<?php
/**
 * @package ActivityLog404
 */

namespace ActivityLog404;

use ActivityLog404\Admin\SettingsPage;
use ActivityLog404\Cli\Command;
use ActivityLog404\Cli\IntegrityCommand;
use ActivityLog404\Import\ImportActions;
use ActivityLog404\Import\Importer;
use ActivityLog404\Privacy\PersonalData;
use ActivityLog404\Rest\EventsController;
use ActivityLog404\Sessions\Enforcer;
use ActivityLog404\Sessions\SessionActions;
use ActivityLog404\Sessions\SessionLog;

defined( 'ABSPATH' ) || exit;

/**
 * Main plugin bootstrapper.
 */
final class Plugin {

	/** Whether the request's early plugin bootstrap has already run. */
	private static bool $booted = false;

	/** Whether the request's admin settings hooks have already been registered. */
	private static bool $admin_registered = false;

	/**
	 * Wire up hooks. Idempotent.
	 */
	public static function boot(): void {
		if ( self::$booted ) {
			return;
		}

		self::$booted = true;

		// Ensure the log table exists / is current. Activation hooks do not
		// re-fire on redeploys of an already-active plugin, so this
		// schema-version check is what guarantees the table on live sites.
		Database::maybe_upgrade();

		// The network log's table (#8), only while network-active.
		Network\NetworkDatabase::maybe_upgrade();

		// File integrity monitoring: its table, its actions and scan
		// continuation, and the updater hook that re-baselines what the
		// updater installs. Single site, or a network's main site only --
		// the files are the network's (docs/file-integrity.md).
		if ( Integrity\IntegrityActions::available() ) {
			Integrity\Store::maybe_upgrade();
			Integrity\IntegrityActions::register();
			Integrity\Rebaseline::register();
		}

		// The tamper-evident chain (docs/tamper-evident-chain.md): the Log
		// integrity tab's action and the verification's cron continuation.
		Chain\ChainActions::register();

		// Register event logging hooks.
		EventLogger::register_hooks();

		// Session management (#6): the idle timeout and session limit run on
		// every request, front end included; the Sessions tab's writes are
		// admin-post handlers; policy changes are logged from any writer.
		Enforcer::register();
		SessionActions::register();
		SessionLog::register();

		// History import (#21): the Import tab's admin-post and AJAX actions,
		// and the WP-Cron event that carries a run on without the tab open.
		ImportActions::register();

		// Register WordPress's native personal-data export/erase tools.
		PersonalData::register_hooks();

		// Scripted reads of the log: the REST route always, and the WP-CLI
		// command when WP-CLI is what is running this request.
		EventsController::register_hooks();
		Rest\ChainController::register_hooks();
		if ( \defined( 'WP_CLI' ) && \constant( 'WP_CLI' ) ) {
			\WP_CLI::add_command( 'activity-log', Command::class );
			\WP_CLI::add_command( 'activity-log integrity', IntegrityCommand::class );
			\WP_CLI::add_command( 'activity-log chain', Cli\ChainCommand::class );
		}

		// Schedule daily cron for purging and digest.
		self::schedule_cron();

		// SettingsPage::register() translates its menu metadata. WordPress 6.7+
		// reports a notice when that happens before init, so defer only this
		// admin wiring. A named static callback keeps repeated boot calls from
		// accumulating distinct closures.
		if ( is_admin() ) {
			add_action( 'init', array( __CLASS__, 'register_admin' ) );
		}

		/**
		 * The free plugin has finished loading.
		 *
		 * The Pro add-on's only entry point. Fired UNCONDITIONALLY -- there
		 * is nothing here for free to decide, and a `Pro\Gate::is_pro()`
		 * wrapped around this line would be invisible to any test that only
		 * runs with the add-on present. The add-on does its own gating.
		 *
		 * Fired LAST in boot() so everything the carrier closes over is
		 * already wired: an add-on listener runs with free's hooks, cron and
		 * admin deferral all in place.
		 *
		 * @param ProServices $services Free's own boot-time services. See that class.
		 */
		do_action( 'ops404_activity_log_booted', self::pro_services() );
	}

	/**
	 * The carrier free hands the add-on. Built here, once per boot, so the
	 * closures inside it are bound to this request's free classes rather than
	 * re-resolved add-on-side. See {@see ProServices} for why three of the
	 * four are closures.
	 */
	private static function pro_services(): ProServices {
		return new ProServices(
			static fn( array $args ): array => ActivityLog::get_events( $args ),
			Database::get_table_name(),
			static function (): array {
				return array(
					'retention_days' => ActivityLog::retention_days_or_default(
						get_option( 'ops_activity_log_retention_days', ActivityLog::DEFAULT_RETENTION_DAYS )
					),
					'store_full_ips' => (bool) get_option( EventLogger::OPTION_STORE_FULL_IPS, false ),
					'ip_source'      => EventLogger::ip_source(),
				);
			},
			// The sixth parameter (who acted) since the login-alerts slice:
			// an alert is written during wp_login, before the current user is
			// set, and a "this wasn't me" report from a logged-out browser --
			// both are the user's own events, exactly as their login is.
			// Optional, so a caller passing five is unchanged.
			static function ( string $event_type, string $summary, ?string $object_type = null, ?int $object_id = null, ?array $details = null, ?int $actor_user_id = null ): void {
				EventLogger::log( $event_type, $summary, $object_type, $object_id, $details, $actor_user_id );
			}
		);
	}

