<?php
/**
 * Identity provider callback endpoints.
 *
 * @package AKSRT
 */

namespace AKSRT\Identity;

use AKSRT\Identity\Provider\ProviderFactory;

defined('ABSPATH') || exit;

final class CallbackController {

    private const NS = 'aksrt/v1';

    public function register_routes(): void {
        foreach (['aliyun', 'tencent'] as $provider) {
            register_rest_route(self::NS, '/identity/callback/' . $provider, [
                'methods' => $provider === 'aliyun' ? ['GET', 'POST'] : 'POST',
                'callback' => function (\WP_REST_Request $request) use ($provider): \WP_REST_Response {
                    return $this->handle($provider, $request);
                },
                'permission_callback' => '__return_true',
            ]);
        }
    }

    private function handle(string $provider_key, \WP_REST_Request $request): \WP_REST_Response {
        $body = $request->get_body();
        if (strlen($body) > 1024 * 1024) {
            return new \WP_REST_Response(['success' => false], 413);
        }
        $provider = ProviderFactory::make($provider_key);
        if (!$provider->verify_callback($request)) {
            return new \WP_REST_Response(['success' => false], 403);
        }
        $result = $provider->parse_callback($request);
        $session = sanitize_text_field((string) ($result->data['provider_session_id'] ?? ''));
        $outer_order = sanitize_text_field((string) ($result->data['outer_order_no'] ?? ''));
        if ($session === '' && $outer_order === '') {
            return new \WP_REST_Response(['success' => false], 422);
        }

        global $wpdb;
        $table = \AKSRT\Core\DBMigrator::table('identity_application');
        if ($session !== '') {
            $row = $wpdb->get_row($wpdb->prepare(
                "SELECT * FROM {$table} WHERE provider = %s AND provider_session_id = %s ORDER BY id DESC LIMIT 1",
                $provider_key,
                $session
            ), ARRAY_A);
        } else {
            $row = $wpdb->get_row($wpdb->prepare(
                "SELECT * FROM {$table} WHERE provider = %s AND application_uuid = %s ORDER BY id DESC LIMIT 1",
                $provider_key,
                $outer_order
            ), ARRAY_A);
        }
        if (!is_array($row)) {
            return new \WP_REST_Response(['success' => false], 404);
        }

        // The callback only wakes server-side reconciliation. A provider query
        // remains the source of truth for a successful identity decision.
        $service = new ApplicationService();
        $response = $service->refresh($row);
        if (is_wp_error($response)) {
            return new \WP_REST_Response(['success' => false], 409);
        }
        return new \WP_REST_Response(['success' => true]);
    }
}