<?php
/**
 * Centralized nonce + request integrity helpers.
 *
 * @package SuiteMkt3k
 */

namespace SuiteMkt3k\Security;

defined( 'ABSPATH' ) || exit;

final class Nonces {

	public const ADMIN_ACTION = 'suitemkt3k_admin_action';
	public const REST_ACTION  = 'wp_rest';
	public const PUBLIC_FORM  = 'suitemkt3k_public_form';

	public static function create( string $action = self::ADMIN_ACTION ): string {
		return wp_create_nonce( $action );
	}

	public static function verify_admin( ?string $nonce, string $action = self::ADMIN_ACTION ): bool {
		if ( null === $nonce || '' === $nonce ) {
			return false;
		}
		return (bool) wp_verify_nonce( $nonce, $action );
	}

	public static function require_admin( ?string $nonce, string $action = self::ADMIN_ACTION ): void {
		if ( ! self::verify_admin( $nonce, $action ) ) {
			wp_send_json_error(
				array(
					'code'    => 'invalid_nonce',
					'message' => __( 'Security token expired. Please refresh the page and try again.', 'suitemkt3k' ),
				),
				403
			);
		}
	}
}