	/**
	 * Register admin settings hooks after WordPress has initialized translations.
	 *
	 * Public because WordPress invokes this named action callback.
	 */
	public static function register_admin(): void {
		if ( self::$admin_registered ) {
			return;
		}

		self::$admin_registered = true;
		( new SettingsPage() )->register();

		// Network Admin → Activity Log (#8): super admins, network-active only.
		if ( Network\NetworkLog::is_active() && is_network_admin() ) {
			Admin\NetworkPage::register();
		}
	}

	/**
	 * Remove all plugin data: the activity log table and every option.
	 * Called from uninstall.php (WP_UNINSTALL_PLUGIN context) — never from
	 * deactivation, which must leave data intact for reactivation.
	 *
	 * On a network (#8) uninstall.php runs ONCE, on the main site, however
	 * the plugin was activated: so every site's table and options are
	 * removed site by site, then the network log's table and its network
	 * option. A site the plugin never ran on has nothing to remove, and
	 * each removal is a no-op there. Before #8 only the main site was
	 * cleaned, leaving every other site's table behind.
	 */
	public static function uninstall(): void {
		if ( ! function_exists( 'is_multisite' ) || ! is_multisite() ) {
			self::uninstall_site();
			return;
		}

		// Every site of every network (get_sites() reads all networks unless
		// given one): the network table is one per install.
		foreach ( get_sites(
			array(
				'fields' => 'ids',
				'number' => 0,
			)
		) as $site_id ) {
			switch_to_blog( (int) $site_id );
			try {
				self::uninstall_site();
			} finally {
				restore_current_blog();
			}
		}

		Network\NetworkDatabase::drop_table();
	}

	/**
	 * One site's data: its table and its options.
	 */
	private static function uninstall_site(): void {
		Database::drop_table();
		delete_option( 'ops_activity_log_retention_days' );
		delete_option( 'ops_activity_log_retention_unlimited' );
		delete_option( EventLogger::OPTION_STORE_FULL_IPS );
		delete_option( EventLogger::OPTION_IP_SOURCE );
		delete_option( Exclusions::OPTION_USERS );
		delete_option( Exclusions::OPTION_ROLES );
		delete_option( Alerts::OPTION_ENABLED );
		delete_option( AiSummary::OPTION_AI_ENABLED );
		delete_option( Sessions\SessionPolicy::OPTION );
		delete_option( Importer::STATE_OPTION );
		// Location and device (#7): the settings, the encrypted licence key,
		// and the database this plugin installed. A database the owner
		// pointed at elsewhere on the server is theirs and stays.
		delete_option( Context\RequestContext::OPTION_DEVICE );
		delete_option( Context\GeoUpdater::OPTION_ENABLED );
		delete_option( Context\GeoUpdater::OPTION_ACCOUNT );
		delete_option( Context\GeoUpdater::OPTION_KEY );
		delete_option( Context\GeoUpdater::OPTION_EDITION );
		delete_option( Context\GeoUpdater::OPTION_STATUS );
		delete_option( Context\GeoUpdater::OPTION_LAST_SUCCESS );
		Context\GeoDatabase::remove_managed_dir();
		delete_option( Context\GeoDatabase::OPTION_PATH );
		// File integrity monitoring: its table and options. The scanned
		// files were only ever read.
		Integrity\IntegrityActions::uninstall();
		// The chain's signed state and last verdict.
		Chain\ChainActions::uninstall();
	}

	/**
	 * Handle plugin deactivation.
	 */
	public static function on_deactivate(): void {
		// Clear every instance, including duplicates left by older deployments.
		wp_clear_scheduled_hook( 'ops_activity_log_daily_cron' );
		// A running import's next batch (#21). Its events carry the source as
		// an argument, which wp_clear_scheduled_hook() would have to match;
		// wp_unschedule_hook() clears every one. The run's state is kept, so
		// reactivating and pressing Import carries on from its cursor.
		wp_unschedule_hook( ImportActions::CRON_HOOK );
		// A running integrity scan's continuation. Its position is kept, so
		// "Run a batch now" after reactivating carries on from it.
		wp_unschedule_hook( Integrity\IntegrityActions::CRON_HOOK );
		// A running verification's continuation; its position is kept.
		wp_unschedule_hook( Chain\ChainActions::CRON_HOOK );
	}

	/**
	 * Schedule daily cron job.
	 */
	private static function schedule_cron(): void {
		if ( ! wp_next_scheduled( 'ops_activity_log_daily_cron' ) ) {
			wp_schedule_event( time(), 'daily', 'ops_activity_log_daily_cron' );
		}

		add_action( 'ops_activity_log_daily_cron', array( __CLASS__, 'run_daily_cron' ) );
	}

	/**
	 * Run daily cron tasks.
	 */
	public static function run_daily_cron(): void {
		// Purge old events based on retention setting.
		$retention_days = ActivityLog::retention_days_or_default(
			get_option( 'ops_activity_log_retention_days', ActivityLog::DEFAULT_RETENTION_DAYS )
		);
		ActivityLog::purge_old_events( $retention_days );

		// Send the daily digest. EmailDigest honours the site's off-switch.
		EmailDigest::send_daily_digest();

		// The optional weekly GeoLite2 download (#7). A no-op unless the
		// owner switched it on and gave it their own MaxMind credentials.
		Context\GeoUpdater::maybe_update();

		// The daily file integrity scan, only when the owner switched it on.
		Integrity\IntegrityActions::daily();

		// The daily verification of the log's chain.
		Chain\ChainActions::daily();
	}
}