<?php
/**
 * @package AKSRT
 */

namespace AKSRT\Auth;

defined('ABSPATH') || exit;

final class Router {

	private static $instance = null;

	public static function get_instance(): self {
		if (null === self::$instance) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	private function __construct() {}

	public function init(): void {
		add_filter('query_vars', [$this, 'register_query_vars']);
		add_action('init', [$this, 'register_rewrite_rules']);
		add_filter('template_include', [$this, 'handle_template_include'], 99);
		add_action('init', [$this, 'maybe_flush_rewrite_rules']);

		add_filter('login_url', [$this, 'filter_login_url'], 10, 3);
		add_filter('lostpassword_url', [$this, 'filter_lostpassword_url'], 10, 2);
		add_filter('register_url', [$this, 'filter_register_url']);
		add_filter('logout_url', [$this, 'filter_logout_url'], 10, 2);

		add_action('login_init', [$this, 'redirect_native_login']);
		add_action('template_redirect', [$this, 'handle_logout_route']);
	}

	public function register_query_vars(array $vars): array {
		$vars[] = 'aksrt_sign';
		$vars[] = 'aksrt_auth_tab';
		$vars[] = 'aksrt_logout';
		return $vars;
	}

	private function auth_route_map(): array {
		return [
			'login'          => 'index.php?aksrt_sign=1&aksrt_auth_tab=login',
			'register'       => 'index.php?aksrt_sign=1&aksrt_auth_tab=register',
			'bind-account'   => 'index.php?aksrt_sign=1&aksrt_auth_tab=bind',
			'logout'         => 'index.php?aksrt_logout=1',
			'reset-password' => 'index.php?aksrt_sign=1&aksrt_auth_tab=reset-password',
			'verify-email'   => 'index.php?aksrt_sign=1&aksrt_auth_tab=verify-email',
		];
	}

	public function register_rewrite_rules(): void {
		foreach ($this->auth_route_map() as $path => $query) {
			add_rewrite_rule('^' . preg_quote($path, '/') . '/?$', $query, 'top');
		}
	}

	public function handle_template_include(string $template): string {
		if (get_query_var('aksrt_sign')) {
			// §4.1 Global sign gate: when close_sign is active, block non-logged-in access to sign page
			if (class_exists('\AKSRT\Settings\Settings') && \AKSRT\Settings\Settings::close_sign() && !is_user_logged_in()) {
				$tab = (string) get_query_var('aksrt_auth_tab');
				if (!in_array($tab, ['reset-password', 'verify-email', 'bind-account'], true) && empty($_REQUEST['interim-login'])) {
					if (!headers_sent()) {
						wp_safe_redirect(home_url('/'), 302);
						exit;
					}
				}
			}

			$auth_template = function_exists('aksrt_get_auth_template_file')
				? aksrt_get_auth_template_file((string) get_query_var('aksrt_auth_tab'), true)
				: 'templates/pages/page-sign.php';
			$tpl = aksrt_locate_template_file($auth_template);
			if ($tpl) {
				return $tpl;
			}
		}

		return $template;
	}

	public function maybe_flush_rewrite_rules(): void {
		$rewrite_version = AKSRT_VERSION . ':sign-router-v2-logout';
		if (get_option('aksrt_auth_routes_flushed') !== $rewrite_version) {
			flush_rewrite_rules(false);
			update_option('aksrt_auth_routes_flushed', $rewrite_version);
		}
	}

	public function filter_login_url(string $login_url, string $redirect, bool $force_reauth): string {
		if (strpos($login_url, 'wp-login.php') === false) {
			return $login_url;
		}

		$custom_login_url = aksrt_get_login_url();
		if ($redirect !== '') {
			$custom_login_url = add_query_arg('redirect_to', urlencode($redirect), $custom_login_url);
		}
		if ($force_reauth) {
			$custom_login_url = add_query_arg('reauth', '1', $custom_login_url);
		}

		return $custom_login_url;
	}

	public function filter_lostpassword_url(string $lostpassword_url, string $redirect): string {
		$custom_url = aksrt_get_reset_password_url();
		if ($redirect !== '') {
			$custom_url = add_query_arg('redirect_to', urlencode($redirect), $custom_url);
		}
		return $custom_url;
	}

	public function filter_register_url(string $register_url): string {
		return aksrt_get_register_url();
	}

	public function filter_logout_url(string $logout_url, string $redirect): string {
		return aksrt_get_logout_url($redirect ?: home_url('/'));
	}

	public function redirect_native_login(): void {
		if (wp_doing_ajax()) {
			return;
		}

