<?php
namespace JVBase\integrations;

use JetBrains\PhpStorm\NoReturn;
use WP_Error;

if (!defined('ABSPATH')) {
	exit;
}

trait OAuth
{
	use _Base, Admin;
	protected bool $hasOAuth = true;
	protected OAuthURLs $oauth;
	/**
	 * Child classes must set this (e.g. 'https://api.example.com/v1/')
	 */
	protected ?string $baseOAuthUrl = null;
	protected ?string $oauthRedirectUrl = null;
	protected int $oauthTTL = 300;
	protected array $oathScopes = [];


	/**
	 * @return array Defaults to the base getRequestHeaders, but can optionally be overridden
	 */
	protected function getOAuthRequestHeaders(): array
	{
		return $this->getRequestHeaders();
	}

	/**
	 * Default to the base handleResponse method, but extensions can modify accordingly
	 * @param array|WP_Error $response
	 * @param string $method
	 * @param string $endpoint
	 * @return array
	 */
	protected function handleOAuthResponse(array|WP_Error $response, string $method, string $endpoint): array
	{
		return $this->handleResponse($response, $method, $endpoint);
	}
	abstract protected function refreshAccessToken(OAuthCredentials $credentials): array;

	function addOAuthActions():void
	{
		$actions = [
			[
				'name'		=> 'Connect to Service',
				'label'		=> 'Connect',
				'icon'		=> 'plugs-connected',
				'action'	=> [$this, 'handleOAuthConnect']
			],
			[
				'name'		=> 'Disconnect from Service',
				'icon'		=> 'plugs-disconnected',
				'action'	=> [$this, 'handleOAuthDisconnect']
			],
//			[
//				'name'		=> 'Refresh Token',
//				'icon'		=> 'arrows-clockwise',
//				'action'	=> [$this, 'handleOAuthRefreshToken']
//			]
		];
		foreach ($actions as $a) {
			$this->addAction($a['name'], $a['action'], $a['slug']??null, $a['icon']??null, $a['label']??null);
		}
	}
		public function handleOAuthConnect():array
		{
			if (!$this->hasOAuth) {
				return $this->response(false, 'Not an OAuth service');
			}
			$url = $this->getOAuthUrl();
			if ($url) {
				return [
					'success'	=> true,
					'redirect'	=> $url,
				];
			}
			return $this->response(false, 'Failed to generate OAuth URL');
		}

		public function handleOAuthDisconnect():array
		{
			$revoked = $this->revokeOAuth();
			return $this->response($revoked, $revoked ?
			'Successfully disconnected from '.$this->title :
			'Failed to disconnect from '.$this->title);
		}

		public function revokeOAuth():bool
		{
			if (!$this->hasOAuth) {
				return false;
			}
			if (empty($this->oauth['revoke'])) {
				error_log('No revoke url set for '.$this->service_name);
				return false;
			}
			$credentials = $this->loadCredentials();
			if (empty($credentials['access_token'])) {
				error_log('Could not send revoke request, no access_token for '.$this->service_name);
			} else {
				$response = $this->postOAuthRequest($this->oauth['revoke'], [
					'body'	=> [
						'token'	=> $credentials['access_token']
					]
				]);
				$empty = new OAuthCredentials([]);
				foreach ($empty->toArray() as $key => $value) {
					if (array_key_exists($key, $credentials)) {
						unset($credentials[$key]);
					}
				}

				return Auth::getInstance()->storeCredentials($this->service_name, $credentials, $this->userID);
			}
			return false;
		}

	protected function registerOAuthCallbacks():void
	{
		add_action( 'wp_ajax_'.BASE.$this->service_name.'_oauth_callback', [$this, 'handleAjaxResponse'] );
		add_action( 'wp_ajax_nopriv_'.BASE.$this->service_name.'_oauth_callback', [$this, 'handleAjaxResponse'] );
	}

	protected function getOAuthRequest(string $endpoint, array $data = [], bool $force = false, ?int $ttl = null): array
	{
		$key = [$this->service_name, $this->userID, $endpoint, $data];
		if (!$force) {
			$cached = $this->cache->get($key);
			if ($cached) {
				return $cached;
			}
		}
		$response = $this->makeOAuthRequest('GET', $endpoint, $data);
		if ($response && !is_wp_error($response)) {
			$ttl = is_int($ttl) ? $ttl : $this->oauthTTL;
			$this->cache->set($key, $response, $ttl);
		}
		return $response;
	}

