<?php
/**
 * The "404 Emails" admin page (its own item in the WordPress menu): Connect
 * to 404 Emails (see Connect), or - under Advanced - connection settings (Part B),
 * Test Connection (Part D), remote form selection (Part E), Event Tickets
 * settings (Part F), and the sync-status area (Part N). Every write path
 * requires `manage_options` and a valid nonce (Part U); every output value
 * is escaped at the point of output, never trusted pre-escaped.
 *
 * @package Emails404
 */

namespace Emails404;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

use Emails404\Providers\Event_Tickets_Provider;
use Emails404\Providers\WooCommerce_Provider;

class Admin_Page {

	const CAPABILITY        = 'manage_options';
	const SAVE_ACTION       = 'emails404_save_settings';
	const TEST_ACTION       = 'emails404_test_connection';
	const CONNECT_ACTION    = 'emails404_connect';
	const DISCONNECT_ACTION = 'emails404_disconnect';
	const MENU_SLUG         = '404-emails';
	const SETTINGS_SLUG     = '404-emails-settings';
	const FORMS_TRANSIENT   = 'emails404_remote_forms_cache';

	/** @var Integration_Provider_Interface[] */
	private $providers;

	private $save_message = '';
	private $save_error   = '';

	public function __construct( array $providers ) {
		$this->providers = $providers;

		add_action( 'admin_menu', array( $this, 'register_menu' ) );
		add_action( 'admin_init', array( $this, 'handle_connect_return' ) );
		add_action( 'admin_init', array( $this, 'handle_post' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_assets' ) );
	}

	/** This plugin's page in wp-admin - also where 404 Emails sends the browser back after connecting. */
	public static function page_url() {
		return admin_url( 'admin.php?page=' . self::MENU_SLUG );
	}

	public function register_menu() {
		add_menu_page(
			__( '404 Emails', '404-emails' ),
			__( '404 Emails', '404-emails' ),
			self::CAPABILITY,
			self::MENU_SLUG,
			array( Forms_Page::class, 'render' ),
			'dashicons-email-alt',
			58
		);
		add_submenu_page( self::MENU_SLUG, __( 'Forms', '404-emails' ), __( 'Forms', '404-emails' ), self::CAPABILITY, self::MENU_SLUG, array( Forms_Page::class, 'render' ) );
		add_submenu_page( self::MENU_SLUG, __( 'Other forms', '404-emails' ), __( 'Other forms', '404-emails' ), self::CAPABILITY, Other_Forms_Page::SLUG, array( Other_Forms_Page::class, 'render' ) );
		add_submenu_page( self::MENU_SLUG, __( 'Settings', '404-emails' ), __( 'Settings', '404-emails' ), self::CAPABILITY, self::SETTINGS_SLUG, array( $this, 'render' ) );
	}

	public function enqueue_assets( $hook_suffix ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- which screen this is.
		$page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
		if ( ! in_array( $page, array( self::MENU_SLUG, self::SETTINGS_SLUG, Other_Forms_Page::SLUG ), true ) ) {
			return;
		}
		wp_enqueue_style( 'emails404-admin', EMAILS404_PLUGIN_URL . 'assets/admin.css', array(), EMAILS404_VERSION );
		if ( self::MENU_SLUG === $page ) {
			wp_enqueue_script( 'emails404-forms-editor', EMAILS404_PLUGIN_URL . 'assets/forms-editor.js', array(), EMAILS404_VERSION, true );
		}
	}

	/**
	 * 404 Emails sends the browser back here with `state` and either a
	 * one-time `code` or `error`. Finish connecting (Connect::complete checks
	 * the state belongs to this admin), then reload the page without them.
	 */
	public function handle_connect_return() {
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- the PKCE state (checked in Connect::complete) is this redirect's CSRF protection.
		if ( ! isset( $_GET['page'], $_GET['state'] ) || self::MENU_SLUG !== $_GET['page'] ) {
			return;
		}
		if ( ! isset( $_GET['code'] ) && ! isset( $_GET['error'] ) ) {
			return;
		}
		if ( ! current_user_can( self::CAPABILITY ) ) {
			return;
		}

		$state  = sanitize_text_field( wp_unslash( $_GET['state'] ) );
		$code   = isset( $_GET['code'] ) ? sanitize_text_field( wp_unslash( $_GET['code'] ) ) : null;
		// phpcs:enable
		$result = Connect::complete( $state, $code );

		delete_transient( self::FORMS_TRANSIENT );
		wp_safe_redirect( add_query_arg( 'emails404_notice', $result, self::page_url() ) );
		exit;
	}

	/**
	 * Handles both the settings-save form and the Test-Connection button,
	 * on admin_init so redirects can happen before any output starts.
	 * Every branch re-checks capability and nonce independently - never
	 * trusts that reaching this page at all implies authorization (Part U:
	 * "Do not trust request parameters merely because they come from
	 * wp-admin").
	 */
	public function handle_post() {
		if ( ! isset( $_POST['emails404_action'] ) ) {
			return;
		}
		if ( ! is_admin() || ! current_user_can( self::CAPABILITY ) ) {
			return;
		}

