<?php

/**
 * Booktics Get Settings Tool
 *
 * @package Aisentic\Integrations\Booktics
 */

declare(strict_types=1);

namespace Aisentic\Integrations\Booktics;

use Aisentic\Util\Log;

defined( 'ABSPATH' ) || exit;

/**
 * Tool to read low-impact Booktics settings.
 *
 * Administrator only. Deliberately whitelists the returned keys so credentials
 * and secrets (Stripe/PayPal keys, OAuth tokens, webhook URLs) are never exposed
 * to the assistant — only safe display/behaviour settings are returned.
 */
class Booktics_Get_Settings_Tool extends Booktics_Base_Tool {

	/**
	 * Setting keys that are safe to read.
	 *
	 * Payment credentials, API keys, OAuth tokens and webhook URLs are
	 * intentionally excluded.
	 */
	private const READABLE_KEYS = [
		// Currency & formatting.
		'currency',
		'currency_symbol_position',
		'currency_decimals',
		'currency_price_separator',
		'date_format',
		'time_format',
		'timezone',
		'calendar_locale',
		'show_end_time',
		// Business identity.
		'business_name',
		'business_address',
		'business_email',
		'admin_email',
		// Branding.
		'primary_color',
		'secondary_color',
		// Booking behaviour.
		'allow_customer_as_wp_user',
		'allow_customer_rescheduling',
		'allow_customer_cancellation',
		'interval_time',
		'slot_duration',
		// Feature toggles (read-only view of what is enabled).
		'enable_stripe',
		'enable_paypal',
		'enable_local_payment',
		'enable_google_calendar',
		'enable_outlook_calendar',
		'enable_fluentcrm',
		'enable_pabbly',
		'enable_zapier',
		'enable_zoho',
	];

	/**
	 * Constructor
	 */
	public function __construct() {
		parent::__construct(
			'booktics-get-settings',
			'Read Booktics\' low-impact configuration — currency and date/time formats, business name and contact, branding colours, booking behaviour, and which feature modules are enabled. ' .
			'Does not expose any API keys, payment credentials, or secrets. Administrator only.'
		);
	}

	/**
	 * Define tool properties
	 *
	 * @return array
	 */
	protected function properties(): array {
		return [];
	}

	/**
	 * Execute the tool
	 *
	 * @return array
	 */
	public function __invoke(): array {
		$check = $this->guard_admin();
		if ( $check ) {
			return $check;
		}

		try {
			$request = new \WP_REST_Request( 'GET', '/booktics/v1/settings' );

			$controller = new \Booktics\Settings\Controllers\Settings_Controller();
			$settings   = $this->extract_response( $controller->get_item( $request ), 'Failed to retrieve settings.' );

			if ( isset( $settings['error'] ) ) {
				return $settings;
			}

			// Whitelist: only expose the safe keys, never credentials or secrets.
			$safe = array_intersect_key( $settings, array_flip( self::READABLE_KEYS ) );

			return [ 'settings' => $safe ];
		} catch ( \Throwable $e ) {
			Log::error( 'Booktics_Get_Settings_Tool error', [ 'error' => $e->getMessage() ] );

			return [ 'error' => 'Failed to retrieve settings: ' . $e->getMessage() ];
		}
	}
}