<?php
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

class Linkquiver_Health_Check {

    /**
     * Run diagnostics and return a status report.
     *
     * The response is intentionally minimal: anything the SaaS doesn't
     * actively consume is recon material for an attacker holding a
     * compromised API key. Specifically we no longer leak PHP version,
     * full uploads filesystem path, active plugin list, or memory/upload
     * limits — none of which the LinkQuiver dashboard reads. If we ever
     * need richer diagnostics we'll move them behind a `?verbose=1`
     * opt-in flag.
     */
    public function run() {
        $seo_handler = new Linkquiver_SEO_Handler();
        $seo         = $seo_handler->detect();
        // Only expose which SEO plugin family is active (name) — drop any
        // version/path fields the detector may include.
        $seo_minimal = is_array( $seo )
            ? array(
                // detect() returns 'active', not 'detected' — reading the wrong
                // key made this report false even when an SEO plugin was live.
                'detected' => $seo['active'] ?? false,
                'plugin'   => isset( $seo['plugin'] ) ? (string) $seo['plugin'] : null,
            )
            : array( 'detected' => false, 'plugin' => null );

        return array(
            'status'            => 'ok',
            'plugin_version'    => LINKQUIVER_VERSION,
            'wordpress_version' => get_bloginfo( 'version' ),
            'checks'            => array(
                'seo_plugin' => $seo_minimal,
            ),
        );
    }

}