<?php
/**
 * Ledger filters shared by the ledger view and its export.
 *
 * @package AgentFirewall
 */

declare(strict_types=1);

namespace AgentFirewall\Rest;

use DateTimeImmutable;
use WP_REST_Request;

defined( 'ABSPATH' ) || exit; // @codeCoverageIgnore

/**
 * The ledger's filter parameters: their REST schemas, and how a request
 * becomes the filter array LedgerRepository turns into a WHERE clause.
 *
 * One definition for the ledger view and anything that reads the ledger the
 * same way, so "what I am looking at" means the same parameters, read the
 * same way, applied in the same SQL.
 */
final class LedgerFilters {

	/**
	 * Filter parameter schemas with sanitize/validate callbacks (checklist §1.14).
	 *
	 * @return array<string, array<string, mixed>>
	 */
	public static function args(): array {
		return array(
			'agent_id'    => array(
				'type'              => 'integer',
				'sanitize_callback' => 'absint',
				'validate_callback' => 'rest_validate_request_arg',
			),
			'entity_id'   => array(
				'type'              => 'integer',
				'sanitize_callback' => 'absint',
				'validate_callback' => 'rest_validate_request_arg',
			),
			'status'      => array(
				'type'              => 'string',
				'enum'              => array( 'allowed', 'denied', 'pending', 'undone', 'untracked', 'refused', 'drifted', 'bypassed', 'notified', 'interrupted' ),
				'sanitize_callback' => 'sanitize_key',
				'validate_callback' => 'rest_validate_request_arg',
			),
			'decided_by'  => array(
				'description'       => 'Restrict to entries decided by a policy id, by "defaults" for those no rule matched, by "network" for a multisite network rule, or by "extension" for an extension\'s default rule.',
				'type'              => 'string',
				'pattern'           => '^(defaults|network|extension|[1-9][0-9]*)$',
				'sanitize_callback' => 'sanitize_key',
				'validate_callback' => 'rest_validate_request_arg',
			),
			'entity_type' => array(
				'type'              => 'string',
				'sanitize_callback' => 'sanitize_key',
				'validate_callback' => 'rest_validate_request_arg',
			),
			'since'       => array(
				'type'              => 'string',
				'format'            => 'date-time',
				'sanitize_callback' => 'sanitize_text_field',
				'validate_callback' => 'rest_validate_request_arg',
			),
			'until'       => array(
				'type'              => 'string',
				'format'            => 'date-time',
				'sanitize_callback' => 'sanitize_text_field',
				'validate_callback' => 'rest_validate_request_arg',
			),
		);
	}

	/**
	 * Repository filters from a request.
	 *
	 * @param WP_REST_Request $request Request.
	 * @return array<string, mixed>
	 */
	public static function from_request( WP_REST_Request $request ): array {
		$filters = array();
		foreach ( array( 'agent_id', 'entity_id' ) as $int_filter ) {
			if ( null !== $request->get_param( $int_filter ) ) {
				$filters[ $int_filter ] = (int) $request->get_param( $int_filter );
			}
		}
		foreach ( array( 'status', 'entity_type' ) as $string_filter ) {
			if ( null !== $request->get_param( $string_filter ) ) {
				$filters[ $string_filter ] = (string) $request->get_param( $string_filter );
			}
		}
		// One parameter covers both "this policy" and "no policy at all": a
		// separate integer would make an empty value indistinguishable from a
		// request for entries the defaults decided, once absint has run.
		$decided_by = $request->get_param( 'decided_by' );
		if ( is_string( $decided_by ) && '' !== $decided_by ) {
			if ( 'defaults' === $decided_by ) {
				$filters['default_decision'] = true;
			} elseif ( 'network' === $decided_by ) {
				$filters['network_decision'] = true;
			} elseif ( 'extension' === $decided_by ) {
				$filters['extension_decision'] = true;
			} else {
				$filters['policy_id'] = (int) $decided_by;
			}
		}

		foreach ( array( 'since', 'until' ) as $date_filter ) {
			$value = $request->get_param( $date_filter );
			if ( is_string( $value ) && '' !== $value ) {
				$filters[ $date_filter ] = new DateTimeImmutable( $value );
			}
		}

		return $filters;
	}
}