<?php

namespace WPUltimateSecurity\UltimateSecurity\Presentation\API\Routes;

use WPUltimateSecurity\UltimateSecurity\Infrastructure\Security\Capabilities;
use WPUltimateSecurity\UltimateSecurity\Presentation\API\Controllers\SecurityController;
// Removed: SecurityHeadersController - server-level feature (see SERVER_LEVEL_FEATURES.md)
use WPUltimateSecurity\UltimateSecurity\Presentation\API\Controllers\ScannerController;
use WPUltimateSecurity\UltimateSecurity\Presentation\API\Controllers\FeedbackController;

/**
 * Security Routes
 *
 * Registers REST API routes for security features:
 * - Salt key management
 * - File integrity scanning
 *
 * Note: Security headers routes removed - server-level feature.
 *
 * @package WPUltimateSecurity\UltimateSecurity\Presentation\API\Routes
 * @since 2.0.0
 */
class SecurityRoutes extends AbstractRouteRegistrar
{
    /**
     * {@inheritDoc}
     */
    public function register(): void
    {
        $this->registerSaltRoutes();
        // Removed: $this->registerSecurityHeadersRoutes() - server-level feature
        $this->registerScannerRoutes();
        $this->registerFeedbackRoutes();
    }

    /**
     * Register salt key management routes.
     *
     * @return void
     */
    private function registerSaltRoutes(): void
    {
        // Get current salt keys
        $this->get(
            '/get-salt',
            [SecurityController::class, 'get_salt'],
            Capabilities::MANAGE_HARDENING
        );

        // Generate new salt keys
        $this->get(
            '/generate-salt',
            [SecurityController::class, 'generate_salts'],
            Capabilities::MANAGE_HARDENING
        );

        // Get failed login logs
        $this->get(
            '/get-login-failed-logs',
            [SecurityController::class, 'get_login_failed_logs'],
            Capabilities::VIEW_LOGS
        );

        // Salt info endpoint
        $this->get(
            '/salt-info',
            [SecurityController::class, 'get_salt_info'],
            Capabilities::MANAGE_HARDENING
        );

        // Salt backup endpoint
        $this->get(
            '/salt-backup',
            [SecurityController::class, 'get_salt_backup'],
            Capabilities::MANAGE_HARDENING
        );

        // Restore salt backup
        $this->post(
            '/salt-backup/restore',
            [SecurityController::class, 'restore_salt_backup'],
            Capabilities::MANAGE_HARDENING
        );

        // Pause salt schedule
        $this->post(
            '/salt-schedule/pause',
            [SecurityController::class, 'pause_salt_schedule'],
            Capabilities::MANAGE_HARDENING,
            [
                'args' => [
                    'until_date' => ['sanitize_callback' => 'sanitize_text_field'],
                ],
            ]
        );

        // Skip next salt change
        $this->post(
            '/salt-schedule/skip-next',
            [SecurityController::class, 'skip_next_salt_change'],
            Capabilities::MANAGE_HARDENING,
            [
                'args' => [
                    'skip' => ['sanitize_callback' => 'rest_sanitize_boolean'],
                ],
            ]
        );

        // Salt change history
        $this->get(
            '/salt-history',
            [SecurityController::class, 'get_salt_history'],
            Capabilities::VIEW_LOGS
        );
    }

    // REMOVED: registerSecurityHeadersRoutes() - Security headers are better configured at server level.
    // See docs/SERVER_LEVEL_FEATURES.md for nginx/Apache configuration examples.

    /**
     * Register scanner routes.
     *
     * @return void
     */
    private function registerScannerRoutes(): void
    {
        // Core file integrity scan
        $this->get(
            '/core-scan-check-integrity-status',
            [ScannerController::class, 'check_integrity'],
            Capabilities::RUN_SCANS
        );
    }

    /**
     * Register feedback routes.
     *
     * @return void
     */
    private function registerFeedbackRoutes(): void
    {
        $this->post(
            '/feedback',
            [FeedbackController::class, 'submit_feedback'],
            Capabilities::MANAGE_SETTINGS
        );
    }
}
