' . esc_html__( 'Export / Import Courses', 'accessnow-lms' ) . '

<?php
namespace AccessNow\SimpleLMS;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Export_Import {

	public static function init() {
		add_action( 'admin_menu', array( __CLASS__, 'register_menu' ) );
		add_action( 'admin_init', array( __CLASS__, 'handle_export' ) );
		add_action( 'admin_init', array( __CLASS__, 'handle_import' ) );
	}

	public static function register_menu() {
		add_submenu_page(
			'slms-main',
			__( 'Export / Import', 'accessnow-lms' ),
			__( 'Export / Import', 'accessnow-lms' ),
			'manage_options',
			'slms-export-import',
			array( __CLASS__, 'render_page' )
		);
	}

	/* ─── Admin Page ───────────────────────────────────────────── */

	public static function render_page() {
		$courses = get_posts(
			array(
				'post_type'      => 'slms_course',
				'posts_per_page' => -1,
				'post_status'    => 'any',
				'orderby'        => 'title',
				'order'          => 'ASC',
			)
		);

		echo '<div class="wrap">';
		echo '<h1>' . esc_html__( 'Export / Import Courses', 'accessnow-lms' ) . '</h1>';

		// Success / error notices from import
		$notice_key = self::notice_key();
		$notice     = get_transient( $notice_key );
		if ( is_array( $notice ) && ! empty( $notice['message'] ) ) {
			$type = in_array( $notice['type'] ?? '', array( 'error', 'warning', 'success' ), true ) ? $notice['type'] : 'error';
			printf( '<div class="notice notice-%s is-dismissible"><p>%s</p></div>', esc_attr( $type ), esc_html( $notice['message'] ) );
			delete_transient( $notice_key );
		}

		// ── Export Section
		echo '<div style="display:flex;gap:40px;flex-wrap:wrap;margin-top:20px;">';
		echo '<div style="flex:1;min-width:360px;background:#fff;padding:20px 24px;border:1px solid #ccd0d4;border-radius:4px;">';
		echo '<h2>' . esc_html__( 'Export Course', 'accessnow-lms' ) . '</h2>';
		echo '<p class="description">' . esc_html__( 'Download a course as a .zip file including all units, lessons, quizzes, and questions. Media can be included or excluded.', 'accessnow-lms' ) . '</p>';
		echo '<form method="post" style="margin-top:16px;">';
		wp_nonce_field( 'accessnow_slms_export_course', 'accessnow_slms_export_nonce' );

		if ( empty( $courses ) ) {
			echo '<p><em>' . esc_html__( 'No courses found.', 'accessnow-lms' ) . '</em></p>';
		} else {
			echo '<table class="form-table"><tbody>';
			echo '<tr><th><label for="slms_export_course_id">' . esc_html__( 'Select Course', 'accessnow-lms' ) . '</label></th><td>';
			echo '<select name="slms_export_course_id" id="slms_export_course_id" style="min-width:300px;">';
			foreach ( $courses as $c ) {
				printf( '<option value="%s">%s</option>', esc_attr( $c->ID ), esc_html( $c->post_title ) );
			}
			echo '</select></td></tr>';
			echo '<tr><th>' . esc_html__( 'Include Media', 'accessnow-lms' ) . '</th><td>';
			echo '<label><input type="checkbox" name="slms_export_media" value="1" checked> ';
			echo esc_html__( 'Include header images, downloads and the pictures in lesson text', 'accessnow-lms' ) . '</label>';
			echo '<p class="description">' . esc_html__( 'Untick for the text and settings only: a much smaller file, whose pictures keep pointing at this site.', 'accessnow-lms' ) . '</p>';
			echo '</td></tr>';
			echo '</tbody></table>';
			submit_button( __( 'Export Course (.zip)', 'accessnow-lms' ), 'primary', 'slms_do_export' );
		}

		echo '</form></div>';

		// ── Import Section
		echo '<div style="flex:1;min-width:360px;background:#fff;padding:20px 24px;border:1px solid #ccd0d4;border-radius:4px;">';
		echo '<h2>' . esc_html__( 'Import Course', 'accessnow-lms' ) . '</h2>';
		echo '<p class="description">' . esc_html__( 'Upload a .zip file previously exported from AccessNow LMS. All content and media will be imported. Duplicate imports will create new copies.', 'accessnow-lms' ) . '</p>';
		echo '<form method="post" enctype="multipart/form-data" style="margin-top:16px;">';
		wp_nonce_field( 'accessnow_slms_import_course', 'accessnow_slms_import_nonce' );

		echo '<table class="form-table"><tbody>';
		echo '<tr><th><label for="slms_import_file">' . esc_html__( 'Course File (.zip)', 'accessnow-lms' ) . '</label></th><td>';
		echo '<input type="file" name="slms_import_file" id="slms_import_file" accept=".zip">';
		printf(
			'<p class="description">%s</p>',
			/* translators: %s: maximum upload size, e.g. "64 MB". */
			sprintf( esc_html__( 'Maximum file size: %s', 'accessnow-lms' ), esc_html( size_format( wp_max_upload_size() ) ) )
		);
		echo '</td></tr>';
		echo '</tbody></table>';
		submit_button( __( 'Import Course', 'accessnow-lms' ), 'primary', 'slms_do_import' );

		echo '</form></div>';
		echo '</div></div>';
	}

	/* ─── Export Handler ───────────────────────────────────────── */

	public static function handle_export() {
		if ( ! isset( $_POST['slms_do_export'] ) ) {
			return;
		}
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['accessnow_slms_export_nonce'] ?? '' ) ), 'accessnow_slms_export_course' ) ) {
			wp_die( esc_html__( 'Security check failed.', 'accessnow-lms' ) );
		}

