<?php
/**
 * Network Admin → Activity Log (#8).
 *
 * @package ActivityLog404
 */

namespace ActivityLog404\Admin;

use ActivityLog404\ActivityLog;
use ActivityLog404\Context\UserAgent;
use ActivityLog404\Export\CsvExport;
use ActivityLog404\Network\NetworkEvents;
use ActivityLog404\Network\NetworkLog;
use Ops404\ActivityLog\Vendor\Ops404\Ui\Render;
use Ops404\ActivityLog\Vendor\Ops404\Ui\Ui;

defined( 'ABSPATH' ) || exit;

/**
 * The network log's screen: every site's events and the network's own, with
 * a Site column and filter beside the site screen's filters, and the CSV
 * export of what it shows.
 *
 * **Who sees it: super admins, and only them.** The menu, the render and the
 * export each check `manage_network` themselves -- three gates, not one
 * inherited from the menu, because an export is a plain GET to any admin URL
 * and a render can be reached by a hand-typed one. A site administrator
 * keeps their own site's screen, which reads their own site's table and
 * nothing else: no filter there, and no parameter of its REST route or its
 * export, names another site (tests/Integration/Network/NetworkPermissionTest).
 *
 * **What a page load costs**: one indexed page read and one COUNT on the
 * network table, one `get_sites()` for the labels of the sites that page
 * shows, and at most 250 sites for the filter -- never a loop over every
 * site's table.
 */
final class NetworkPage {

	/** The screen's slug. */
	public const MENU_SLUG = '404ops-activity-log-network';

	/** Rows per page, as the site screen shows. */
	private const PER_PAGE = 25;

	/** Sites the Site filter lists before it becomes a site-id field. */
	private const SITES_LISTED = 250;

	/** Users the User filter lists (logins, alphabetical). */
	private const USERS_LISTED = 500;

	/** The export's nonce action. */
	public const EXPORT_NONCE = 'ops_activity_log_network_export';

	/** The screen's hook suffix, once the menu has registered it. */
	private static string $hook_suffix = '';

	/**
	 * Wire the screen. Only while the network log is in use.
	 */
	public static function register(): void {
		add_action( 'network_admin_menu', array( __CLASS__, 'add_menu' ) );
		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'assets' ) );
		add_action( 'admin_init', array( __CLASS__, 'handle_export' ) );
	}

	/**
	 * A top-level Network Admin page. The shared 404ops parent is a site
	 * menu; the network admin has no 404ops parent to nest under.
	 */
	public static function add_menu(): void {
		$suffix = add_menu_page(
			__( 'Activity Log', '404ops-activity-log' ),
			__( 'Activity Log', '404ops-activity-log' ),
			'manage_network',
			self::MENU_SLUG,
			array( __CLASS__, 'render' ),
			'dashicons-clock'
		);

		self::$hook_suffix = $suffix;
	}

	/**
	 * The ui-kit on this screen only.
	 *
	 * @param string $hook The screen's hook suffix.
	 */
	public static function assets( $hook ): void {
		if ( '' !== self::$hook_suffix && self::$hook_suffix === $hook ) {
			Ui::enqueue();
		}
	}

	/**
	 * What an export request is allowed to do, decided without ending the
	 * request so it can be tested: `none` (not an export), `forbidden`,
	 * `bad_nonce`, or `export`. The capability comes first, so a site
	 * administrator holding a valid-looking link learns nothing more.
	 *
	 * @param array<string, mixed> $request Request parameters ($_GET).
	 */
	public static function export_decision( array $request ): string {
		if ( ! isset( $request['ops_activity_log_network_export'] ) ) {
			return 'none';
		}
		if ( ! is_multisite() || ! current_user_can( 'manage_network' ) ) {
			return 'forbidden';
		}

