<?php
/**
 * Integration token auth for the Agentmatica MCP server.
 *
 * @package Agentmatica
 */

declare(strict_types=1);

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class Agentmatica_Auth {
	public const TOKEN_OPTION       = 'agentmatica_token_hash';
	public const TOKEN_PLAIN_OPTION = 'agentmatica_integration_token';
	public const TOKEN_PREFIX       = 'amk_wp_';

	public static function init(): void {
		// Bearer auth is enforced per-request on the MCP REST route.
	}

	public static function verify_request_token( $request = null ): bool {
		unset( $request );

		$token = self::read_bearer_token_from_request();
		if ( ! $token ) {
			return false;
		}

		return self::verify_integration_token( $token );
	}

	/**
	 * @return array{token: string, hash: string}
	 */
	public static function ensure_integration_token(): array {
		$existing_hash = (string) get_option( self::TOKEN_OPTION, '' );
		if ( $existing_hash !== '' ) {
			return array(
				'token' => '',
				'hash'  => $existing_hash,
			);
		}

		return self::rotate_integration_token();
	}

	/**
	 * @return array{token: string, hash: string}
	 */
	public static function rotate_integration_token(): array {
		$token = self::TOKEN_PREFIX . wp_generate_password( 40, false, false );
		$hash  = wp_hash_password( $token );
		update_option( self::TOKEN_OPTION, $hash, false );
		update_option( self::TOKEN_PLAIN_OPTION, $token, false );

		return array(
			'token' => $token,
			'hash'  => $hash,
		);
	}

	public static function verify_integration_token( string $token ): bool {
		$hash = (string) get_option( self::TOKEN_OPTION, '' );
		if ( $hash === '' ) {
			return false;
		}

		return wp_check_password( $token, $hash );
	}

	public static function get_integration_token_for_outbound(): string {
		return trim( (string) get_option( self::TOKEN_PLAIN_OPTION, '' ) );
	}

	public static function get_mcp_endpoint_url(): string {
		return Agentmatica_Public_Urls::get_mcp_endpoint_url();
	}

	public static function get_ucp_profile_url(): string {
		return Agentmatica_Public_Urls::get_ucp_profile_url();
	}

	private static function read_bearer_token_from_request(): ?string {
		$header = self::read_authorization_header();
		if ( ! $header ) {
			return null;
		}

		if ( preg_match( '/^Bearer\s+(.+)$/i', $header, $matches ) ) {
			return trim( $matches[1] );
		}

		return null;
	}

	private static function read_authorization_header(): ?string {
		if ( isset( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
			return trim( sanitize_text_field( wp_unslash( (string) $_SERVER['HTTP_AUTHORIZATION'] ) ) );
		}

		if ( isset( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
			return trim( sanitize_text_field( wp_unslash( (string) $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) );
		}

		if ( function_exists( 'getallheaders' ) ) {
			$headers = getallheaders();
			foreach ( $headers as $name => $value ) {
				if ( strtolower( (string) $name ) === 'authorization' ) {
					return trim( (string) $value );
				}
			}
		}

		return null;
	}
}