<?php
/**
 * Dynamic Query — signed refresh source.
 *
 * Filters, sort, search, Load more and infinite scroll re-render a query over
 * the public REST route. That route must only ever render a query the site
 * itself put on a page, wherever it was placed — post content, a template or
 * template part, a synced pattern, a widget, or another query's item.
 *
 * First paint embeds an opaque, signed reference to a server-held definition.
 * Encoding the template itself would expose blocks hidden by visibility rules.
 * Definitions bind to the issuing viewer (user ID, or 0 for all visitors).
 * This prevents replay of a member-only query or ancestor across viewers.
 * WordPress transients retain each definition/viewer pair for 30 days; missing
 * records fail closed. Purge page/CDN caches when upgrading from plaintext
 * sources or clearing transients. Keep page-cache lifetimes below 30 days.
 * Base64 protects the envelope from the_content text filters, not from readers.
 *
 * @package airo-wp
 * @since 2.7.4
 */

declare(strict_types=1);

namespace GoDaddy\WordPress\Plugins\AiroWp\Blocks\Common\Query;

defined( 'ABSPATH' ) || exit;
/**
 * Signs, verifies and authorises Dynamic Query refresh sources.
 */
class RefreshSource {

	/**
	 * Payload format version.
	 */
	const VERSION = 2;

	/** Maximum storage lifetime; page caches must expire sooner. */
	const LIFETIME = 30 * DAY_IN_SECONDS;

	/**
	 * Post IDs whose content is being rendered, innermost last.
	 *
	 * @var int[]
	 */
	private static $content_posts = array();

	/**
	 * Track which post's content is rendering, so a query knows whether it
	 * sits inside a post (and inherits that post's visibility) or in a
	 * template, pattern or widget (public wherever it renders).
	 *
	 * @return void
	 */
	public static function bootstrap() {
		add_filter( 'the_content', array( __CLASS__, 'enter_content' ), 1 );
		add_filter( 'the_content', array( __CLASS__, 'leave_content' ), PHP_INT_MAX );
	}

	/**
	 * Record the post whose content is about to render.
	 *
	 * @param string $content Post content.
	 * @return string Unchanged content.
	 */
	public static function enter_content( $content ) {
		self::$content_posts[] = (int) get_the_ID();
		return $content;
	}

	/**
	 * Forget the post whose content just rendered.
	 *
	 * @param string $content Rendered content.
	 * @return string Unchanged content.
	 */
	public static function leave_content( $content ) {
		array_pop( self::$content_posts );
		return $content;
	}

	/**
	 * The post whose content the current block is rendering inside, or 0.
	 *
	 * @return int Post ID.
	 */
	public static function current_content_post_id() {
		return empty( self::$content_posts ) ? 0 : (int) end( self::$content_posts );
	}

	/**
	 * Render as though inside a post's content.
	 *
	 * A REST refresh runs outside the_content, so without this a query nested
	 * in the refreshed region would be re-signed as public (source 0) even
	 * when the region it belongs to is gated behind a private post.
	 *
	 * @param int      $post_id Post whose content holds the query, or 0.
	 * @param callable $render  Render callback.
	 * @return mixed Callback result.
	 */
	public static function render_within( $post_id, callable $render ) {
		self::$content_posts[] = (int) $post_id;
		try {
			return $render();
		} finally {
			array_pop( self::$content_posts );
		}
	}

	/**
	 * Store a query definition and sign its opaque reference.
	 *
	 * @param string $query_id       Sanitized query ID.
	 * @param array  $attributes     Query block attributes.
	 * @param string $inner_blocks   Serialized inner blocks.
	 * @param int    $source_post_id Post whose content holds the query, or 0.
	 * @param array  $page_context   Page facts the query reads from its first-paint
	 *                               request (current post, inherited archive vars).
	 *                               Carried in the signed envelope, so a refresh
	 *                               replays them and a caller can't supply them.
	 * @return array{source: string, signature: string}
	 */
	public static function sign( $query_id, array $attributes, $inner_blocks, $source_post_id, array $page_context = array() ) {
		$definition = array(
			'queryId'      => (string) $query_id,
			'sourcePostId' => absint( $source_post_id ),
			'viewerId'     => get_current_user_id(),
			'attributes'   => $attributes,
			'innerBlocks'  => (string) $inner_blocks,
		);
		$reference  = self::reference( $definition );
		$key        = 'airowp_query_source_' . $reference;
		self::store( $key, $definition );

		$envelope = array(
			'v'            => self::VERSION,
			'queryId'      => $definition['queryId'],
			'sourcePostId' => $definition['sourcePostId'],
			'ref'          => $reference,
		);
		// Page facts travel in the signed envelope, never in the stored record:
		// they vary per request (a search term, an archive date), so keying the
		// record on them would let anonymous requests mint a 30-day row each.
		// The signature covers the envelope, so they still can't be forged.
		if ( ! empty( $page_context['currentPostId'] ) || ! empty( $page_context['inheritedVars'] ) ) {
			$envelope['ctx'] = $page_context;
		}
		$source = base64_encode( (string) wp_json_encode( $envelope ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- transport encoding, see class docblock.

