<?php
/** Identity application REST endpoints. @package AKSRT */

namespace AKSRT\Identity;

defined('ABSPATH') || exit;

final class RestController {

	private const NS = 'aksrt/v1';
	private ApplicationService $service;

	public function __construct(?ApplicationService $service = null) {
		$this->service = $service ?? new ApplicationService();
	}

	public function register_routes(): void {
		register_rest_route(self::NS, '/identity/applications', [
			'methods' => \WP_REST_Server::CREATABLE,
			'callback' => [$this, 'create'],
			'permission_callback' => [$this, 'logged_in'],
		]);
	}

	public function logged_in(\WP_REST_Request $request) {
		if (!is_user_logged_in()) {
			return new \WP_Error('aksrt_identity_auth', __('请先登录', 'aksrt'), ['status' => 401]);
		}
		$nonce = (string) $request->get_header('X-WP-Nonce');
		if ($nonce === '' || !wp_verify_nonce($nonce, 'wp_rest')) {
			return new \WP_Error('aksrt_identity_nonce', __('安全校验失败，请刷新页面后重试', 'aksrt'), ['status' => 403]);
		}
		return true;
	}

	public function create(\WP_REST_Request $request): \WP_REST_Response {
		$files = $request->get_file_params();
		return $this->respond($this->service->create(
			get_current_user_id(),
			$request->get_params(),
			$files['evidence'] ?? null
		), 201);
	}

	private function respond($result, int $success_status = 200): \WP_REST_Response {
		if (is_wp_error($result)) {
			$error_data = $result->get_error_data();
			$status = is_array($error_data) ? (int) ($error_data['status'] ?? 0) : 0;
			if ($status < 400 || $status > 599) $status = 400;
			$response = new \WP_REST_Response([
				'success' => false,
				'code' => $result->get_error_code(),
				'message' => $result->get_error_message(),
			], $status);
		} else {
			$response = new \WP_REST_Response(['success' => true, 'data' => $result], $success_status);
		}
		$response->header('Cache-Control', 'no-store, private');
		$response->header('Pragma', 'no-cache');
		return $response;
	}
}