<?php
/**
 * PostGate Merchant Authentication Class
 *
 * This file contains the merchant authentication class that provides
 * access to stored Stripe credentials and mode management.
 *
 * @package PostGate
 * @subpackage Authentication
 * @since 1.0.0
 * @author QodeSphere
 * @license GPL-2.0+
 */

defined( 'ABSPATH' ) || exit;

/**
 * PostGate Merchant Authentication Class
 *
 * Provides centralized access to merchant authentication credentials
 * and mode management for Stripe integration. Supports both sandbox
 * (test) and live modes with automatic mode detection.
 *
 * All credentials are stored in WordPress options and retrieved
 * based on the current operating mode.
 *
 * @since 1.0.0
 */
class PostGate_Merchant_Auth {

	/**
	 * Get the current operating mode.
	 *
	 * Returns either 'live' or 'sandbox' based on the plugin settings.
	 * Defaults to 'sandbox' for safety if no mode is set.
	 *
	 * @since 1.0.0
	 * @return string The current mode ('live' or 'sandbox').
	 */
	public static function mode(): string {
		$mode = get_option( 'postgate_stripe_connect_mode', 'sandbox' );
		return 'live' === $mode ? 'live' : 'sandbox';
	}

	/**
	 * Get the Stripe access token for the specified mode.
	 *
	 * Retrieves the stored Stripe access token from the bridge connection.
	 * Used for authenticating API requests to Stripe.
	 *
	 * @since 1.0.0
	 * @param string|null $mode Optional. The mode to get token for. Defaults to current mode.
	 * @return string The access token, or empty string if not found.
	 */
	public static function token( ?string $mode = null ): string {
		$mode = $mode ?: self::mode();
		return (string) get_option( "postgate_access_token_{$mode}", '' );
	}

	/**
	 * Get the connected Stripe account ID for the specified mode.
	 *
	 * Retrieves the Stripe Connect account ID that was obtained during
	 * the OAuth flow via the bridge connection.
	 *
	 * @since 1.0.0
	 * @param string|null $mode Optional. The mode to get account for. Defaults to current mode.
	 * @return string The connected account ID, or empty string if not found.
	 */
	public static function account( ?string $mode = null ): string {
		$mode = $mode ?: self::mode();
		return (string) get_option( "postgate_connected_acct_{$mode}", '' );
	}

	/**
	 * Get the Stripe publishable key for the specified mode.
	 *
	 * Retrieves the publishable key used for client-side Stripe operations
	 * such as Stripe Elements and checkout sessions.
	 *
	 * @since 1.0.0
	 * @param string|null $mode Optional. The mode to get publishable key for. Defaults to current mode.
	 * @return string The publishable key, or empty string if not found.
	 */
	public static function publishable_key( ?string $mode = null ): string {
		$mode = $mode ?: self::mode();
		return (string) get_option( "postgate_publishable_key_{$mode}", '' );
	}

	/**
	 * Get the webhook secret for the specified mode.
	 *
	 * Retrieves the webhook signing secret used to verify incoming
	 * webhook events from Stripe. This is manually configured by
	 * the merchant in their Stripe dashboard.
	 *
	 * @since 1.0.0
	 * @param string|null $mode Optional. The mode to get webhook secret for. Defaults to current mode.
	 * @return string The webhook secret, or empty string if not configured.
	 */
	public static function webhook_secret( ?string $mode = null ): string {
		$mode = $mode ?: self::mode();
		return (string) get_option( "postgate_webhook_secret_{$mode}", '' );
	}

	/**
	 * Disconnect the merchant for a given mode.
	 *
	 * Removes stored credentials and related settings for the specified
	 * Stripe mode. If no mode is provided, the current mode is used.
	 *
	 * @since 1.0.0
	 * @param string|null $mode Optional. 'live' or 'sandbox'. Defaults to current mode.
	 * @return void
	 */
	public static function disconnect( ?string $mode = null ): void {
		$mode = $mode ?: self::mode();

		foreach ( [ 'connected_acct', 'access_token', 'refresh_token', 'publishable_key', 'webhook_secret' ] as $k ) {
			delete_option( "postgate_{$k}_{$mode}" );
		}
	}
}