<?php
/**
 * Agent Security Service
 * 
 * Manages the whitelist of API routes that the AI agent can access.
 * Provides enable/disable functionality for each route.
 *
 * @package AI_Builder
 */

if (!defined('ABSPATH')) {
    exit;
}

class AIBUI_Agent_Security_Service
{
    /**
     * Option name for storing whitelist in database
     */
    const OPTION_WHITELIST = 'aibui_agent_route_whitelist';

    /**
     * Option name for storing route settings (custom configs)
     */
    const OPTION_ROUTE_SETTINGS = 'aibui_agent_route_settings';

    /**
     * Discovery service instance
     *
     * @var AIBUI_Agent_Discovery_Service
     */
    private $discovery;

    /**
     * Cached whitelist
     *
     * @var array|null
     */
    private $whitelist_cache = null;

    /**
     * Constructor
     *
     * @param AIBUI_Agent_Discovery_Service $discovery
     */
    public function __construct(AIBUI_Agent_Discovery_Service $discovery)
    {
        $this->discovery = $discovery;
    }

    /**
     * Get the current whitelist of enabled routes
     *
     * @return array Array of route IDs that are enabled
     */
    public function get_whitelist()
    {
        if ($this->whitelist_cache !== null) {
            return $this->whitelist_cache;
        }

        $whitelist = get_option(self::OPTION_WHITELIST, null);

        // If no whitelist exists, initialize with defaults
        if ($whitelist === null) {
            $whitelist = $this->initialize_default_whitelist();
        }

        $this->whitelist_cache = $whitelist;
        return $whitelist;
    }

    /**
     * Initialize whitelist with default enabled routes
     *
     * @return array
     */
    private function initialize_default_whitelist()
    {
        $routes = $this->discovery->get_all_routes();
        $whitelist = array();

        foreach ($routes as $route) {
            if ($route['is_default_enabled']) {
                $whitelist[] = $route['unique_id'];
            }
        }

        // Save the default whitelist
        update_option(self::OPTION_WHITELIST, $whitelist, false);

        return $whitelist;
    }

    /**
     * Check if a route is whitelisted (enabled)
     *
     * @param string $route Route path
     * @param string $method HTTP method
     * @return bool
     */
    public function is_route_whitelisted($route, $method)
    {
        // First check if route is forbidden (security)
        if ($this->discovery->is_forbidden_route($route, $method)) {
            return false;
        }

        $route_id = $this->discovery->generate_route_id($route, $method);
        $whitelist = $this->get_whitelist();

        return in_array($route_id, $whitelist, true);
    }

    /**
     * Enable a route
     *
     * @param string $route_id Unique route ID
     * @return bool Success
     */
    public function enable_route($route_id)
    {
        // Verify the route exists and is not forbidden
        if (!$this->is_valid_route_id($route_id)) {
            return false;
        }

        $whitelist = $this->get_whitelist();

        if (!in_array($route_id, $whitelist, true)) {
            $whitelist[] = $route_id;
            $this->save_whitelist($whitelist);
        }

        return true;
    }

    /**
     * Disable a route
     *
     * @param string $route_id Unique route ID
     * @return bool Success
     */
    public function disable_route($route_id)
    {
        $whitelist = $this->get_whitelist();
        $key = array_search($route_id, $whitelist, true);

        if ($key !== false) {
            unset($whitelist[$key]);
            $whitelist = array_values($whitelist); // Re-index
            $this->save_whitelist($whitelist);
        }

        return true;
    }

    /**
     * Update multiple routes at once
     *
     * @param array $enabled_routes Array of route IDs to enable
     * @return bool Success
     */
    public function update_whitelist(array $enabled_routes)
    {
        // Validate all routes
        $valid_routes = array();
        foreach ($enabled_routes as $route_id) {
            if ($this->is_valid_route_id($route_id)) {
                $valid_routes[] = $route_id;
            }
        }

        $this->save_whitelist($valid_routes);
        return true;
    }

    /**
     * Save whitelist to database
     *
     * @param array $whitelist
     */
    private function save_whitelist(array $whitelist)
    {
        update_option(self::OPTION_WHITELIST, $whitelist, false);
        $this->whitelist_cache = $whitelist;
    }

