<?php
/**
 * @package ActivityLog404
 */

namespace ActivityLog404\Admin;

use ActivityLog404\ActivityLog;
use ActivityLog404\AiSummary;
use ActivityLog404\Alerts;
use ActivityLog404\Context\LoginSignal;
use ActivityLog404\Context\UserAgent;
use ActivityLog404\EventLogger;
use ActivityLog404\Exclusions;
use ActivityLog404\Export\CsvExport;
use Ops404\ActivityLog\Vendor\Ops404\Ui\Menu;
use Ops404\ActivityLog\Vendor\Ops404\Ui\Render;
use Ops404\ActivityLog\Vendor\Ops404\Ui\Ui;

defined( 'ABSPATH' ) || exit;

/**
 * Registers the plugin's admin settings page.
 */
final class SettingsPage {

	/** Page slug under the shared 404ops parent. Unchanged by the move. */
	private const MENU_SLUG = '404ops-activity-log';

	/**
	 * The capability this screen needs, given to BOTH `add_submenu_page()` and
	 * `Menu::register_plugin()` so the landing page lists a row exactly when
	 * the user can open it.
	 */
	private const CAPABILITY = 'manage_options';

	/**
	 * Entries a details toggle's nested list shows before summarising the
	 * rest, and how many levels deep it follows nested arrays before doing
	 * the same. Keeps an oversized or deeply-nested details blob (in
	 * principle unbounded -- nothing in this schema caps it) from rendering
	 * an unbounded page.
	 */
	private const DETAILS_MAX_ENTRIES = 50;
	private const DETAILS_MAX_DEPTH   = 3;

	/**
	 * Hook registration.
	 */
	public function register(): void {
		// The shared parent must be claimed BEFORE `admin_menu` fires, never
		// from inside an `admin_menu` callback. Menu::parent() registers its
		// own `admin_menu` listener, and a listener added at priority 10
		// while priority 10 is already being iterated is not re-entered --
		// the parent silently never registers, this page becomes an orphan
		// submenu reachable only by URL, and the landing page 403s. It looks
		// exactly like a permissions bug and is not one.
		Menu::parent( '404ops-activity-log' );
		Menu::register_plugin(
			'404ops-activity-log',
			// Callables: this runs at bootstrap, before `init`, and a `__()`
			// evaluated here loads the text domain too early (the WordPress
			// 6.7+ "translation loading was triggered too early" notice).
			// The kit resolves them only when the landing page renders.
			static fn(): string => __( 'Activity Log', '404ops-activity-log' ),
			self::MENU_SLUG,
			static fn(): string => __( 'Audit trail of logins, content, plugin, user and settings events, with retention and CSV export.', '404ops-activity-log' ),
			'dashicons-clock',
			self::CAPABILITY
		);

		add_action( 'admin_menu', array( $this, 'add_menu' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'assets' ) );
		add_action( 'admin_init', array( $this, 'handle_export' ) );
		add_action( 'admin_init', array( $this, 'save_settings' ) );
		add_action( 'admin_notices', array( $this, 'ai_migration_notice' ) );

		// Location and device (#7): its own form on the Settings tab, and
		// its two log columns in Screen Options, where each viewer can hide
		// them. Core's own column toggles (common.js, the hidden-columns
		// AJAX action, per-user meta) do the rest.
		ContextSettings::register();
		add_filter( 'manage_' . self::hook_suffix() . '_columns', array( __CLASS__, 'hideable_columns' ) );
	}

	/**
	 * The log columns Screen Options lists, so they can be hidden.
	 *
	 * @param mixed $columns What earlier listeners returned.
	 * @return array<string, string>
	 */
	public static function hideable_columns( $columns ): array {
		return array_merge(
			is_array( $columns ) ? $columns : array(),
			array(
				'location' => __( 'Location', '404ops-activity-log' ),
				'device'   => __( 'Device', '404ops-activity-log' ),
			)
		);
	}

	/**
	 * The log columns the current viewer has hidden in Screen Options.
	 *
	 * @return array<int, string>
	 */
	private static function hidden_columns(): array {
		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;

		return $screen ? array_map( 'strval', get_hidden_columns( $screen ) ) : array();
	}

	/**
	 * Enqueue the 404ops UI kit on our screen only.
	 *
	 * Bound to `admin_enqueue_scripts` unconditionally, so this method runs
	 * on EVERY wp-admin request -- the Dashboard, the post list, Settings,
	 * screens belonging to other people's plugins, so a fatal here is a white
	 * screen across the whole of wp-admin, raised by a plugin the admin may
	 * not even be looking at.
	 */
	public function assets( string $hook ): void {
		if ( self::hook_suffix() === $hook ) {
			Ui::enqueue();
			ImportTab::enqueue();
		}
	}

	/**
	 * This screen's `admin_enqueue_scripts` hook suffix, as `Menu::hook()`
	 * derives it: `404ops_page_404ops-activity-log`.
	 *
	 * Derived, never hardcoded: this page is a submenu of the shared parent, so
	 * the old 'toplevel_page_*' suffix stopped matching and the kit's
	 * stylesheet would silently stop loading on this screen. The integration
	 * suite pins the kit's answer against core's own
	 * `get_plugin_page_hookname()`.
	 *
	 * The call is unguarded: this plugin bundles its own namespace-prefixed copy
	 * of the kit (vendor-prefixed/, ui-kit 0.6.0), so the class is always there.
	 * Nothing probes for it, and nothing falls back to another copy's.
	 */
	private static function hook_suffix(): string {
		return Menu::hook( self::MENU_SLUG );
	}