		$action = sanitize_key( wp_unslash( $_POST['emails404_action'] ) );

		if ( self::SAVE_ACTION === $action ) {
			$this->handle_save();
		} elseif ( self::TEST_ACTION === $action ) {
			$this->handle_test_connection();
		} elseif ( self::CONNECT_ACTION === $action ) {
			check_admin_referer( self::CONNECT_ACTION, 'emails404_nonce' );
			// An outside address on purpose: 404 Emails' own sign-in and Allow page.
			wp_redirect( Connect::start_url( self::page_url() ) ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
			exit;
		} elseif ( self::DISCONNECT_ACTION === $action ) {
			check_admin_referer( self::DISCONNECT_ACTION, 'emails404_nonce' );
			Connect::disconnect();
			delete_transient( self::FORMS_TRANSIENT );
			wp_safe_redirect( add_query_arg( 'emails404_notice', 'disconnected', self::page_url() ) );
			exit;
		}
	}

	private function handle_save() {
		check_admin_referer( self::SAVE_ACTION, 'emails404_nonce' );

		$platform_url_raw = isset( $_POST['emails404_platform_url'] ) ? wp_unslash( $_POST['emails404_platform_url'] ) : '';
		$sanitized_url     = Settings::sanitize_platform_url( $platform_url_raw );

		if ( '' !== trim( (string) $platform_url_raw ) && '' === $sanitized_url ) {
			$this->save_error = __( 'That platform URL was not accepted - it must be a valid HTTPS URL (a plain HTTP URL is only allowed for localhost/.test/.local development addresses).', '404-emails' );
			return;
		}
		Settings::update_platform_url_raw( $sanitized_url );

		if ( ! empty( $_POST['emails404_api_key'] ) ) {
			// A fresh key was pasted in - store it. An empty field is
			// deliberately treated as "leave the existing key alone," not
			// "clear it," since the field is never pre-filled with the
			// real secret (see Admin_Page::render_connection_section()) -
			// an admin re-saving the form without touching this field must
			// never accidentally wipe a working key.
			Settings::set_api_key( wp_unslash( $_POST['emails404_api_key'] ) );
		}

		if ( ! empty( $_POST['emails404_has_site_display'] ) ) {
			$site = array();
			foreach ( array( 'enabled', 'form', 'mode', 'trigger', 'delay', 'scroll', 'frequency', 'label', 'position', 'launcher', 'hide_paths', 'hide_shop' ) as $field ) {
				$key = 'emails404_site_' . $field;
				if ( isset( $_POST[ $key ] ) ) {
					$site[ $field ] = 'hide_paths' === $field
						? sanitize_textarea_field( wp_unslash( $_POST[ $key ] ) )
						: sanitize_text_field( wp_unslash( $_POST[ $key ] ) );
				}
			}
			Site_Display::save( $site );
		}

		// The "Also add people from" settings are only on the page once connected -
		// never switch them off just because the form didn't include them.
		if ( ! empty( $_POST['emails404_has_sources'] ) ) {
			if ( isset( $_POST['emails404_selected_form_public_id'] ) ) {
				$form_id   = sanitize_text_field( wp_unslash( $_POST['emails404_selected_form_public_id'] ) );
				$form_name = isset( $_POST['emails404_selected_form_name'] ) ? sanitize_text_field( wp_unslash( $_POST['emails404_selected_form_name'] ) ) : '';
				Settings::set_selected_form( $form_id, $form_name );
			}

			Settings::set_event_tickets_enabled( ! empty( $_POST['emails404_et_enabled'] ) );
			Settings::set_consent_checkbox_visible( ! empty( $_POST['emails404_et_consent_visible'] ) );

			if ( isset( $_POST['emails404_et_consent_label'] ) ) {
				Settings::set_consent_label( wp_unslash( $_POST['emails404_et_consent_label'] ) );
			}
			if ( isset( $_POST['emails404_et_consent_field_slug'] ) ) {
				Settings::set_consent_field_slug( wp_unslash( $_POST['emails404_et_consent_field_slug'] ) );
			}

			Settings::set_woocommerce_enabled( ! empty( $_POST['emails404_woo_enabled'] ) );

			if ( isset( $_POST['emails404_woo_consent_label'] ) ) {
				Settings::set_woo_consent_label( wp_unslash( $_POST['emails404_woo_consent_label'] ) );
			}
			if ( isset( $_POST['emails404_woo_selected_form_public_id'] ) ) {
				$woo_form_id   = sanitize_text_field( wp_unslash( $_POST['emails404_woo_selected_form_public_id'] ) );
				$woo_form_name = isset( $_POST['emails404_woo_selected_form_name'] ) ? sanitize_text_field( wp_unslash( $_POST['emails404_woo_selected_form_name'] ) ) : '';
				Settings::set_woo_selected_form( $woo_form_id, $woo_form_name );
			}

		}

		delete_transient( self::FORMS_TRANSIENT );
		$this->save_message = __( 'Settings saved.', '404-emails' );
	}

	private function handle_test_connection() {
		check_admin_referer( self::TEST_ACTION, 'emails404_nonce' );

