<?php
/**
 * The Sessions screen's write actions (#6).
 *
 * @package ActivityLog404
 */

namespace ActivityLog404\Sessions;

defined( 'ABSPATH' ) || exit;

/**
 * Every write the Sessions screen can make, behind one admin-post action.
 *
 * The decision is perform(), which reads a request array and returns a
 * result code; handle() only feeds it $_POST and redirects. perform() never
 * redirects or exits, so every refusal below is a plain return value a test
 * can assert (OPERATIONS.md §4: an admin-post handler ending in exit kills
 * PHPUnit silently).
 *
 * Who may do what, checked in this order on every write:
 *  1. The nonce, bound to the operation AND the target user id, so a nonce
 *     rendered for one row cannot be replayed against another user.
 *  2. `manage_options` -- the capability of the screen this lives on.
 *  3. For anyone else's sessions, core's own `edit_user` meta capability on
 *     the target -- the exact check core's "Log Out Everywhere" button on
 *     the user-edit screen makes (wp_ajax_destroy_sessions()). On multisite
 *     that maps to `manage_network_users` and refuses a super admin's
 *     sessions to anyone who is not one, which is right: sessions are
 *     network-wide, so ending one ends it on every site.
 *  4. The acting user's OWN current session can never be ended from here,
 *     by any path. "Log out everywhere else" keeps it by construction
 *     (core's destroy_others()); the per-user "log out all" is not offered
 *     for yourself and is refused if forged; and the per-session button is
 *     not rendered on the current row and is refused if forged. Ending your
 *     own session is what the Log Out link is for.
 *
 * Saving the policy needs `manage_options`, and on multisite
 * `manage_network_options` as well: a site's idle timeout ends sessions
 * that are valid network-wide, so a single site's administrator must not
 * be able to set one that logs out the network's administrators.
 */
final class SessionActions {

	public const ACTION = 'ops404_al_sessions';

	/** The result query argument the screen reads back. */
	public const RESULT_ARG = 'ops404_al_sessions_result';

	public const OP_DESTROY_ONE    = 'destroy_one';
	public const OP_DESTROY_USER   = 'destroy_user';
	public const OP_DESTROY_OTHERS = 'destroy_others';
	public const OP_SAVE_POLICY    = 'save_policy';

	/** Result codes; SessionsTab maps each to its notice. */
	public const RESULTS = array(
		'destroyed_one',
		'destroyed_user',
		'destroyed_others',
		'policy_saved',
		'bad_request',
		'bad_nonce',
		'forbidden',
		'own_current',
		'gone',
		'unsupported',
		'no_current_session',
	);

	/**
	 * Hook registration.
	 */
	public static function register(): void {
		add_action( 'admin_post_' . self::ACTION, array( __CLASS__, 'handle' ) );
		// Log core's own "Log Out Everywhere" button on the profile and
		// user-edit screens, which ends sessions without firing anything.
		// Priority 1: before core's handler, which ends the request.
		add_action( 'wp_ajax_destroy_sessions', array( __CLASS__, 'log_core_destroy_sessions' ), 1 );
	}

	/**
	 * The nonce action for one operation on one user.
	 *
	 * @param string $op      One of the OP_* constants.
	 * @param int    $user_id The target user (the acting user for their own ops; 0 for the policy).
	 */
	public static function nonce_action( string $op, int $user_id ): string {
		return self::ACTION . ':' . $op . ':' . $user_id;
	}

	/**
	 * The admin-post callback.
	 */
	public static function handle(): void {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- perform() verifies the nonce before anything else.
		$result = self::perform( wp_unslash( $_POST ) );

		wp_safe_redirect(
			add_query_arg(
				array(
					'page'           => '404ops-activity-log',
					'tab'            => 'sessions',
					self::RESULT_ARG => $result,
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/**
	 * Decide and carry out one request. Returns a RESULTS code.
	 *
	 * @param mixed $request The unslashed POST body.
	 */
	public static function perform( $request ): string {
		$request = is_array( $request ) ? $request : array();
		$op      = isset( $request['op'] ) && is_string( $request['op'] ) ? sanitize_key( $request['op'] ) : '';
		$user_id = isset( $request['user_id'] ) && is_scalar( $request['user_id'] ) ? absint( $request['user_id'] ) : 0;
		$nonce   = isset( $request['_wpnonce'] ) && is_string( $request['_wpnonce'] ) ? sanitize_text_field( $request['_wpnonce'] ) : '';

