<?php
/**
 * AWS S3 destination. Extends the S3-compatible base; locks endpoint to AWS.
 *
 * @package Backreload\Destinations
 */

namespace Backreload\Destinations;

use Backreload\Models\DestinationRecord;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class AwsDestination extends S3compatDestination {

	public static function type(): string  { return 'aws'; }
	public static function label(): string { return 'AWS S3'; }

	/** AWS endpoint is derived from the region — no manual endpoint field. */
	protected function resolve_endpoint( DestinationRecord $dest ): string {
		$region = (string) ( $dest->config['region'] ?? 'us-east-1' );
		return 'https://s3.' . $region . '.amazonaws.com';
	}

	public static function config_schema(): array {
		$regions = [
			'us-east-1','us-east-2','us-west-1','us-west-2',
			'eu-west-1','eu-west-2','eu-central-1',
			'ap-south-1','ap-southeast-1','ap-southeast-2','ap-northeast-1',
			'ca-central-1','sa-east-1',
		];

		return [
			[ 'key' => 'region',        'label' => 'Region',             'type' => 'select', 'options' => $regions, 'default' => 'us-east-1', 'required' => true ],
			[ 'key' => 'bucket',        'label' => 'Bucket',             'type' => 'text',     'required' => true ],
			[ 'key' => 'access_key',    'label' => 'Access key ID',      'type' => 'text',     'required' => true, 'secret' => true ],
			[ 'key' => 'secret_key',    'label' => 'Secret access key',  'type' => 'password', 'required' => true, 'secret' => true ],
			[ 'key' => 'prefix',        'label' => 'Object key prefix',  'type' => 'text',     'default' => 'wordpress/' ],
			[ 'key' => 'storage_class', 'label' => 'Storage class',      'type' => 'select',
			  'options' => [ 'STANDARD', 'STANDARD_IA', 'INTELLIGENT_TIERING', 'GLACIER', 'DEEP_ARCHIVE' ], 'default' => 'STANDARD' ],
			[ 'key' => 'sse',           'label' => 'Server-side encryption', 'type' => 'select',
			  'options' => [ 'none', 'AES256', 'aws:kms' ], 'default' => 'AES256' ],
		];
	}

	/**
	 * Walkthrough for the AWS console. We recommend a dedicated IAM user
	 * with a minimal-privilege inline policy scoped to a single bucket —
	 * that way an exposed key can only hurt the backup bucket, not the
	 * rest of the account. Most user-facing pain comes from skipping this
	 * and using a root or admin key, then panicking when GitHub leaks it.
	 *
	 * The inline policy JSON in callouts is the smallest set of permissions
	 * the plugin needs: PutObject + GetObject + DeleteObject + ListBucket.
	 */
	public static function setup_help(): array {
		$policy_json = wp_json_encode(
			[
				'Version'   => '2012-10-17',
				'Statement' => [
					[
						'Effect'   => 'Allow',
						'Action'   => [ 's3:ListBucket' ],
						'Resource' => 'arn:aws:s3:::YOUR-BUCKET-NAME',
					],
					[
						'Effect'   => 'Allow',
						'Action'   => [ 's3:PutObject', 's3:GetObject', 's3:DeleteObject' ],
						'Resource' => 'arn:aws:s3:::YOUR-BUCKET-NAME/*',
					],
				],
			],
			JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES
		);
		return [
			'title'    => 'Setup help: where do I get the Access key and Secret?',
			'provider' => 'AWS S3',
			'steps' => [
				'Sign in to the <a href="https://s3.console.aws.amazon.com/" target="_blank" rel="noopener">AWS S3 console</a> with an account that can create buckets.',
				'Click <strong>Create bucket</strong>. Pick a unique name, choose a region near your visitors, leave <strong>Block all public access</strong> ON (the plugin only needs private access). Create the bucket.',
				'Switch to <a href="https://console.aws.amazon.com/iam/home#/users" target="_blank" rel="noopener">IAM → Users → Create user</a>. Name it something like <code>backreload-uploader</code>. <strong>Do NOT</strong> grant console access; this user only needs an API key.',
				'On the permissions step pick <strong>Attach policies directly → Create policy</strong>. Switch to the <strong>JSON</strong> tab and paste the policy shown in the box below. Replace <code>YOUR-BUCKET-NAME</code> with the bucket you just created. Name the policy <code>BackReloadBucketPolicy</code> and create it.',
				'Back on the user creation step, search for <code>BackReloadBucketPolicy</code>, check the box, and finish creating the user.',
				'Open the user → <strong>Security credentials</strong> tab → <strong>Create access key</strong>. Choose <strong>Application running outside AWS</strong>. Click through, then copy the <strong>Access key ID</strong> and <strong>Secret access key</strong> into the fields above. <strong>Copy the secret now</strong> because AWS hides it permanently once you close the page.',
				'Save the destination. The "Test" button will probe the bucket immediately so any typos surface right away.',
			],
			'callouts' => [
				[
					'label' => 'Minimum IAM policy (replace YOUR-BUCKET-NAME)',
					'value' => (string) $policy_json,
					'help'  => 'Paste into IAM → Policies → Create policy → JSON. Gives the user permission to write/read/delete only inside this one bucket.',
				],
			],
		];
	}
}
