import { trimTrailingChar } from './text'
import type { AxiosRequestConfig, InternalAxiosRequestConfig } from 'axios'

const normalizeUrl = (url: string | undefined) =>
	trimTrailingChar(url ?? '', '/')

export const REST_BASES = {
	snippets: normalizeUrl(window.CODE_SNIPPETS?.restAPI.snippets),
	recentlyActive: normalizeUrl(window.CODE_SNIPPETS?.restAPI.recentlyActive),
	preferences: normalizeUrl(window.CODE_SNIPPETS?.restAPI.preferences),
	importPlugins: normalizeUrl(window.CODE_SNIPPETS?.restAPI.importPlugins),
	importFiles: normalizeUrl(window.CODE_SNIPPETS?.restAPI.importFiles),
	cloud: {
		snippets: normalizeUrl(window.CODE_SNIPPETS?.restAPI.cloud.snippets),
	}
}

/** Verbs that hosts and firewalls commonly reject outright. */
const OVERRIDDEN_METHODS = ['delete', 'put', 'patch']

/**
 * Send write requests as POST, naming the intended verb in a header.
 *
 * Plenty of hosts allow only GET and POST, so a DELETE never reaches
 * WordPress: the request is rejected upstream, and the browser reports a 403 —
 * or a severed connection — that no amount of correct authentication can fix.
 * The REST server reads `X-HTTP-Method-Override` on a POST and dispatches the
 * route exactly as it would have, so this changes nothing WordPress sees while
 * letting the request through.
 */
export const applyMethodOverride = (config: InternalAxiosRequestConfig): InternalAxiosRequestConfig => {
	const method = config.method?.toLowerCase()

	if (!method || !OVERRIDDEN_METHODS.includes(method)) {
		return config
	}

	config.headers.set('X-HTTP-Method-Override', method.toUpperCase())
	config.method = 'post'

	return config
}

/**
 * The REST nonce to authenticate the next request with.
 *
 * Held in a variable rather than baked into the axios config, because the value
 * the page was rendered with does not stay valid. A nonce expires with the
 * session, and the snippet editor is a screen people leave open for a long
 * time. Once it lapsed, every save failed with a 403 and the only cure was
 * reloading the page, which loses whatever was being written.
 */
let restNonce = window.CODE_SNIPPETS?.restAPI.nonce

/**
 * Keep the REST nonce current for as long as the page is open.
 *
 * WordPress already sends a freshly minted nonce with every Heartbeat response,
 * from `wp_refresh_heartbeat_nonces()`. Core applies it to `wpApiSettings`,
 * which our screens do not enqueue, so the value went unused. Listening for the
 * tick ourselves means an editor left open stays able to save.
 */
export const listenForNonceRefresh = () => {
	// Heartbeat also fires the tick through the hooks API, which avoids
	// depending on jQuery being present and typed.
	window.wp.hooks?.addAction(
		'heartbeat.tick',
		'code-snippets/refresh-rest-nonce',
		(data: { rest_nonce?: string }) => {
			if (data.rest_nonce) {
				restNonce = data.rest_nonce
			}
		}
	)
}

/**
 * Attach the current nonce to an outgoing request.
 *
 * Read per request, so that a nonce refreshed since page load is actually used.
 */
export const applyRestNonce = (config: InternalAxiosRequestConfig): InternalAxiosRequestConfig => {
	if (restNonce) {
		config.headers.set('X-WP-Nonce', restNonce)
	}

	return config
}

export const REST_API_AXIOS_CONFIG: AxiosRequestConfig = {
	headers: {
		'Access-Control': window.CODE_SNIPPETS?.restAPI.cloud.token
	}
}