<?php
/**
 * File integrity monitoring: the Integrity tab's actions and the schedule.
 *
 * @package ActivityLog404
 */

namespace ActivityLog404\Integrity;

use ActivityLog404\EventLogger;

defined( 'ABSPATH' ) || exit;

/**
 * Starts, drives and stops scans, accepts findings, and saves the tab's one
 * setting.
 *
 * Every write is a POST to admin-post.php, checked in this order: the
 * operation is known, the nonce (bound to the operation AND its target, so a
 * nonce minted to accept one finding cannot accept another), then the
 * capability. The decision is perform(), which returns a result code and
 * never exits (OPERATIONS.md: an admin-post handler ending in exit kills
 * PHPUnit); handle() only redirects.
 *
 * The capability is `manage_options` on a single site and
 * `manage_network_options` on a network: the files are the network's, and a
 * site administrator on a multisite install must not be able to accept
 * changes to every site's code. The feature lives on the main site only
 * (Integrity::available()).
 *
 * Scans are driven by:
 *  - CRON_HOOK, a single event rescheduled while a scan runs (CRON_SECONDS
 *    per event), scheduled by every start;
 *  - the daily cron (Plugin::run_daily_cron()), which STARTS a scan only
 *    when the owner switched the daily scan on (AUTO_OPTION, off by
 *    default -- the scan's wordpress.org requests are made only with the
 *    owner's say-so);
 *  - "Run a batch now" (OP_BATCH), STEP_SECONDS of work inside the request:
 *    with WP-Cron disabled, the owner pressing it is the scheduler.
 */
final class IntegrityActions {

	public const ACTION     = 'ops404_al_integrity';
	public const CRON_HOOK  = 'ops404_al_integrity_cron';
	public const RESULT_ARG = 'ops404_al_integrity_result';

	public const AUTO_OPTION = 'ops404_al_integrity_auto';

	public const OP_START       = 'start';
	public const OP_BATCH       = 'batch';
	public const OP_CANCEL      = 'cancel';
	public const OP_ACCEPT      = 'accept';
	public const OP_ACCEPT_UNIT = 'accept_unit';
	public const OP_SAVE        = 'save';

	/** Seconds of scanning per browser request. */
	public const STEP_SECONDS = 8.0;

	/** Seconds of scanning per cron event. */
	public const CRON_SECONDS = 20.0;

	/** Result codes; IntegrityTab maps each to its notice. */
	public const RESULTS = array(
		'started',
		'running',
		'batch',
		'finished',
		'cancelled',
		'not_running',
		'accepted',
		'accepted_unit',
		'not_found',
		'saved',
		'bad_request',
		'bad_nonce',
		'forbidden',
	);

	public static function register(): void {
		add_action( 'admin_post_' . self::ACTION, array( __CLASS__, 'handle' ) );
		add_action( self::CRON_HOOK, array( __CLASS__, 'cron' ) );
	}

	/** The capability every action and the tab require. */
	public static function capability(): string {
		return self::multisite() ? 'manage_network_options' : 'manage_options';
	}

	/** Whether this site carries the feature: single site, or a network's main site. */
	public static function available(): bool {
		return ! self::multisite() || is_main_site();
	}

	/**
	 * is_multisite(), guarded as NetworkLog::is_active() guards it: boot and
	 * the daily cron run here, and the unit suites drive both without
	 * WordPress loaded.
	 */
	private static function multisite(): bool {
		return function_exists( 'is_multisite' ) && is_multisite();
	}

	/**
	 * The nonce action for one operation on one target.
	 *
	 * @param string $op     Operation.
	 * @param string $target Row id, unit key, or ''.
	 */
	public static function nonce_action( string $op, string $target = '' ): string {
		return self::ACTION . '|' . $op . '|' . $target;
	}

	/** admin-post handler: decide, then redirect back to the tab. */
	public static function handle(): void {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- perform() verifies the nonce first thing.
		$result = self::perform( wp_unslash( $_POST ) );

		wp_safe_redirect(
			add_query_arg(
				array(
					'page'           => '404ops-activity-log',
					'tab'            => 'integrity',
					self::RESULT_ARG => $result,
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/**
	 * Carry out one posted operation.
	 *
	 * @param array<string, mixed> $request The posted fields, unslashed.
	 * @return string A RESULTS code.
	 */
	public static function perform( array $request ): string {
		$op     = isset( $request['op'] ) && is_string( $request['op'] ) ? sanitize_key( $request['op'] ) : '';
		$target = isset( $request['target'] ) && is_scalar( $request['target'] ) ? substr( (string) $request['target'], 0, 200 ) : '';
		$nonce  = isset( $request['_wpnonce'] ) && is_string( $request['_wpnonce'] ) ? sanitize_text_field( $request['_wpnonce'] ) : '';