		$result = Api_Client::from_settings()->list_forms();

		if ( $result->success ) {
			Settings::set_connection_result( Settings::CONNECTION_CONNECTED );
			$meta = Api_Client::from_settings()->get_meta();
			if ( $meta->success && ! empty( $meta->data['meta']['workspaceName'] ) ) {
				Settings::set_workspace_name( (string) $meta->data['meta']['workspaceName'] );
			}
			delete_transient( self::FORMS_TRANSIENT );
			$this->save_message = __( 'Connection successful.', '404-emails' );
			return;
		}

		$status = $this->map_error_to_connection_status( $result->error_category );
		Settings::set_connection_result( $status, $result->error_category );
		$this->save_error = $this->describe_connection_failure( $status );
	}

	private function map_error_to_connection_status( $error_category ) {
		switch ( $error_category ) {
			case 'unauthorized':
				return Settings::CONNECTION_INVALID_KEY;
			case 'forbidden_scope':
				return Settings::CONNECTION_MISSING_SCOPE;
			case 'timeout':
			case 'unreachable':
			case 'not_configured':
				return Settings::CONNECTION_UNREACHABLE;
			default:
				return Settings::CONNECTION_UNEXPECTED;
		}
	}

	/** Beginner-friendly, never a stack trace or raw response body - Part D. */
	private function describe_connection_failure( $status ) {
		switch ( $status ) {
			case Settings::CONNECTION_INVALID_KEY:
				return __( 'Invalid API key. Double-check the key you pasted, or create a new one in your 404 Emails workspace.', '404-emails' );
			case Settings::CONNECTION_UNREACHABLE:
				return __( 'Could not reach 404 Emails. Check the Platform URL and your site\'s outbound internet access, then try again.', '404-emails' );
			case Settings::CONNECTION_MISSING_SCOPE:
				return __( 'This API key is missing a required permission. Create a new key with the "View and submit signup forms" and "Create and update contacts" permissions.', '404-emails' );
			default:
				return __( 'Unexpected response from 404 Emails. Please try again shortly.', '404-emails' );
		}
	}

	public function render() {
		if ( ! current_user_can( self::CAPABILITY ) ) {
			wp_die( esc_html__( 'You do not have permission to access this page.', '404-emails' ) );
		}

		$et_provider = $this->find_event_tickets_provider();
		$connected   = Settings::is_connected();
		?>
		<div class="wrap emails404">
			<h1 class="emails404-title"><img src="<?php echo esc_url( EMAILS404_PLUGIN_URL . 'assets/logo.png' ); ?>" alt="<?php esc_attr_e( '404 Emails', '404-emails' ); ?>" class="emails404-logo" /></h1>

			<?php self::render_redirect_notice(); ?>
			<?php if ( $this->save_message ) : ?>
				<div class="notice notice-success"><p><?php echo esc_html( $this->save_message ); ?></p></div>
			<?php endif; ?>
			<?php if ( $this->save_error ) : ?>
				<div class="notice notice-error"><p><?php echo esc_html( $this->save_error ); ?></p></div>
			<?php endif; ?>

			<?php
			if ( $connected ) {
				$this->render_connected_card();
			} else {
				self::render_welcome_card();
			}
			?>

			<form method="post">
				<?php wp_nonce_field( self::SAVE_ACTION, 'emails404_nonce' ); ?>
				<input type="hidden" name="emails404_action" value="<?php echo esc_attr( self::SAVE_ACTION ); ?>" />

				<?php if ( $connected ) : ?>
					<?php $this->render_site_display_section(); ?>

					<input type="hidden" name="emails404_has_sources" value="1" />
					<h2 class="emails404-section-title"><?php esc_html_e( 'Also add people from', '404-emails' ); ?></h2>
					<?php $this->render_forms_section(); ?>
					<?php $this->render_event_tickets_section( $et_provider ); ?>
					<?php $this->render_woocommerce_section( $this->find_woocommerce_provider() ); ?>
				<?php endif; ?>

				<details class="emails404-advanced" <?php echo ( ! $connected && Settings::has_api_key() ) ? 'open' : ''; ?>>
					<summary><?php esc_html_e( 'Advanced: connect with an API key', '404-emails' ); ?></summary>
					<p class="description"><?php esc_html_e( 'Only needed if the Connect button can\'t be used - for example on a site without HTTPS. Create a key in 404 Emails under Settings → API keys, with the permissions to view and submit signup forms and to create and update contacts.', '404-emails' ); ?></p>
					<?php $this->render_connection_section(); ?>
				</details>

				<?php submit_button( __( 'Save settings', '404-emails' ) ); ?>
			</form>

			<?php if ( Settings::has_api_key() ) : ?>
				<form method="post" class="emails404-test-connection-form">
					<?php wp_nonce_field( self::TEST_ACTION, 'emails404_nonce' ); ?>
					<input type="hidden" name="emails404_action" value="<?php echo esc_attr( self::TEST_ACTION ); ?>" />
					<?php submit_button( __( 'Test connection', '404-emails' ), 'secondary', 'submit', false ); ?>
				</form>
				<?php $this->render_status_section(); ?>
			<?php endif; ?>
		</div>
		<?php
	}

