<?php
/**
 * @package ActivityLog404
 */

namespace ActivityLog404\Context;

use ActivityLog404\Context\Mmdb\Reader;

defined( 'ABSPATH' ) || exit;

/**
 * The site owner's own MaxMind-format geolocation database (#7): where it
 * is, whether it is one, and installing a new copy.
 *
 * Nothing here is a hosted service. The owner downloads GeoLite2 (free, with
 * their own MaxMind account) or buys GeoIP2, and either uploads the `.mmdb`
 * on the Settings tab, points at a copy already on the server, or turns on
 * the optional scheduled download (GeoUpdater) with their own licence key.
 * Any database in the MaxMind DB format whose type names a Country or City
 * database is accepted -- GeoLite2, GeoIP2, and DB-IP's lite files alike.
 *
 * An installed copy lives in `uploads/404ops-activity-log/geoip/`, next to
 * the Pro add-on's archives, behind the same `index.php` and deny-all
 * `.htaccess`. GeoLite2's licence forbids redistributing the file, so it
 * must not be downloadable from the site. `.htaccess` does nothing on nginx;
 * the Settings tab says so, and a path outside the web root is the answer
 * there.
 *
 * Install is all-or-nothing: the new file is validated with the real reader
 * BEFORE it replaces anything, and it replaces the old one with a rename, so
 * a failed upload or download leaves the working database exactly as it was.
 */
final class GeoDatabase {

	/** Option: absolute path of the database in use; '' for none. */
	public const OPTION_PATH = 'ops_activity_log_geo_db_path';

	/** Largest database accepted: GeoIP2 City is ~120 MB. */
	public const MAX_BYTES = 200 * 1024 * 1024;

	/** The installed copy's file name inside the managed directory. */
	private const FILE_NAME = 'geoip.mmdb';

	/**
	 * The database path in use, or '' when geolocation is off.
	 */
	public static function path(): string {
		$path = get_option( self::OPTION_PATH, '' );

		return is_string( $path ) ? $path : '';
	}

	/**
	 * The directory an uploaded or downloaded database is installed into.
	 */
	public static function managed_dir(): string {
		$uploads = wp_upload_dir( null, false );

		return trailingslashit( (string) $uploads['basedir'] ) . '404ops-activity-log/geoip';
	}

	/**
	 * Where an uploaded or downloaded database is installed.
	 */
	public static function managed_path(): string {
		return self::managed_dir() . '/' . self::FILE_NAME;
	}

	/**
	 * What a file is, as a geolocation database: its type and build date,
	 * or why it cannot be used. Reads only the file's metadata.
	 *
	 * @param string $path Absolute path.
	 * @return array{ok: bool, type: string, built: int, error: string}
	 */
	public static function inspect( string $path ): array {
		$result = array(
			'ok'    => false,
			'type'  => '',
			'built' => 0,
			'error' => '',
		);

		// A plain filesystem path only: no stream wrapper (phar://, a URL),
		// which is what "a file on this server" can never need.
		if ( '' === $path || str_contains( $path, '://' ) || ! path_is_absolute( $path ) ) {
			$result['error'] = __( 'Enter the full path of the database file on this server.', '404ops-activity-log' );
			return $result;
		}
		if ( ! is_file( $path ) || ! is_readable( $path ) ) {
			$result['error'] = __( 'No readable file at that path.', '404ops-activity-log' );
			return $result;
		}
		$size = filesize( $path );
		if ( false === $size || $size > self::MAX_BYTES ) {
			$result['error'] = __( 'That file is too large to be a geolocation database.', '404ops-activity-log' );
			return $result;
		}

		try {
			$reader   = new Reader( $path );
			$metadata = $reader->metadata();
			$reader->close();
		} catch ( \Throwable $e ) {
			$result['error'] = __( 'That file is not a MaxMind DB (.mmdb) database.', '404ops-activity-log' );
			return $result;
		}

		$type = $metadata->database_type;
		if ( 1 !== preg_match( '/country|city/i', $type ) ) {
			$result['error'] = sprintf(
				/* translators: %s: the database's own type name, e.g. GeoLite2-ASN. */
				__( 'That database (%s) has no country or city data. Use a Country or City database.', '404ops-activity-log' ),
				substr( $type, 0, 60 )
			);
			return $result;
		}