		$course_id = absint( $_POST['slms_export_course_id'] ?? 0 );
		$course    = get_post( $course_id );
		if ( ! $course || 'slms_course' !== $course->post_type ) {
			wp_die( esc_html__( 'Invalid course.', 'accessnow-lms' ) );
		}

		$tmp_file = wp_tempnam( 'slms-export' );
		if ( ! self::build_zip( $course_id, ! empty( $_POST['slms_export_media'] ), $tmp_file ) ) {
			wp_die( esc_html__( 'Could not create ZIP file.', 'accessnow-lms' ) );
		}

		$slug     = sanitize_title( $course->post_title );
		$filename = 'slms-course-' . $slug . '-' . gmdate( 'Y-m-d' ) . '.zip';

		header( 'Content-Type: application/zip' );
		header( 'Content-Disposition: attachment; filename="' . $filename . '"' );
		header( 'Content-Length: ' . filesize( $tmp_file ) );
		header( 'Pragma: no-cache' );
		// Stream the temporary ZIP we just built (can be large, so not read into memory).
		readfile( $tmp_file ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_readfile
		wp_delete_file( $tmp_file );
		exit;
	}

	/**
	 * Writes a course's export ZIP: course.json, and with $include_media the files it uses under media/.
	 *
	 * @param int    $course_id     Course.
	 * @param bool   $include_media Header images, attachments and the pictures in lesson text.
	 * @param string $path          Where to write the ZIP.
	 * @return bool
	 */
	public static function build_zip( $course_id, $include_media, $path ) {
		$data = self::gather_course_data( $course_id );
		if ( ! $include_media ) {
			$data = self::strip_media_from_data( $data );
		}
		$zip = new \ZipArchive();
		if ( true !== $zip->open( $path, \ZipArchive::CREATE | \ZipArchive::OVERWRITE ) ) {
			return false;
		}
		$zip->addFromString( 'course.json', wp_json_encode( $data, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE ) );
		if ( $include_media ) {
			foreach ( self::collect_media_files( $data ) as $relative_path => $absolute_path ) {
				if ( file_exists( $absolute_path ) ) {
					$zip->addFile( $absolute_path, 'media/' . $relative_path );
				}
			}
		}
		return $zip->close();
	}

	/**
	 * Attachments used inside post content: image (and other media) block ids, wp-image-N classes,
	 * and links to files in this site's uploads folder.
	 *
	 * @param string $html Post content.
	 * @return int[]
	 */
	public static function content_attachment_ids( $html ) {
		$ids = array();
		if ( preg_match_all( '/\bwp-image-(\d+)\b/', $html, $m ) ) {
			$ids = array_merge( $ids, $m[1] );
		}
		if ( preg_match_all( '/<!-- wp:(?:image|cover|media-text|file|video|audio|gallery)\s+\{[^}]*?"id":(\d+)/', $html, $m ) ) {
			$ids = array_merge( $ids, $m[1] );
		}
		$base = wp_upload_dir()['baseurl'];
		if ( preg_match_all( '#(?:src|href)="(' . preg_quote( $base, '#' ) . '/[^"]+)"#', $html, $m ) ) {
			foreach ( $m[1] as $url ) {
				// A resized copy (photo-1024x338.png) belongs to its full-size attachment.
				$id = attachment_url_to_postid( preg_replace( '/-\d+x\d+(\.\w+)$/', '$1', $url ) );
				if ( $id ) {
					$ids[] = $id;
				}
			}
		}
		$ids = array_values( array_unique( array_map( 'intval', $ids ) ) );
		return array_values(
			array_filter(
				$ids,
				function ( $id ) {
					return 'attachment' === get_post_type( $id );
				}
			)
		);
	}

	/* ─── Which post meta travels with a course ─────────────────── */

	/** The post meta exported, imported and copied with a course, per post type. */
	const META_KEYS = array(
		'slms_course' => array( '_slms_progression_mode', '_slms_enrollment_mode', '_slms_content_change_mode', '_slms_course_language', '_slms_featured', Lesson_Header::META ),
		'slms_unit'   => array( '_slms_sort_order', Lesson_Header::META ),
		'slms_lesson' => array( '_slms_sort_order', '_slms_content_type', '_slms_video_url', Lesson_Header::META ),
		'slms_quiz'   => array( '_slms_pass_threshold', '_slms_max_retries', '_slms_time_limit', '_slms_randomize_questions', '_slms_randomize_options', '_slms_show_answers', '_slms_questions' ),
	);

	/**
	 * The post meta keys exported and copied for a post type.
	 *
	 * @param string $post_type slms_course, slms_unit, slms_lesson or slms_quiz.
	 * @return string[]
	 */
	public static function meta_keys( $post_type ) {
		$keys = isset( self::META_KEYS[ $post_type ] ) ? self::META_KEYS[ $post_type ] : array();