		$nonce = isset( $request['_wpnonce'] ) && is_string( $request['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $request['_wpnonce'] ) ) : '';
		if ( ! wp_verify_nonce( $nonce, self::EXPORT_NONCE ) ) {
			return 'bad_nonce';
		}

		return 'export';
	}

	/**
	 * `admin_init` in the network admin: stream the export, or refuse it.
	 */
	public static function handle_export(): void {
		if ( ! is_network_admin() ) {
			return;
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- export_decision() verifies the nonce.
		$request  = $_GET;
		$decision = self::export_decision( $request );
		if ( 'none' === $decision ) {
			return;
		}
		if ( 'export' !== $decision ) {
			wp_die( esc_html__( 'Security check failed.', '404ops-activity-log' ), '', array( 'response' => 403 ) );
		}

		CsvExport::download_network( self::filters( $request ) );
	}

	/**
	 * The screen's filters, read from its request and validated: the site
	 * screen's filters, plus `blog_id` (the `site` parameter: a site id, or 0
	 * for the network's own rows).
	 *
	 * @param array<string, mixed> $request Request parameters.
	 * @return array<string, mixed> NetworkLog::get_events() filters.
	 */
	public static function filters( array $request ): array {
		$text = static function ( string $key ) use ( $request ): ?string {
			if ( ! isset( $request[ $key ] ) || ! is_string( $request[ $key ] ) ) {
				return null;
			}
			$value = sanitize_text_field( wp_unslash( $request[ $key ] ) );

			return '' !== $value ? $value : null;
		};

		$site    = $text( 'site' );
		$user    = $text( 'user_id' );
		$country = strtoupper( (string) $text( 'country' ) );
		$device  = (string) $text( 'device' );

		return array(
			'blog_id'      => null !== $site && 1 === preg_match( '/^\d{1,19}$/D', $site ) ? (int) $site : null,
			'user_id'      => null !== $user && 1 === preg_match( '/^[1-9]\d{0,19}$/D', $user ) ? (int) $user : null,
			'event_type'   => null !== $text( 'event_type' ) ? sanitize_key( (string) $text( 'event_type' ) ) : null,
			'date_from'    => $text( 'date_from' ),
			'date_to'      => $text( 'date_to' ),
			'search'       => $text( 'log_search' ),
			'country'      => 1 === preg_match( '/^[A-Z]{2}$/', $country ) ? $country : null,
			'device_class' => in_array( $device, UserAgent::CLASSES, true ) ? $device : null,
		);
	}

	/**
	 * Filters back into the screen's own query arguments, empty ones
	 * dropped: for the pager and the export link.
	 *
	 * @param array<string, mixed> $filters filters()'s answer.
	 * @return array<string, string>
	 */
	private static function query_args( array $filters ): array {
		$names = array(
			'blog_id'      => 'site',
			'user_id'      => 'user_id',
			'event_type'   => 'event_type',
			'date_from'    => 'date_from',
			'date_to'      => 'date_to',
			'search'       => 'log_search',
			'country'      => 'country',
			'device_class' => 'device',
		);

		$args = array();
		foreach ( $names as $filter => $name ) {
			if ( isset( $filters[ $filter ] ) && '' !== (string) $filters[ $filter ] ) {
				$args[ $name ] = (string) $filters[ $filter ];
			}
		}

		return $args;
	}

	/**
	 * Every event type either log can hold, labelled.
	 *
	 * @return array<string, string>
	 */
	public static function event_types(): array {
		return ActivityLog::get_event_types() + NetworkEvents::event_types();
	}

	/**
	 * Render the screen.
	 */
	public static function render(): void {
		if ( ! is_multisite() || ! current_user_can( 'manage_network' ) ) {
			return;
		}

		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- a read-only filter form.
		$request = $_GET;
		$page    = isset( $request['paged'] ) && is_numeric( $request['paged'] ) ? max( 1, (int) $request['paged'] ) : 1;
		// phpcs:enable WordPress.Security.NonceVerification.Recommended
		$filters = self::filters( $request );