		$ops = array( self::OP_START, self::OP_BATCH, self::OP_CANCEL, self::OP_ACCEPT, self::OP_ACCEPT_UNIT, self::OP_SAVE );
		if ( ! in_array( $op, $ops, true ) || ! self::available() ) {
			return 'bad_request';
		}
		if ( false === wp_verify_nonce( $nonce, self::nonce_action( $op, $target ) ) ) {
			return 'bad_nonce';
		}
		if ( ! current_user_can( self::capability() ) ) {
			return 'forbidden';
		}

		switch ( $op ) {
			case self::OP_START:
				// Starting does no scanning: the cron continuation, or "Run
				// a batch now", does -- so the press returns at once.
				$result = Scanner::for_site()->start( 'manual' );
				if ( 'started' === $result ) {
					self::schedule();
				}
				return $result;

			case self::OP_BATCH:
				if ( ! Scanner::is_running() ) {
					return 'not_running';
				}
				return self::advance( Scanner::for_site(), self::STEP_SECONDS ) ? 'batch' : 'finished';

			case self::OP_CANCEL:
				wp_clear_scheduled_hook( self::CRON_HOOK );
				return Scanner::cancel() ? 'cancelled' : 'not_running';

			case self::OP_ACCEPT:
				return Review::accept( (int) $target, Roots::from_wordpress() );

			case self::OP_ACCEPT_UNIT:
				return Review::accept_unit( $target );

			default:
				return self::save( $request );
		}
	}

	/**
	 * Run a scan for a while; true while it is still running.
	 *
	 * @param Scanner $scanner The scanner.
	 * @param float   $seconds Budget.
	 */
	public static function advance( Scanner $scanner, float $seconds ): bool {
		return Scanner::RUNNING === $scanner->run( $seconds )['status'];
	}

	/**
	 * @param array<string, mixed> $request The posted fields.
	 */
	private static function save( array $request ): string {
		$was = self::auto_enabled();
		$now = isset( $request['auto'] );

		// '1'/'0', never a bare false (OPERATIONS.md: update_option() of
		// false on an absent option writes nothing).
		update_option( self::AUTO_OPTION, $now ? '1' : '0', false );

		if ( $was !== $now ) {
			EventLogger::log(
				Scanner::EVENT_SETTINGS,
				$now ? 'Daily file integrity scan switched on' : 'Daily file integrity scan switched off',
				'integrity',
				null,
				array( 'daily_scan' => $now )
			);
		}

		return 'saved';
	}

	/** Whether the owner switched the daily scan on. */
	public static function auto_enabled(): bool {
		return '1' === (string) get_option( self::AUTO_OPTION, '0' );
	}

	/**
	 * The daily cron's part: start a scan when the owner asked for daily
	 * scans and none is running.
	 */
	public static function daily(): void {
		// The switch first: it is off on almost every site, and reading it
		// costs nothing the daily cron does not already pay.
		if ( ! self::auto_enabled() || ! self::available() ) {
			return;
		}

		if ( 'started' === Scanner::for_site()->start( 'schedule' ) ) {
			self::schedule();
		}
	}

	/** WP-Cron continuation: run for a while, and come back while there is more. */
	public static function cron(): void {
		if ( ! self::available() ) {
			return;
		}

		if ( self::advance( Scanner::for_site(), self::CRON_SECONDS ) ) {
			self::schedule();
		}
	}

	private static function schedule(): void {
		if ( ! wp_next_scheduled( self::CRON_HOOK ) ) {
			wp_schedule_single_event( time(), self::CRON_HOOK );
		}
	}

	/** Remove everything this feature stored. Uninstall only. */
	public static function uninstall(): void {
		Store::drop_table();
		foreach ( Scanner::OPTIONS as $option ) {
			delete_option( $option );
		}
		delete_option( self::AUTO_OPTION );
	}
}