		/**
		 * The post meta keys a course export (and Clone) carries for one post type.
		 *
		 * A key added here is exported and cloned; it is only imported if
		 * accessnow_slms_import_meta_sanitizers gives it a sanitiser.
		 *
		 * @since 1.1.0
		 *
		 * @param string[] $keys      Meta keys.
		 * @param string   $post_type slms_course, slms_unit, slms_lesson or slms_quiz.
		 */
		$keys = apply_filters( 'accessnow_slms_export_meta_keys', $keys, $post_type );
		return array_values( array_unique( array_filter( (array) $keys, 'is_string' ) ) );
	}

	/**
	 * Meta key => sanitiser for importing one post type. Keys without one are not imported.
	 *
	 * @param string $post_type slms_course, slms_unit, slms_lesson or slms_quiz.
	 * @return array<string, callable>
	 */
	public static function meta_sanitizers( $post_type ) {
		$maps = array(
			'slms_course' => array(
				'_slms_progression_mode'    => array( __CLASS__, 'sanitize_choice_progression' ),
				'_slms_enrollment_mode'     => array( __CLASS__, 'sanitize_choice_enrollment' ),
				'_slms_content_change_mode' => array( __CLASS__, 'sanitize_choice_change_mode' ),
				'_slms_course_language'     => array( __CLASS__, 'sanitize_choice_language' ),
				'_slms_featured'            => array( __CLASS__, 'sanitize_flag' ),
				Lesson_Header::META         => array( __CLASS__, 'sanitize_header_style' ),
			),
			'slms_unit'   => array(
				'_slms_sort_order'  => array( __CLASS__, 'sanitize_absint' ),
				Lesson_Header::META => array( __CLASS__, 'sanitize_header_style' ),
			),
			'slms_lesson' => array(
				'_slms_sort_order'   => array( __CLASS__, 'sanitize_absint' ),
				'_slms_content_type' => array( __CLASS__, 'sanitize_choice_content_type' ),
				'_slms_video_url'    => array( __CLASS__, 'sanitize_url' ),
				Lesson_Header::META  => array( __CLASS__, 'sanitize_header_style' ),
			),
			'slms_quiz'   => array(
				'_slms_pass_threshold'      => array( __CLASS__, 'sanitize_threshold' ),
				'_slms_max_retries'         => array( __CLASS__, 'sanitize_intval' ),
				'_slms_time_limit'          => array( __CLASS__, 'sanitize_absint' ),
				'_slms_randomize_questions' => array( __CLASS__, 'sanitize_flag' ),
				'_slms_randomize_options'   => array( __CLASS__, 'sanitize_flag' ),
				'_slms_show_answers'        => array( __CLASS__, 'sanitize_show_answers' ),
				'_slms_questions'           => array( __CLASS__, 'sanitize_questions' ),
			),
		);
		$map = isset( $maps[ $post_type ] ) ? $maps[ $post_type ] : array();

		/**
		 * Meta key => sanitiser (a callable taking the imported value) for importing one post type.
		 * Imported files are untrusted: a key with no sanitiser here is not imported.
		 *
		 * @since 1.1.0
		 *
		 * @param array<string, callable> $map       Sanitisers.
		 * @param string                  $post_type slms_course, slms_unit, slms_lesson or slms_quiz.
		 */
		$map = apply_filters( 'accessnow_slms_import_meta_sanitizers', $map, $post_type );
		return array_filter( (array) $map, 'is_callable' );
	}

	/* ─── Gather Course Data ──────────────────────────────────── */

	public static function gather_course_data( $course_id ) {
		$course = get_post( $course_id );

		$data = array(
			'export_version' => '1.0',
			'plugin_version' => ACCESSNOW_SLMS_VERSION,
			'exported_at'    => current_time( 'mysql' ),
			'course'         => self::serialize_post( $course, self::meta_keys( 'slms_course' ) ),
			'units'          => array(),
		);

		// Course thumbnail
		$thumb_id = get_post_thumbnail_id( $course_id );
		if ( $thumb_id ) {
			$data['course']['thumbnail'] = self::serialize_attachment( $thumb_id );
		}

		// Units
		$units = Progress::get_course_units( $course_id, 'any' );

		foreach ( $units as $unit ) {
			$unit_data            = self::serialize_post( $unit, self::meta_keys( 'slms_unit' ) );
			$unit_data['lessons'] = array();
			$unit_thumb           = get_post_thumbnail_id( $unit->ID );
			if ( $unit_thumb ) {
				$unit_data['thumbnail'] = self::serialize_attachment( $unit_thumb );
			}

			// Lessons
			$lessons = Progress::get_unit_lessons( $unit->ID, 'any' );

			foreach ( $lessons as $lesson ) {
				$lesson_data = self::serialize_post( $lesson, self::meta_keys( 'slms_lesson' ) );
				$lesson_thumb = get_post_thumbnail_id( $lesson->ID );
				if ( $lesson_thumb ) {
					$lesson_data['thumbnail'] = self::serialize_attachment( $lesson_thumb );
				}

