<?php
/**
 * Settings schema REST controller — GET /blocksify/v1/settings/schema.
 *
 * Returns the `{ panels: [...] }` shape that drives the JS-side schema
 * form. PHP is the single source of truth — JS NEVER redeclares field
 * metadata (SPEC §5.4, §8.2.2).
 *
 * @package Blocksify
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * REST controller for the settings schema endpoint.
 */
class Blocksify_Dashboard_Settings_Schema_Controller extends WP_REST_Controller {

	/**
	 * Wire namespace + base for register_routes().
	 */
	public function __construct() {
		$this->namespace = 'blocksify/v1';
		$this->rest_base = 'settings/schema';
	}

	/**
	 * Register GET on /settings/schema.
	 */
	public function register_routes() {
		register_rest_route(
			$this->namespace,
			'/' . $this->rest_base,
			array(
				array(
					'methods'             => WP_REST_Server::READABLE,
					'callback'            => array( $this, 'get_item' ),
					'permission_callback' => array( $this, 'permission_check' ),
				),
			)
		);
	}

	/**
	 * Capability gate. Schema is sensitive enough (lists every setting) to
	 * keep behind the dashboard cap.
	 *
	 * @return bool
	 */
	public function permission_check() {
		return current_user_can( Blocksify_Dashboard::get_capability() );
	}

	/**
	 * GET /settings/schema handler.
	 *
	 * @param WP_REST_Request $request Unused.
	 * @return WP_REST_Response
	 */
	public function get_item( $request ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter
		return rest_ensure_response( Blocksify_Dashboard_Schema::get_schema() );
	}
}