	protected function postOAuthRequest(string $endpoint, array $data = []): array
	{
		return $this->makeOAuthRequest('POST', $endpoint, $data);
	}

	protected function putOAuthRequest(string $endpoint, array $data = []): array
	{
		return $this->makeOAuthRequest('PUT', $endpoint, $data);
	}

	protected function deleteOAuthRequest(string $endpoint, array $data = []): array
	{
		return $this->makeOAuthRequest('DELETE', $endpoint, $data);
	}

	protected function makeOAuthRequest(string $method, string $endpoint, array $data = []): array
	{
		if (is_null($this->baseOAuthUrl)) {
			error_log('Can not make request. No $baseOAuthUrl set for '.$this->service_name);
			return [];
		}
		if ($this->oauthLimiter && !$this->awaitOAuthRateLimit($endpoint)) {
			$error = new WP_Error('rate_limit_exceeded', "Rate limit exceeded for {$endpoint}");
			return $this->handleOAuthResponse($error, $method, $endpoint);
		}

		$credentials = $this->ensureFreshToken();
		if (!$credentials->isValid()) {
			$error = new WP_Error('invalid_credentials', "Missing or invalid OAuth credentials for {$this->service_name}");
			return $this->handleOAuthResponse($error, $method, $endpoint);
		}


		$url = rtrim($this->baseOAuthUrl, '/') . '/' . ltrim($endpoint, '/');

		$args = [
			'method'	=> $method,
			'headers'	=> $this->getOAuthRequestHeaders(),
			'timeout'	=> 15,
		];

		if (!empty($data)) {
			if (in_array($method, ['GET', 'DELETE'], true)) {
				$url = add_query_arg($data, $url);
			} else {
				$args['body'] = wp_json_encode($data);
			}
		}

		$response = wp_remote_request($url, $args);

		$this->oauthLimiter?->recordRequest($endpoint);

		return $this->handleOAuthResponse($response, $method, $endpoint);
	}

	/**
	 * Checks stored credentials, refreshes via refreshAccessToken() if expired,
	 * and persists the refreshed credentials back to Auth
	 */
	protected function ensureFreshToken(): OAuthCredentials
	{
		$auth = Auth::getInstance();
		$credentials = new OAuthCredentials($auth->getCredentials($this->service_name, $this->userID));

		if (!$credentials->isValid() || !$credentials->isExpired()) {
			return $credentials;
		}

		$refreshed = new OAuthCredentials($this->refreshAccessToken($credentials));
		if ($refreshed->isValid()) {
			$auth->storeCredentials($this->service_name, $refreshed->toArray(), $this->userID);
			return $refreshed;
		}

		return $credentials;
	}

	public function hasValidOAuth():bool
	{
		$auth = Auth::getInstance();
		$credentials = new OAuthCredentials($auth->getCredentials($this->service_name, $this->userID));
		return $credentials->isValid();
	}

	protected function awaitOAuthRateLimit(string $endpoint, int $maxAttempts = 3): bool
	{
		$attempts = 0;

		if (is_null($this->oauthLimiter)) {
			return false;
		}

		while (!$this->oauthLimiter->checkRateLimit($endpoint)) {
			$attempts++;
			if ($attempts >= $maxAttempts) {
				return false;
			}
			usleep(random_int(250_000, 750_000));
		}

		return true;
	}

	/***************************************************************
	 * ACTIONS CALLBACKS
	***************************************************************/
	#[NoReturn] public function handleAjaxResponse():void
	{

		$code = $_GET['code'];
		$state =  $_GET['state'];


		$state_parts = explode('|', $state);
		$state_key = $state_parts[0] ?? '';
		$user_id = intval($state_parts[1] ?? 0);
		$user_id = ($user_id === 0) ? null : $user_id;
		$return_url = isset($state_parts[2]) ? base64_decode($state_parts[2]) : admin_url('admin.php?page=jvb-integrations');

		$state_data = get_transient('oauth_state_' . $state_key);
		if (!$state_data || $state_data['service'] !== $this->service_name) {
			wp_die('Invalid state parameter', 'OAuth Error');
		}