				// Lesson attachments
				$attachment_ids = get_post_meta( $lesson->ID, '_slms_attachments', true );
				if ( is_array( $attachment_ids ) && ! empty( $attachment_ids ) ) {
					$lesson_data['attachments'] = array();
					foreach ( $attachment_ids as $att_id ) {
						$att = self::serialize_attachment( $att_id );
						if ( $att ) {
							$lesson_data['attachments'][] = $att;
						}
					}
				}

				// Quiz
				$quiz = get_posts(
					array(
						'post_type'      => 'slms_quiz',
						'posts_per_page' => 1,
						'post_status'    => 'any',
						'meta_key'       => '_slms_parent_lesson', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- course structure is stored as post meta.
						'meta_value'     => $lesson->ID, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- course structure is stored as post meta.
					)
				);

				if ( ! empty( $quiz ) ) {
					$quiz                = $quiz[0];
					$lesson_data['quiz'] = self::serialize_post( $quiz, self::meta_keys( 'slms_quiz' ) );
				}

				$unit_data['lessons'][] = $lesson_data;
			}

			$data['units'][] = $unit_data;
		}

		// Pictures and files used inside the course's and lessons' text, by their id on this site.
		$content = $course->post_content;
		foreach ( $units as $unit ) {
			foreach ( Progress::get_unit_lessons( $unit->ID, 'any' ) as $lesson ) {
				$content .= "\n" . $lesson->post_content;
			}
		}
		$data['content_media'] = array();
		foreach ( self::content_attachment_ids( $content ) as $att_id ) {
			$att = self::serialize_attachment( $att_id );
			if ( $att ) {
				$data['content_media'][] = $att + array(
					'id'  => $att_id,
					'url' => wp_get_attachment_url( $att_id ),
				);
			}
		}

		return $data;
	}

	public static function serialize_post( $post, $meta_keys = array() ) {
		$out = array(
			'title'   => $post->post_title,
			'content' => $post->post_content,
			'status'  => $post->post_status,
			'meta'    => array(),
		);
		foreach ( $meta_keys as $key ) {
			$out['meta'][ $key ] = get_post_meta( $post->ID, $key, true );
		}
		return $out;
	}

	public static function serialize_attachment( $attachment_id ) {
		$file_path = get_attached_file( $attachment_id );
		if ( ! $file_path || ! file_exists( $file_path ) ) {
			return null;
		}

		$post = get_post( $attachment_id );
		return array(
			'filename'  => basename( $file_path ),
			'mime_type' => $post ? $post->post_mime_type : '',
			'title'     => $post ? $post->post_title : '',
			'alt'       => get_post_meta( $attachment_id, '_wp_attachment_image_alt', true ),
		);
	}

	/* ─── Collect media file paths for ZIP ────────────────────── */

	private static function collect_media_files( $data ) {
		$media = array();

		// Course thumbnail
		if ( ! empty( $data['course']['thumbnail'] ) ) {
			$fname = $data['course']['thumbnail']['filename'];
			$path  = self::find_media_path( $fname );
			if ( $path ) {
				$media[ $fname ] = $path;
			}
		}

		// Pictures and files used in the course's and lessons' text
		foreach ( (array) ( $data['content_media'] ?? array() ) as $att ) {
			$path = self::find_media_path( $att['filename'] );
			if ( $path ) {
				$media[ $att['filename'] ] = $path;
			}
		}

		// Unit and lesson header images, lesson attachments
		foreach ( $data['units'] as $unit ) {
			$files = array();
			if ( ! empty( $unit['thumbnail'] ) ) {
				$files[] = $unit['thumbnail']['filename'];
			}
			foreach ( $unit['lessons'] as $lesson ) {
				if ( ! empty( $lesson['thumbnail'] ) ) {
					$files[] = $lesson['thumbnail']['filename'];
				}
			}
			foreach ( $files as $fname ) {
				$path = self::find_media_path( $fname );
				if ( $path ) {
					$media[ $fname ] = $path;
				}
			}
			foreach ( $unit['lessons'] as $lesson ) {
				if ( ! empty( $lesson['attachments'] ) ) {
					foreach ( $lesson['attachments'] as $att ) {
						$path = self::find_media_path( $att['filename'] );
						if ( $path ) {
							$media[ $att['filename'] ] = $path;
						}
					}
				}
			}
		}

		return $media;
	}

	/* ─── Strip media references from export data ──────────── */

	private static function strip_media_from_data( $data ) {
		// Remove course thumbnail and the pictures in the text (they then keep pointing at this site)
		unset( $data['course']['thumbnail'], $data['content_media'] );

		// Remove unit and lesson header images and lesson attachments
		foreach ( $data['units'] as &$unit ) {
			unset( $unit['thumbnail'] );
			foreach ( $unit['lessons'] as &$lesson ) {
				unset( $lesson['attachments'], $lesson['thumbnail'] );
			}
		}

		return $data;
	}

	private static function find_media_path( $filename ) {
		$upload_dir = wp_upload_dir();
		// Search common locations
		$base = $upload_dir['basedir'];

		// Try current year/month first, then glob
		$pattern = $base . '/*/' . $filename;
		$matches = glob( $base . '/*/*/' . $filename );
		if ( empty( $matches ) ) {
			$matches = glob( $base . '/' . $filename );
		}
		if ( ! empty( $matches ) ) {
			return $matches[0];
		}