	/** Not connected yet: the one button that matters. */
	public static function render_welcome_card() {
		$can_connect = self::can_use_connect_button();
		?>
		<div class="emails404-card emails404-welcome">
			<h2><?php esc_html_e( 'Welcome to 404 Emails', '404-emails' ); ?></h2>
			<p><?php esc_html_e( 'Connect your 404 Emails account to collect subscribers on this site.', '404-emails' ); ?></p>
			<?php if ( $can_connect ) : ?>
				<?php self::render_connect_button(); ?>
				<p class="emails404-muted"><?php esc_html_e( 'You\'ll sign in to 404 Emails, choose a workspace and allow this site. No API key to copy.', '404-emails' ); ?></p>
			<?php else : ?>
				<div class="notice notice-warning inline"><p><?php esc_html_e( 'This site\'s admin isn\'t on HTTPS, so the Connect button can\'t be used. Switch the site to HTTPS, or connect with an API key under Advanced below.', '404-emails' ); ?></p></div>
			<?php endif; ?>
			<ul class="emails404-points">
				<li><?php esc_html_e( 'Signup forms, consent records and double opt-in are handled by 404 Emails.', '404-emails' ); ?></li>
				<li><?php esc_html_e( 'This site sends a visitor\'s details to 404 Emails only when they sign up.', '404-emails' ); ?></li>
			</ul>
		</div>
		<?php
	}

	/** The "Connect to 404 Emails" button (also "connect again" for older connections). */
	public static function render_connect_button() {
		?>
		<form method="post" action="<?php echo esc_url( self::page_url() ); ?>">
			<?php wp_nonce_field( self::CONNECT_ACTION, 'emails404_nonce' ); ?>
			<input type="hidden" name="emails404_action" value="<?php echo esc_attr( self::CONNECT_ACTION ); ?>" />
			<button type="submit" class="button button-primary button-hero emails404-connect-button"><?php esc_html_e( 'Connect to 404 Emails', '404-emails' ); ?></button>
		</form>
		<?php
	}

	/** Connected: which workspace, and how to disconnect. */
	private function render_connected_card() {
		$workspace = Settings::get_workspace_name();
		?>
		<div class="emails404-card emails404-connected">
			<p class="emails404-connected-line">
				<span class="emails404-dot" aria-hidden="true"></span>
				<?php
				if ( '' !== $workspace ) {
					printf(
						/* translators: %s: the 404 Emails workspace's name */
						esc_html__( 'Connected to %s', '404-emails' ),
						'<strong>' . esc_html( $workspace ) . '</strong>'
					);
				} else {
					esc_html_e( 'Connected to 404 Emails', '404-emails' );
				}
				?>
			</p>
			<div class="emails404-connected-actions">
				<a class="button" href="<?php echo esc_url( Settings::get_platform_url() ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Open 404 Emails', '404-emails' ); ?></a>
				<form method="post">
					<?php wp_nonce_field( self::DISCONNECT_ACTION, 'emails404_nonce' ); ?>
					<input type="hidden" name="emails404_action" value="<?php echo esc_attr( self::DISCONNECT_ACTION ); ?>" />
					<button type="submit" class="button-link emails404-disconnect"><?php esc_html_e( 'Disconnect', '404-emails' ); ?></button>
				</form>
			</div>
		</div>
		<?php
	}

