<?php

declare(strict_types=1);

namespace LIT\MCP\Server;

use WP_REST_Request;

/**
 * Tracks whether the current REST dispatch is serving our OAuth-protected MCP
 * server route (`/mcp/mcp-oauth-server`).
 *
 * Abilities must never run outside that route – not through mcp-adapter's
 * (disabled) default server, not through a differently configured server, and
 * not through any unrelated REST request. WordPress fires
 * `rest_request_before_callbacks` for every matched REST route before any
 * permission_callback runs (see WP_REST_Server::dispatch()), so by the time an
 * ability's permission_callback executes – itself only reachable from inside
 * the MCP route's own callback – the flag below is already accurate for the
 * current request.
 */
final class RequestContext
{
    private static bool $isOAuthServerRequest = false;

    public function register(): void
    {
        add_filter('rest_request_before_callbacks', [self::class, 'recordRoute'], 10, 3);
    }

    /**
     * @param mixed                $response
     * @param array<string, mixed> $handler
     * @return mixed
     */
    public static function recordRoute(mixed $response, array $handler, WP_REST_Request $request): mixed
    {
        if ($request->get_route() === self::route()) {
            self::$isOAuthServerRequest = true;
        }

        return $response;
    }

    public static function isOAuthServerRequest(): bool
    {
        return self::$isOAuthServerRequest;
    }

    /**
     * Test-only: resets (or forces) the recorded state between unit tests.
     */
    public static function reset(bool $isOAuthServerRequest = false): void
    {
        self::$isOAuthServerRequest = $isOAuthServerRequest;
    }

    private static function route(): string
    {
        return '/' . ServerRegistrar::NAMESPACE . '/' . ServerRegistrar::ROUTE;
    }
}