		// Fallback: search by attachment post
		global $wpdb;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- one-off lookup while exporting.
		$attachment = $wpdb->get_var(
			$wpdb->prepare(
				"SELECT meta_value FROM {$wpdb->postmeta} pm
             JOIN {$wpdb->posts} p ON p.ID = pm.post_id
             WHERE pm.meta_key = '_wp_attached_file'
             AND p.post_type = 'attachment'
             AND pm.meta_value LIKE %s
             LIMIT 1",
				'%' . $wpdb->esc_like( $filename )
			)
		);

		if ( $attachment ) {
			$full = $base . '/' . $attachment;
			if ( file_exists( $full ) ) {
				return $full;
			}
		}

		return null;
	}

	/* ─── Import Handler ──────────────────────────────────────── */

	/** Largest course.json accepted from an import file (bytes). */
	const MAX_JSON_BYTES = 10485760;

	/** Largest single media file accepted from an import file (bytes, uncompressed). */
	const MAX_MEDIA_BYTES = 268435456;

	/**
	 * Files imported so far in this import, by file name, so each is imported once.
	 *
	 * @var array<string, int>
	 */
	private static $imported_media = array();

	private static function notice_key() {
		return 'accessnow_slms_import_notice_' . get_current_user_id();
	}

	private static function import_redirect( $message, $type = 'error' ) {
		set_transient(
			self::notice_key(),
			array(
				'type'    => $type,
				'message' => $message,
			),
			30
		);
		wp_safe_redirect( admin_url( 'admin.php?page=slms-export-import' ) );
		exit;
	}

	public static function handle_import() {
		// Only ever act on our own admin page, and only for users allowed to import.
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- routing check only; the nonce is verified below.
		$page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
		if ( 'slms-export-import' !== $page || ! current_user_can( 'manage_options' ) ) {
			return;
		}

		// Detect post_max_size overflow: $_POST is empty but content was sent.
		$method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '';
		if ( 'POST' === $method && empty( $_POST ) && isset( $_SERVER['CONTENT_LENGTH'] ) && (int) $_SERVER['CONTENT_LENGTH'] > 0 ) {
			$max = ini_get( 'post_max_size' );
			self::import_redirect(
				/* translators: %s: PHP post_max_size value, e.g. "8M". */
				sprintf( __( 'Error: The uploaded file exceeds the server limit (%s). Increase upload_max_filesize and post_max_size in php.ini, or use a smaller export.', 'accessnow-lms' ), $max )
			);
		}

		if ( ! isset( $_POST['slms_do_import'] ) ) {
			return;
		}
		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['accessnow_slms_import_nonce'] ?? '' ) ), 'accessnow_slms_import_course' ) ) {
			wp_die( esc_html__( 'Security check failed.', 'accessnow-lms' ) );
		}

        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- file array validated field by field below.
		$file = isset( $_FILES['slms_import_file'] ) && is_array( $_FILES['slms_import_file'] ) ? $_FILES['slms_import_file'] : array();
		if ( empty( $file['tmp_name'] ) || ! isset( $file['error'] ) || UPLOAD_ERR_OK !== $file['error'] || ! is_uploaded_file( $file['tmp_name'] ) ) {
			self::import_redirect( __( 'Error: No file uploaded or upload failed.', 'accessnow-lms' ) );
		}

		// Validate type and size; never trust the client-supplied name beyond its extension.
		$ext = strtolower( pathinfo( sanitize_file_name( $file['name'] ?? '' ), PATHINFO_EXTENSION ) );
		if ( 'zip' !== $ext ) {
			self::import_redirect( __( 'Error: Please upload a .zip file.', 'accessnow-lms' ) );
		}
		if ( (int) ( $file['size'] ?? 0 ) <= 0 || (int) $file['size'] > wp_max_upload_size() ) {
			self::import_redirect( __( 'Error: No file uploaded or upload failed.', 'accessnow-lms' ) );
		}

		$zip = new \ZipArchive();
		if ( true !== $zip->open( $file['tmp_name'], \ZipArchive::CHECKCONS ) ) {
			self::import_redirect( __( 'Error: Could not open ZIP file.', 'accessnow-lms' ) );
		}

		// Read course.json straight from the archive: nothing is extracted to disk.
		$stat = $zip->statName( 'course.json' );
		if ( ! $stat ) {
			$zip->close();
			self::import_redirect( __( 'Error: Invalid export file — course.json not found.', 'accessnow-lms' ) );
		}
		if ( $stat['size'] > self::MAX_JSON_BYTES ) {
			$zip->close();
			self::import_redirect( __( 'Error: Invalid or corrupt course data.', 'accessnow-lms' ) );
		}

		$data = json_decode( (string) $zip->getFromName( 'course.json' ), true );
		if ( ! is_array( $data ) || empty( $data['course'] ) || ! is_array( $data['course'] ) ) {
			$zip->close();
			self::import_redirect( __( 'Error: Invalid or corrupt course data.', 'accessnow-lms' ) );
		}