	/** "Show on every page": one form as a pop-up or corner button across the site. */
	private function render_site_display_section() {
		$forms = self::get_forms();
		$site  = Site_Display::get();
		?>
		<h2 class="emails404-section-title" id="emails404-every-page"><?php esc_html_e( 'Show a form on every page', '404-emails' ); ?></h2>
		<p class="description"><?php esc_html_e( 'One published form as a pop-up or corner button across the whole site. To put a form inside a page, use the "404 Emails form" block or the form\'s shortcode (404 Emails → Forms).', '404-emails' ); ?></p>
		<input type="hidden" name="emails404_has_site_display" value="1" />
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Every page', '404-emails' ); ?></th>
				<td>
					<label>
						<input type="checkbox" name="emails404_site_enabled" value="1" <?php checked( ! empty( $site['enabled'] ) ); ?> <?php disabled( empty( $forms ) ); ?> />
						<?php esc_html_e( 'Show a form across the whole site - no page editing', '404-emails' ); ?>
					</label>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_site_form"><?php esc_html_e( 'Form', '404-emails' ); ?></label></th>
				<td>
					<select id="emails404_site_form" name="emails404_site_form">
						<option value=""><?php esc_html_e( '— Select a form —', '404-emails' ); ?></option>
						<?php foreach ( $forms as $form ) : ?>
							<option value="<?php echo esc_attr( $form['id'] ); ?>" <?php selected( $site['form'], $form['id'] ); ?>><?php echo esc_html( $form['name'] ); ?></option>
						<?php endforeach; ?>
					</select>
				</td>
			</tr>
			<tr>
				<th scope="row"><?php esc_html_e( 'Show as', '404-emails' ); ?></th>
				<td>
					<fieldset>
						<label><input type="radio" name="emails404_site_mode" value="popup" <?php checked( $site['mode'], 'popup' ); ?> /> <?php esc_html_e( 'Pop-up', '404-emails' ); ?></label><br />
						<label><input type="radio" name="emails404_site_mode" value="floating" <?php checked( $site['mode'], 'floating' ); ?> /> <?php esc_html_e( 'Corner button', '404-emails' ); ?></label>
					</fieldset>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_site_trigger"><?php esc_html_e( 'Pop-up opens', '404-emails' ); ?></label></th>
				<td>
					<select id="emails404_site_trigger" name="emails404_site_trigger">
						<option value="delay" <?php selected( $site['trigger'], 'delay' ); ?>><?php esc_html_e( 'After a few seconds', '404-emails' ); ?></option>
						<option value="scroll" <?php selected( $site['trigger'], 'scroll' ); ?>><?php esc_html_e( 'When they scroll down the page', '404-emails' ); ?></option>
						<option value="exit" <?php selected( $site['trigger'], 'exit' ); ?>><?php esc_html_e( 'When they are about to leave', '404-emails' ); ?></option>
						<option value="click" <?php selected( $site['trigger'], 'click' ); ?>><?php esc_html_e( 'When the button is clicked', '404-emails' ); ?></option>
					</select>
					<label class="emails404-inline-field"><?php esc_html_e( 'Seconds', '404-emails' ); ?> <input type="number" name="emails404_site_delay" min="1" max="120" class="small-text" value="<?php echo esc_attr( (string) $site['delay'] ); ?>" /></label>
					<label class="emails404-inline-field"><?php esc_html_e( 'How far down (%)', '404-emails' ); ?> <input type="number" name="emails404_site_scroll" min="10" max="90" class="small-text" value="<?php echo esc_attr( (string) $site['scroll'] ); ?>" /></label>
					<p class="description"><?php esc_html_e( 'A corner button always opens when it\'s clicked.', '404-emails' ); ?></p>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_site_frequency"><?php esc_html_e( 'Show again after (days)', '404-emails' ); ?></label></th>
				<td>
					<input type="number" id="emails404_site_frequency" name="emails404_site_frequency" min="0" max="365" class="small-text" value="<?php echo esc_attr( (string) $site['frequency'] ); ?>" />
					<p class="description"><?php esc_html_e( '0 shows it on every visit. People who sign up or close it wait this long.', '404-emails' ); ?></p>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_site_label"><?php esc_html_e( 'Button text', '404-emails' ); ?></label></th>
				<td>
					<input type="text" id="emails404_site_label" name="emails404_site_label" maxlength="60" class="regular-text" value="<?php echo esc_attr( $site['label'] ); ?>" placeholder="<?php esc_attr_e( 'Subscribe', '404-emails' ); ?>" />
					<br /><label><input type="checkbox" name="emails404_site_launcher" value="1" <?php checked( ! empty( $site['launcher'] ) ); ?> /> <?php esc_html_e( 'Also show the button for a pop-up that opens by itself', '404-emails' ); ?></label>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_site_position"><?php esc_html_e( 'Corner', '404-emails' ); ?></label></th>
				<td>
					<select id="emails404_site_position" name="emails404_site_position">
						<option value="bottom-right" <?php selected( $site['position'], 'bottom-right' ); ?>><?php esc_html_e( 'Bottom right', '404-emails' ); ?></option>
						<option value="bottom-left" <?php selected( $site['position'], 'bottom-left' ); ?>><?php esc_html_e( 'Bottom left', '404-emails' ); ?></option>
					</select>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_site_hide_paths"><?php esc_html_e( 'Not on these pages', '404-emails' ); ?></label></th>
				<td>
					<textarea id="emails404_site_hide_paths" name="emails404_site_hide_paths" rows="3" class="large-text code" placeholder="/contact/"><?php echo esc_textarea( $site['hide_paths'] ); ?></textarea>
					<p class="description"><?php esc_html_e( 'One page address per line, e.g. /contact/ - pages under it are skipped too.', '404-emails' ); ?></p>
					<label><input type="checkbox" name="emails404_site_hide_shop" value="1" <?php checked( ! empty( $site['hide_shop'] ) ); ?> /> <?php esc_html_e( 'Not on the WooCommerce cart, checkout or account pages', '404-emails' ); ?></label>
				</td>
			</tr>
		</table>
		<?php
	}

	/** After coming back from 404 Emails or disconnecting. */
	public static function render_redirect_notice() {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only.
		$notice = isset( $_GET['emails404_notice'] ) ? sanitize_key( wp_unslash( $_GET['emails404_notice'] ) ) : '';
		$messages = array(
			Connect::RESULT_CONNECTED => array( 'success', __( 'Connected. This site can now collect subscribers for 404 Emails.', '404-emails' ) ),
			Connect::RESULT_CANCELLED => array( 'warning', __( 'Connecting was cancelled. Nothing was changed.', '404-emails' ) ),
			Connect::RESULT_EXPIRED   => array( 'error', __( 'That connection attempt expired or didn\'t start on this site. Please click Connect again.', '404-emails' ) ),
			Connect::RESULT_FAILED    => array( 'error', __( 'Connecting didn\'t finish - 404 Emails couldn\'t be reached or the link was already used. Please click Connect again.', '404-emails' ) ),
			'disconnected'            => array( 'success', __( 'Disconnected. This site no longer sends sign-ups to 404 Emails.', '404-emails' ) ),
		);
		if ( ! isset( $messages[ $notice ] ) ) {
			return;
		}
		list( $type, $message ) = $messages[ $notice ];
		printf( '<div class="notice notice-%1$s is-dismissible"><p>%2$s</p></div>', esc_attr( $type ), esc_html( $message ) );
	}

