<?php
/**
 * Suite: the public listings endpoints never return private fields to anonymous users.
 *
 * Bug (dev36, 2026-09-26, fixed in 1.1.1): GET /wpdo/v1/listings/{id} is public and
 * returned every registered hot / cold field, because show_in_rest defaulted to true —
 * e.g. the infocards IG token fields on hp_vendor and WooCommerce's _purchase_note.
 *
 * @package WP_Data_Optimizer
 */

declare(strict_types=1);

/**
 * GET a wpdo REST route as an anonymous visitor.
 *
 * @param string               $route  Route, e.g. /wpdo/v1/listings/12.
 * @param array<string, mixed> $params Query parameters.
 * @return array<int|string, mixed> Response data.
 */
function tmdo_live_rest_anonymous( string $route, array $params = array() ): array {
	$user    = get_current_user_id();
	$request = new WP_REST_Request( 'GET', $route );
	$request->set_query_params( $params );
	wp_set_current_user( 0 );
	try {
		$response = rest_do_request( $request );
	} finally {
		wp_set_current_user( $user );
	}
	tmdo_live_assert_same( 200, $response->get_status(), "GET {$route}" );
	return (array) $response->get_data();
}

/**
 * Keys that must never reach an anonymous visitor.
 *
 * @return string[]
 */
function tmdo_live_rest_private_keys(): array {
	return array( 'tmeetic_ig_access_token_enc', 'tmeetic_ig_token_expiry', 'tmeetic_ig_user_id', '_purchase_note' );
}

TMDO_Live::test(
	'GET /wpdo/v1/listings/{id} returns no private field to an anonymous visitor',
	static function () {
		$checked = 0;
		foreach ( array( 'hp_vendor', 'product' ) as $post_type ) {
			$ids = get_posts( array( 'post_type' => $post_type, 'post_status' => 'publish', 'numberposts' => 1, 'fields' => 'ids' ) );
			if ( ! $ids ) {
				continue;
			}
			$data = tmdo_live_rest_anonymous( '/wpdo/v1/listings/' . (int) $ids[0] );
			tmdo_live_assert_same( array(), array_values( array_intersect( tmdo_live_rest_private_keys(), array_keys( $data ) ) ), "{$post_type} #{$ids[0]} private keys" );
			tmdo_live_assert_same( array(), array_values( preg_grep( '/^_|token|secret|passw|api_?key/i', array_keys( $data ) ) ), "{$post_type} #{$ids[0]} protected / credential-like keys" );
			++$checked;
		}
		if ( 0 === $checked ) {
			throw new TMDO_Live_Skip( 'no published hp_vendor or product on this site' );
		}
	}
);

TMDO_Live::test(
	'GET /wpdo/v1/listings returns no private field to an anonymous visitor',
	static function () {
		foreach ( array( 'hp_vendor', 'product', 'hp_listing' ) as $post_type ) {
			if ( ! post_type_exists( $post_type ) ) {
				continue;
			}
			foreach ( tmdo_live_rest_anonymous( '/wpdo/v1/listings', array( 'post_type' => $post_type, 'per_page' => 5 ) ) as $item ) {
				tmdo_live_assert_same( array(), array_values( preg_grep( '/^_|token|secret|passw|api_?key/i', array_keys( (array) $item ) ) ), "{$post_type} list item keys" );
			}
		}
	}
);