		// Version compatibility checks
		$export_format  = isset( $data['export_version'] ) ? sanitize_text_field( (string) $data['export_version'] ) : '0';
		$export_plugin  = isset( $data['plugin_version'] ) ? sanitize_text_field( (string) $data['plugin_version'] ) : 'unknown';
		$current_plugin = ACCESSNOW_SLMS_VERSION;

		// Block if export format is from a future major version
		if ( version_compare( $export_format, '2.0', '>=' ) ) {
			$zip->close();
			self::import_redirect(
				/* translators: %s: export format version. */
				sprintf( __( 'Error: This file was created with export format v%s which is not supported by this version. Please update AccessNow LMS and try again.', 'accessnow-lms' ), $export_format )
			);
		}

		// Warn (but allow) if plugin versions differ
		$version_warning = '';
		if ( $export_plugin !== $current_plugin ) {
			$version_warning = sprintf(
				/* translators: 1: plugin version that made the export, 2: plugin version on this site. */
				__( ' Note: exported from plugin v%1$s, this site runs v%2$s. Please verify the imported content.', 'accessnow-lms' ),
				$export_plugin,
				$current_plugin
			);
		}

		$result = self::import_course_data( $data, $zip );
		$zip->close();

		if ( is_wp_error( $result ) ) {
			self::import_redirect( 'Error: ' . $result->get_error_message() );
		}

		self::import_redirect(
			/* translators: %s: course title. */
			sprintf( __( 'Course "%s" imported successfully.', 'accessnow-lms' ), sanitize_text_field( (string) $data['course']['title'] ) ) . $version_warning,
			'' === $version_warning ? 'success' : 'warning'
		);
	}

	/* ─── Import sanitising helpers ───────────────────────────── */

	private static function import_status( $status, $fallback ) {
		$status = is_string( $status ) ? sanitize_key( $status ) : '';
		return in_array( $status, array( 'publish', 'draft', 'pending', 'private' ), true ) ? $status : $fallback;
	}

	private static function import_text( $value ) {
		return is_scalar( $value ) ? sanitize_text_field( (string) $value ) : '';
	}

	private static function import_html( $value ) {
		return is_scalar( $value ) ? wp_kses_post( (string) $value ) : '';
	}

	/**
	 * Only known AccessNow LMS meta keys are imported, each with its own sanitiser.
	 */
	private static function import_meta( $post_id, $meta, $allowed ) {
		if ( ! is_array( $meta ) ) {
			return;
		}
		foreach ( $allowed as $key => $sanitize ) {
			if ( ! array_key_exists( $key, $meta ) ) {
				continue;
			}
			$value = call_user_func( $sanitize, $meta[ $key ] );
			if ( null === $value ) {
				continue;
			}
			update_post_meta( $post_id, $key, wp_slash( $value ) );
		}
	}

	public static function sanitize_choice_progression( $value ) {
		return Course_Meta::sanitize_choice( '_slms_progression_mode', $value );
	}

	public static function sanitize_choice_enrollment( $value ) {
		return Course_Meta::sanitize_choice( '_slms_enrollment_mode', $value );
	}

	public static function sanitize_choice_change_mode( $value ) {
		return Course_Meta::sanitize_choice( '_slms_content_change_mode', $value );
	}

	public static function sanitize_choice_language( $value ) {
		return Course_Meta::sanitize_choice( '_slms_course_language', $value );
	}

	public static function sanitize_choice_content_type( $value ) {
		return in_array( $value, array( 'text', 'video' ), true ) ? $value : null;
	}

	public static function sanitize_flag( $value ) {
		return empty( $value ) ? 0 : 1;
	}

	public static function sanitize_absint( $value ) {
		return is_scalar( $value ) ? absint( $value ) : 0;
	}

	public static function sanitize_intval( $value ) {
		return is_scalar( $value ) ? intval( $value ) : 0;
	}

	public static function sanitize_threshold( $value ) {
		return is_scalar( $value ) ? min( 100, absint( $value ) ) : 0;
	}

	public static function sanitize_url( $value ) {
		return is_string( $value ) ? esc_url_raw( $value ) : '';
	}

	public static function sanitize_header_style( $value ) {
		$style = Lesson_Header::sanitize_style( $value );
		return '' === $style ? null : $style;
	}

	public static function sanitize_show_answers( $value ) {
		return is_string( $value ) && in_array( $value, Quiz_Engine::SHOW_ANSWERS, true ) ? $value : null;
	}

	/** Set a unit's or lesson's header image from the export data, if the file is in the ZIP. */
	private static function import_thumbnail( $post_id, $post_data, $zip ) {
		if ( ! empty( $post_data['thumbnail'] ) && is_array( $post_data['thumbnail'] ) ) {
			$att_id = self::import_media_file( $post_data['thumbnail'], $zip );
			if ( $att_id ) {
				set_post_thumbnail( $post_id, $att_id );
			}
		}
	}

	public static function sanitize_questions( $value ) {
		return is_array( $value ) ? Quiz_Meta::sanitize_questions( $value ) : array();
	}

	/* ─── Import Course Data ──────────────────────────────────── */

	private static function import_course_data( $data, $zip ) {
		self::$imported_media = array();
		$course_data          = $data['course'];
		$with_content         = array(); // Imported posts whose text may hold pictures.