		// Delete the transient to prevent reuse
		delete_transient('oauth_state_' . $state_key);
		// Handle error from OAuth provider
		if (array_key_exists('error', $_GET)) {
			$error_description = $_GET['error_description'] ?? 'Authorization denied';

			wp_redirect(add_query_arg([
				'error' => 'OAuth authorization denied: ' . $error_description
			], $return_url));
			exit;
		}

		// Get integration instance
		$integration = JVB()->connect($this->service_name, $user_id);

		if (!$integration) {
			wp_die('Invalid service: ' . esc_html($this->service_name), 'OAuth Error');
		}


		// Exchange code for tokens
		$result = $integration->handleOAuthCode($code, $state);

		// Redirect back with result
		if ($result['success']) {
			wp_redirect(add_query_arg([
				'success' => 'Successfully connected to ' . $integration->title
			], $return_url));
		} else {
			// Handle failure
			$error_message = $result['message'] ?? 'Failed to complete OAuth authorization';

			wp_redirect(add_query_arg([
				'error' => $error_message
			], $return_url));
		}
		exit;
	}

	protected function renderOAuthConnectionForm():string
	{
		$credentials = $this->loadCredentials();
		$hasCredentials = $this->hasValidOAuth();
		$returnURL = $this->getReturnURL();

		if ($hasCredentials) {
			return sprintf(
			'<div class="oauth-connect">
				<h3>Connect to your %s account</h3>
				<a href="%s" class="btn jvb-oauth-connect" data-service="%s">%s Authorize Connection</a>',
				$this->title,
				$this->getOAuthURL($returnURL),
				esc_attr($this->service_name),
				$this->outputIcon($this->icon)
			);
		}
		$form = sprintf(
			'<details open>
			<summary>Connected Account
				<div class="connection-status connected">
					<span class="status-indicator">●</span>
					<span>Connected</span>
				</div>
			</summary>
			<span class="label">OAuth Redirect URL:</span>
			<code>%s</code>',
			$this->getRedirectUri()
		);
		if (!empty($credentials['updated_at'])) {
			$form .= sprintf(
				'<div class="oauth-meta"><small>Token expires: %s</small></div>',
				array_key_exists('expires_at', $credentials) ?
						human_time_diff($credentials['expires_at']) :
						'Never'
			);
		}
		//
		if (method_exists($this, 'renderOAuthConnectedOptions')) {
			$form .= $this->renderOAuthConnectedOptions();
		}
		$form .= '</details';
		return $form;
	}

	/**
	 * @return string Outputs additional information after the basic OAuth connection
	 */
	protected function renderOAuthConnectedOptions():string
	{
		return '';
	}

	public function getOAuthURL(?string $return_url = null):string
	{
		if (!$this->hasOAuth) {
			return '';
		}
		$credentials = $this->loadCredentials();
		if (empty($this->oauth['authorize'])) {
			$this->logError('getOAuthUrl', 'OAuth authorize URL not configured');
			return '';
		}
		$params = [
			'client_id'		=> $credentials['client_id']??$credentials['application_id']??$credentials['app_id']??'',
			'redirect_url'	=> $this->getRedirectUri(),
			'response_type'	=> 'code',
			'scope'			=> implode(' ', $this->oauthScopes??[])
		];
		$state_key = wp_generate_password(32, false);
		$user_id = $this->userID??0;

		//Store state data in transient, expiring in 10 minutes
		set_transient(
			BASE.'oauth_state_'.$state_key,
			[
				'service'	=> $this->service_name,
				'user_id'	=> $user_id,
				'created'	=> time()
			],
			600
		);

		$state_parts = [
			$state_key,
			$user_id
		];

		$state_parts[] = base64_encode(is_null($return_url) ? $this->getReturnURL() : $return_url);

		$params['state'] = implode('|', $state_parts);

		//Allow extensions to modify params
		if (method_exists($this, 'addOAuthParams')) {
			$params = $this->addOAuthParams($params);
		}

		return $this->oauth['authorize'] . '?' . http_build_query($params);
	}

	protected function getRedirectUri():string
	{
		if ($this->hasOAuth) {
			return admin_url('admin-ajax.php?action='.BASE . $this->service_name . '_oauth_callback');
		}
		return rest_url('jvb/v1/oauth/callback?service=' . $this->service_name);
	}
}