		return array(
			'source'    => $source,
			'signature' => self::signature( $source ),
		);
	}

	/**
	 * Persist a definition, avoiding a database write on every page view.
	 *
	 * Without a persistent object cache a transient lives in wp_options, so an
	 * unconditional set_transient() is two option writes per Query per view.
	 * An unchanged record is only rewritten once half its lifetime has elapsed,
	 * which keeps it comfortably ahead of any page cache that holds the key.
	 *
	 * @param string $key        Transient key.
	 * @param array  $definition Definition to store.
	 * @return void
	 */
	private static function store( $key, array $definition ) {
		if ( ! wp_using_ext_object_cache() && get_transient( $key ) === $definition ) {
			$expires = (int) get_option( '_transient_timeout_' . $key, 0 );
			if ( $expires - time() > self::LIFETIME / 2 ) {
				return;
			}
		}

		set_transient( $key, $definition, self::LIFETIME );
	}

	/**
	 * Verify and decode a signed source.
	 *
	 * @param mixed  $source    Encoded source from the request.
	 * @param mixed  $signature Signature from the request.
	 * @param string $query_id  Query ID the request names.
	 * @return array{queryId: string, sourcePostId: int, attributes: array, innerBlocks: string, pageContext?: array}|null Definition, or null when it doesn't verify.
	 */
	public static function verify( $source, $signature, $query_id ) {
		if ( ! is_string( $source ) || '' === $source || ! is_string( $signature ) ) {
			return null;
		}

		if ( ! hash_equals( self::signature( $source ), $signature ) ) {
			return null;
		}

		$data = json_decode( (string) base64_decode( $source, true ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- transport encoding, see class docblock.
		if (
			! is_array( $data ) ||
			! isset( $data['v'], $data['queryId'], $data['sourcePostId'], $data['ref'] ) ||
			self::VERSION !== $data['v'] ||
			$data['queryId'] !== (string) $query_id ||
			! is_int( $data['sourcePostId'] ) ||
			! is_string( $data['ref'] ) ||
			! preg_match( '/^[a-f0-9]{64}$/D', $data['ref'] ) ||
			! is_array( $data['ctx'] ?? array() )
		) {
			return null;
		}

		$definition = get_transient( 'airowp_query_source_' . $data['ref'] );
		if (
			! is_array( $definition ) ||
			( $definition['queryId'] ?? null ) !== $data['queryId'] ||
			( $definition['sourcePostId'] ?? null ) !== $data['sourcePostId'] ||
			( $definition['viewerId'] ?? null ) !== get_current_user_id() ||
			! is_array( $definition['attributes'] ?? null ) ||
			! is_string( $definition['innerBlocks'] ?? null ) ||
			! hash_equals( self::reference( $definition ), $data['ref'] )
		) {
			return null;
		}

		if ( ! empty( $data['ctx'] ) ) {
			$definition['pageContext'] = $data['ctx'];
		}

		return $definition;
	}

	/**
	 * Whether the current user may see the post a query was placed in.
	 *
	 * A query outside post content (sourcePostId 0) has no additional post gate.
	 * Its issuing-viewer binding has already been checked by verify().
	 *
	 * @param int $source_post_id Post whose content holds the query, or 0.
	 * @return bool
	 */
	public static function can_view_source( $source_post_id ) {
		if ( ! $source_post_id ) {
			return true;
		}

		$post = get_post( $source_post_id );
		if ( ! $post || post_password_required( $post ) ) {
			return false;
		}

		return is_post_publicly_viewable( $post ) || current_user_can( 'read_post', $post->ID );
	}

	/**
	 * Stable, unguessable key for an unchanged definition/viewer on this site.
	 *
	 * @param array $definition Query definition, kept entirely server-side.
	 * @return string Hex reference.
	 */
	private static function reference( array $definition ) {
		return hash_hmac( 'sha256', 'airo-wp/query-template|' . get_current_blog_id() . '|' . wp_json_encode( $definition ), wp_salt( 'auth' ) );
	}

	/**
	 * HMAC over the encoded source, keyed to this site.
	 *
	 * The blog ID is part of the message because AUTH_SALT is shared across a
	 * multisite network: without it, one site's signed query would render on
	 * another, against that site's content.
	 *
	 * @param string $source Encoded source.
	 * @return string Hex signature.
	 */
	private static function signature( $source ) {
		return hash_hmac( 'sha256', 'airo-wp/query-refresh-source|' . get_current_blog_id() . '|' . $source, wp_salt( 'auth' ) );
	}
}