		// Create course
		$course_id = wp_insert_post(
			wp_slash( array(
				'post_type'    => 'slms_course',
				'post_title'   => self::import_text( $course_data['title'] ?? '' ),
				'post_content' => self::import_html( $course_data['content'] ?? '' ),
				'post_status'  => self::import_status( $course_data['status'] ?? '', 'draft' ),
			) ),
			true
		);

		if ( is_wp_error( $course_id ) ) {
			return $course_id;
		}
		$with_content[] = $course_id;

		// Course meta
		self::import_meta(
			$course_id,
			$course_data['meta'] ?? array(),
			self::meta_sanitizers( 'slms_course' )
		);

		// Course thumbnail
		if ( ! empty( $course_data['thumbnail'] ) && is_array( $course_data['thumbnail'] ) ) {
			$att_id = self::import_media_file( $course_data['thumbnail'], $zip );
			if ( $att_id ) {
				set_post_thumbnail( $course_id, $att_id );
			}
		}

		// Units
		if ( ! empty( $data['units'] ) && is_array( $data['units'] ) ) {
			foreach ( $data['units'] as $unit_data ) {
				if ( ! is_array( $unit_data ) ) {
					continue;
				}

				$unit_id = wp_insert_post(
					wp_slash( array(
						'post_type'   => 'slms_unit',
						'post_title'  => self::import_text( $unit_data['title'] ?? '' ),
						'post_status' => self::import_status( $unit_data['status'] ?? '', 'publish' ),
					) ),
					true
				);

				if ( is_wp_error( $unit_id ) ) {
					continue;
				}

				// Unit meta
				update_post_meta( $unit_id, '_slms_parent_course', $course_id );
				self::import_meta(
					$unit_id,
					$unit_data['meta'] ?? array(),
					self::meta_sanitizers( 'slms_unit' )
				);
				self::import_thumbnail( $unit_id, $unit_data, $zip );

				// Lessons
				if ( empty( $unit_data['lessons'] ) || ! is_array( $unit_data['lessons'] ) ) {
					continue;
				}

				foreach ( $unit_data['lessons'] as $lesson_data ) {
					if ( ! is_array( $lesson_data ) ) {
						continue;
					}

					$lesson_id = wp_insert_post(
						wp_slash( array(
							'post_type'    => 'slms_lesson',
							'post_title'   => self::import_text( $lesson_data['title'] ?? '' ),
							'post_content' => self::import_html( $lesson_data['content'] ?? '' ),
							'post_status'  => self::import_status( $lesson_data['status'] ?? '', 'publish' ),
						) ),
						true
					);

					if ( is_wp_error( $lesson_id ) ) {
						continue;
					}
					$with_content[] = $lesson_id;

					// Lesson meta — parent is the new unit
					update_post_meta( $lesson_id, '_slms_parent_unit', $unit_id );
					self::import_meta(
						$lesson_id,
						$lesson_data['meta'] ?? array(),
						self::meta_sanitizers( 'slms_lesson' )
					);
					self::import_thumbnail( $lesson_id, $lesson_data, $zip );

					// Lesson attachments
					if ( ! empty( $lesson_data['attachments'] ) && is_array( $lesson_data['attachments'] ) ) {
						$new_att_ids = array();
						foreach ( $lesson_data['attachments'] as $att_info ) {
							$att_id = is_array( $att_info ) ? self::import_media_file( $att_info, $zip ) : null;
							if ( $att_id ) {
								$new_att_ids[] = $att_id;
							}
						}
						if ( ! empty( $new_att_ids ) ) {
							update_post_meta( $lesson_id, '_slms_attachments', $new_att_ids );
						}
					}

					// Quiz
					if ( ! empty( $lesson_data['quiz'] ) && is_array( $lesson_data['quiz'] ) ) {
						$quiz_data = $lesson_data['quiz'];
						$quiz_id   = wp_insert_post(
							wp_slash( array(
								'post_type'   => 'slms_quiz',
								'post_title'  => self::import_text( $quiz_data['title'] ?? '' ),
								'post_status' => self::import_status( $quiz_data['status'] ?? '', 'publish' ),
							) ),
							true
						);

						if ( ! is_wp_error( $quiz_id ) ) {
							update_post_meta( $quiz_id, '_slms_parent_lesson', $lesson_id );
							self::import_meta(
								$quiz_id,
								$quiz_data['meta'] ?? array(),
								self::meta_sanitizers( 'slms_quiz' )
							);
						}
					}
				}
			}
		}

		self::import_content_media( $data, $zip, $with_content );

		return $course_id;
	}

	/**
	 * Imports the pictures and files used in the text, and points the imported text at them.
	 *
	 * @param array             $data  Export data.
	 * @param \ZipArchive|null $zip   The archive.
	 * @param int[]             $posts The imported course and lessons.
	 */
	private static function import_content_media( $data, $zip, array $posts ) {
		$map = array();
		foreach ( (array) ( $data['content_media'] ?? array() ) as $att ) {
			if ( ! is_array( $att ) || empty( $att['id'] ) ) {
				continue;
			}
			$new_id = self::import_media_file( $att, $zip );
			if ( $new_id ) {
				$map[] = array(
					'old_id'  => absint( $att['id'] ),
					'new_id'  => (int) $new_id,
					'old_url' => esc_url_raw( (string) ( $att['url'] ?? '' ) ),
					'new_url' => (string) wp_get_attachment_url( $new_id ),
				);
			}
		}
		if ( ! $map ) {
			return;
		}
		foreach ( $posts as $post_id ) {
			$old = get_post_field( 'post_content', $post_id );
			$new = self::rewrite_content_media( $old, $map );
			if ( $new !== $old ) {
				wp_update_post(
					array(
						'ID'           => $post_id,
						'post_content' => wp_slash( $new ),
					)
				);
			}
		}
	}