		// §4.1 Emergency bypass key (admin_sign_key): allow wp-login.php direct access when key matches
		if (isset($_GET['aksrt_bypass'])) {
			$key = class_exists('\AKSRT\Settings\Settings') ? \AKSRT\Settings\Settings::admin_sign_key() : '';
			if ($key !== '' && hash_equals($key, (string) $_GET['aksrt_bypass'])) {
				return;
			}
		}

		$action          = isset($_REQUEST['action']) ? sanitize_key((string) $_REQUEST['action']) : 'login';
		$redirect_to     = isset($_REQUEST['redirect_to']) ? wp_unslash((string) $_REQUEST['redirect_to']) : '';
		$interim         = !empty($_REQUEST['interim-login']);
		$reauth          = !empty($_REQUEST['reauth']);
		$is_admin_target = $redirect_to !== '' && strpos($redirect_to, admin_url()) === 0;

		if (is_user_logged_in() && current_user_can('manage_options')) {
			return;
		}

		if ($is_admin_target || $interim || $reauth || $action === 'logout') {
			return;
		}

		switch ($action) {
			case 'register':
				$target = aksrt_get_register_url();
				break;
			case 'lostpassword':
				$target = aksrt_get_reset_password_url();
				break;
			case 'rp':
			case 'resetpass':
				$target = add_query_arg('legacy', '1', aksrt_get_reset_password_url());
				break;
			default:
				$target = aksrt_get_login_url();
				break;
		}

		$passthrough = [];
		if ($redirect_to !== '') {
			$passthrough['redirect_to'] = $redirect_to;
		}
		if ($reauth) {
			$passthrough['reauth'] = '1';
		}
		if (!empty($_REQUEST['obk'])) {
			$passthrough['obk'] = sanitize_text_field((string) $_REQUEST['obk']);
		}

		if (!empty($passthrough)) {
			$target = add_query_arg($passthrough, $target);
		}

		wp_safe_redirect($target, 302);
		exit;
	}

	public function handle_logout_route(): void {
		if (!$this->is_logout_request()) {
			return;
		}

		if (!is_user_logged_in()) {
			wp_safe_redirect(home_url('/'));
			exit;
		}

		$nonce = isset($_GET['_wpnonce']) ? sanitize_text_field((string) $_GET['_wpnonce']) : '';
		// Accept theme nonce and core log-out nonce (wp_logout_url default).
		$nonce_ok = ($nonce !== '' && (
			wp_verify_nonce($nonce, 'aksrt-logout')
			|| wp_verify_nonce($nonce, 'log-out')
		));
		if (!$nonce_ok) {
			wp_die(esc_html__('退出登录请求无效，请重试。', 'aksrt'), esc_html__('退出登录', 'aksrt'), ['response' => 403]);
		}

		$redirect_to = isset($_GET['redirect_to']) ? wp_unslash((string) $_GET['redirect_to']) : home_url('/');
		$redirect_to = wp_validate_redirect($redirect_to, home_url('/'));

		wp_logout();
		wp_safe_redirect($redirect_to !== '' ? $redirect_to : home_url('/'));
		exit;
	}

	/**
	 * Detect logout via rewrite query var, GET flag, or pretty path.
	 */
	private function is_logout_request(): bool {
		if ((string) get_query_var('aksrt_logout') !== '' && (string) get_query_var('aksrt_logout') !== '0') {
			return true;
		}
		if (isset($_GET['aksrt_logout']) && (string) $_GET['aksrt_logout'] !== '' && (string) $_GET['aksrt_logout'] !== '0') {
			return true;
		}

		$request_uri = isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '';
		if ($request_uri === '') {
			return false;
		}
		$path = (string) wp_parse_url($request_uri, PHP_URL_PATH);
		$home_path = (string) wp_parse_url(home_url('/'), PHP_URL_PATH);
		if ($home_path !== '' && $home_path !== '/' && str_starts_with($path, $home_path)) {
			$path = (string) substr($path, strlen(rtrim($home_path, '/')));
		}
		$path = '/' . trim($path, '/');
		return $path === '/logout';
	}
}