	/**
	 * Add this plugin's page under the shared 404ops parent menu.
	 */
	public function add_menu(): void {
		add_submenu_page(
			Menu::parent( '404ops-activity-log' ),
			__( 'Activity Log', '404ops-activity-log' ),
			// The label drops the "404ops" prefix now it is nested -- the
			// parent already says it.
			__( 'Activity Log', '404ops-activity-log' ),
			self::CAPABILITY,
			self::MENU_SLUG,
			array( $this, 'render' )
		);
	}

	/**
	 * Handle CSV export. Free tier — CsvExport::download() does its own
	 * capability check; the nonce check below happens first so an
	 * unauthenticated/forged request never reaches it.
	 */
	public function handle_export(): void {
		// phpcs:disable WordPress.Security.NonceVerification.Missing
		if ( ! isset( $_GET['ops_activity_log_export'] ) || ! current_user_can( 'manage_options' ) ) {
			return;
		}

		// Verify nonce.
		if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'ops_activity_log_export' ) ) {
			wp_die( 'Security check failed.' );
		}

		CsvExport::download( self::export_filters( $_GET ) );
		// phpcs:enable
	}

	/**
	 * The export's filters, read from its request: the same ones the log
	 * tab shows, carried on its Export CSV link.
	 *
	 * @param array<string, mixed> $request Request parameters ($_GET).
	 * @return array<string, int|string>
	 */
	public static function export_filters( array $request ): array {
		$args = array();

		if ( ! empty( $request['user_id'] ) ) {
			$args['user_id'] = (int) $request['user_id'];
		}

		foreach ( array(
			'event_type' => 'event_type',
			'date_from'  => 'date_from',
			'date_to'    => 'date_to',
			'log_search' => 'search',
			'country'    => 'country',
			'device'     => 'device_class',
		) as $param => $filter ) {
			if ( ! empty( $request[ $param ] ) && is_string( $request[ $param ] ) ) {
				$args[ $filter ] = sanitize_text_field( wp_unslash( $request[ $param ] ) );
			}
		}

		return $args;
	}

	/**
	 * Save settings.
	 */
	public function save_settings(): void {
		// phpcs:disable WordPress.Security.NonceVerification.Missing
		if ( ! isset( $_POST['ops_activity_log_save_settings'] ) || ! current_user_can( 'manage_options' ) ) {
			return;
		}

		// Verify nonce.
		if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'ops_activity_log_settings' ) ) {
			wp_die( 'Security check failed.' );
		}

		$retention = isset( $_POST['ops_activity_log_retention_days'] ) ? sanitize_text_field( wp_unslash( $_POST['ops_activity_log_retention_days'] ) ) : null;
		if ( ActivityLog::has_valid_retention_days( $retention ) ) {
			update_option( 'ops_activity_log_retention_days', (int) $retention );
		}
		update_option( 'ops_activity_log_retention_unlimited', isset( $_POST['ops_activity_log_retention_unlimited'] ) );

		// Unchecked checkboxes are absent from $_POST entirely -- presence
		// (regardless of value) means "checked".
		update_option( EventLogger::OPTION_STORE_FULL_IPS, isset( $_POST['ops_activity_log_store_full_ips'] ) );

		// The high-risk email alerts decided for #3: off unless opted in.
		update_option( Alerts::OPTION_ENABLED, isset( $_POST['ops_activity_log_alerts_enabled'] ) );
		if ( isset( $_POST['ops_activity_log_ai_settings_present'] ) ) {
			update_option( AiSummary::OPTION_AI_ENABLED, isset( $_POST['ops_activity_log_ai_enabled'] ) ? '1' : '0' );
		}

		// Only one of the offered sources is ever stored, never a header name
		// a forged request supplies.
		$ip_source = isset( $_POST['ops_activity_log_ip_source'] ) ? sanitize_text_field( wp_unslash( $_POST['ops_activity_log_ip_source'] ) ) : '';
		if ( isset( EventLogger::IP_SOURCES[ $ip_source ] ) ) {
			update_option( EventLogger::OPTION_IP_SOURCE, $ip_source );
		}

		// The exclusion lists post together behind a marker, so a form
		// without them leaves them alone. Unticked roles are absent from
		// $_POST, so absence with the marker means none.
		if ( isset( $_POST['ops_activity_log_exclusions'] ) ) {
			$roles = isset( $_POST['ops_activity_log_excluded_roles'] ) ? array_map( 'sanitize_key', (array) wp_unslash( $_POST['ops_activity_log_excluded_roles'] ) ) : array();
			update_option( Exclusions::OPTION_ROLES, Exclusions::sanitize_roles( $roles ) );

			$typed = isset( $_POST['ops_activity_log_excluded_users'] ) ? sanitize_textarea_field( wp_unslash( $_POST['ops_activity_log_excluded_users'] ) ) : '';
			update_option( Exclusions::OPTION_USERS, Exclusions::ids_from_logins( $typed ) );
		}

		// phpcs:enable
	}

	/** Explain the provider migration to sites that used the previous connection. */
	public function ai_migration_notice(): void {
		if ( ! current_user_can( 'manage_options' ) || ! AiSummary::needs_migration_notice() ) {
			return;
		}
		$url = add_query_arg(
			array(
				'page' => '404ops-activity-log',
				'tab'  => 'settings',
			),
			admin_url( 'admin.php' )
		);
		echo '<div class="notice notice-warning"><p>' . esc_html__( 'Activity Log now uses WordPress AI providers. Its AI summaries are paused until you configure a provider and enable AI again. Save Activity Log settings to acknowledge this change.', '404ops-activity-log' ) . ' <a href="' . esc_url( $url ) . '">' . esc_html__( 'Open Activity Log settings', '404ops-activity-log' ) . '</a></p></div>';
	}

	/**
	 * Render the page.
	 */
	public function render(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}

		// phpcs:disable WordPress.Security.NonceVerification.Recommended
		$tab = isset( $_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'log';

