<?php

namespace WPUltimateSecurity\UltimateSecurity\Presentation\API\Routes;

use WPUltimateSecurity\UltimateSecurity\Infrastructure\Security\Capabilities;
use WPUltimateSecurity\UltimateSecurity\Presentation\API\Controllers\TrustedDevicesController;
use WPUltimateSecurity\UltimateSecurity\Presentation\API\Controllers\LoginNotificationsController;
use WPUltimateSecurity\UltimateSecurity\Presentation\API\Controllers\TwoFactorController;

/**
 * Authentication Routes
 *
 * Registers REST API routes for authentication-related features:
 * - 2FA trusted devices
 * - Magic link authentication
 * - Login notifications
 *
 * @package WPUltimateSecurity\UltimateSecurity\Presentation\API\Routes
 * @since 2.0.0
 */
class AuthenticationRoutes extends AbstractRouteRegistrar
{
    /**
     * {@inheritDoc}
     */
    public function register(): void
    {
        $this->registerTrustedDevicesRoutes();
        $this->registerLoginNotificationsRoutes();
        $this->registerTwoFactorRoutes();
    }

    /**
     * Register Two-Factor Authentication routes.
     *
     * @return void
     */
    private function registerTwoFactorRoutes(): void
    {
        $controller = new TwoFactorController();
        $controller->registerRoutes();
    }

    /**
     * Register trusted devices routes.
     *
     * All trusted devices routes require Pro plugin.
     *
     * @return void
     */
    private function registerTrustedDevicesRoutes(): void
    {
        // Get current user's trusted devices (Pro)
        $this->get(
            '/2fa/trusted-devices',
            [TrustedDevicesController::class, 'get_user_devices'],
            $this->requirePro($this->loggedInOnly(), 'trusted_devices')
        );

        // Get all trusted devices (admin, Pro)
        $this->get(
            '/2fa/trusted-devices/all',
            [TrustedDevicesController::class, 'get_all_devices'],
            $this->requirePro(Capabilities::MANAGE_2FA, 'trusted_devices'),
            [
                'args' => [
                    'page' => ['sanitize_callback' => 'absint'],
                    'per_page' => ['sanitize_callback' => 'absint'],
                    'orderby' => ['sanitize_callback' => 'sanitize_text_field'],
                    'order' => ['sanitize_callback' => 'sanitize_text_field'],
                    'user_id' => ['sanitize_callback' => 'absint'],
                    'include_revoked' => ['sanitize_callback' => 'sanitize_text_field'],
                    'include_expired' => ['sanitize_callback' => 'sanitize_text_field'],
                ],
            ]
        );

        // Get trusted devices statistics (Pro)
        $this->get(
            '/2fa/trusted-devices/statistics',
            [TrustedDevicesController::class, 'get_statistics'],
            $this->requirePro(Capabilities::MANAGE_2FA, 'trusted_devices')
        );

        // Get trusted devices settings (Pro)
        $this->get(
            '/2fa/trusted-devices/settings',
            [TrustedDevicesController::class, 'get_settings'],
            $this->requirePro(Capabilities::MANAGE_2FA, 'trusted_devices')
        );

        // Revoke a specific device (Pro)
        $this->delete(
            '/2fa/trusted-devices/(?P<id>\d+)',
            [TrustedDevicesController::class, 'revoke_device'],
            $this->requirePro($this->loggedInOnly(), 'trusted_devices'),
            [
                'args' => [
                    'id' => [
                        'required' => true,
                        'sanitize_callback' => 'absint',
                    ],
                ],
            ]
        );

        // Delete a device permanently (admin only, Pro)
        $this->delete(
            '/2fa/trusted-devices/(?P<id>\d+)/delete',
            [TrustedDevicesController::class, 'delete_device'],
            $this->requirePro(Capabilities::MANAGE_2FA, 'trusted_devices'),
            [
                'args' => [
                    'id' => [
                        'required' => true,
                        'sanitize_callback' => 'absint',
                    ],
                ],
            ]
        );

        // Revoke all devices for a user (Pro)
        $this->post(
            '/2fa/trusted-devices/revoke-all',
            [TrustedDevicesController::class, 'revoke_all_devices'],
            $this->requirePro($this->loggedInOnly(), 'trusted_devices'),
            [
                'args' => [
                    'user_id' => ['sanitize_callback' => 'absint'],
                ],
            ]
        );

        // Cleanup expired devices (admin only, Pro)
        $this->post(
            '/2fa/trusted-devices/cleanup',
            [TrustedDevicesController::class, 'cleanup_devices'],
            $this->requirePro(Capabilities::MANAGE_2FA, 'trusted_devices'),
            [
                'args' => [
                    'days_old' => ['sanitize_callback' => 'absint'],
                ],
            ]
        );
    }

    /**
     * Register login notifications routes.
     *
     * @return void
     */
    private function registerLoginNotificationsRoutes(): void
    {
        // Get login notification settings
        $this->get(
            '/login-notifications/settings',
            [LoginNotificationsController::class, 'get_settings'],
            Capabilities::MANAGE_LOGIN
        );

        // Update login notification settings
        $this->post(
            '/login-notifications/settings',
            [LoginNotificationsController::class, 'update_settings'],
            Capabilities::MANAGE_LOGIN
        );

        // Get recent notifications
        $this->get(
            '/login-notifications/recent',
            [LoginNotificationsController::class, 'get_recent'],
            Capabilities::VIEW_LOGS,
            [
                'args' => [
                    'limit' => [
                        'sanitize_callback' => 'absint',
                        'default' => 50,
                    ],
                ],
            ]
        );

        // Send test notification
        $this->post(
            '/login-notifications/test',
            [LoginNotificationsController::class, 'send_test'],
            Capabilities::MANAGE_LOGIN,
            [
                'args' => [
                    'email' => [
                        'sanitize_callback' => 'sanitize_email',
                    ],
                ],
            ]
        );

        // Clear notification history
        $this->delete(
            '/login-notifications/clear',
            [LoginNotificationsController::class, 'clear_history'],
            Capabilities::MANAGE_LOGIN
        );

        // Get notification statistics
        $this->get(
            '/login-notifications/stats',
            [LoginNotificationsController::class, 'get_stats'],
            Capabilities::VIEW_LOGS,
            [
                'args' => [
                    'period' => [
                        'sanitize_callback' => 'sanitize_text_field',
                        'default' => '24h',
                    ],
                ],
            ]
        );

        // Trigger digest manually (for testing)
        $this->post(
            '/login-notifications/trigger-digest',
            [LoginNotificationsController::class, 'trigger_digest'],
            Capabilities::MANAGE_LOGIN,
            [
                'args' => [
                    'type' => [
                        'required' => true,
                        'sanitize_callback' => 'sanitize_text_field',
                    ],
                ],
            ]
        );
    }

}