		$result['ok']    = true;
		$result['type']  = substr( $type, 0, 60 );
		$result['built'] = (int) $metadata->build_epoch;

		return $result;
	}

	/**
	 * Point geolocation at a database already on the server, leaving the
	 * file where it is. Refused (and nothing changed) unless it inspects
	 * clean.
	 *
	 * @param string $path Absolute path.
	 * @return array{ok: bool, type: string, built: int, error: string}
	 */
	public static function use_path( string $path ): array {
		$inspected = self::inspect( $path );
		if ( $inspected['ok'] ) {
			update_option( self::OPTION_PATH, $path, false );
			Geolocator::reset();
		}

		return $inspected;
	}

	/**
	 * Install a database file (an upload's temporary file, or a download's
	 * extracted one) as the managed copy, and use it.
	 *
	 * The file is inspected first; on any failure the managed copy and the
	 * option are exactly as they were.
	 *
	 * @param string $source Absolute path of the new database.
	 * @return array{ok: bool, type: string, built: int, error: string}
	 */
	public static function install( string $source ): array {
		$inspected = self::inspect( $source );
		if ( ! $inspected['ok'] ) {
			return $inspected;
		}

		if ( ! self::prepare_dir() ) {
			$inspected['ok']    = false;
			$inspected['error'] = __( 'Could not create the uploads folder for the database.', '404ops-activity-log' );
			return $inspected;
		}

		$target  = self::managed_path();
		$staging = $target . '.new';

		// Copy, then rename over: rename() within one directory is atomic,
		// so a lookup running meanwhile reads the old file or the new one,
		// never half of either.
		// phpcs:disable WordPress.WP.AlternativeFunctions -- one local file into a directory this plugin owns; WP_Filesystem may need FTP credentials a cron run cannot supply.
		if ( ! @copy( $source, $staging ) || ! @rename( $staging, $target ) ) { // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- the failure is reported below, not raised as a PHP warning.
			if ( file_exists( $staging ) ) {
				wp_delete_file( $staging );
			}
			$inspected['ok']    = false;
			$inspected['error'] = __( 'Could not write the database into the uploads folder.', '404ops-activity-log' );
			return $inspected;
		}
		// phpcs:enable

		update_option( self::OPTION_PATH, $target, false );
		Geolocator::reset();

		return $inspected;
	}

	/**
	 * Stop geolocating. The managed copy, if any, is deleted; a file the
	 * owner pointed at elsewhere is theirs and is left alone.
	 */
	public static function forget(): void {
		$managed = self::managed_path();
		if ( file_exists( $managed ) ) {
			wp_delete_file( $managed );
		}
		delete_option( self::OPTION_PATH );
		Geolocator::reset();
	}

	/**
	 * Remove the managed directory entirely (uninstall).
	 */
	public static function remove_managed_dir(): void {
		$dir = self::managed_dir();
		foreach ( array( self::FILE_NAME, self::FILE_NAME . '.new', 'index.php', '.htaccess' ) as $file ) {
			if ( file_exists( $dir . '/' . $file ) ) {
				wp_delete_file( $dir . '/' . $file );
			}
		}
		if ( is_dir( $dir ) ) {
			@rmdir( $dir ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged,WordPress.WP.AlternativeFunctions.file_system_operations_rmdir -- best effort; a directory someone else put files in is left.
		}
	}

	/**
	 * Create the managed directory with its web guards.
	 */
	private static function prepare_dir(): bool {
		$dir = self::managed_dir();
		if ( ! wp_mkdir_p( $dir ) ) {
			return false;
		}

		// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- two fixed guard files in a directory this plugin owns.
		if ( ! file_exists( $dir . '/index.php' ) ) {
			file_put_contents( $dir . '/index.php', "<?php\n// Silence is golden.\n" );
		}
		if ( ! file_exists( $dir . '/.htaccess' ) ) {
			// Both syntaxes, each behind its own module guard, as the Pro
			// add-on's archive directory does: a server that understands only
			// one treats the other's directive as an error unless wrapped.
			file_put_contents(
				$dir . '/.htaccess',
				"# Activity log geolocation database. Not for the web.\n"
				. "<IfModule mod_authz_core.c>\n\tRequire all denied\n</IfModule>\n"
				. "<IfModule !mod_authz_core.c>\n\tOrder allow,deny\n\tDeny from all\n</IfModule>\n"
			);
		}
		// phpcs:enable

		return is_dir( $dir ) && wp_is_writable( $dir );
	}
}