<?php

declare(strict_types=1);

namespace BotGuard\Controllers\Api;

use BotGuard\Core\Request;
use BotGuard\Core\Response;
use BotGuard\Services\VerificationService;

/**
 * JSON endpoint that receives the client-collected signal bundle, runs the
 * detection engine and returns the decision (score, classification, redirect
 * target or block). Thin by design — all logic lives in VerificationService.
 */
final class VerificationApiController
{
    public function __construct(private VerificationService $verification)
    {
    }

    public function verify(Request $request): Response
    {
        $payload = $request->json();

        if ($payload === [] || ! isset($payload['token'])) {
            return Response::json(['error' => 'Malformed verification payload.'], 422);
        }

        $decision = $this->verification->verify($request, $payload);

        return Response::json([
            'ok'             => true,
            'score'          => $decision['score'],
            'classification' => $decision['classification'],
            'action'         => $decision['action'],
            'redirect_url'   => $decision['redirect_url'],
            'block_message'  => $decision['block_message'],
            'breakdown'      => $decision['breakdown'],
        ]);
    }
}
