<?php
/**
 * The Log integrity tab's actions, and the daily verification.
 *
 * @package ActivityLog404
 */

namespace ActivityLog404\Chain;

use ActivityLog404\Database;
use ActivityLog404\EventLogger;

defined( 'ABSPATH' ) || exit;

/**
 * Two operations, each a POST to admin-post.php checked in the estate's
 * usual order: the operation is known, the nonce (bound to the operation),
 * then the capability. The decision is perform(), which returns a result
 * code and never exits (OPERATIONS.md: an admin-post handler ending in
 * `exit` kills PHPUnit); handle() only redirects.
 *
 *  - `verify` starts a run if there is none and works on it for STEP_SECONDS;
 *    pressed again it continues, and the cron event carries it on between
 *    presses.
 *  - `restart` begins a new chain. It is the way out when the signing key
 *    changed (salts rotated), and a deliberate act: it needs `confirm`, it is
 *    the one operation here that makes the log's earlier rows unverifiable,
 *    and it writes `chain_restarted`, with the verdict it replaced, into the
 *    new chain so that clearing an alarm is itself on the record.
 *
 * `manage_options`, per site: each site of a network has its own table, its
 * own chain and its own administrators.
 */
final class ChainActions {

	public const ACTION     = 'ops404_al_chain';
	public const CRON_HOOK  = 'ops404_al_chain_cron';
	public const RESULT_ARG = 'ops404_al_chain_result';

	public const OP_VERIFY  = 'verify';
	public const OP_RESTART = 'restart';

	/** Seconds of verification per browser request. */
	public const STEP_SECONDS = 8.0;

	/** Seconds of verification per cron event. */
	public const CRON_SECONDS = 20.0;

	/** Result codes; ChainTab maps each to its notice. */
	public const RESULTS = array(
		'verify_done',
		'verify_running',
		'restarted',
		'confirm_needed',
		'bad_request',
		'bad_nonce',
		'forbidden',
	);

	public static function register(): void {
		add_action( 'admin_post_' . self::ACTION, array( __CLASS__, 'handle' ) );
		add_action( self::CRON_HOOK, array( __CLASS__, 'cron' ) );
	}

	/** The capability every action and the tab require. */
	public static function capability(): string {
		return 'manage_options';
	}

	/**
	 * The nonce action for one operation.
	 *
	 * @param string $op Operation.
	 */
	public static function nonce_action( string $op ): string {
		return self::ACTION . '|' . $op;
	}

	/** admin-post handler: decide, then redirect back to the tab. */
	public static function handle(): void {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- perform() verifies the nonce first thing.
		$result = self::perform( wp_unslash( $_POST ) );

		wp_safe_redirect(
			add_query_arg(
				array(
					'page'           => '404ops-activity-log',
					'tab'            => 'chain',
					self::RESULT_ARG => $result,
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/**
	 * Carry out one posted operation.
	 *
	 * @param array<string, mixed> $request The posted fields, unslashed.
	 * @return string A RESULTS code.
	 */
	public static function perform( array $request ): string {
		$op    = isset( $request['op'] ) && is_string( $request['op'] ) ? sanitize_key( $request['op'] ) : '';
		$nonce = isset( $request['_wpnonce'] ) && is_string( $request['_wpnonce'] ) ? sanitize_text_field( $request['_wpnonce'] ) : '';

		if ( ! in_array( $op, array( self::OP_VERIFY, self::OP_RESTART ), true ) ) {
			return 'bad_request';
		}
		if ( false === wp_verify_nonce( $nonce, self::nonce_action( $op ) ) ) {
			return 'bad_nonce';
		}
		if ( ! current_user_can( self::capability() ) ) {
			return 'forbidden';
		}

		if ( self::OP_VERIFY === $op ) {
			if ( self::advance( self::STEP_SECONDS ) ) {
				self::schedule();
				return 'verify_running';
			}

			return 'verify_done';
		}

		if ( empty( $request['confirm'] ) ) {
			return 'confirm_needed';
		}

		self::restart();
		return 'restarted';
	}

	/**
	 * Work on the verification for a while; true while it is still running.
	 *
	 * @param float $seconds Budget.
	 */
	public static function advance( float $seconds ): bool {
		return Verifier::DONE !== Verifier::run( $seconds )['status'];
	}

	/**
	 * Begin a new chain: everything logged so far becomes "before the
	 * chain", the head and ledger are cleared, and the restart is the first
	 * thing the new chain records.
	 */
	public static function restart(): void {
		global $wpdb;

		$key   = Key::get();
		$table = Database::get_table_name();
		$last  = Verifier::last();

		// phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- the plugin's own table; $table is prefix-composed.
		$floor = (int) $wpdb->get_var( "SELECT MAX(id) FROM $table" );
		// phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching

		$head = Ledger::head( $key );

		Ledger::write_cuts( $key, $floor, array() );
		delete_option( Ledger::HEAD_OPTION );
		delete_option( Verifier::STATE_OPTION );
		wp_clear_scheduled_hook( self::CRON_HOOK );

		EventLogger::log(
			Verifier::EVENT_RESTART,
			'Log chain restarted',
			'chain',
			null,
			array(
				'previous_verdict' => isset( $last['verdict'] ) ? (string) $last['verdict'] : 'never_verified',
				'previous_head_id' => $head['id'],
				'floor'            => $floor,
			)
		);
	}

	/**
	 * The daily cron's part: run a verification's first slice, or the next
	 * one if a run is already under way (a continuation event lost to a
	 * site without WP-Cron must not strand it).
	 */
	public static function daily(): void {
		self::cron();
	}

	/** WP-Cron continuation: run for a while, and come back while there is more. */
	public static function cron(): void {
		if ( self::advance( self::CRON_SECONDS ) ) {
			self::schedule();
		}
	}

	private static function schedule(): void {
		if ( ! wp_next_scheduled( self::CRON_HOOK ) ) {
			wp_schedule_single_event( time() + 30, self::CRON_HOOK );
		}
	}

	/** Remove everything this feature stored. Uninstall only. */
	public static function uninstall(): void {
		Ledger::uninstall();
		delete_option( Verifier::STATE_OPTION );
		delete_option( Verifier::LAST_OPTION );
	}
}