		$events = NetworkLog::get_events(
			array_merge(
				$filters,
				array(
					'per_page' => self::PER_PAGE,
					'page'     => $page,
				)
			)
		);
		$total  = NetworkLog::count_events( $filters );
		$types  = self::event_types();
		$base   = network_admin_url( 'admin.php?page=' . self::MENU_SLUG );

		echo '<div class="wrap o4o-wrap" data-testid="ops-activity-log-network">';
		Render::header( __( 'Network Activity Log', '404ops-activity-log' ), __( 'Every site\'s events, and the network\'s own', '404ops-activity-log' ) );
		echo '<p class="description">' . esc_html__( 'Events are copied here as each site logs them, from when the plugin was network-activated. Earlier events are in each site\'s own log. Network events follow the main site\'s settings: its exclusions, IP address handling, location and device settings, and retention.', '404ops-activity-log' ) . '</p>';

		self::render_filters( $filters, $types );

		if ( array() === $events ) {
			Render::empty_state( __( 'No events found', '404ops-activity-log' ), __( 'Activity from every site will appear here.', '404ops-activity-log' ) );
			echo '</div>';
			return;
		}

		$sites = NetworkLog::site_labels( array_map( 'intval', array_column( $events, 'blog_id' ) ) );

		echo '<table class="wp-list-table widefat striped" data-testid="ops-activity-log-network-table">';
		echo '<thead><tr>';
		foreach ( array(
			__( 'Timestamp', '404ops-activity-log' ),
			__( 'Site', '404ops-activity-log' ),
			__( 'User', '404ops-activity-log' ),
			__( 'IP Address', '404ops-activity-log' ),
			__( 'Location', '404ops-activity-log' ),
			__( 'Device', '404ops-activity-log' ),
			__( 'Event', '404ops-activity-log' ),
			__( 'Summary', '404ops-activity-log' ),
			__( 'Details', '404ops-activity-log' ),
		) as $heading ) {
			echo '<th scope="col">' . esc_html( $heading ) . '</th>';
		}
		echo '</tr></thead><tbody>';

		foreach ( $events as $event ) {
			$blog_id    = (int) ( $event['blog_id'] ?? 0 );
			$event_type = (string) ( $event['event_type'] ?? '' );
			$label      = $types[ $event_type ] ?? ucfirst( str_replace( '_', ' ', $event_type ) );
			$ts         = strtotime( (string) $event['timestamp'] );
			$time       = false !== $ts ? (string) wp_date( 'Y-m-d H:i:s', $ts ) : (string) $event['timestamp'];
			$email      = (string) ( $event['user_email'] ?? '' );
			$network    = null === $event['site_event_id'];

			echo '<tr>';
			echo '<td>' . esc_html( $time ) . '</td>';
			echo '<td data-blog-id="' . esc_attr( (string) $blog_id ) . '">' . esc_html( $sites[ $blog_id ] ?? (string) $blog_id );
			if ( $network ) {
				echo ' <span class="o4o-chip" data-testid="ops-activity-log-network-row">' . esc_html__( 'Network', '404ops-activity-log' ) . '</span>';
			}
			echo '</td>';
			echo '<td>' . esc_html( '' !== $email ? $email : 'Guest' ) . '</td>';
			echo '<td>' . esc_html( (string) ( $event['ip_address'] ?? 'N/A' ) ) . '</td>';
			echo '<td>' . wp_kses_post( SettingsPage::location_cell( $event ) ) . '</td>';
			echo '<td>' . wp_kses_post( SettingsPage::device_cell( $event ) ) . '</td>';
			echo '<td><strong>' . esc_html( $label ) . '</strong></td>';
			echo '<td>' . esc_html( (string) $event['summary'] ) . '</td>';
			echo '<td>' . wp_kses_post( SettingsPage::render_details( self::without_revision_link( $event, $network ) ) ) . '</td>';
			echo '</tr>';
		}

		echo '</tbody></table>';

		self::render_pager( $page, (int) ceil( $total / self::PER_PAGE ), $total, $base, $filters );
		echo '</div>';
	}