	/**
	 * Points content at imported copies of its pictures: block ids, wp-image-N classes and file
	 * addresses (resized copies point at the new full-size file).
	 *
	 * @param string $html Post content.
	 * @param array  $map  Rows of old_id, new_id, old_url, new_url.
	 * @return string
	 */
	public static function rewrite_content_media( $html, array $map ) {
		// Through placeholders, so an old id that equals another row's new id is never rewritten twice.
		foreach ( $map as $i => $row ) {
			$token = "\x01slms-media-{$i}\x01";
			$html  = preg_replace( '/\bwp-image-' . $row['old_id'] . '\b/', 'wp-image-' . $token, $html );
			$html  = preg_replace( '/(<!-- wp:(?:image|cover|media-text|file|video|audio|gallery)\s+\{[^}]*?"id":)' . $row['old_id'] . '\b/', '${1}' . $token, $html );
			if ( '' !== $row['old_url'] && preg_match( '/^(.*)(\.\w+)$/', $row['old_url'], $u ) ) {
				$html = preg_replace( '#' . preg_quote( $u[1], '#' ) . '(?:-\d+x\d+)?' . preg_quote( $u[2], '#' ) . '#', "\x02slms-url-{$i}\x02", $html );
			}
		}
		foreach ( $map as $i => $row ) {
			$html = str_replace( array( "\x01slms-media-{$i}\x01", "\x02slms-url-{$i}\x02" ), array( (string) $row['new_id'], $row['new_url'] ), $html );
		}
		return $html;
	}

	/* ─── Import a single media file into the WP Media Library ── */

	private static function import_media_file( $att_info, $zip ) {
		// Never trust the supplied name: strip any path and sanitise it.
		$filename = sanitize_file_name( wp_basename( self::import_text( $att_info['filename'] ?? '' ) ) );
		if ( '' === $filename ) {
			return null;
		}
		// A file used twice in one course (a header image that is also in a lesson) is imported once.
		if ( isset( self::$imported_media[ $filename ] ) ) {
			return self::$imported_media[ $filename ];
		}

		// Only file types this site allows in the Media Library.
		$check = wp_check_filetype( $filename );
		if ( empty( $check['type'] ) ) {
			return null;
		}

		if ( ! $zip instanceof \ZipArchive ) {
			return null; // No archive to read the file from.
		}

		$entry = 'media/' . $filename;
		$stat  = $zip->statName( $entry );
		if ( ! $stat || $stat['size'] <= 0 || $stat['size'] > self::MAX_MEDIA_BYTES ) {
			return null;
		}

		$contents = $zip->getFromName( $entry );
		if ( false === $contents ) {
			return null;
		}

		// wp_upload_bits() re-checks the type against the allowed list and picks a unique name.
		$upload = wp_upload_bits( $filename, null, $contents );
		unset( $contents );
		if ( ! empty( $upload['error'] ) || empty( $upload['file'] ) ) {
			return null;
		}

		// Verify the real content matches the extension (e.g. images really are images).
		$real = wp_check_filetype_and_ext( $upload['file'], $filename );
		if ( empty( $real['type'] ) ) {
			wp_delete_file( $upload['file'] );
			return null;
		}

		$attachment_id = wp_insert_attachment(
			array(
				'post_title'     => self::import_text( $att_info['title'] ?? '' ) ?: pathinfo( $filename, PATHINFO_FILENAME ),
				'post_mime_type' => $real['type'],
				'post_status'    => 'inherit',
			),
			$upload['file']
		);

		if ( is_wp_error( $attachment_id ) || ! $attachment_id ) {
			wp_delete_file( $upload['file'] );
			return null;
		}

		require_once ABSPATH . 'wp-admin/includes/image.php';
		$metadata = wp_generate_attachment_metadata( $attachment_id, $upload['file'] );
		wp_update_attachment_metadata( $attachment_id, $metadata );

		$alt = self::import_text( $att_info['alt'] ?? '' );
		if ( '' !== $alt ) {
			update_post_meta( $attachment_id, '_wp_attachment_image_alt', $alt );
		}

		self::$imported_media[ $filename ] = (int) $attachment_id;
		return $attachment_id;
	}
}
' . esc_html__( 'Select Course', 'accessnow-lms' ) . '	'; echo '
' . esc_html__( 'Include Media', 'accessnow-lms' ) . '	'; echo ' '; echo esc_html__( 'Include header images, downloads and the pictures in lesson text', 'accessnow-lms' ) . ''; echo ' ' . esc_html__( 'Untick for the text and settings only: a much smaller file, whose pictures keep pointing at this site.', 'accessnow-lms' ) . ' '; echo '