<?php

namespace Automad\API;

use Automad\Core\Debug;
use Automad\Core\Messenger;
use Automad\Core\Request;
use Automad\Core\Session;
use Automad\Core\Str;

/**
 * The API class handles all user interactions using the dashboard.
 *
 * @author Marc Anton Dahmen
 * @copyright Copyright (c) 2014-2023 by Marc Anton Dahmen - https://marcdahmen.de
 * @license MIT license - https://automad.org/license
 */
class RequestHandler
{
	const REQUEST_KEY_CSRF = '__csrf__';
	const REQUEST_KEY_JSON = '__json__';

	/** The API base route. */
	public static string $apiBase = '/api';

	/** The controller namespace. */
	private static string $controllerNamespace = '\\Automad\\Controllers\\API\\';

	/** An array of routes that are excluded from CSRF token validation. */
	private static array $validationExcluded = array(
		'Session/login',
		'User/resetPassword'
	);


	/**
	 * Get the JSON response for a requested route
	 *
	 * @return string the JSON formatted response
	 */
	public static function getResponse(): string
	{
		header('Content-Type: application/json; charset=utf-8');

		$apiRoute = trim(Str::stripStart(AM_REQUEST, self::$apiBase), '/');

		Debug::log($apiRoute);

		$method = self::$controllerNamespace . str_replace('/', 'Controller::', $apiRoute);
		$parts = explode('::', $method);
		$class = $parts[0];

		if (!empty($parts[1]) && self::classFileExists($class) && method_exists($class, $parts[1])) {
			$Messenger = new Messenger();

			if (self::validate($apiRoute, $Messenger)) {
				self::registerControllerErrorHandler();
				self::convertJsonPost();
				$Response = call_user_func($method);
			} else {
				$Response = new Response();
				$Response->setCode(403);
				$Response->setError($Messenger->getError());
			}
		} else {
			$Response = new Response();
			$Response->setCode(404);
			$Response->setError('Invalid API route: ' . $apiRoute);
		}

		$Response->setDebug(Debug::getLog());

		return $Response->json();
	}


	/**
	 * Test whether a file of a given class is readable.
	 *
	 * @param string $className
	 * @return bool true in case the file is readable.
	 */
	private static function classFileExists(string $className): bool
	{
		$prefix = 'Automad\\';
		$file = AM_BASE_DIR . '/automad/src/server/' . str_replace('\\', '/', substr($className, strlen($prefix))) . '.php';

		return is_readable($file);
	}


	/**
	 * Parse __json__ field and merged the parsed data back to $_POST.
	 */
	private static function convertJsonPost(): void
	{
		$json = $_POST[self::REQUEST_KEY_JSON] ?? null;

		if (is_string($json)) {
			$_POST = array_merge($_POST, json_decode($json, true));
			unset($_POST[self::REQUEST_KEY_JSON]);
		}

		Debug::log($_POST);
	}


	/**
	 * Register a error handler that sends a 500 response code in case of a fatal error created by a controller.
	 */
	private static function registerControllerErrorHandler(): void
	{
		error_reporting(0);

		register_shutdown_function(function () {
			$error = error_get_last();

			if (is_array($error) && !empty($error['type']) && $error['type'] === 1) {
				http_response_code(500);
				$error['message'] = explode("\n", $error['message'] ?? '');
				exit(json_encode($error, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
			}
		});
	}


	/**
	 * Validate request by checking the CSRF token in case of a post request.
	 *
	 * @param string $route
	 * @param Messenger $Messenger
	 * @return bool true if the request is valid
	 */
	private static function validate(string $route, Messenger $Messenger): bool
	{
		if (in_array($route, self::$validationExcluded)) {
			return true;
		}

		if (!empty($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST') {
			$token = Request::post(self::REQUEST_KEY_CSRF);

			if (empty($token) || !Session::verifyCsrfToken($token)) {
				$Messenger->setError('CSRF token mismatch');

				return false;
			}
		}

		return true;
	}
}
__halt_compiler();----SIGNATURE:----Ylgw4aMxZgk4yaUgXw3xQGxDT3LX7AIfJj7rKDE3L3NjtCzD99dUkuy67Aftf/uwpeX2XxZkAwj68AfQI+cxub3mLxZ71i0tXZ5C8nrau+5yopLfob2uWlaVJmHDGmlcAjfZIU3ElMGTwDX+WtJ+ecWdx3x7bNbtwq3neinYLCAj1FwG5q1Q9TZVjmN8cb2q1mWKay1w8AvYVoyxuMEd8Fv4YvV+4RNdiHWgNVU59gnJWkQHUO3RJIlJr/V21O3039ZZJlMWRUGvfnrgU5mgip98B8DW+JmQ0PrpMOQQlRQYmw2by76LajCSH3EkQygy9jcoJZvqm6amrGbUpfdFgoKEw9nqLD2LIqLj2uHzZJ0BUgtPyG9I47RqCfKs5srQaqCY/wVFnfKf2Q2HNxHhi7CwwmV3gprgmt1hXERsKDpM+liMyZib6IHSOI2oI6EMi+VyzpTr7+hQd8WQ8CblKXyg3N2gtUfdmBck5Z0Tc9X1la1f81usQ+HtDlV8ST/IHf9437QUZs0LKCiyXygpoYIwbOM2xsK/hvLvtcLeaEaA26kAJmo400GOPstBj10gJeT789o9O99PcYKMapYhSKF+zCXr1kIQmQTsZTmlLL0LT5eRFq0wdcIPQAequ29ws1xIZzJZj8OJyfbah9wQE51nzfZBDPFVgzBiMkVJzc4=----ATTACHMENT:----NDUxODI1Mjk4OTY4NDgxMCA5MDYzNjE5Mjg4ODE5MTM0IDcwNzc3NzExOTU5Mzk5OTI=