	/**
	 * 404 Emails only sends a connection back to an HTTPS address (or a
	 * local development one), so the button is offered only then.
	 */
	public static function can_use_connect_button() {
		$url    = self::page_url();
		$scheme = wp_parse_url( $url, PHP_URL_SCHEME );
		$host   = (string) wp_parse_url( $url, PHP_URL_HOST );
		return 'https' === $scheme || Api_Client::is_local_development_host( $host );
	}

	private function render_connection_section() {
		$platform_url = Settings::get_platform_url();
		$has_key      = Settings::has_api_key();
		$key_prefix   = Settings::get_api_key_prefix();
		$status       = Settings::get_connection_status();
		?>
		<p>
			<?php echo esc_html( $this->status_label( $status ) ); ?>
		</p>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><label for="emails404_platform_url"><?php esc_html_e( 'Platform URL', '404-emails' ); ?></label></th>
				<td>
					<input type="url" id="emails404_platform_url" name="emails404_platform_url" class="regular-text" value="<?php echo esc_attr( '' !== $platform_url ? $platform_url : Settings::default_platform_url() ); ?>" autocomplete="off" />
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_api_key"><?php esc_html_e( 'API key', '404-emails' ); ?></label></th>
				<td>
					<input type="password" id="emails404_api_key" name="emails404_api_key" class="regular-text" value="" autocomplete="off" placeholder="<?php echo $has_key ? esc_attr__( 'Leave blank to keep the current key', '404-emails' ) : esc_attr__( 'ep_live_...', '404-emails' ); ?>" />
					<?php if ( $has_key ) : ?>
						<p class="description">
							<?php
							printf(
								/* translators: %s: non-secret key prefix, e.g. ep_live_a1b2c3d4e5f6 */
								esc_html__( 'Current key: %s (never shown in full after saving)', '404-emails' ),
								'<code>' . esc_html( $key_prefix ) . '</code>'
							);
							?>
						</p>
					<?php endif; ?>
				</td>
			</tr>
		</table>
		<?php
	}

	private function render_forms_section() {
		$forms          = self::get_forms();
		$selected_id    = Settings::get_selected_form_public_id();
		?>
		<h2><?php esc_html_e( 'Destination form', '404-emails' ); ?></h2>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><label for="emails404_selected_form_public_id"><?php esc_html_e( 'Send registrations to', '404-emails' ); ?></label></th>
				<td>
					<?php if ( empty( $forms ) ) : ?>
						<p class="description"><?php esc_html_e( 'Connect successfully first to choose a form - only published forms in your workspace are shown.', '404-emails' ); ?></p>
					<?php else : ?>
						<select id="emails404_selected_form_public_id" name="emails404_selected_form_public_id" data-emails404-form-select="1">
							<option value=""><?php esc_html_e( '— Select a form —', '404-emails' ); ?></option>
							<?php foreach ( $forms as $form ) : ?>
								<option
									value="<?php echo esc_attr( $form['id'] ); ?>"
									data-name="<?php echo esc_attr( $form['name'] ); ?>"
									<?php selected( $selected_id, $form['id'] ); ?>
								>
									<?php echo esc_html( $form['name'] ); ?>
								</option>
							<?php endforeach; ?>
						</select>
						<input type="hidden" name="emails404_selected_form_name" id="emails404_selected_form_name" value="<?php echo esc_attr( Settings::get_selected_form_name() ); ?>" />
						<script>
						( function () {
							var select = document.getElementById( 'emails404_selected_form_public_id' );
							var hidden = document.getElementById( 'emails404_selected_form_name' );
							if ( select && hidden ) {
								select.addEventListener( 'change', function () {
									var option = select.options[ select.selectedIndex ];
									hidden.value = option ? ( option.getAttribute( 'data-name' ) || '' ) : '';
								} );
							}
						} )();
						</script>
					<?php endif; ?>
					<p class="description"><?php esc_html_e( 'The form itself (consent wording, double opt-in, groups/tags) stays fully configured on the 404 Emails side - this only remembers which one to use.', '404-emails' ); ?></p>
				</td>
			</tr>
		</table>
		<?php
	}

	private function render_event_tickets_section( $et_provider ) {
		$et_active   = $et_provider && $et_provider->is_available();
		$plus_active = Event_Tickets_Provider::is_plus_available();
		?>
		<h2><?php esc_html_e( 'Event Tickets', '404-emails' ); ?></h2>

		<?php if ( ! $et_active ) : ?>
			<p class="description"><?php esc_html_e( 'Event Tickets is not active on this site. Install and activate it to enable this integration - the rest of this page still works without it.', '404-emails' ); ?></p>
			<?php return; ?>
		<?php endif; ?>

		<ol class="emails404-steps">
			<li><?php esc_html_e( 'Choose the 404 Emails form people join under "Destination form" above (its double opt-in, groups and welcome emails apply).', '404-emails' ); ?></li>
			<li><?php esc_html_e( 'Tick "Enabled" and "Show checkbox" below, check the wording, and save.', '404-emails' ); ?></li>
			<li><?php esc_html_e( 'Your RSVP forms and ticket checkout now show the tick-box under the email field. Only people who tick it are sent to 404 Emails and subscribed - nothing is sent for anyone else.', '404-emails' ); ?></li>
		</ol>