		if ( ! in_array( $op, array( self::OP_DESTROY_ONE, self::OP_DESTROY_USER, self::OP_DESTROY_OTHERS, self::OP_SAVE_POLICY ), true ) ) {
			return 'bad_request';
		}

		if ( ! wp_verify_nonce( $nonce, self::nonce_action( $op, $user_id ) ) ) {
			return 'bad_nonce';
		}

		if ( ! current_user_can( 'manage_options' ) ) {
			return 'forbidden';
		}

		switch ( $op ) {
			case self::OP_SAVE_POLICY:
				return self::save_policy( $request );
			case self::OP_DESTROY_OTHERS:
				return self::destroy_others( $user_id );
			case self::OP_DESTROY_USER:
				return self::destroy_user( $user_id );
			default:
				$handle = isset( $request['session'] ) && is_string( $request['session'] ) ? $request['session'] : '';
				return self::destroy_one( $user_id, $handle );
		}
	}

	/**
	 * Whether the acting user may end $target's sessions (rule 3 above).
	 *
	 * @param \WP_User $target Whose sessions.
	 */
	public static function may_manage( \WP_User $target ): bool {
		return current_user_can( 'edit_user', $target->ID );
	}

	/**
	 * Whether the acting user may change the policy (see the class docblock).
	 */
	public static function may_edit_policy(): bool {
		return current_user_can( 'manage_options' ) && ( ! is_multisite() || current_user_can( 'manage_network_options' ) );
	}

	/**
	 * @param array<string, mixed> $request The unslashed POST body.
	 */
	private static function save_policy( array $request ): string {
		if ( ! self::may_edit_policy() ) {
			return 'forbidden';
		}

		$raw = array(
			'idle_minutes' => isset( $request['idle_minutes'] ) && is_scalar( $request['idle_minutes'] ) ? sanitize_text_field( (string) $request['idle_minutes'] ) : '0',
			'roles'        => array(),
		);

		// Only roles that exist on this site are ever stored.
		$known = array_keys( wp_roles()->get_names() );
		$roles = isset( $request['roles'] ) && is_array( $request['roles'] ) ? $request['roles'] : array();
		foreach ( $known as $role ) {
			$entry = isset( $roles[ $role ] ) && is_array( $roles[ $role ] ) ? $roles[ $role ] : array();

			$raw['roles'][ $role ] = array(
				'idle'  => isset( $entry['idle'] ) && is_scalar( $entry['idle'] ) ? sanitize_text_field( (string) $entry['idle'] ) : '',
				'limit' => isset( $entry['limit'] ) && is_scalar( $entry['limit'] ) ? sanitize_text_field( (string) $entry['limit'] ) : '0',
			);
		}

		// SessionLog records the change on update_option_ / add_option_.
		update_option( SessionPolicy::OPTION, SessionPolicy::sanitize( $raw ), true );

		return 'policy_saved';
	}

	/**
	 * "Log out everywhere else": the acting user's other sessions.
	 *
	 * @param int $user_id Must be the acting user.
	 */
	private static function destroy_others( int $user_id ): string {
		$me = wp_get_current_user();
		if ( $user_id !== $me->ID ) {
			return 'forbidden';
		}

		$token = wp_get_session_token();
		if ( '' === $token ) {
			return 'no_current_session';
		}

		$manager = \WP_Session_Tokens::get_instance( $me->ID );
		$others  = max( 0, count( $manager->get_all() ) - 1 );
		$manager->destroy_others( $token );