		$tabs = self::tabs();
		if ( ! isset( $tabs[ $tab ] ) ) {
			$tab = 'log';
		}

		echo '<div class="wrap o4o-wrap">';
		Render::header( __( 'Activity Log', '404ops-activity-log' ), __( 'Monitor site security and changes', '404ops-activity-log' ) );

		// Render tabs.
		echo '<nav class="o4o-tabs">';
		foreach ( $tabs as $slug => $label ) {
			echo '<a href="' . esc_attr( add_query_arg( array( 'tab' => $slug ), admin_url( 'admin.php?page=' . self::MENU_SLUG ) ) ) . '" class="o4o-tab' . ( $slug === $tab ? ' active' : '' ) . '">' . esc_html( $label ) . '</a>';
		}
		echo '</nav>';

		if ( 'settings' === $tab ) {
			$this->render_settings_tab();
		} elseif ( 'log' === $tab ) {
			$this->render_log_tab();
		} elseif ( 'sessions' === $tab ) {
			SessionsTab::render();
		} elseif ( 'import' === $tab ) {
			ImportTab::render();
		} elseif ( 'integrity' === $tab ) {
			IntegrityTab::render();
		} elseif ( 'chain' === $tab ) {
			ChainTab::render();
		} else {
			/**
			 * Render the body of a tab added through
			 * `ops404_activity_log_settings_tabs`. The matching half of that
			 * filter: free never names the class that owns the tab, and a
			 * slug free does not know about lands here rather than silently
			 * falling back to the log.
			 *
			 * @param string $tab The tab slug being rendered.
			 */
			do_action( 'ops404_activity_log_render_settings_tab', $tab );
		}

		echo '</div>';
	}

	/**
	 * This screen's tabs, `slug => label`, in display order.
	 *
	 * Public so the Pro add-on's own tab can look up what already exists
	 * before appending, and so a test can read the same list the nav renders.
	 *
	 * @return array<string, string>
	 */
	public static function tabs(): array {
		$tabs = array(
			'log'      => __( 'Activity Log', '404ops-activity-log' ),
			'settings' => __( 'Settings', '404ops-activity-log' ),
			'sessions' => __( 'Sessions', '404ops-activity-log' ),
			'import'   => __( 'Import', '404ops-activity-log' ),
		);

		// File integrity monitoring lives on a single site or a network's
		// main site only: the files are the network's.
		if ( \ActivityLog404\Integrity\IntegrityActions::available() ) {
			$tabs['integrity'] = __( 'Integrity', '404ops-activity-log' );
		}

		// Each site has its own log and so its own chain.
		$tabs['chain'] = __( 'Log integrity', '404ops-activity-log' );

		// 'sessions' (#6), 'import' (#21), 'integrity' and 'chain' are free: see
		// AGENTS.md's product invariants.
		//
		// Lets the Pro add-on inject its own tabs (Forwarding, Retention,
		// Licence) without free code ever naming a Pro class; `render()`
		// above carries the matching render-dispatch seam. Free itself adds
		// nothing through this filter. Shape is `[ slug => label ]`,
		// appended after free's own tabs.
		//
		// No `@param` doc tag on the call (PHPStan reads a doc-comment
		// immediately before an apply_filters() as the hook's signature and,
		// with `array<string,string>` declared, would narrow $filtered to
		// match -- making the is_array() guard below provably dead from its
		// perspective, though a real third-party listener can return
		// anything at runtime, which is what the guard defends against).
		$filtered = apply_filters( 'ops404_activity_log_settings_tabs', $tabs );

		return is_array( $filtered ) ? $filtered : $tabs;
	}

	/**
	 * The screen's filters as URL query arguments, without the empty ones.
	 *
	 * @param array<string, mixed> $filters Filters from render_log_tab().
	 * @return array<string, string>
	 */
	private static function filter_query_args( array $filters ): array {
		$names = array(
			'user_id'    => 'user_id',
			'event_type' => 'event_type',
			'date_from'  => 'date_from',
			'date_to'    => 'date_to',
			'search'     => 'log_search',
			'country'    => 'country',
			'device'     => 'device',
		);

		$args = array();
		foreach ( $names as $filter => $name ) {
			if ( isset( $filters[ $filter ] ) && '' !== (string) $filters[ $filter ] ) {
				$args[ $name ] = (string) $filters[ $filter ];
			}
		}

		return $args;
	}

	/**
	 * The screen's query filters without the empty ones, as the
	 * `ops404_activity_log_after_log_filters` seam hands them over.
	 *
	 * @param array<string, mixed> $query_filters The query's filters, keyed by EventQuery names.
	 * @return array<string, int|string>
	 */
	public static function current_filters( array $query_filters ): array {
		$current = array();
		foreach ( $query_filters as $key => $value ) {
			if ( null === $value || '' === $value || 0 === $value || ! is_scalar( $value ) ) {
				continue;
			}
			$current[ (string) $key ] = is_int( $value ) ? $value : (string) $value;
		}

		return $current;
	}

	/**
	 * Render the activity log tab.
	 */
	private function render_log_tab(): void {
		// phpcs:disable WordPress.Security.NonceVerification.Recommended
		$page       = isset( $_GET['paged'] ) ? (int) $_GET['paged'] : 1;
		$user_id    = isset( $_GET['user_id'] ) ? (int) $_GET['user_id'] : null;
		$event_type = isset( $_GET['event_type'] ) ? sanitize_text_field( wp_unslash( $_GET['event_type'] ) ) : null;
		$date_from  = isset( $_GET['date_from'] ) ? sanitize_text_field( wp_unslash( $_GET['date_from'] ) ) : null;
		$date_to    = isset( $_GET['date_to'] ) ? sanitize_text_field( wp_unslash( $_GET['date_to'] ) ) : null;
		$search     = isset( $_GET['log_search'] ) ? sanitize_text_field( wp_unslash( $_GET['log_search'] ) ) : null;
		$country    = isset( $_GET['country'] ) ? strtoupper( sanitize_key( wp_unslash( $_GET['country'] ) ) ) : null;
		$device     = isset( $_GET['device'] ) ? sanitize_key( wp_unslash( $_GET['device'] ) ) : null;
		// phpcs:enable

