<?php
/**
 * SSO entity group registration（7 欄位）.
 *
 * 從 wp-data-optimizer/includes/integrations/class-wpdo-member-fields.php:226-271 抽出。
 * 註冊到 user entity，flat table = wp_wpdo_user_sso。
 *
 * @package TMDO_SPOKE
 * @since   0.1.0
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class TMDO_Spoke_SSO_Group {

	private static bool $registered = false;

	/**
	 * Register `sso` group on user entity.
	 *
	 * @param string|object $registry_class TMDO_Entity_Registry / WPDO_Entity_Registry class name or instance.
	 */
	public static function register( $registry_class ): void {
		if ( self::$registered ) {
			return;
		}

		// 解析 registry：可能是 class name (string) 或 instance。
		$cls = is_string( $registry_class ) ? $registry_class
			: ( is_object( $registry_class ) ? get_class( $registry_class ) : null );

		if ( ! $cls || ! class_exists( $cls ) || ! method_exists( $cls, 'register_group' ) ) {
			// fallback：直接呼叫已知 class
			if ( class_exists( 'TMDO_Entity_Registry' ) ) {
				$cls = 'TMDO_Entity_Registry';
			} elseif ( class_exists( 'WPDO_Entity_Registry' ) ) {
				$cls = 'WPDO_Entity_Registry';
			} else {
				return;
			}
		}

		$cls::register_group(
			'user',
			'sso',
			array(
				array(
					'key'        => 'hub_global_user_id',
					'type'       => 'text',
					'searchable' => true,
					'label'      => 'Hub global user UUID (2mso_user_mapping.global_user_id bridge key)',
				),
				array(
					'key'   => 'picture_url',
					'type'  => 'text',
					'label' => 'Social / SSO profile picture URL',
				),
				array(
					'key'   => 'last_id_token_hash',
					'type'  => 'text',
					'label' => 'SHA-256(last_id_token) for SLO comparison — no plaintext stored',
				),
				array(
					'key'   => 'refresh_token_enc',
					'type'  => 'textarea',
					'label' => 'Encrypted refresh token (TMSO_Crypto — key-versioned enc_vN:ciphertext)',
				),
				array(
					'key'        => 'token_expires_at',
					'type'       => 'datetime',
					'searchable' => true,
					'label'      => 'SSO token expiry (set to past to force re-auth on next request)',
				),
				array(
					'key'   => 'sso_last_login_at',
					'type'  => 'datetime',
					'label' => 'Last SSO-initiated login datetime',
				),
				array(
					'key'     => 'sso_login_count',
					'type'    => 'integer',
					'default' => 0,
					'label'   => 'SSO login count',
				),
			)
		);

		self::$registered = true;
	}
}