<?php
/**
 * AKSRT Comment Actions
 *
 * REST endpoints for comment edit / delete / moderate.
 *
 * @package AKSRT
 */

defined('ABSPATH') || exit;

class AKSRT_Comment_Actions {

    private static $instance = null;

    private function __construct() {}

    public static function get_instance(): self {
        if (null === self::$instance) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    public function init(): void {
        add_action('rest_api_init', [$this, 'register_routes']);
    }

    public function register_routes(): void {
        register_rest_route('aksrt/v1', '/comment/edit', [
            'methods'             => 'POST',
            'callback'            => [$this, 'edit_comment'],
            'permission_callback' => [$this, 'check_edit_permission'],
            'args'                => [
                'comment_id' => ['required' => true, 'type' => 'integer', 'sanitize_callback' => 'absint'],
                'content'    => ['required' => true, 'type' => 'string', 'sanitize_callback' => 'sanitize_textarea_field'],
            ],
        ]);

        register_rest_route('aksrt/v1', '/comment/delete', [
            'methods'             => 'POST',
            'callback'            => [$this, 'delete_comment'],
            'permission_callback' => [$this, 'check_delete_permission'],
            'args'                => [
                'comment_id' => ['required' => true, 'type' => 'integer', 'sanitize_callback' => 'absint'],
            ],
        ]);

        register_rest_route('aksrt/v1', '/comment/moderate', [
            'methods'             => 'POST',
            'callback'            => [$this, 'moderate_comment'],
            'permission_callback' => function () {
                return current_user_can('moderate_comments');
            },
            'args'                => [
                'comment_id' => ['required' => true, 'type' => 'integer', 'sanitize_callback' => 'absint'],
                'status'     => ['required' => true, 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field'],
            ],
        ]);

        register_rest_route('aksrt/v1', '/comment/pin', [
            'methods'             => 'POST',
            'callback'            => [$this, 'pin_comment'],
            'permission_callback' => [$this, 'check_pin_permission'],
            'args'                => [
                'comment_id' => ['required' => true, 'type' => 'integer', 'sanitize_callback' => 'absint'],
                'pinned'     => ['required' => false, 'type' => 'boolean'],
            ],
        ]);

        register_rest_route('aksrt/v1', '/comment/like', [
            'methods'             => 'POST',
            'callback'            => [$this, 'like_comment'],
            // Guests may like; abuse is bounded by per-visitor toggle state.
            'permission_callback' => '__return_true',
            'args'                => [
                'comment_id' => ['required' => true, 'type' => 'integer', 'sanitize_callback' => 'absint'],
                'active'     => ['required' => false, 'type' => 'boolean'],
            ],
        ]);
    }

    /**
     * Resolve the per-comment action contract (single source of truth).
     *
     * @param int $comment_id Comment ID.
     * @return array{can_edit:bool,can_delete:bool,can_moderate:bool,can_pin:bool}
     */
    private function permissions(int $comment_id): array {
        if (function_exists('aksrt_comment_action_permissions')) {
            return aksrt_comment_action_permissions($comment_id);
        }

        // Defensive fallback if the helper is unavailable.
        $comment = get_comment($comment_id);
        $is_mod = current_user_can('moderate_comments');
        $is_owner = $comment && is_user_logged_in() && (int) $comment->user_id === get_current_user_id();
        return [
            'can_edit'     => $is_mod || $is_owner,
            'can_delete'   => $is_mod || $is_owner,
            'can_moderate' => $is_mod,
            'can_pin'      => $is_mod,
        ];
    }

    /**
     * Permission: can edit? (author within configured window, or moderator)
     */
    public function check_edit_permission(\WP_REST_Request $request): bool {
        if (!is_user_logged_in()) return false;
        return $this->permissions((int) $request->get_param('comment_id'))['can_edit'];
    }

    /**
     * Permission: can delete? (author, or moderator)
     */
    public function check_delete_permission(\WP_REST_Request $request): bool {
        if (!is_user_logged_in()) return false;
        return $this->permissions((int) $request->get_param('comment_id'))['can_delete'];
    }

    /**
     * Permission: can pin? (moderator, top-level only)
     */
    public function check_pin_permission(\WP_REST_Request $request): bool {
        if (!is_user_logged_in()) return false;
        return $this->permissions((int) $request->get_param('comment_id'))['can_pin'];
    }

    /**
     * Edit comment content
     */
    public function edit_comment(\WP_REST_Request $request): \WP_REST_Response {
        $comment_id = $request->get_param('comment_id');
        $content    = $request->get_param('content');

        $comment = get_comment($comment_id);
        if (!$comment) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'comment_not_found',
                'message' => __('评论不存在。', 'aksrt'),
            ], 404);
        }

        // Sanitize with wp_kses (allow basic HTML)
        $allowed_html = [
            'a'      => ['href' => [], 'title' => [], 'target' => []],
            'code'   => [],
            'pre'    => [],
            'strong' => [],
            'em'     => [],
            'br'     => [],
            'p'      => [],
        ];
        $clean_content = wp_kses($content, $allowed_html);