		// ActivityLog validates both again; these keep an invalid value out
		// of the links this screen builds.
		$country = null !== $country && 1 === preg_match( '/^[A-Z]{2}$/', $country ) ? $country : null;
		$device  = null !== $device && in_array( $device, UserAgent::CLASSES, true ) ? $device : null;

		// The screen's filters, used for the page, the count, pagination
		// links and the export link alike.
		$filters = array(
			'user_id'    => $user_id,
			'event_type' => $event_type,
			'date_from'  => $date_from,
			'date_to'    => $date_to,
			'search'     => $search,
			'country'    => $country,
			'device'     => $device,
		);

		$per_page = 25;
		// The screen names the device filter `device`; the query calls it
		// `device_class`, as the column is.
		$query_filters = array_merge( $filters, array( 'device_class' => $device ) );
		unset( $query_filters['device'] );

		$events = ActivityLog::get_events(
			array_merge(
				$query_filters,
				array(
					'per_page' => $per_page,
					'page'     => $page,
				)
			)
		);

		$total = ActivityLog::count_events( $query_filters );

		$event_types = ActivityLog::get_event_types();

		echo '<div style="margin: 20px 0;">';

		// Filter form.
		echo '<form method="get" action="" class="o4o-form">';
		echo '<input type="hidden" name="page" value="404ops-activity-log">';

		// Free-text search.
		echo '<div style="margin-bottom: 10px;">';
		echo '<label for="ops404-al-search">' . esc_html__( 'Search', '404ops-activity-log' ) . '</label>';
		echo '<input type="search" name="log_search" id="ops404-al-search" value="' . esc_attr( $search ?? '' ) . '" aria-describedby="ops404-al-search-help" style="width: 100%; padding: 8px;">';
		echo '<p id="ops404-al-search-help" class="description">' . esc_html__( 'Matches the summary, email address, IP address and event details.', '404ops-activity-log' ) . '</p>';
		echo '</div>';

		echo '<div style="display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 10px; margin-bottom: 15px;">';

		// User filter.
		echo '<div>';
		echo '<label for="ops404-al-user">' . esc_html__( 'User', '404ops-activity-log' ) . '</label>';
		echo '<select name="user_id" id="ops404-al-user" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Users', '404ops-activity-log' ) . '</option>';
		$users = get_users();
		foreach ( $users as $u ) {
			$selected = $user_id === $u->ID ? 'selected' : '';
			echo '<option value="' . esc_attr( (string) $u->ID ) . '" ' . esc_attr( $selected ) . '>' . esc_html( $u->user_login ) . '</option>';
		}
		echo '</select>';
		echo '</div>';

		// Event type filter.
		echo '<div>';
		echo '<label for="ops404-al-event-type">' . esc_html__( 'Event Type', '404ops-activity-log' ) . '</label>';
		echo '<select name="event_type" id="ops404-al-event-type" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Events', '404ops-activity-log' ) . '</option>';
		foreach ( $event_types as $key => $label ) {
			$selected = $event_type === $key ? 'selected' : '';
			echo '<option value="' . esc_attr( $key ) . '" ' . esc_attr( $selected ) . '>' . esc_html( $label ) . '</option>';
		}
		echo '</select>';
		echo '</div>';

		// Country filter (#7): the countries the log actually holds.
		echo '<div>';
		echo '<label for="ops404-al-country">' . esc_html__( 'Country', '404ops-activity-log' ) . '</label>';
		echo '<select name="country" id="ops404-al-country" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Countries', '404ops-activity-log' ) . '</option>';
		foreach ( ActivityLog::countries() as $code ) {
			echo '<option value="' . esc_attr( $code ) . '"' . selected( $country, $code, false ) . '>' . esc_html( $code ) . '</option>';
		}
		echo '</select>';
		echo '</div>';

		// Device class filter (#7).
		echo '<div>';
		echo '<label for="ops404-al-device">' . esc_html__( 'Device', '404ops-activity-log' ) . '</label>';
		echo '<select name="device" id="ops404-al-device" style="width: 100%; padding: 8px;">';
		echo '<option value="">' . esc_html__( 'All Devices', '404ops-activity-log' ) . '</option>';
		foreach ( self::device_class_labels() as $class => $label ) {
			echo '<option value="' . esc_attr( $class ) . '"' . selected( $device, $class, false ) . '>' . esc_html( $label ) . '</option>';
		}
		echo '</select>';
		echo '</div>';

		// Date from filter.
		echo '<div>';
		echo '<label for="ops404-al-date-from">' . esc_html__( 'Date From', '404ops-activity-log' ) . '</label>';
		echo '<input type="date" name="date_from" id="ops404-al-date-from" value="' . esc_attr( $date_from ?? '' ) . '" style="width: 100%; padding: 8px;">';
		echo '</div>';

		// Date to filter.
		echo '<div>';
		echo '<label for="ops404-al-date-to">' . esc_html__( 'Date To', '404ops-activity-log' ) . '</label>';
		echo '<input type="date" name="date_to" id="ops404-al-date-to" value="' . esc_attr( $date_to ?? '' ) . '" style="width: 100%; padding: 8px;">';
		echo '</div>';

		echo '</div>';

		submit_button( __( 'Filter', '404ops-activity-log' ), 'primary', 'ops_activity_log_filter', false );

