<?php

declare(strict_types=1);

namespace Plugin\AzuraCastOnDemandHls\EventHandler;

use App\Event\Nginx\WriteNginxConfiguration;
use Plugin\AzuraCastOnDemandHls\Config;
use Plugin\AzuraCastOnDemandHls\Cors\CorsConfigurationProvider;
use Plugin\AzuraCastOnDemandHls\Cors\NginxRules;

final readonly class NginxConfiguration
{
    public function __construct(
        private Config $config,
        private CorsConfigurationProvider $corsConfiguration,
    )
    {
    }

    public function __invoke(WriteNginxConfiguration $event): void
    {
        if (!$this->config->enabled) {
            return;
        }

        $station = $event->getStation();
        $stationId = $station->id;
        $assetDirectory = rtrim($station->getRadioTempDir(), '/')
            . '/' . $this->config->cacheDirectory . '/assets/';
        $transcodeTimeout = $this->config->transcodeTimeout;
        $corsOriginRules = $this->corsOriginRules($station->id);

        $event->appendBlock(<<<NGINX
        # Protected on-demand HLS. Handle this route directly in PHP-FPM so denied
        # bearer-token requests never leave this access_log-off location.
        location ^~ /api/station/{$stationId}/ondemand-hls/playback/ {
            access_log off;

            include fastcgi_params;
            fastcgi_read_timeout {$transcodeTimeout};
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME \$realpath_root/index.php;
            fastcgi_param SCRIPT_NAME /index.php;
            fastcgi_param PHP_SELF /index.php;
            fastcgi_param DOCUMENT_ROOT \$realpath_root;
            fastcgi_pass php-fpm-www;
        }

        # Successful authorization redirects internally here. Keeping access logs
        # disabled in the final X-Accel location prevents the original bearer URL
        # from being logged after Nginx performs the internal redirect.
        location ^~ /internal/ondemand-hls/{$stationId}/ {
            internal;
            access_log off;
            # The allowlist is emitted as exact Origin matches. Nginx omits an
            # add_header with an empty value, so missing/disallowed Origins do not
            # receive Access-Control-Allow-Origin. This applies after X-Accel.
{$corsOriginRules}            add_header Access-Control-Allow-Origin $ondemand_hls_cors_origin always;
            add_header Vary $ondemand_hls_cors_vary always;
            add_header Cache-Control "private, no-store, max-age=0" always;
            add_header X-Content-Type-Options "nosniff" always;
            alias {$assetDirectory};
        }
        NGINX);
    }

    private function corsOriginRules(int $stationId): string
    {
        return NginxRules::forOrigins($this->corsConfiguration->getAllowedOrigins($stationId));
    }
}