<?php
/**
 * Identity provider configuration for the admin REST surface.
 *
 * @package AKSRT
 */

namespace AKSRT\Settings;

use AKSRT\Identity\Provider\ProviderFactory;
use AKSRT\Identity\SecretStore;

defined('ABSPATH') || exit;

final class IdentityAdmin {

    private const PROVIDER_FIELDS = [
        'aliyun' => ['access_key_id', 'access_key_secret'],
        'tencent' => ['secret_id', 'secret_key'],
    ];

    /** @return array<string,mixed> */
    public static function read(): array {
        $stored = Settings::get_all();
        $provider = sanitize_key((string) ($stored['user_verify_provider'] ?? 'aliyun'));
        if (!isset(self::PROVIDER_FIELDS[$provider])) {
            $provider = 'aliyun';
        }
        return [
            'provider' => $provider,
            'providers' => [
                'aliyun' => self::provider_state('aliyun'),
                'tencent' => self::provider_state('tencent'),
            ],
        ];
    }

    /** @param array<string,mixed> $input @return array<string,mixed> */
    public static function update(array $input): array {
        if (array_key_exists('provider', $input)) {
            $provider = sanitize_key((string) $input['provider']);
            if (isset(self::PROVIDER_FIELDS[$provider])) {
                Settings::write_domain('users', 'verify', ['user_verify_provider' => $provider]);
            }
        }

        $providers = isset($input['providers']) && is_array($input['providers']) ? $input['providers'] : [];
        foreach (self::PROVIDER_FIELDS as $provider => $fields) {
            $changes = isset($providers[$provider]) && is_array($providers[$provider]) ? $providers[$provider] : [];
            $updates = [];
            if (!empty($changes['clear_credentials'])) {
                foreach ($fields as $field) {
                    $updates[$field] = null;
                }
            } else {
                $credentials = isset($changes['credentials']) && is_array($changes['credentials']) ? $changes['credentials'] : [];
                foreach ($fields as $field) {
                    $value = trim((string) ($credentials[$field] ?? ''));
                    if ($value !== '') {
                        $updates[$field] = $value;
                    }
                }
            }
            if ($updates !== []) {
                SecretStore::update($provider, $updates);
            }
        }
        return self::read();
    }

    /** @return array{success:bool,message:string} */
    public static function test(string $provider): array {
        if (!isset(self::PROVIDER_FIELDS[$provider])) {
            return ['success' => false, 'message' => __('不支持的身份认证服务商', 'aksrt')];
        }
        $valid = ProviderFactory::make($provider)->validate_config();
        if (is_wp_error($valid)) {
            return ['success' => false, 'message' => $valid->get_error_message()];
        }
        return ['success' => true, 'message' => sprintf(__('%s配置检查通过', 'aksrt'), self::label($provider))];
    }

    /** @return array<string,mixed> */
    private static function provider_state(string $provider): array {
        $secrets = SecretStore::get($provider);
        $configured_fields = [];
        $missing = [];
        foreach (self::PROVIDER_FIELDS[$provider] as $field) {
            $configured = !empty($secrets[$field]);
            $configured_fields[$field] = $configured;
            if (!$configured) {
                $missing[] = $field;
            }
        }
        return [
            'label' => self::label($provider),
            'configured' => $missing === [],
            'configured_fields' => $configured_fields,
            'missing_fields' => $missing,
        ];
    }

    private static function label(string $provider): string {
        return $provider === 'aliyun' ? __('阿里云', 'aksrt') : __('腾讯云', 'aksrt');
    }
}