		// Export CSV (free tier) with the same filters as this view. The link
		// used to carry none of them, so every export held the whole log.
		echo ' <a href="' . esc_attr( wp_nonce_url( add_query_arg( array_merge( self::filter_query_args( $filters ), array( 'ops_activity_log_export' => '1' ) ), admin_url( 'admin.php?page=404ops-activity-log' ) ), 'ops_activity_log_export' ) ) . '" class="button button-secondary">' . esc_html__( 'Export CSV', '404ops-activity-log' ) . '</a>';

		echo '</form>';
		echo '</div>';

		/**
		 * After the log tab's filter form, with the filters the screen is
		 * showing. The Pro add-on's saved views render here; free adds
		 * nothing. A public seam rather than the add-on reading `$_GET`
		 * itself: the filters arrive already validated by this screen (an
		 * invalid country or device class is dropped before the query, as
		 * it is from every link the screen builds), keyed by
		 * `Api\EventQuery`'s names, empty ones omitted.
		 *
		 * @param array<string, int|string> $current user_id, event_type, date_from, date_to, search, country, device_class.
		 */
		do_action( 'ops404_activity_log_after_log_filters', self::current_filters( $query_filters ) );

		// Events table. The two context columns carry core's column classes,
		// so Screen Options can hide them per viewer.
		$hidden        = self::hidden_columns();
		$hide_location = in_array( 'location', $hidden, true ) ? ' hidden' : '';
		$hide_device   = in_array( 'device', $hidden, true ) ? ' hidden' : '';
		if ( ! empty( $events ) ) {
			echo '<table class="wp-list-table widefat striped">';
			echo '<thead><tr>';
			echo '<th>' . esc_html__( 'Timestamp', '404ops-activity-log' ) . '</th>';
			echo '<th>' . esc_html__( 'User', '404ops-activity-log' ) . '</th>';
			echo '<th>' . esc_html__( 'IP Address', '404ops-activity-log' ) . '</th>';
			echo '<th scope="col" class="manage-column column-location' . esc_attr( $hide_location ) . '">' . esc_html__( 'Location', '404ops-activity-log' ) . '</th>';
			echo '<th scope="col" class="manage-column column-device' . esc_attr( $hide_device ) . '">' . esc_html__( 'Device', '404ops-activity-log' ) . '</th>';
			echo '<th>' . esc_html__( 'Event', '404ops-activity-log' ) . '</th>';
			echo '<th>' . esc_html__( 'Summary', '404ops-activity-log' ) . '</th>';
			echo '<th>' . esc_html__( 'Details', '404ops-activity-log' ) . '</th>';
			echo '</tr></thead>';
			echo '<tbody>';

			foreach ( $events as $event ) {
				$event_label = $event_types[ $event['event_type'] ] ?? ucfirst( str_replace( '_', ' ', (string) $event['event_type'] ) );
				$event_ts    = strtotime( (string) $event['timestamp'] );
				$event_time  = false !== $event_ts ? (string) wp_date( 'Y-m-d H:i:s', $event_ts ) : (string) $event['timestamp'];
				$user_email  = (string) ( $event['user_email'] ?? '' );
				echo '<tr>';
				echo '<td>' . esc_html( $event_time ) . '</td>';
				echo '<td>' . esc_html( '' !== $user_email ? $user_email : 'Guest' ) . '</td>';
				echo '<td>' . esc_html( $event['ip_address'] ?? 'N/A' ) . '</td>';
				echo '<td class="column-location' . esc_attr( $hide_location ) . '">' . wp_kses_post( self::location_cell( $event ) ) . '</td>';
				echo '<td class="column-device' . esc_attr( $hide_device ) . '">' . wp_kses_post( self::device_cell( $event ) ) . '</td>';
				echo '<td><strong>' . esc_html( $event_label ) . '</strong></td>';
				echo '<td>' . esc_html( $event['summary'] ) . '</td>';
				echo '<td>' . wp_kses_post( self::render_details( $event ) ) . '</td>';
				echo '</tr>';
			}

			echo '</tbody>';
			echo '</table>';

			// Pagination.
			$total_pages = (int) ceil( $total / $per_page );
			if ( $total_pages > 1 ) {
				echo '<div style="margin-top: 20px;">';
				$query_args = array_merge( array( 'page' => '404ops-activity-log' ), self::filter_query_args( $filters ) );
				for ( $i = 1; $i <= $total_pages; $i++ ) {
					$query_args['paged'] = $i;
					$link                = add_query_arg( $query_args, admin_url( 'admin.php' ) );
					$class               = $i === $page ? 'class="button button-primary"' : 'class="button"';
					echo '<a ' . wp_kses_data( $class ) . ' href="' . esc_attr( $link ) . '">' . esc_html( (string) $i ) . '</a> ';
				}
				echo '</div>';
			}
		} else {
			Render::empty_state( __( 'No events found', '404ops-activity-log' ), __( 'Activity will appear here as site changes occur.', '404ops-activity-log' ) );
		}
	}

	/**
	 * The device classes, labelled for people.
	 *
	 * @return array<string, string>
	 */
	public static function device_class_labels(): array {
		return array(
			'desktop' => __( 'Desktop', '404ops-activity-log' ),
			'mobile'  => __( 'Mobile', '404ops-activity-log' ),
			'tablet'  => __( 'Tablet', '404ops-activity-log' ),
			'bot'     => __( 'Bot', '404ops-activity-log' ),
		);
	}

	/**
	 * A row's location as text: "NZ, Auckland", "NZ", or ''.
	 *
	 * @param array<string, mixed> $event One ActivityLog::get_events() row.
	 */
	public static function location_text( array $event ): string {
		$country = isset( $event['country'] ) && is_string( $event['country'] ) ? $event['country'] : '';
		$city    = isset( $event['city'] ) && is_string( $event['city'] ) ? $event['city'] : '';

		return implode( ', ', array_filter( array( $country, $city ), static fn( string $part ): bool => '' !== $part ) );
	}