		<?php if ( Settings::is_event_tickets_integration_enabled() && ! Settings::is_consent_checkbox_visible() && ! ( $plus_active && '' !== Settings::get_consent_field_slug() ) ) : ?>
			<div class="notice notice-warning inline"><p><?php esc_html_e( 'Nobody will be added: the tick-box is switched off and no Event Tickets Plus field is set. Tick "Show checkbox" below.', '404-emails' ); ?></p></div>
		<?php endif; ?>

		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Integration', '404-emails' ); ?></th>
				<td>
					<label>
						<input type="checkbox" name="emails404_et_enabled" value="1" <?php checked( Settings::is_event_tickets_integration_enabled() ); ?> />
						<?php esc_html_e( 'Enabled - send people who tick the box to 404 Emails', '404-emails' ); ?>
					</label>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_et_consent_label"><?php esc_html_e( 'Marketing consent text', '404-emails' ); ?></label></th>
				<td>
					<input type="text" id="emails404_et_consent_label" name="emails404_et_consent_label" class="large-text" value="<?php echo esc_attr( Settings::get_consent_label() ); ?>" />
				</td>
			</tr>
			<tr>
				<th scope="row"><?php esc_html_e( 'Show checkbox', '404-emails' ); ?></th>
				<td>
					<label>
						<input type="checkbox" name="emails404_et_consent_visible" value="1" <?php checked( Settings::is_consent_checkbox_visible() ); ?> />
						<?php esc_html_e( 'Show the marketing consent checkbox on the registration form', '404-emails' ); ?>
					</label>
					<p class="description"><?php esc_html_e( 'Under the email field of your RSVP forms and ticket checkout. Never ticked in advance. Works with the free Event Tickets.', '404-emails' ); ?></p>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_et_consent_field_slug"><?php esc_html_e( 'Event Tickets Plus field (optional)', '404-emails' ); ?></label></th>
				<td>
					<input type="text" id="emails404_et_consent_field_slug" name="emails404_et_consent_field_slug" class="regular-text" value="<?php echo esc_attr( Settings::get_consent_field_slug() ); ?>" placeholder="marketing-consent" />
					<p class="description">
						<?php
						echo esc_html(
							$plus_active
								? __( 'Only if you\'d rather use your own checkbox from a ticket\'s Attendee Information: paste that field\'s slug here, and this plugin\'s tick-box is no longer added.', '404-emails' )
								: __( 'For Event Tickets Plus users who already have a newsletter checkbox in a ticket\'s Attendee Information. Leave it empty otherwise.', '404-emails' )
						);
						?>
					</p>
				</td>
			</tr>
		</table>
		<?php
	}

	/**
	 * Its own "which form" dropdown, deliberately independent of the
	 * shared Event Tickets destination form above - see
	 * Settings::set_woo_selected_form()'s own doc comment for why. No
	 * ecommerce analytics, no product/order sync controls here (Part S) -
	 * enable, consent label, and destination form only.
	 */
	private function render_woocommerce_section( $woo_provider ) {
		$woo_active = $woo_provider && $woo_provider->is_available();
		$forms      = self::get_forms();
		?>
		<h2><?php esc_html_e( 'WooCommerce', '404-emails' ); ?></h2>

		<?php if ( ! $woo_active ) : ?>
			<p class="description"><?php esc_html_e( 'WooCommerce is not active on this site. Install and activate it to enable this integration - the rest of this page still works without it.', '404-emails' ); ?></p>
			<?php return; ?>
		<?php endif; ?>

		<p class="description">
			<?php esc_html_e( 'Adds an unchecked marketing-consent checkbox to your Checkout Block. A customer\'s order is only ever sent to 404 Emails if they explicitly check it - placing an order, creating an account, or entering a checkout email is never treated as consent. Only supports the Checkout Block; classic (shortcode) checkout is not supported this release.', '404-emails' ); ?>
		</p>

