<?php
/**
 * Rewrite rule and plain-text response for /llms.txt.
 *
 * @package Gcco\AiViewSync
 */

namespace Gcco\AiViewSync;

defined( 'ABSPATH' ) || exit;

/**
 * Registers rewrite + serves llms.txt.
 */
class Output {

	const QUERY_VAR = 'aivisy_llms_txt';

	/**
	 * Hook registrations.
	 */
	public function register() {
		add_action( 'init', array( $this, 'add_rewrite' ) );
		add_filter( 'query_vars', array( $this, 'query_vars' ) );
		add_action( 'template_redirect', array( $this, 'maybe_serve' ), 0 );
	}

	public function add_rewrite() {
		add_rewrite_rule( '^llms\.txt$', 'index.php?' . self::QUERY_VAR . '=1', 'top' );
	}

	/**
	 * @param array<int, string> $vars Query vars.
	 * @return array<int, string>
	 */
	public function query_vars( $vars ) {
		$vars[] = self::QUERY_VAR;
		return $vars;
	}

	/**
	 * If our query var is set, send plain text and exit (no theme).
	 */
	public function maybe_serve() {
		$match = (bool) get_query_var( self::QUERY_VAR, false );
		if ( ! $match ) {
			$match = $this->request_is_llms_txt();
		}
		if ( ! $match ) {
			return;
		}

		$content = Settings::get_active_content();

		// WP's handle_404() has already sent a 404 status by template_redirect
		// (the query var matches no posts), so the 200 must be sent explicitly.
		global $wp_query;
		if ( $wp_query instanceof \WP_Query ) {
			$wp_query->is_404 = false;
		}

		if ( ! headers_sent() ) {
			status_header( 200 );
			nocache_headers();
			header( 'Content-Type: text/plain; charset=UTF-8', true );
		}

		// esc_html() is the correct late-escaping function here.
		// – WPCS recognises it as a safe output wrapper (wp_strip_all_tags() is a sanitiser, not an
		//   escaper, and still triggers EscapeOutput warnings).
		// – Nothing is stripped: all LLMS.txt markdown characters (#, -, *, >) are preserved.
		// – The only encoding side-effect is & → &amp;, which does not affect LLMS.txt in practice
		//   because entries are canonical page URLs (/slug/), not query strings.
		// – text/plain Content-Type is the primary XSS barrier; esc_html() is defence-in-depth
		//   against any browser content-type sniffing.
		echo esc_html( (string) $content );
		exit;
	}

	/**
	 * Fallback when rewrite rules are not flushed yet or plain permalinks limit rewrites.
	 *
	 * @return bool
	 */
	protected function request_is_llms_txt() {
		if ( ! isset( $_SERVER['REQUEST_URI'] ) ) {
			return false;
		}
		$uri = sanitize_text_field( wp_unslash( (string) $_SERVER['REQUEST_URI'] ) );
		if ( '' === $uri ) {
			return false;
		}
		$path = wp_parse_url( $uri, PHP_URL_PATH );
		if ( ! is_string( $path ) || '' === $path ) {
			return false;
		}
		$path = untrailingslashit( $path );
		return 'llms.txt' === basename( $path );
	}

	/**
	 * Flush rewrite rules (activation/deactivation).
	 */
	public static function flush_rewrite_rules() {
		$tmp = new self();
		$tmp->add_rewrite();
		flush_rewrite_rules( false );
	}
}