	/**
	 * A copied post row's revision link points into ITS site, and
	 * render_details() builds it against the site the screen runs on; on
	 * the network screen the object id is dropped so no link is built to the
	 * wrong site's revision.
	 *
	 * @param array<string, mixed> $event   A network row.
	 * @param bool                 $network Whether it is a network row.
	 * @return array<string, mixed>
	 */
	private static function without_revision_link( array $event, bool $network ): array {
		if ( ! $network ) {
			$event['object_id'] = null;
		}

		return $event;
	}

	/**
	 * The filter form and the export link.
	 *
	 * @param array<string, mixed>  $filters filters()'s answer.
	 * @param array<string, string> $types   Event types.
	 */
	private static function render_filters( array $filters, array $types ): void {
		echo '<form method="get" action="' . esc_url( network_admin_url( 'admin.php' ) ) . '" class="o4o-form" style="margin: 20px 0;">';
		echo '<input type="hidden" name="page" value="' . esc_attr( self::MENU_SLUG ) . '">';

		echo '<div style="margin-bottom: 10px;">';
		echo '<label for="ops404-aln-search">' . esc_html__( 'Search', '404ops-activity-log' ) . '</label>';
		echo '<input type="search" name="log_search" id="ops404-aln-search" value="' . esc_attr( (string) ( $filters['search'] ?? '' ) ) . '" style="width: 100%; padding: 8px;">';
		echo '</div>';

		echo '<div style="display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 10px; margin-bottom: 15px;">';

		// Site: a list up to SITES_LISTED sites, a site-id field beyond.
		$blog_id = $filters['blog_id'];
		$sites   = get_sites(
			array(
				'number'     => self::SITES_LISTED + 1,
				'network_id' => get_current_network_id(),
				'orderby'    => 'id',
			)
		);
		echo '<div>';
		echo '<label for="ops404-aln-site">' . esc_html__( 'Site', '404ops-activity-log' ) . '</label>';
		if ( count( $sites ) > self::SITES_LISTED ) {
			echo '<input type="number" min="0" name="site" id="ops404-aln-site" value="' . esc_attr( null === $blog_id ? '' : (string) $blog_id ) . '" placeholder="' . esc_attr__( 'Site ID', '404ops-activity-log' ) . '" style="width: 100%; padding: 8px;">';
		} else {
			echo '<select name="site" id="ops404-aln-site" style="width: 100%; padding: 8px;">';
			echo '<option value="">' . esc_html__( 'All Sites', '404ops-activity-log' ) . '</option>';
			echo '<option value="0"' . selected( 0, $blog_id, false ) . '>' . esc_html__( 'Network (no site)', '404ops-activity-log' ) . '</option>';
			foreach ( $sites as $site ) {
				echo '<option value="' . esc_attr( (string) $site->blog_id ) . '"' . selected( (int) $site->blog_id, $blog_id, false ) . '>' . esc_html( NetworkEvents::site_label( $site ) ) . '</option>';
			}
			echo '</select>';
		}
		echo '</div>';

		// User: network users, by login.
		echo '<div>';
		echo '<label for="ops404-aln-user">' . esc_html__( 'User', '404ops-activity-log' ) . '</label>';
		echo '<select name="user_id" id="ops404-aln-user" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Users', '404ops-activity-log' ) . '</option>';
		foreach ( get_users(
			array(
				'blog_id' => 0,
				'number'  => self::USERS_LISTED,
				'orderby' => 'login',
				'fields'  => array( 'ID', 'user_login' ),
			)
		) as $u ) {
			echo '<option value="' . esc_attr( (string) $u->ID ) . '"' . selected( (int) $u->ID, $filters['user_id'], false ) . '>' . esc_html( (string) $u->user_login ) . '</option>';
		}
		echo '</select></div>';

		echo '<div>';
		echo '<label for="ops404-aln-event-type">' . esc_html__( 'Event Type', '404ops-activity-log' ) . '</label>';
		echo '<select name="event_type" id="ops404-aln-event-type" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Events', '404ops-activity-log' ) . '</option>';
		foreach ( $types as $key => $label ) {
			echo '<option value="' . esc_attr( $key ) . '"' . selected( $key, $filters['event_type'], false ) . '>' . esc_html( $label ) . '</option>';
		}
		echo '</select></div>';