		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Integration', '404-emails' ); ?></th>
				<td>
					<label>
						<input type="checkbox" name="emails404_woo_enabled" value="1" <?php checked( Settings::is_woocommerce_integration_enabled() ); ?> />
						<?php esc_html_e( 'Enabled - send consenting WooCommerce customers to 404 Emails', '404-emails' ); ?>
					</label>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_woo_consent_label"><?php esc_html_e( 'Marketing consent text', '404-emails' ); ?></label></th>
				<td>
					<input type="text" id="emails404_woo_consent_label" name="emails404_woo_consent_label" class="large-text" value="<?php echo esc_attr( Settings::get_woo_consent_label() ); ?>" />
					<p class="description"><?php esc_html_e( 'Shown as its own checkbox at checkout, separate from your store\'s terms/privacy checkbox. Never pre-checked.', '404-emails' ); ?></p>
				</td>
			</tr>
			<tr>
				<th scope="row"><label for="emails404_woo_selected_form_public_id"><?php esc_html_e( 'Send consenting customers to', '404-emails' ); ?></label></th>
				<td>
					<?php if ( empty( $forms ) ) : ?>
						<p class="description"><?php esc_html_e( 'Connect successfully first to choose a form - only published forms in your workspace are shown.', '404-emails' ); ?></p>
					<?php else : ?>
						<select id="emails404_woo_selected_form_public_id" name="emails404_woo_selected_form_public_id" data-emails404-form-select="1">
							<option value=""><?php esc_html_e( '— Select a form —', '404-emails' ); ?></option>
							<?php foreach ( $forms as $form ) : ?>
								<option
									value="<?php echo esc_attr( $form['id'] ); ?>"
									data-name="<?php echo esc_attr( $form['name'] ); ?>"
									<?php selected( Settings::get_woo_selected_form_public_id(), $form['id'] ); ?>
								>
									<?php echo esc_html( $form['name'] ); ?>
								</option>
							<?php endforeach; ?>
						</select>
						<input type="hidden" name="emails404_woo_selected_form_name" id="emails404_woo_selected_form_name" value="<?php echo esc_attr( Settings::get_woo_selected_form_name() ); ?>" />
						<script>
						( function () {
							var select = document.getElementById( 'emails404_woo_selected_form_public_id' );
							var hidden = document.getElementById( 'emails404_woo_selected_form_name' );
							if ( select && hidden ) {
								select.addEventListener( 'change', function () {
									var option = select.options[ select.selectedIndex ];
									hidden.value = option ? ( option.getAttribute( 'data-name' ) || '' ) : '';
								} );
							}
						} )();
						</script>
					<?php endif; ?>
					<p class="description"><?php esc_html_e( 'Without a selected form, consenting customers are not synced (there is nothing safe to do with consent alone). The form itself (consent wording, double opt-in, groups/tags) stays fully configured on the 404 Emails side.', '404-emails' ); ?></p>
				</td>
			</tr>
		</table>
		<?php
	}

	private function render_status_section() {
		$last_success = Logger::get_last_success();
		$last_failure = Logger::get_last_failure();
		$pending      = Retry_Queue::pending_count();
		?>
		<h2><?php esc_html_e( 'Recent status', '404-emails' ); ?></h2>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Last successful sync', '404-emails' ); ?></th>
				<td><?php echo $last_success ? esc_html( $this->format_log_row( $last_success ) ) : esc_html__( 'None yet', '404-emails' ); ?></td>
			</tr>
			<tr>
				<th scope="row"><?php esc_html_e( 'Last failed sync', '404-emails' ); ?></th>
				<td><?php echo $last_failure ? esc_html( $this->format_log_row( $last_failure ) ) : esc_html__( 'None yet', '404-emails' ); ?></td>
			</tr>
			<tr>
				<th scope="row"><?php esc_html_e( 'Pending retries', '404-emails' ); ?></th>
				<td><?php echo esc_html( (string) $pending ); ?></td>
			</tr>
		</table>
		<?php
	}

	private function format_log_row( $row ) {
		$time = get_date_from_gmt( $row->created_at, get_option( 'date_format' ) . ' ' . get_option( 'time_format' ) );
		if ( $row->error_code ) {
			/* translators: 1: date/time, 2: safe error code */
			return sprintf( __( '%1$s (%2$s)', '404-emails' ), $time, $row->error_code );
		}
		return $time;
	}

	private function status_label( $status ) {
		switch ( $status ) {
			case Settings::CONNECTION_CONNECTED:
				return __( '✓ Connected', '404-emails' );
			case Settings::CONNECTION_INVALID_KEY:
				return __( '✗ Invalid API key', '404-emails' );
			case Settings::CONNECTION_UNREACHABLE:
				return __( '✗ Platform unreachable', '404-emails' );
			case Settings::CONNECTION_MISSING_SCOPE:
				return __( '✗ Missing permission on this API key', '404-emails' );
			case Settings::CONNECTION_UNEXPECTED:
				return __( '✗ Unexpected response', '404-emails' );
			default:
				return __( 'Not tested yet', '404-emails' );
		}
	}

	/**
	 * The workspace's published forms (id = public id), cached for a minute.
	 * Also used by the editor block and the every-page setting.
	 *
	 * @return array<int,array{id:string,name:string,heading:string}>
	 */
	public static function get_forms() {
		$cached = get_transient( self::FORMS_TRANSIENT );
		if ( is_array( $cached ) ) {
			return $cached;
		}

		if ( ! Settings::has_api_key() || '' === Settings::get_platform_url() ) {
			return array();
		}

		$result = Api_Client::from_settings()->list_forms();
		if ( ! $result->success || empty( $result->data['items'] ) ) {
			return array();
		}

		$forms = array();
		foreach ( $result->data['items'] as $item ) {
			if ( ! empty( $item['id'] ) && isset( $item['name'] ) ) {
				$forms[] = array(
					'id'      => (string) $item['id'],
					'name'    => (string) $item['name'],
					'heading' => isset( $item['heading'] ) ? (string) $item['heading'] : '',
				);
			}
		}

		set_transient( self::FORMS_TRANSIENT, $forms, MINUTE_IN_SECONDS );
		return $forms;
	}

	private function find_event_tickets_provider() {
		foreach ( $this->providers as $provider ) {
			if ( $provider instanceof Event_Tickets_Provider ) {
				return $provider;
			}
		}
		return null;
	}

	private function find_woocommerce_provider() {
		foreach ( $this->providers as $provider ) {
			if ( $provider instanceof WooCommerce_Provider ) {
				return $provider;
			}
		}
		return null;
	}
}