	/**
	 * A row's device as text: "Mobile · Safari 18 · iOS 18", or ''.
	 *
	 * @param array<string, mixed> $event One ActivityLog::get_events() row.
	 */
	public static function device_text( array $event ): string {
		$class = isset( $event['device_class'] ) && is_string( $event['device_class'] ) ? $event['device_class'] : '';
		if ( '' === $class ) {
			return '';
		}

		$labels = self::device_class_labels();
		$parts  = array( $labels[ $class ] ?? $class );
		foreach ( array( 'browser', 'os' ) as $key ) {
			if ( isset( $event[ $key ] ) && is_string( $event[ $key ] ) && '' !== $event[ $key ] ) {
				$parts[] = $event[ $key ];
			}
		}

		return implode( ' · ', $parts );
	}

	/**
	 * The login flags (#7, Context\LoginSignal) a row's details carry.
	 *
	 * @param array<string, mixed> $event One ActivityLog::get_events() row.
	 * @return array<string, bool>
	 */
	private static function login_flags( array $event ): array {
		$details = isset( $event['details'] ) && is_string( $event['details'] ) ? json_decode( $event['details'], true ) : null;
		if ( ! is_array( $details ) ) {
			return array();
		}

		return array(
			'new_country'       => true === ( $details['new_country'] ?? null ),
			'new_device'        => true === ( $details['new_device'] ?? null ),
			'impossible_travel' => true === ( $details['impossible_travel'] ?? null ),
		);
	}

	/**
	 * The Location cell, escaped: the location, "New country" when the
	 * login was the user's first from it, and "Impossible travel" when it
	 * could not have been reached from the user's previous location in time.
	 *
	 * @param array<string, mixed> $event One ActivityLog::get_events() row.
	 */
	public static function location_cell( array $event ): string {
		$text = self::location_text( $event );
		$html = '' !== $text ? esc_html( $text ) : '&mdash;';
		if ( self::login_flags( $event )['new_country'] ?? false ) {
			$html .= ' <span class="o4o-chip o4o-chip--amber" data-testid="ops-activity-log-new-country">' . esc_html__( 'New country', '404ops-activity-log' ) . '</span>';
		}
		if ( self::login_flags( $event )['impossible_travel'] ?? false ) {
			$html .= ' <span class="o4o-chip o4o-chip--red" data-testid="ops-activity-log-impossible-travel">' . esc_html__( 'Impossible travel', '404ops-activity-log' ) . '</span>';
		}

		return $html;
	}

	/**
	 * The Device cell, escaped, with "New device" on a login from a device
	 * the user had not used recently.
	 *
	 * @param array<string, mixed> $event One ActivityLog::get_events() row.
	 */
	public static function device_cell( array $event ): string {
		$text = self::device_text( $event );
		$html = '' !== $text ? esc_html( $text ) : '&mdash;';
		if ( self::login_flags( $event )['new_device'] ?? false ) {
			$html .= ' <span class="o4o-chip o4o-chip--amber" data-testid="ops-activity-log-new-device">' . esc_html__( 'New device', '404ops-activity-log' ) . '</span>';
		}

		return $html;
	}

	/**
	 * The "Details" toggle for one log row: a native `<details>` element
	 * (no inline script) expanding an escaped key/value view of the event's
	 * details JSON. Empty string when the row has no details.
	 *
	 * Public, and independent of this screen's own manage_options gate, so
	 * a test can drive the revision-link capability check in
	 * render_revision_id() below (`current_user_can( 'edit_post', ... )`,
	 * which answers differently for an editor and a subscriber) without
	 * needing to satisfy render()'s own capability check first.
	 *
	 * Every value this method or the private helpers below it output is
	 * escaped with esc_html() (keys, scalar values, and the "N more" /
	 * "N items" summary text) or esc_url()/esc_html() together (the
	 * revision link). Callers also filter the completed HTML at output.
	 *
	 * @param array<string, mixed> $event One ActivityLog::get_events() row.
	 */
	public static function render_details( array $event ): string {
		$details = isset( $event['details'] ) && is_string( $event['details'] ) && '' !== $event['details']
			? json_decode( $event['details'], true )
			: null;
		$details = is_array( $details ) ? $details : array();

		// The request context (#7) leads the toggle, so it is there even
		// with the Location and Device columns hidden.
		$context = array_filter(
			array(
				__( 'Location', '404ops-activity-log' ) => self::location_text( $event ),
				__( 'Device', '404ops-activity-log' )   => self::device_text( $event ),
			),
			static fn( string $text ): bool => '' !== $text
		);

		if ( array() === $details && array() === $context ) {
			return '';
		}

		$object_id = isset( $event['object_id'] ) && '' !== $event['object_id']
			? (int) $event['object_id']
			: null;

		$context_html = '';
		foreach ( $context as $label => $text ) {
			$context_html .= '<li>' . esc_html( (string) $label ) . ': ' . esc_html( $text ) . '</li>';
		}

		return '<details><summary>' . esc_html__( 'Details', '404ops-activity-log' ) . '</summary>'
			. ( '' !== $context_html ? '<ul class="ops-activity-log-context">' . $context_html . '</ul>' : '' )
			. ( array() !== $details ? self::render_details_list( $details, 1, $object_id ) : '' )
			. '</details>';
	}