        $updated = wp_update_comment([
            'comment_ID'      => $comment_id,
            'comment_content' => $clean_content,
        ]);

        if (is_wp_error($updated)) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'update_failed',
                'message' => __('更新失败。', 'aksrt'),
            ], 500);
        }

        return new \WP_REST_Response([
            'success' => true,
            'code'    => 'updated',
            'message' => __('评论已更新。', 'aksrt'),
            'data'    => [
                'content' => $clean_content,
            ],
        ]);
    }

    /**
     * Delete comment
     */
    public function delete_comment(\WP_REST_Request $request): \WP_REST_Response {
        $comment_id = $request->get_param('comment_id');

        $comment = get_comment($comment_id);
        if (!$comment) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'comment_not_found',
                'message' => __('评论不存在。', 'aksrt'),
            ], 404);
        }

        $deleted = wp_delete_comment($comment_id, false); // soft delete
        if (!$deleted) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'delete_failed',
                'message' => __('删除失败。', 'aksrt'),
            ], 500);
        }

        return new \WP_REST_Response([
            'success' => true,
            'code'    => 'deleted',
            'message' => __('评论已删除。', 'aksrt'),
        ]);
    }

    /**
     * Moderate comment (approve / hold / spam)
     */
    public function moderate_comment(\WP_REST_Request $request): \WP_REST_Response {
        $comment_id = $request->get_param('comment_id');
        $status     = $request->get_param('status');

        $allowed_statuses = ['approve', 'hold', 'spam'];
        if (!in_array($status, $allowed_statuses, true)) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'invalid_status',
                'message' => __('无效状态。', 'aksrt'),
            ], 400);
        }

        $comment = get_comment($comment_id);
        if (!$comment) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'comment_not_found',
                'message' => __('评论不存在。', 'aksrt'),
            ], 404);
        }

        $status_map = [
            'approve' => 'approved',
            'hold'    => 'hold',
            'spam'    => 'spam',
        ];

        $result = wp_set_comment_status($comment_id, $status_map[$status]);
        if (is_wp_error($result)) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'moderate_failed',
                'message' => __('操作失败。', 'aksrt'),
            ], 500);
        }

        return new \WP_REST_Response([
            'success' => true,
            'code'    => 'moderated',
            'message' => __('操作成功。', 'aksrt'),
            'data'    => [
                'status' => $status_map[$status],
            ],
        ]);
    }

    /**
     * Toggle a comment's pinned ("置顶") state. Top-level comments only.
     */
    public function pin_comment(\WP_REST_Request $request): \WP_REST_Response {
        $comment_id = (int) $request->get_param('comment_id');
        $comment = get_comment($comment_id);
        if (!$comment) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'comment_not_found',
                'message' => __('评论不存在。', 'aksrt'),
            ], 404);
        }

        if ((int) $comment->comment_parent !== 0) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'cannot_pin_reply',
                'message' => __('仅顶层评论可置顶。', 'aksrt'),
            ], 400);
        }

        $current = '1' === (string) get_comment_meta($comment_id, '_aksrt_comment_pinned', true);
        $target  = null !== $request->get_param('pinned')
            ? (bool) $request->get_param('pinned')
            : !$current;

        if ($target) {
            update_comment_meta($comment_id, '_aksrt_comment_pinned', '1');
        } else {
            delete_comment_meta($comment_id, '_aksrt_comment_pinned');
        }

        return new \WP_REST_Response([
            'success' => true,
            'code'    => 'pinned',
            'message' => $target ? __('评论已置顶。', 'aksrt') : __('已取消置顶。', 'aksrt'),
            'data'    => [
                'pinned' => $target,
            ],
        ]);
    }

    /**
     * Toggle the current visitor's like on a comment.
     */
    public function like_comment(\WP_REST_Request $request): \WP_REST_Response {
        $comment_id = (int) $request->get_param('comment_id');
        $comment = get_comment($comment_id);
        if (!$comment || '1' !== (string) $comment->comment_approved) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'comment_unavailable',
                'message' => __('评论不存在或未通过审核。', 'aksrt'),
            ], 404);
        }

        if (!function_exists('aksrt_is_comment_liked') || !function_exists('aksrt_set_comment_like_state') || !function_exists('aksrt_update_comment_counter')) {
            return new \WP_REST_Response([
                'success' => false,
                'code'    => 'like_unavailable',
                'message' => __('点赞功能不可用。', 'aksrt'),
            ], 500);
        }

        $current = aksrt_is_comment_liked($comment_id);
        $target  = null !== $request->get_param('active')
            ? (bool) $request->get_param('active')
            : !$current;

        if ($target !== $current) {
            aksrt_set_comment_like_state($comment_id, $target);
            $count = aksrt_update_comment_counter($comment_id, 'aksrt_comment_likes', $target ? 1 : -1);
        } else {
            $count = aksrt_get_comment_likes($comment_id);
        }

        return new \WP_REST_Response([
            'success' => true,
            'code'    => 'liked',
            'data'    => [
                'active' => $target,
                'count'  => $count,
            ],
        ]);
    }
}