * @package AgentStamp
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class AgentStamp_Request {

	/** @var string */
	public $method;

	/** @var string Absolute URL, used when a signature covers @target-uri or @authority. */
	public $url;

	/** @var string */
	public $user_agent;

	/** @var array<string,string> Lowercase header names, raw values. */
	public $headers;

	/**
	 * @param array<string,string> $headers
	 */
	public function __construct( $method, $url, $user_agent, array $headers ) {
		$this->method     = strtoupper( (string) $method );
		$this->url        = (string) $url;
		$this->user_agent = (string) $user_agent;
		$this->headers    = $headers;
	}

	/**
	 * Build a request from the current PHP process.
	 *
	 * @return self
	 */
	public static function from_globals() {
		$headers = array();

		if ( function_exists( 'getallheaders' ) ) {
			foreach ( getallheaders() as $name => $value ) {
				if ( is_string( $name ) && is_string( $value ) ) {
					$headers[ strtolower( $name ) ] = $value;
				}
			}
		}

		foreach ( $_SERVER as $key => $value ) {
			if ( ! is_string( $key ) || strpos( $key, 'HTTP_' ) !== 0 || ! is_string( $value ) ) {
				continue;
			}
			$name = strtolower( str_replace( '_', '-', substr( $key, 5 ) ) );
			if ( isset( $headers[ $name ] ) ) {
				continue;
			}
			// WordPress addslashes() on $_SERVER. Signature headers must stay byte-exact.
			$headers[ $name ] = function_exists( 'wp_unslash' ) ? wp_unslash( $value ) : stripslashes( $value );
		}

		$method = isset( $_SERVER['REQUEST_METHOD'] ) && is_string( $_SERVER['REQUEST_METHOD'] )
			? preg_replace( '/[^A-Za-z]/', '', wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Letters only.
			: 'GET';
		$host   = isset( $headers['host'] ) ? $headers['host'] : 'localhost';
		// The signature covers the path byte for byte, so it is unslashed and not otherwise changed.
		$uri    = isset( $_SERVER['REQUEST_URI'] ) && is_string( $_SERVER['REQUEST_URI'] )
			? wp_unslash( $_SERVER['REQUEST_URI'] ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
			: '/';
		$https  = function_exists( 'is_ssl' ) ? is_ssl() : self::https_from_server();
		$url    = ( $https ? 'https' : 'http' ) . '://' . $host . $uri;
		$ua     = isset( $headers['user-agent'] ) ? $headers['user-agent'] : '';

		return new self( $method, $url, $ua, $headers );
	}

	/**
	 * @return bool
	 */
	private static function https_from_server() {
		if ( ! empty( $_SERVER['HTTPS'] ) && 'off' !== $_SERVER['HTTPS'] ) {
			return true;
		}
		return isset( $_SERVER['SERVER_PORT'] ) && 443 === (int) $_SERVER['SERVER_PORT'];
	}
}