	/**
	 * One level of a details value as an escaped `<ul>`: scalars as
	 * "key: value" list items, arrays recursed into a nested `<ul>` up to
	 * DETAILS_MAX_DEPTH levels, and only the first DETAILS_MAX_ENTRIES
	 * entries of any one level listed -- the rest summarised as "…and N
	 * more" rather than rendered, so neither an oversized nor a deeply
	 * nested details blob can grow this screen without bound.
	 *
	 * @param array<int|string, mixed> $value     The array to render at this level.
	 * @param int                      $depth     1-based nesting depth of $value itself.
	 * @param int|null                 $object_id The event's object_id, for the revision link.
	 */
	private static function render_details_list( array $value, int $depth, ?int $object_id ): string {
		$entries  = array_slice( $value, 0, self::DETAILS_MAX_ENTRIES, true );
		$overflow = count( $value ) - count( $entries );

		$html = '<ul>';
		foreach ( $entries as $key => $item ) {
			$html .= '<li>' . self::render_details_item( (string) $key, $item, $depth, $object_id ) . '</li>';
		}
		if ( $overflow > 0 ) {
			$html .= '<li>' . esc_html(
				sprintf(
					/* translators: %d: number of additional entries not shown. */
					_n( '…and %d more', '…and %d more', $overflow, '404ops-activity-log' ),
					$overflow
				)
			) . '</li>';
		}
		$html .= '</ul>';

		return $html;
	}

	/**
	 * One key => value entry: the revision-id special case (see
	 * render_revision_id()), a nested list, or an escaped scalar.
	 *
	 * @param mixed $item The value stored under $key.
	 */
	private static function render_details_item( string $key, $item, int $depth, ?int $object_id ): string {
		if ( 'revision_id' === $key && ( is_int( $item ) || ( is_string( $item ) && ctype_digit( $item ) ) ) ) {
			return esc_html( $key ) . ': ' . self::render_revision_id( (int) $item, $object_id );
		}

		if ( is_array( $item ) ) {
			if ( $depth >= self::DETAILS_MAX_DEPTH ) {
				return esc_html( $key ) . ': ' . esc_html(
					sprintf(
						/* translators: %d: number of nested entries not shown. */
						_n( '%d item', '%d items', count( $item ), '404ops-activity-log' ),
						count( $item )
					)
				);
			}

			return esc_html( $key ) . ': ' . self::render_details_list( $item, $depth + 1, $object_id );
		}

		return esc_html( $key ) . ': ' . esc_html( self::scalar_as_text( $item ) );
	}

	/**
	 * @param mixed $item A details leaf value.
	 */
	private static function scalar_as_text( $item ): string {
		if ( is_bool( $item ) ) {
			return $item ? 'true' : 'false';
		}

		return null === $item ? '' : (string) $item;
	}

	/**
	 * The revision id, linked to core's compare screen when the current
	 * user can edit the post it belongs to -- otherwise plain text, per
	 * issue #2 ("otherwise no link"). Independent of whatever capability
	 * gates this screen itself: an editor and a subscriber get different
	 * answers here even though today only an administrator ever reaches
	 * this through render()'s own manage_options check.
	 *
	 * @param int      $revision_id The revision's post id.
	 * @param int|null $object_id   The updated post's id.
	 */
	private static function render_revision_id( int $revision_id, ?int $object_id ): string {
		if ( null !== $object_id && current_user_can( 'edit_post', $object_id ) ) {
			return '<a href="' . esc_url( admin_url( 'revision.php?revision=' . $revision_id ) ) . '">' . esc_html( (string) $revision_id ) . '</a>';
		}

		return esc_html( (string) $revision_id );
	}

	/**
	 * Render the settings tab.
	 */
	private function render_settings_tab(): void {
		$retention           = (int) get_option( 'ops_activity_log_retention_days', 90 );
		$retention_unlimited = (bool) get_option( 'ops_activity_log_retention_unlimited', false );
		$store_full_ips      = (bool) get_option( EventLogger::OPTION_STORE_FULL_IPS, false );

		echo '<form method="post" action="" class="o4o-form" style="max-width: 400px;">';
		wp_nonce_field( 'ops_activity_log_settings' );
		echo '<div style="margin: 20px 0;">';
		echo '<input type="hidden" name="ops_activity_log_ai_settings_present" value="1">';
		echo '<label><input type="checkbox" name="ops_activity_log_ai_enabled" value="1"' . checked( (bool) get_option( AiSummary::OPTION_AI_ENABLED, false ), true, false ) . '> ' . esc_html__( 'Use AI to summarize activity', '404ops-activity-log' ) . '</label>';
		echo '<p class="description">' . esc_html__( 'Off by default. When enabled, WordPress chooses a compatible provider from those configured in Settings > Connectors; it may change as your providers change. Daily activity counts and anomaly descriptions are sent to that provider. If the Pro weekly AI summary is enabled, its redacted figures, flags and change summaries are also sent.', '404ops-activity-log' ) . '</p>';
		echo '<p><a href="' . esc_url( admin_url( 'options-connectors.php' ) ) . '">' . esc_html__( 'Open WordPress Connectors', '404ops-activity-log' ) . '</a></p>';
		echo '</div>';

		echo '<div style="margin: 20px 0;">';
		echo '<label for="ops_activity_log_retention_days">' . esc_html__( 'Retention Period (days)', '404ops-activity-log' ) . '</label>';
		// The ceiling is read, not hardcoded: save_settings() validates
		// against ActivityLog::max_retention_days(), so a hardcoded ceiling here
		// would leave the Pro add-on's raised ceiling accepted by the
		// validator and refused by the browser.
		echo '<input type="number" id="ops_activity_log_retention_days" name="ops_activity_log_retention_days" value="' . esc_attr( (string) $retention ) . '" min="' . esc_attr( (string) ActivityLog::MIN_RETENTION_DAYS ) . '" max="' . esc_attr( (string) ActivityLog::max_retention_days() ) . '" style="width: 100%; padding: 8px; margin-top: 5px;">';
		echo '<p style="margin-top: 5px; font-size: 12px; color: #666;">' . esc_html__( 'Events older than this many days will be automatically deleted.', '404ops-activity-log' ) . '</p>';
		echo '<p><label for="ops_activity_log_retention_unlimited"><input type="checkbox" id="ops_activity_log_retention_unlimited" name="ops_activity_log_retention_unlimited" value="1"' . checked( $retention_unlimited, true, false ) . '> ' . esc_html__( 'Keep events indefinitely', '404ops-activity-log' ) . '</label></p>';
		echo '<p style="margin-top: 5px; font-size: 12px; color: #666;">' . esc_html__( 'When enabled, automatic retention cleanup is paused and imported history is kept regardless of age.', '404ops-activity-log' ) . '</p>';
		echo '</div>';

