<?php

// Demonstrates attaching Lib\Comments to a page — see /admin/docs/comments.
// This is the one post under App/pages/blog/ with a sidecar, specifically
// so it can carry a live comment thread; giving it one is what excludes
// it from the static HTML cache (Renderer::render() only ever caches
// sidecar-less pages) — every other post stays sidecar-less/cached and
// has no thread, since blog/_layout/layout.twig only includes one when
// 'comments' is present in the returned context.

use App\AdminAuth;
use App\Response;
use Lib\Comments;
use Lib\Csrf;
use Lib\FormValidator;
use Lib\Input;
use Lib\SpamGuard;

$pagePath = Comments::currentPagePath();
$user = AdminAuth::currentUser();
$spamGuard = new SpamGuard();
$commentError = null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!Csrf::verify(Input::post('csrf_token'))) {
        return Response::redirect($pagePath . '?error=security');
    }

    if ($user === null) {
        return Response::redirect($pagePath . '?error=login');
    }

    $body = Input::post('body', '');
    $validator = (new FormValidator())
        ->required($body, 'body', 'Enter a comment.')
        ->maxLength($body, 'body', 2000, 'Comments are 2000 characters max.');

    if ($validator->passes()) {
        // Same "bot gets an identical response" reasoning as the contact
        // form — see App/pages/contact/index.php. Only the insert is
        // skipped for spam.
        if (!$spamGuard->isSpam(Input::post())) {
            Comments::create($pagePath, $user['id'], $body);
        }

        return Response::redirect($pagePath);
    }

    $commentError = $validator->errors()['body'] ?? null;
}

return [
    'comments'     => Comments::forPage($pagePath),
    'currentUser'  => $user,
    'commentError' => $commentError,
    'renderedAt'   => $spamGuard->renderedAt(),
    'csrfField'    => Csrf::fieldName(),
    'csrfToken'    => Csrf::token(),
];