		echo '<div>';
		echo '<label for="ops404-aln-country">' . esc_html__( 'Country', '404ops-activity-log' ) . '</label>';
		echo '<select name="country" id="ops404-aln-country" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Countries', '404ops-activity-log' ) . '</option>';
		foreach ( NetworkLog::countries() as $code ) {
			echo '<option value="' . esc_attr( $code ) . '"' . selected( $code, $filters['country'], false ) . '>' . esc_html( $code ) . '</option>';
		}
		echo '</select></div>';

		echo '<div>';
		echo '<label for="ops404-aln-device">' . esc_html__( 'Device', '404ops-activity-log' ) . '</label>';
		echo '<select name="device" id="ops404-aln-device" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Devices', '404ops-activity-log' ) . '</option>';
		foreach ( SettingsPage::device_class_labels() as $class => $label ) {
			echo '<option value="' . esc_attr( $class ) . '"' . selected( $class, $filters['device_class'], false ) . '>' . esc_html( $label ) . '</option>';
		}
		echo '</select></div>';

		echo '<div>';
		echo '<label for="ops404-aln-date-from">' . esc_html__( 'Date From', '404ops-activity-log' ) . '</label>';
		echo '<input type="date" name="date_from" id="ops404-aln-date-from" value="' . esc_attr( (string) ( $filters['date_from'] ?? '' ) ) . '" style="width: 100%; padding: 8px;">';
		echo '</div>';

		echo '<div>';
		echo '<label for="ops404-aln-date-to">' . esc_html__( 'Date To', '404ops-activity-log' ) . '</label>';
		echo '<input type="date" name="date_to" id="ops404-aln-date-to" value="' . esc_attr( (string) ( $filters['date_to'] ?? '' ) ) . '" style="width: 100%; padding: 8px;">';
		echo '</div>';

		echo '</div>';

		submit_button( __( 'Filter', '404ops-activity-log' ), 'primary', 'ops_activity_log_filter', false );

		$export = wp_nonce_url(
			add_query_arg(
				array_merge( self::query_args( $filters ), array( 'ops_activity_log_network_export' => '1' ) ),
				network_admin_url( 'admin.php?page=' . self::MENU_SLUG )
			),
			self::EXPORT_NONCE
		);
		echo ' <a href="' . esc_url( $export ) . '" class="button button-secondary" data-testid="ops-activity-log-network-export">' . esc_html__( 'Export CSV', '404ops-activity-log' ) . '</a>';

		echo '</form>';
	}

	/**
	 * Previous / next and where you are: a network log's page count has no
	 * useful upper bound, so the pager never lists every page.
	 *
	 * @param int                  $page    Current page.
	 * @param int                  $pages   Page count.
	 * @param int                  $total   Row count.
	 * @param string               $base    Screen URL.
	 * @param array<string, mixed> $filters Filters.
	 */
	private static function render_pager( int $page, int $pages, int $total, string $base, array $filters ): void {
		echo '<div style="margin-top: 20px;" data-testid="ops-activity-log-network-pager">';
		/* translators: 1: page number, 2: page count, 3: event count. */
		echo '<span>' . esc_html( sprintf( __( 'Page %1$d of %2$d (%3$d events)', '404ops-activity-log' ), $page, max( 1, $pages ), $total ) ) . '</span> ';

		$args = self::query_args( $filters );
		if ( $page > 1 ) {
			echo '<a class="button" href="' . esc_url( add_query_arg( array_merge( $args, array( 'paged' => $page - 1 ) ), $base ) ) . '">' . esc_html__( 'Previous', '404ops-activity-log' ) . '</a> ';
		}
		if ( $page < $pages ) {
			echo '<a class="button" href="' . esc_url( add_query_arg( array_merge( $args, array( 'paged' => $page + 1 ) ), $base ) ) . '">' . esc_html__( 'Next', '404ops-activity-log' ) . '</a>';
		}
		echo '</div>';
	}
}