<?php
/**
 * File integrity monitoring: what the WordPress updater changes is known-good.
 *
 * @package ActivityLog404
 */

namespace ActivityLog404\Integrity;

use ActivityLog404\EventLogger;

defined( 'ABSPATH' ) || exit;

/**
 * When the WordPress updater installs or updates a plugin or theme, the
 * files it writes are the release the owner asked for, so the unit's
 * baseline is reset: its rows are forgotten and the next scan records the
 * new files as they are (Scanner::rebaseline(), Scanner::prepare()).
 * A plugin wordpress.org publishes checksums for is verified against them
 * instead, whatever the updater did.
 *
 * Hooked on `upgrader_post_install`, which core applies once per package,
 * only after that package's files are in place -- not on
 * `upgrader_process_complete`, which fires even when the install failed
 * (OPERATIONS.md, wave 3). A failed package arrives here as a WP_Error and
 * is ignored, so a half-written update is still compared against the old
 * baseline and its damage reported.
 *
 * A manual edit -- the theme/plugin file editor, SFTP, a compromised
 * process -- passes through none of this, and is reported. That is the
 * whole point of the distinction.
 *
 * Core needs nothing here: its expected rows are wordpress.org's checksums
 * for the running version, refetched when the version changes, so an update
 * is verified rather than trusted.
 */
final class Rebaseline {

	public static function register(): void {
		add_filter( 'upgrader_post_install', array( __CLASS__, 'after_install' ), 10, 3 );
	}

	/**
	 * Filter callback; returns the response unchanged.
	 *
	 * @param mixed $response   The install result so far (true, or a WP_Error).
	 * @param mixed $hook_extra Upgrader context: `plugin` / `theme` on updates, `type` + `action` on installs.
	 * @param mixed $result     Install result: `destination_name` is the package's directory.
	 * @return mixed
	 */
	public static function after_install( $response, $hook_extra = array(), $result = array() ) {
		if ( is_wp_error( $response ) || false === $response || ! is_array( $hook_extra ) ) {
			return $response;
		}

		$unit = self::unit_for( $hook_extra, is_array( $result ) ? $result : array() );
		if ( null !== $unit && self::enabled() ) {
			$forgotten = Scanner::rebaseline( $unit );

			EventLogger::log(
				Scanner::EVENT_REBASELINED,
				sprintf( 'Integrity baseline reset by the WordPress updater: %s', $unit ),
				'integrity',
				null,
				array(
					'unit' => $unit,
					'via'  => 'updater',
					'rows' => $forgotten,
				)
			);
		}

		return $response;
	}

	/**
	 * Whether there is a baseline to keep: the site has scanned at least
	 * once. Before that there is nothing to reset, and no row to write.
	 */
	private static function enabled(): bool {
		return Scanner::established() || Scanner::is_running();
	}

	/**
	 * The unit an upgrader package is, or null for one that is not a plugin
	 * or theme directory (core, translations, a single-file plugin).
	 *
	 * @param array<string, mixed> $hook_extra Upgrader context.
	 * @param array<string, mixed> $result     Install result.
	 */
	public static function unit_for( array $hook_extra, array $result ): ?string {
		$type = '';
		$slug = '';

		if ( isset( $hook_extra['plugin'] ) && is_string( $hook_extra['plugin'] ) ) {
			$type = 'plugin';
			$slug = false !== strpos( $hook_extra['plugin'], '/' ) ? dirname( $hook_extra['plugin'] ) : '';
		} elseif ( isset( $hook_extra['theme'] ) && is_string( $hook_extra['theme'] ) ) {
			$type = 'theme';
			$slug = $hook_extra['theme'];
		} elseif ( isset( $hook_extra['type'] ) && in_array( $hook_extra['type'], array( 'plugin', 'theme' ), true ) ) {
			// A fresh install names its package only in the result.
			$type = (string) $hook_extra['type'];
			$slug = isset( $result['destination_name'] ) && is_string( $result['destination_name'] ) ? $result['destination_name'] : '';
		}

		if ( '' === $type || '' === $slug || ! Comparison::is_safe_relative( $slug ) || false !== strpos( $slug, '/' ) ) {
			return null;
		}

		return $type . ':' . $slug;
	}
}