<?php
namespace Admirly\Wp;

use Admirly\Plugin;

/**
 * Three-step setup wizard: sector preset → basics → pages.
 */
final class Wizard {
	public const PAGE  = 'admirly-setup';
	public const NONCE = 'admirly_wizard';

	public function register(): void {
		add_action( 'admin_menu', [ $this, 'page' ] );
		add_action( 'admin_init', [ $this, 'maybeRedirect' ] );
		add_action( 'admin_post_admirly_wizard', [ $this, 'handle' ] );
	}

	public function page(): void {
		add_submenu_page( null, __( 'Admirly setup', 'admirly' ), __( 'Admirly setup', 'admirly' ), 'manage_options', self::PAGE, [ $this, 'render' ] );
	}

	public function maybeRedirect(): void {
		if ( ! get_transient( 'admirly_do_activation_redirect' ) ) {
			return;
		}
		delete_transient( 'admirly_do_activation_redirect' );
		if ( get_option( 'admirly_wizard_done' ) || ! current_user_can( 'manage_options' ) || isset( $_GET['activate-multi'] ) || wp_doing_ajax() ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only activation context
			return;
		}
		wp_safe_redirect( self::url( 1 ) );
		exit;
	}

	public static function url( int $step ): string {
		return admin_url( 'admin.php?page=' . self::PAGE . '&step=' . $step );
	}

	public function render(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		$step = max( 1, min( 4, absint( $_GET['step'] ?? 1 ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only step number
		Shortcodes::display(
			'admin/wizard',
			[
				'step'    => $step,
				'presets' => Plugin::presets(),
				'opts'    => Settings::all(),
			]
		);
	}

	public function handle(): void {
		$nonce = sanitize_text_field( wp_unslash( (string) ( $_POST['_wpnonce'] ?? '' ) ) );
		if ( ! current_user_can( 'manage_options' ) || ! wp_verify_nonce( $nonce, self::NONCE ) ) {
			wp_die( esc_html__( 'Not allowed.', 'admirly' ) );
		}
		$step = absint( $_POST['step'] ?? 1 );
		$opts = Settings::all();

		if ( $step === 1 ) {
			$key                 = sanitize_key( (string) ( $_POST['preset'] ?? 'blank' ) );
			$p                   = Plugin::preset( $key ) ?: Plugin::preset( 'blank' );
			$key                 = Plugin::preset( $key ) ? $key : 'blank';
			$opts['preset']      = $key;
			$opts['fields']      = $p['fields'];
			$opts['form_title']  = $p['form_title'];
			$opts['thanks_text'] = $p['thanks_text'];
		} elseif ( $step === 2 ) {
			$opts['privacy_page_id'] = absint( $_POST['privacy_page_id'] ?? 0 );
			$color                   = sanitize_hex_color( wp_unslash( (string) ( $_POST['color'] ?? '' ) ) );
			if ( $color ) {
				$opts['color'] = $color;
			}
			/** Nonce verified above; extensions read their own posted fields. @param array<string,mixed> $opts */
			$opts = (array) apply_filters( 'admirly_wizard_step2_options', $opts );
		} elseif ( $step === 3 ) {
			$opts['wall_page_id'] = $this->ensurePage( absint( $_POST['wall_page_id'] ?? 0 ), sanitize_text_field( wp_unslash( (string) ( $_POST['wall_title'] ?? '' ) ) ), '<!-- wp:admirly/wall /-->' );
			$opts['form_page_id'] = $this->ensurePage( absint( $_POST['form_page_id'] ?? 0 ), sanitize_text_field( wp_unslash( (string) ( $_POST['form_page_title'] ?? '' ) ) ), '<!-- wp:admirly/form /-->' );
			update_option( 'admirly_wizard_done', 1 );
		}

		update_option( Plugin::OPTION, $opts );
		wp_safe_redirect( self::url( min( 4, $step + 1 ) ) );
		exit;
	}

	/** Uses an existing page id, or creates a published page containing the block. */
	private function ensurePage( int $existing, string $title, string $content ): int {
		if ( $existing > 0 && get_post_status( $existing ) ) {
			return $existing;
		}
		if ( $title === '' ) {
			return 0;
		}
		$id = wp_insert_post(
			[
				'post_type'    => 'page',
				'post_status'  => 'publish',
				'post_title'   => $title,
				'post_content' => $content,
			],
			true
		);
		return is_wp_error( $id ) ? 0 : (int) $id;
	}
}