<?php
declare(strict_types=1);

namespace Unsupervised\Schedular\Policy;

use Unsupervised\Schedular\Auth\RoleManager;
use Unsupervised\Schedular\Val;

class PolicyController {

	public function __construct(
		private PolicyRepository $policies,
		private PolicyVersionRepository $versions,
		private PolicyService $service,
	) {}

	public function renderPage(): void {
		if ( ! current_user_can( RoleManager::CAP_MANAGE_POLICIES ) ) {
			wp_die( esc_html__( 'You do not have permission to manage policies.', 'unsupervised-schedular' ) );
		}

		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_policy_action' ) ) {
			$this->handleFormAction();
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only policy selector.
		$policyId       = absint( Val::int( $_GET['policy_id'] ?? 0 ) );
		$policyList     = $this->policies->findAll();
		$selectedPolicy = $policyId > 0 ? $this->policies->findById( $policyId ) : null;
		$policyVersions = null !== $selectedPolicy ? $this->versions->findByPolicy( (int) $selectedPolicy->id ) : null;

		include USC_PLUGIN_DIR . 'templates/admin/policies.php';
	}

	private function handleFormAction(): void {
		// Nonce is verified by the caller (renderPage) before this method runs.
		// phpcs:disable WordPress.Security.NonceVerification.Missing
		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );

		if ( 'create_policy' === $action ) {
			$title   = sanitize_text_field( Val::string( wp_unslash( $_POST['title'] ?? '' ) ) );
			$slugRaw = sanitize_text_field( Val::string( wp_unslash( $_POST['slug'] ?? '' ) ) );
			$slug    = sanitize_title( '' !== $slugRaw ? $slugRaw : $title );
			$scope   = sanitize_key( Val::string( wp_unslash( $_POST['acceptance_scope'] ?? Policy::SCOPE_BOOKING ) ) );

			if ( ! in_array( $scope, Policy::VALID_SCOPES, true ) ) {
				$scope = Policy::SCOPE_BOOKING;
			}

			if ( '' !== $title && '' !== $slug && null === $this->policies->findBySlug( $slug ) ) {
				$this->service->createPolicy( $title, $slug, $scope );
			}

			return;
		}

		$policyId = absint( Val::int( $_POST['policy_id'] ?? 0 ) );
		if ( $policyId <= 0 || null === $this->policies->findById( $policyId ) ) {
			return;
		}

		if ( 'add_version' === $action ) {
			$body = wp_kses_post( Val::string( wp_unslash( $_POST['body'] ?? '' ) ) );
			$this->service->addDraftVersion( $policyId, $body );
		}

		if ( 'publish_version' === $action ) {
			$versionId = absint( Val::int( $_POST['version_id'] ?? 0 ) );
			if ( $versionId > 0 ) {
				$this->service->publishVersion( $policyId, $versionId );
			}
		}
		// phpcs:enable WordPress.Security.NonceVerification.Missing
	}
}