<?php
/**
 * SecurityHeadersModule — HTTP Security Headers module.
 *
 * Sends all configured security response headers on every frontend and
 * admin request using the 'send_headers' WordPress action.
 *
 * FREE module — available to all users.
 *
 * @package UltraguardPro\modules\security_headers
 * @since   6.6.0
 */

namespace UltraguardPro\modules\security_headers;

use UltraguardPro\modules\core\AbstractModule;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class SecurityHeadersModule extends AbstractModule {

    public function get_id(): string { return 'security_headers'; }

    protected function requires_pro(): bool { return false; }

    /**
     * Register our settings prefix immediately so Settings::get_option() can
     * resolve 'headers_*' keys before boot() is called.
     */
    public function __construct( \UltraguardPro\Plugin $plugin ) {
        parent::__construct( $plugin );
        $this->plugin->settings->register_module_prefix( 'headers_', 'security_headers' );
    }

    public function boot(): void {
        // 1. AJAX handlers
        ( new ajax\SecurityHeadersAjax( $this->plugin ) )->register();

        // 2. Admin page
        add_action( 'ultraguard_register_admin_pages', [ $this, 'register_pages' ], 26, 1 );

        // 3. Send headers on every request (frontend + admin)
        add_action( 'send_headers', [ $this, 'send_security_headers' ], 10 );

        // 4. Also hook into REST API responses
        add_filter( 'rest_post_dispatch', [ $this, 'add_headers_to_rest_response' ], 10, 3 );

        do_action( 'ultraguard_pro/security_headers/booted', $this );
    }

    // ── Admin pages ────────────────────────────────────────────────────────────

    public function register_pages( $admin ): void {
        $admin->register_page( [
            'id'              => 'security-headers',
            'page_title'      => __( 'Security Headers', 'ultraguard-security-suite' ),
            'menu_title'      => __( 'Sec Headers', 'ultraguard-security-suite' ),
            'capability'      => 'manage_options',
            'scheme_callback' => [ pages\SecurityHeadersPage::class, $this->plugin ],
            'is_parent'       => true,
            'priority'        => 26,
            'group'           => 'Protection',
            'icon'            => 'dashicons-admin-network',
        ] );
    }

    // ── Header emission ────────────────────────────────────────────────────────

    /**
     * Emit all enabled security headers on every page request.
     * Fires on 'send_headers' — before any output.
     */
    public function send_security_headers(): void {
        if ( headers_sent() ) { return; }

        $ajax    = new ajax\SecurityHeadersAjax( $this->plugin );
        $headers = $ajax->build_headers( $this->plugin->settings );

        foreach ( $headers as $name => $value ) {
            if ( $name && $value ) {
                header( sanitize_text_field( $name ) . ': ' . $value, true );
            }
        }
    }

    /**
     * Add security headers to REST API responses.
     *
     * @param \WP_REST_Response $result
     * @param \WP_REST_Server   $server
     * @param \WP_REST_Request  $request
     * @return \WP_REST_Response
     */
    public function add_headers_to_rest_response( $result, $server, $request ) {
        $ajax    = new ajax\SecurityHeadersAjax( $this->plugin );
        $headers = $ajax->build_headers( $this->plugin->settings );
        foreach ( $headers as $name => $value ) {
            if ( $name && $value ) {
                $result->header( $name, $value );
            }
        }
        return $result;
    }
}
