<?php
/**
 * Postomatic deactivation functionality.
 *
 * @package Postomatic
 * @subpackage Core
 * @since      1.0.0
 */

namespace Postomatic\Core;

use Postomatic\Constants;
use Postomatic\Utils;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Handles plugin deactivation functionality.
 *
 * This class contains methods to clean up after the plugin is deactivated
 * including removing options, dropping custom tables, and notifying external services.
 *
 * @since 1.0.0
 */
class Deactivator {

	/**
	 * Deactivates the plugin by cleaning up database entries and notifying API.
	 *
	 * @return void
	 * @since  1.0.0
	 */
	public static function deactivate() {
		self::send_post_to_laravel_deactive_api();
		self::delete_options();
	}

	/**
	 * Deletes plugin options from the WordPress database.
	 *
	 * @return void
	 * @since  1.0.0
	 */
	private static function delete_options() {
		delete_option( Constants::OPTION_CODE );
		delete_option( Constants::OPTION_API_SERVICE_KEY );
		delete_option( Constants::OPTION_API_WP_SECURE_KEY );
	}

	/**
	 * Notifies the external API that the plugin has been deactivated.
	 *
	 * @return mixed Response body on success, false on failure
	 * @since  1.0.0
	 */
	private static function send_post_to_laravel_deactive_api() {

		$base_url = Constants::API_BASE_URL ?? '';
		if ( empty( $base_url ) ) {
			return false;
		}

		$api_url = $base_url . '/api/services/postomatic/deactive';
		$code    = Utils::get_code_option();

		/*
		 * A missing or empty Authorization-Code is now answered with a 401 rather
		 * than a 200 carrying status:false, so there is no point sending the
		 * request at all without a credential.
		 */
		if ( empty( $code ) ) {
			return false;
		}

		/*
		 * Only `url` is read. The service normalises it by stripping the trailing
		 * slash, so the canonical form is used here too — a different form than
		 * activation sent would look like a different site. `name` and `email`
		 * were dropped: they are not part of the accepted payload and were
		 * sending the admin's address on every deactivation for no reason.
		 */
		$data = array(
			'url' => Utils::get_canonical_site_url(),
		);

		$args = array(
			'body'        => wp_json_encode( $data ),
			'headers'     => array(
				'Content-Type'       => 'application/json',
				'Accept'             => 'application/json',
				'Authorization-Code' => $code,
			),
			'method'      => 'POST',
			'httpversion' => '1.1',
			'timeout'     => 45,
		);

		$response = wp_remote_post( $api_url, $args );

		if ( is_wp_error( $response ) ) {
			return false;
		}

		$response_code = (int) wp_remote_retrieve_response_code( $response );
		$response_body = wp_remote_retrieve_body( $response );

		/*
		 * 401 (missing or wrong code) and 404 (unknown site URL) used to arrive as
		 * a 200 with status:false, so any caller inspecting only the body could
		 * not tell them apart from a transport failure. Either way the plugin
		 * still deactivates locally — there is nothing the user can do about a
		 * stale credential at this point — but the distinction is no longer lost.
		 */
		if ( 200 !== $response_code ) {
			return false;
		}

		return $response_body;
	}
}
