<?php
/**
 * AKSRT OAuth Proxy Client
 *
 * 代理登录客户端：将 OAuth 流程委托给代理服务端执行。
 * 本机无需配置任何平台的 OAuth 凭据，只需配置服务端地址和通讯密钥。
 *
 * 流程：
 * 1. 用户点击第三方登录 → 生成代理 URL 跳转到服务端
 * 2. 服务端执行 OAuth 流程 → 回调时重定向回本机
 * 3. 本机验证签名、提取用户数据 → find_or_create_user
 *
 * @package AKSRT
 */

defined('ABSPATH') || exit;

class AKSRT_OAuth_Proxy_Client {

    private static $instance = null;

    public static function get_instance(): self {
        if (null === self::$instance) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    private function __construct() {}

    /**
     * 初始化：注册回调路由
     */
    public function init(): void {
        add_action('template_redirect', [$this, 'handle_proxy_callback']);
        add_action('init', [$this, 'add_rewrite_rules']);
    }

    /**
     * 添加 URL 重写规则
     */
    public function add_rewrite_rules(): void {
        add_rewrite_rule(
            '^oauth/proxy/callback/?$',
            'index.php?aksrt_proxy_callback=1',
            'top'
        );

        add_filter('query_vars', function ($vars) {
            $vars[] = 'aksrt_proxy_callback';
            return $vars;
        });
    }

    /**
     * 生成代理登录 URL
     *
     * @param string $provider 平台标识
     * @param string $action   操作类型: 'login' | 'bind'
     * @return string 代理登录 URL
     */
    public function get_proxy_auth_url(string $provider, string $action = 'login'): string {
        $server_url = AKSRT_Settings::oauth_proxy_server_url();
        $secret     = AKSRT_Settings::oauth_proxy_secret();

        if (empty($server_url) || empty($secret)) {
            return '';
        }

        $back_url = home_url('/oauth/proxy/callback');
        $uid      = get_current_user_id();
        $nonce    = wp_create_nonce('aksrt_proxy_' . $provider . '_' . $uid);

        $params = [
            'provider'       => $provider,
            'agent_back_url' => $back_url,
            'action'         => $action,
            'nonce'          => $nonce,
            'uid'            => $uid,
            'ts'             => time(),
        ];

        $params['sign'] = $this->sign($params, $secret);

        $server_url = rtrim($server_url, '/');
        return $server_url . '/oauth/proxy/' . $provider . '?' . http_build_query($params);
    }

    /**
     * 处理代理回调（从服务端重定向回来）
     */
    public function handle_proxy_callback(): void {
        if (!get_query_var('aksrt_proxy_callback')) {
            return;
        }

        $secret = AKSRT_Settings::oauth_proxy_secret();
        if (empty($secret)) {
            wp_die(__('代理登录配置错误', 'aksrt'));
        }

        $sign     = sanitize_text_field($_GET['sign'] ?? '');
        $provider = sanitize_key($_GET['provider'] ?? '');
        $action   = sanitize_key($_GET['action'] ?? 'login');

        if (empty($sign) || empty($provider)) {
            wp_die(__('代理回调参数无效', 'aksrt'));
        }

        // 验证签名
        $verify_params = $_GET;
        unset($verify_params['sign']);

        if (!$this->verify_sign($verify_params, $secret, $sign)) {
            wp_die(__('代理回调签名验证失败', 'aksrt'));
        }

        // 验证时间戳（5分钟内有效）
        $ts = (int) ($_GET['ts'] ?? 0);
        if (abs(time() - $ts) > 300) {
            wp_die(__('代理回调已过期，请重新登录', 'aksrt'));
        }

        // 提取用户数据
        $provider_id = sanitize_text_field($_GET['provider_id'] ?? '');
        if (empty($provider_id)) {
            wp_die(__('代理回调缺少用户标识', 'aksrt'));
        }

        $user_data = [
            'provider'       => $provider,
            'provider_id'    => $provider_id,
            'username'       => sanitize_user($_GET['username'] ?? '', true),
            'name'           => sanitize_text_field($_GET['name'] ?? ''),
            'email'          => sanitize_email($_GET['email'] ?? ''),
            'email_verified' => !empty($_GET['email_verified']),
            'avatar_url'     => esc_url_raw($_GET['avatar_url'] ?? ''),
            'bio'            => sanitize_text_field($_GET['bio'] ?? ''),
        ];

        if ($action === 'bind') {
            $this->handle_proxy_bind($provider, $user_data);
            return;
        }

        $this->handle_proxy_login($provider, $user_data);
    }

    /**
     * 处理代理登录
     */
    private function handle_proxy_login(string $provider, array $user_data): void {
        $user = $this->find_or_create_user_from_proxy($provider, $user_data);

        // 未匹配已有账号 → 跳转绑定页
        if (is_wp_error($user) && $user->get_error_code() === 'oauth_no_match') {
            $error_data = $user->get_error_data();
            $obk = 'aksrt_ob_' . wp_generate_password(24, false);
            set_transient($obk, [
                'provider'    => $error_data['provider'],
                'provider_id' => $error_data['user_data']['provider_id'] ?? '',
                'user_data'   => $error_data['user_data'],
                'token'       => [],
            ], 15 * MINUTE_IN_SECONDS);