		echo '<div style="margin: 20px 0;">';
		echo '<label for="ops_activity_log_store_full_ips"><input type="checkbox" id="ops_activity_log_store_full_ips" name="ops_activity_log_store_full_ips" value="1"' . checked( $store_full_ips, true, false ) . '> ' . esc_html__( 'Store full IP addresses', '404ops-activity-log' ) . '</label>';
		echo '<p style="margin-top: 5px; font-size: 12px; color: #666;">' . esc_html__( 'Off by default: IP addresses are stored truncated (IPv4 last octet, IPv6 last 80 bits removed). Enable to store full IP addresses instead.', '404ops-activity-log' ) . '</p>';
		echo '</div>';

		$alerts_enabled = Alerts::is_enabled();
		echo '<div style="margin: 20px 0;">';
		echo '<label for="ops_activity_log_alerts_enabled"><input type="checkbox" id="ops_activity_log_alerts_enabled" name="ops_activity_log_alerts_enabled" value="1"' . checked( $alerts_enabled, true, false ) . '> ' . esc_html__( 'Email me about high-risk events', '404ops-activity-log' ) . '</label>';
		echo '<p style="margin-top: 5px; font-size: 12px; color: #666;">' . esc_html__( 'Off by default. Sends an email the moment a new administrator is created, a role is raised to administrator, a plugin is activated, the theme is switched, or a burst of failed logins is recorded. At most one email of each kind every 15 minutes.', '404ops-activity-log' ) . '</p>';
		echo '</div>';

		$ip_source  = EventLogger::ip_source();
		$ip_sources = array(
			'remote_addr'      => __( 'Direct connection (REMOTE_ADDR)', '404ops-activity-log' ),
			'x_forwarded_for'  => __( 'X-Forwarded-For header (proxy or load balancer)', '404ops-activity-log' ),
			'x_real_ip'        => __( 'X-Real-IP header (nginx proxy)', '404ops-activity-log' ),
			'cf_connecting_ip' => __( 'CF-Connecting-IP header (Cloudflare)', '404ops-activity-log' ),
		);
		echo '<div style="margin: 20px 0;">';
		echo '<label for="ops_activity_log_ip_source">' . esc_html__( 'IP address source', '404ops-activity-log' ) . '</label>';
		echo '<select id="ops_activity_log_ip_source" name="ops_activity_log_ip_source" aria-describedby="ops_activity_log_ip_source_help" style="width: 100%; padding: 8px; margin-top: 5px;">';
		foreach ( $ip_sources as $value => $label ) {
			echo '<option value="' . esc_attr( $value ) . '"' . selected( $ip_source, $value, false ) . '>' . esc_html( $label ) . '</option>';
		}
		echo '</select>';
		echo '<p id="ops_activity_log_ip_source_help" style="margin-top: 5px; font-size: 12px; color: #666;">' . esc_html__( 'Visitors can send any of these headers themselves. Choose a header only if a proxy or CDN in front of this site sets it; otherwise the logged address can be forged. If the header is missing, the direct connection is used.', '404ops-activity-log' ) . '</p>';
		echo '</div>';

		$excluded_roles = Exclusions::roles();
		echo '<div style="margin: 20px 0;">';
		echo '<fieldset data-testid="ops-activity-log-excluded-roles">';
		echo '<legend style="font-weight: 600;">' . esc_html__( 'Roles never logged', '404ops-activity-log' ) . '</legend>';
		foreach ( wp_roles()->get_names() as $slug => $name ) {
			echo '<label style="display: block; margin: 4px 0;"><input type="checkbox" name="ops_activity_log_excluded_roles[]" value="' . esc_attr( (string) $slug ) . '"' . checked( in_array( (string) $slug, $excluded_roles, true ), true, false ) . '> ' . esc_html( translate_user_role( $name ) ) . '</label>';
		}
		echo '</fieldset>';
		echo '</div>';

		echo '<div style="margin: 20px 0;">';
		echo '<label for="ops_activity_log_excluded_users">' . esc_html__( 'Users never logged', '404ops-activity-log' ) . '</label>';
		echo '<textarea id="ops_activity_log_excluded_users" name="ops_activity_log_excluded_users" rows="3" aria-describedby="ops_activity_log_excluded_users_help" style="width: 100%; padding: 8px; margin-top: 5px;">' . esc_textarea( Exclusions::logins() ) . '</textarea>';
		echo '<p id="ops_activity_log_excluded_users_help" style="margin-top: 5px; font-size: 12px; color: #666;">' . esc_html__( 'One username per line. A name that matches no user is dropped when you save. Failed logins and events with no signed-in user (WP-CLI, cron) are always recorded, and any change to these two lists is always logged, whoever makes it.', '404ops-activity-log' ) . '</p>';
		echo '<input type="hidden" name="ops_activity_log_exclusions" value="1">';
		echo '</div>';

		submit_button( __( 'Save Settings', '404ops-activity-log' ), 'primary', 'ops_activity_log_save_settings', true );

		echo '</form>';

		// A second form, not more fields in this one: it posts a file, and
		// its own marker keeps it from being read as this form's save.
		ContextSettings::render();
	}
}