    /**
     * Check if a route ID is valid (exists and not forbidden)
     *
     * @param string $route_id
     * @return bool
     */
    private function is_valid_route_id($route_id)
    {
        $routes = $this->discovery->get_all_routes();

        foreach ($routes as $route) {
            if ($route['unique_id'] === $route_id) {
                return !$this->discovery->is_forbidden_route($route['route'], $route['method']);
            }
        }

        return false;
    }

    /**
     * Get all routes with their enabled status
     *
     * @return array
     */
    public function get_routes_with_status()
    {
        $routes = $this->discovery->get_routes_by_namespace();
        $whitelist = $this->get_whitelist();
        $result = array();

        foreach ($routes as $namespace => $namespace_routes) {
            $result[$namespace] = array();

            foreach ($namespace_routes as $route) {
                $route['is_enabled'] = in_array($route['unique_id'], $whitelist, true);
                $route['can_toggle'] = !$this->discovery->is_forbidden_route($route['route'], $route['method']);
                $result[$namespace][] = $route;
            }
        }

        return $result;
    }

    /**
     * Get only the whitelisted routes (for tool generation)
     *
     * @return array
     */
    public function get_enabled_routes()
    {
        $routes = $this->discovery->get_all_routes();
        $whitelist = $this->get_whitelist();
        $enabled = array();

        foreach ($routes as $route) {
            if (in_array($route['unique_id'], $whitelist, true)) {
                $enabled[] = $route;
            }
        }

        return $enabled;
    }

    /**
     * Get tools for enabled routes only
     *
     * @return array Tools in JSON Schema format
     */
    public function get_enabled_tools()
    {
        $enabled_routes = $this->get_enabled_routes();
        return $this->discovery->convert_to_tools_format($enabled_routes);
    }

    /**
     * Reset whitelist to defaults
     *
     * @return bool
     */
    public function reset_to_defaults()
    {
        delete_option(self::OPTION_WHITELIST);
        $this->whitelist_cache = null;
        $this->get_whitelist(); // Re-initialize with defaults
        return true;
    }

    /**
     * Get route info by ID
     *
     * @param string $route_id
     * @return array|null
     */
    public function get_route_by_id($route_id)
    {
        $routes = $this->discovery->get_all_routes();

        foreach ($routes as $route) {
            if ($route['unique_id'] === $route_id) {
                return $route;
            }
        }

        return null;
    }

    /**
     * Find route by path and method
     *
     * @param string $path Route path
     * @param string $method HTTP method
     * @return array|null
     */
    public function find_route($path, $method)
    {
        $routes = $this->discovery->get_all_routes();

        foreach ($routes as $route) {
            if ($route['route'] === $path && $route['method'] === strtoupper($method)) {
                return $route;
            }
        }

        // Try pattern matching for parameterized routes
        foreach ($routes as $route) {
            if ($route['method'] !== strtoupper($method)) {
                continue;
            }

            // Convert route pattern to regex
            $pattern = '#^' . $route['route'] . '$#';
            if (preg_match($pattern, $path)) {
                return $route;
            }
        }

        return null;
    }

    /**
     * Validate that a tool name corresponds to a whitelisted route
     *
     * @param string $tool_name
     * @return array|null Route info if valid, null otherwise
     */
    public function validate_tool($tool_name)
    {
        $enabled_tools = $this->get_enabled_tools();

        foreach ($enabled_tools as $tool) {
            if ($tool['name'] === $tool_name) {
                return $tool['_meta'];
            }
        }

        return null;
    }

    /**
     * Get statistics about routes
     *
     * @return array
     */
    public function get_stats()
    {
        $all_routes = $this->discovery->get_all_routes();
        $whitelist = $this->get_whitelist();
        $by_namespace = $this->discovery->get_routes_by_namespace();

        return array(
            'total_routes' => count($all_routes),
            'enabled_routes' => count($whitelist),
            'disabled_routes' => count($all_routes) - count($whitelist),
            'namespaces' => array_keys($by_namespace),
            'namespace_count' => count($by_namespace),
        );
    }
}