<?php
/**
 * @package AKSRT
 */

namespace AKSRT\Auth;

defined('ABSPATH') || exit;

final class Router {

	private static $instance = null;

	public static function get_instance(): self {
		if (null === self::$instance) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	private function __construct() {}

	public function init(): void {
		add_filter('query_vars', [$this, 'register_query_vars']);
		add_action('init', [$this, 'register_rewrite_rules']);
		add_filter('template_include', [$this, 'handle_template_include'], 99);
		add_action('init', [$this, 'maybe_flush_rewrite_rules']);

		add_filter('login_url', [$this, 'filter_login_url'], 10, 3);
		add_filter('lostpassword_url', [$this, 'filter_lostpassword_url'], 10, 2);
		add_filter('register_url', [$this, 'filter_register_url']);
		add_filter('logout_url', [$this, 'filter_logout_url'], 10, 2);

		add_action('login_init', [$this, 'redirect_native_login']);
		add_action('template_redirect', [$this, 'handle_logout_route']);
	}

	public function register_query_vars(array $vars): array {
		$vars[] = 'aksrt_sign';
		$vars[] = 'aksrt_logout';
		return $vars;
	}

	private function auth_route_map(): array {
		return [
			'sign'           => 'index.php?aksrt_sign=1',
			'logout'         => 'index.php?aksrt_logout=1',
		];
	}

	public function register_rewrite_rules(): void {
		foreach ($this->auth_route_map() as $path => $query) {
			add_rewrite_rule('^' . preg_quote($path, '/') . '/?$', $query, 'top');
		}
	}

	public function handle_template_include(string $template): string {
		if (get_query_var('aksrt_sign')) {
			// §4.1 Global sign gate: when close_sign is active, block non-logged-in access to sign page
			if (class_exists('\AKSRT\Settings\Settings') && \AKSRT\Settings\Settings::close_sign() && !is_user_logged_in()) {
				if (empty($_REQUEST['interim-login'])) {
					if (!headers_sent()) {
						wp_safe_redirect(home_url('/'), 302);
						exit;
					}
				}
			}

			$tpl = aksrt_locate_template_file('templates/pages/page-sign.php');
			if ($tpl) {
				return $tpl;
			}
		}

		return $template;
	}

	public function maybe_flush_rewrite_rules(): void {
		$rewrite_version = AKSRT_VERSION . ':sign-router-v3-single-route';
		if (get_option('aksrt_auth_routes_flushed') !== $rewrite_version) {
			flush_rewrite_rules(false);
			update_option('aksrt_auth_routes_flushed', $rewrite_version);
		}
	}

	public function filter_login_url(string $login_url, string $redirect, bool $force_reauth): string {
		if (strpos($login_url, 'wp-login.php') === false) {
			return $login_url;
		}

		$custom_login_url = aksrt_get_login_url();
		if ($redirect !== '') {
			$custom_login_url = add_query_arg('redirect_to', urlencode($redirect), $custom_login_url);
		}
		if ($force_reauth) {
			$custom_login_url = add_query_arg('reauth', '1', $custom_login_url);
		}

		return $custom_login_url;
	}

	public function filter_lostpassword_url(string $lostpassword_url, string $redirect): string {
		$custom_url = aksrt_get_reset_password_url();
		if ($redirect !== '') {
			$custom_url = add_query_arg('redirect_to', urlencode($redirect), $custom_url);
		}
		return $custom_url;
	}

	public function filter_register_url(string $register_url): string {
		return aksrt_get_register_url();
	}

	public function filter_logout_url(string $logout_url, string $redirect): string {
		return aksrt_get_logout_url($redirect ?: home_url('/'));
	}

	public function redirect_native_login(): void {
		if (class_exists('\AKSRT\Settings\Settings') && !\AKSRT\Settings\Settings::replace_wp_login()) {
			return;
		}

		// §4.1 Emergency bypass key (admin_sign_key): allow wp-login.php direct access when key matches
		if (isset($_GET['aksrt_bypass'])) {
			$key = class_exists('\AKSRT\Settings\Settings') ? \AKSRT\Settings\Settings::admin_sign_key() : '';
			if ($key !== '' && hash_equals($key, (string) $_GET['aksrt_bypass'])) {
				return;
			}
		}

		$action          = isset($_REQUEST['action']) ? sanitize_key((string) $_REQUEST['action']) : 'login';
		$redirect_to     = isset($_REQUEST['redirect_to']) ? wp_unslash((string) $_REQUEST['redirect_to']) : '';
		$reauth          = !empty($_REQUEST['reauth']);

		if ($action === 'logout') {
			wp_safe_redirect(aksrt_get_logout_url($redirect_to ?: home_url('/')), 302);
			exit;
		}

		switch ($action) {
			case 'register':
				$target = aksrt_get_sign_page_url('signup');
				break;
			case 'lostpassword':
				$target = aksrt_get_sign_page_url('resetpassword');
				break;
			case 'rp':
			case 'resetpass':
				$target = aksrt_get_sign_page_url('resetpassword');
				break;
			default:
				$target = aksrt_get_sign_page_url('signin');
				break;
		}

		$passthrough = [];
		if ($redirect_to !== '') {
			$passthrough['redirect_to'] = $redirect_to;
		}
		if ($reauth) {
			$passthrough['reauth'] = '1';
		}
		if (!empty($_REQUEST['obk'])) {
			$passthrough['obk'] = sanitize_text_field((string) $_REQUEST['obk']);
		}

		if (!empty($passthrough)) {
			$target = add_query_arg($passthrough, $target);
		}

		wp_safe_redirect($target, 302);
		exit;
	}

	public function handle_logout_route(): void {
		if (!$this->is_logout_request()) {
			return;
		}

		if (!is_user_logged_in()) {
			wp_safe_redirect(home_url('/'));
			exit;
		}

		$nonce = isset($_GET['_wpnonce']) ? sanitize_text_field((string) $_GET['_wpnonce']) : '';
		// Accept theme nonce and core log-out nonce (wp_logout_url default).
		$nonce_ok = ($nonce !== '' && (
			wp_verify_nonce($nonce, 'aksrt-logout')
			|| wp_verify_nonce($nonce, 'log-out')
		));
		if (!$nonce_ok) {
			wp_die(esc_html__('退出登录请求无效，请重试。', 'aksrt'), esc_html__('退出登录', 'aksrt'), ['response' => 403]);
		}

		$redirect_to = isset($_GET['redirect_to']) ? wp_unslash((string) $_GET['redirect_to']) : home_url('/');
		$redirect_to = wp_validate_redirect($redirect_to, home_url('/'));

		wp_logout();
		wp_safe_redirect($redirect_to !== '' ? $redirect_to : home_url('/'));
		exit;
	}

	/**
	 * Detect the unique public logout path.
	 */
	private function is_logout_request(): bool {
		$request_uri = isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '';
		if ($request_uri === '') {
			return false;
		}
		$path = (string) wp_parse_url($request_uri, PHP_URL_PATH);
		$home_path = (string) wp_parse_url(home_url('/'), PHP_URL_PATH);
		if ($home_path !== '' && $home_path !== '/' && str_starts_with($path, $home_path)) {
			$path = (string) substr($path, strlen(rtrim($home_path, '/')));
		}
		$path = '/' . trim($path, '/');
		return $path === '/logout';
	}
}