<?php

declare(strict_types=1);

namespace App\Http\Requests\PublicApi;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;

/**
 * What the frontend could not resolve.
 *
 * Two shapes are accepted, because both are natural on the other side: a
 * single report, which is what one rendered 404 produces, and a batch, which
 * is what a queue on the frontend flushes. The single form is folded into a
 * batch of one before validation, so there is one code path from here on.
 */
class ReportMissingUrlRequest extends FormRequest
{
    public function authorize(): bool
    {
        // The shared secret is the authorisation, and the middleware has
        // already checked it.
        return true;
    }

    /**
     * Accept `{"path": "..."}` as `{"hits": [{"path": "..."}]}`.
     */
    protected function prepareForValidation(): void
    {
        if ($this->has('path') && ! $this->has('hits')) {
            $this->merge(['hits' => [$this->only(['path', 'locale', 'referrer'])]]);
        }
    }

    /**
     * @return array<string, mixed>
     */
    public function rules(): array
    {
        return [
            'hits' => ['required', 'array', 'min:1', 'max:'.$this->maxBatch()],

            // Paths, not URLs: the frontend knows its own origin, and a report
            // carrying a full address would let a caller file a 404 against
            // somebody else's domain.
            'hits.*.path' => ['required', 'string', 'max:500', 'starts_with:/'],

            'hits.*.locale' => [
                'sometimes', 'nullable', 'string',
                Rule::in(array_keys((array) config('locales.supported'))),
            ],

            // Where the visitor came from, verbatim from the Referer header,
            // so it can be a URL on anybody's domain.
            'hits.*.referrer' => ['sometimes', 'nullable', 'string', 'url:http,https', 'max:500'],
        ];
    }

    /**
     * @return array<int, array<string, string|null>>
     */
    public function hits(): array
    {
        return array_values((array) $this->validated('hits'));
    }

    public function maxBatch(): int
    {
        return max(1, (int) config('site.telemetry.max_batch', 50));
    }
}