            $bind_url = aksrt_get_bind_url();
            wp_safe_redirect(add_query_arg('obk', $obk, $bind_url));
            exit;
        }

        if (is_wp_error($user)) {
            wp_die(__('登录失败：', 'aksrt') . esc_html($user->get_error_message()));
        }

        // 登录成功
        wp_set_auth_cookie($user->ID, true);
        $redirect_url = function_exists('aksrt_get_user_center_url') ? aksrt_get_user_center_url() : home_url('/');
        wp_safe_redirect(add_query_arg(['oauth_action' => 'login', 'oauth_bound' => $provider], $redirect_url));
        exit;
    }

    /**
     * 处理代理绑定（已登录用户绑定第三方账号）
     */
    private function handle_proxy_bind(string $provider, array $user_data): void {
        $current_uid = get_current_user_id();
        if (!$current_uid) {
            wp_safe_redirect(aksrt_get_login_url());
            exit;
        }

        // 检查是否已被其他用户占用
        $existing = $this->find_user_by_provider_meta($provider, $user_data['provider_id']);
        if ($existing && (int) $existing->ID !== $current_uid) {
            wp_die(__('该第三方账号已被其他用户绑定', 'aksrt'));
        }

        $this->bind_provider_to_user($current_uid, $provider, $user_data);

        $redirect_url = function_exists('aksrt_get_user_center_url')
            ? add_query_arg(['oauth_action' => 'bind', 'oauth_bound' => $provider], aksrt_get_user_center_url('settings'))
            : home_url('/');
        wp_safe_redirect($redirect_url);
        exit;
    }

    /**
     * 查找或创建用户（代理模式）
     *
     * @return WP_User|WP_Error
     */
    private function find_or_create_user_from_proxy(string $provider, array $user_data) {
        $email = $user_data['email'] ?? '';

        // 1. 通过 provider_id 查找
        if (!empty($user_data['provider_id'])) {
            $existing = $this->find_user_by_provider_meta($provider, $user_data['provider_id']);
            if ($existing instanceof WP_User) {
                $this->ensure_binding_meta($existing->ID, $provider, $user_data);
                return $existing;
            }
        }

        // 2. 通过邮箱查找
        if (!empty($email) && is_email($email)) {
            $existing = get_user_by('email', $email);
            if ($existing && !$existing instanceof WP_Error) {
                $this->ensure_binding_meta($existing->ID, $provider, $user_data);
                return $existing;
            }
        }

        // 3. 未匹配
        return new WP_Error('oauth_no_match', __('需要绑定已有账号', 'aksrt'), [
            'provider'  => $provider,
            'user_data' => $user_data,
        ]);
    }

    /**
     * 确保绑定 meta 存在
     */
    private function ensure_binding_meta(int $user_id, string $provider, array $user_data): void {
        update_user_meta($user_id, "aksrt_{$provider}_id", $user_data['provider_id'] ?? '');

        $bindings = get_user_meta($user_id, 'aksrt_oauth_bindings', true) ?: [];
        if (!is_array($bindings)) {
            $bindings = [];
        }
        if (!in_array($provider, $bindings, true)) {
            $bindings[] = $provider;
            update_user_meta($user_id, 'aksrt_oauth_bindings', $bindings);
        }

        if (!empty($user_data['avatar_url'])) {
            update_user_meta($user_id, 'aksrt_oauth_avatar', esc_url_raw($user_data['avatar_url']));
        }
    }

    /**
     * 绑定第三方账号到用户
     */
    private function bind_provider_to_user(int $user_id, string $provider, array $user_data): void {
        if (!empty($user_data['provider_id'])) {
            update_user_meta($user_id, "aksrt_{$provider}_id", $user_data['provider_id']);
        }

        $bindings = get_user_meta($user_id, 'aksrt_oauth_bindings', true) ?: [];
        if (!is_array($bindings)) {
            $bindings = [];
        }
        if (!in_array($provider, $bindings, true)) {
            $bindings[] = $provider;
            update_user_meta($user_id, 'aksrt_oauth_bindings', $bindings);
        }

        if (!empty($user_data['avatar_url'])) {
            update_user_meta($user_id, 'aksrt_oauth_avatar', esc_url_raw($user_data['avatar_url']));
        }
    }

    /**
     * 通过 provider meta 查找用户
     */
    private function find_user_by_provider_meta(string $provider, string $provider_id): ?WP_User {
        if (empty($provider_id)) {
            return null;
        }
        $users = get_users([
            'meta_key'   => "aksrt_{$provider}_id",
            'meta_value' => $provider_id,
            'number'     => 1,
        ]);
        return !empty($users[0]) ? $users[0] : null;
    }

    /**
     * 生成 HMAC-SHA256 签名
     */
    private function sign(array $data, string $secret): string {
        unset($data['sign']);
        ksort($data);
        $payload = http_build_query($data);
        return hash_hmac('sha256', $payload, $secret);
    }

    /**
     * 验证 HMAC-SHA256 签名
     */
    private function verify_sign(array $data, string $secret, string $expected_sign): bool {
        $computed = $this->sign($data, $secret);
        return hash_equals($computed, $expected_sign);
    }
}

return AKSRT_OAuth_Proxy_Client::get_instance();