<?php
/**
 * Identity verification settings facade.
 *
 * @package AKSRT
 */

namespace AKSRT\Identity;

defined('ABSPATH') || exit;

final class SettingsRuntime {

    /** @return array<string,mixed> */
    public static function get(): array {
        $settings = \AKSRT\Settings\Settings::get_all();
        $provider = sanitize_key((string) ($settings['user_verify_provider'] ?? 'aliyun'));
        if (!in_array($provider, ['aliyun', 'tencent'], true)) {
            $provider = 'aliyun';
        }

        return [
            'enabled' => !isset($settings['user_verify_enabled']) || !empty($settings['user_verify_enabled']),
            'allow_apply' => !isset($settings['user_verify_allow_apply']) || !empty($settings['user_verify_allow_apply']),
            'provider' => $provider,
            'allow_manual_fallback' => !isset($settings['user_verify_allow_manual_fallback']) || !empty($settings['user_verify_allow_manual_fallback']),
            'session_ttl_minutes' => max(5, min(1440, (int) ($settings['user_verify_session_ttl_minutes'] ?? 30))),
            'poll_interval_seconds' => max(3, min(60, (int) ($settings['user_verify_poll_interval_seconds'] ?? 5))),
            'max_retries' => max(0, min(3, (int) ($settings['user_verify_max_retries'] ?? 1))),
            'personal_flow' => sanitize_text_field((string) ($settings['user_verify_' . $provider . '_personal_flow'] ?? '')),
            'product_code' => $provider === 'aliyun' && in_array(($settings['user_verify_aliyun_product_code'] ?? 'ID_PRO'), ['ID_PRO', 'PV_FV', 'LR_FR'], true)
                ? (string) $settings['user_verify_aliyun_product_code']
                : 'ID_PRO',
            'enterprise_flow' => sanitize_text_field((string) ($settings['user_verify_' . $provider . '_enterprise_flow'] ?? '')),
            'region' => sanitize_text_field((string) ($settings['user_verify_' . $provider . '_region'] ?? '')),
            'credentials' => SecretStore::get($provider),
        ];
    }

    public static function hmac(string $value): string {
        return hash_hmac('sha256', trim($value), wp_salt('secure_auth') . '|aksrt-identity-hmac');
    }

    public static function mask_id_number(string $value): string {
        $value = preg_replace('/\s+/', '', $value) ?: '';
        $length = strlen($value);
        if ($length <= 8) {
            return str_repeat('*', max(0, $length - 2)) . substr($value, -2);
        }
        return substr($value, 0, 3) . str_repeat('*', $length - 7) . substr($value, -4);
    }

    public static function mask_name(string $value): string {
        $value = trim($value);
        $length = function_exists('mb_strlen') ? mb_strlen($value) : strlen($value);
        if ($length <= 1) {
            return '*';
        }
        $first = function_exists('mb_substr') ? mb_substr($value, 0, 1) : substr($value, 0, 1);
        return $first . str_repeat('*', max(1, $length - 1));
    }
}