		SessionLog::sessions_ended( $me, $others, true, 'sessions_screen' );

		return 'destroyed_others';
	}

	/**
	 * Every session of ANOTHER user.
	 *
	 * @param int $user_id The target.
	 */
	private static function destroy_user( int $user_id ): string {
		$target = get_userdata( $user_id );
		if ( ! $target instanceof \WP_User ) {
			return 'gone';
		}

		if ( get_current_user_id() === $target->ID ) {
			return 'own_current';
		}

		if ( ! self::may_manage( $target ) ) {
			return 'forbidden';
		}

		$manager = \WP_Session_Tokens::get_instance( $target->ID );
		$count   = count( $manager->get_all() );
		$manager->destroy_all();

		SessionLog::sessions_ended( $target, $count, false, 'sessions_screen' );

		return 'destroyed_user';
	}

	/**
	 * One session, named by its handle.
	 *
	 * @param int    $user_id The session's owner.
	 * @param string $handle  SessionStore::handle() of it.
	 */
	private static function destroy_one( int $user_id, string $handle ): string {
		if ( ! SessionStore::supported() ) {
			return 'unsupported';
		}

		$target = get_userdata( $user_id );
		if ( ! $target instanceof \WP_User ) {
			return 'gone';
		}

		$is_me = get_current_user_id() === $target->ID;
		if ( ! $is_me && ! self::may_manage( $target ) ) {
			return 'forbidden';
		}

		$verifier = SessionStore::verifier_for_handle( $target->ID, $handle );
		if ( null === $verifier ) {
			return 'gone';
		}

		if ( $is_me && hash_equals( SessionStore::current_verifier(), $verifier ) ) {
			return 'own_current';
		}

		$session = SessionStore::sessions( $target->ID )[ $verifier ] ?? array();
		if ( ! SessionStore::destroy( $target->ID, $verifier ) ) {
			return 'gone';
		}

		SessionLog::session_ended( $target, $session );

		return 'destroyed_one';
	}

	/**
	 * Records core's own "Log Out Everywhere" (user-edit screen) and "Log
	 * Out Everywhere Else" (profile screen) button presses, which end
	 * sessions through WP_Session_Tokens and fire no action of their own.
	 *
	 * Mirrors wp_ajax_destroy_sessions()'s checks exactly -- the user
	 * exists, `edit_user` on them, and its `update-user_{id}` nonce -- and
	 * logs only a request that core is about to carry out. Verifying the
	 * nonce here does not consume it; WordPress nonces are not one-time.
	 */
	/**
	 * Core's user-edit nonce action, `update-user_{id}`, for an already
	 * resolved user id.
	 *
	 * Its own method on purpose: semgrep's tainted-sql-string rule reads a
	 * literal starting with a SQL keyword ("update") concatenated with request
	 * data as a SQL string. This is a nonce action name, not SQL; building it
	 * from a typed int in its own frame keeps the scanner's rule intact (the
	 * estate never weakens a guard for a name collision -- OPERATIONS.md) while
	 * the call site stays the exact check wp_ajax_destroy_sessions() makes.
	 */
	private static function core_user_nonce_action( int $user_id ): string {
		return sprintf( 'update-user_%d', $user_id );
	}

	public static function log_core_destroy_sessions(): void {
		// phpcs:disable WordPress.Security.NonceVerification.Missing -- the nonce IS verified below, against core's own action.
		$user_id = isset( $_POST['user_id'] ) && is_scalar( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0;
		$nonce   = isset( $_POST['nonce'] ) && is_string( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
		// phpcs:enable

		$user = $user_id > 0 ? get_userdata( $user_id ) : false;
		if ( ! $user instanceof \WP_User || ! current_user_can( 'edit_user', $user->ID ) || ! wp_verify_nonce( $nonce, self::core_user_nonce_action( $user->ID ) ) ) {
			return;
		}

		$manager = \WP_Session_Tokens::get_instance( $user->ID );
		$count   = count( $manager->get_all() );
		$is_me   = get_current_user_id() === $user->ID;

		if ( $is_me ) {
			$count = max( 0, $count - ( '' !== wp_get_session_token() ? 1 : 0 ) );
		}

		SessionLog::sessions_ended( $user, $count, $is_me, 'profile_screen' );
	}
}