<?php
defined('ABSPATH') || exit();
final class APEARI_Settings
{
    public static function migrate(): void
    {
        if (get_option('apeari_initialized', false)) {
            return;
        }
        foreach (['openai', 'anthropic'] as $provider) {
            foreach (['model', 'router_model'] as $field) {
                $value = get_option('aih_' . $provider . '_' . $field, '');
                if (is_string($value)) {
                    update_option('apeari_' . $provider . '_' . $field, $value, false);
                }
            }
            $stored = get_option('aih_secret_' . $provider, '');
            if (is_string($stored) && str_starts_with($stored, 'v1:') && function_exists('openssl_decrypt')) {
                $binary = base64_decode(substr($stored, 3), true);
                if (is_string($binary) && strlen($binary) > 28) {
                    $key = hash(
                        'sha256',
                        'ai-helper/byok/v1|' .
                            get_current_blog_id() .
                            '|' .
                            wp_salt('auth') .
                            '|' .
                            wp_salt('secure_auth'),
                        true,
                    );
                    $plain = openssl_decrypt(
                        substr($binary, 28),
                        'aes-256-gcm',
                        $key,
                        OPENSSL_RAW_DATA,
                        substr($binary, 0, 12),
                        substr($binary, 12, 16),
                        $provider,
                    );
                    if (is_string($plain) && $plain !== '') {
                        $cipher = APEARI_Provider_Secrets::encrypt($provider, $plain);
                        if (!is_wp_error($cipher)) {
                            update_option('apeari_secret_' . $provider, $cipher, false);
                        }
                    }
                }
            }
        }
        add_option('apeari_mode', 'apeari', '', false);
        update_option('apeari_ai_consent', false, false);
        update_option('apeari_initialized', true, false);
    }
    public static function update(array $input)
    {
        if (!current_user_can('manage_options')) {
            return new WP_Error('apeari_settings', __('Brak dostępu.', 'apeari'));
        }
        $input = APEARI_Settings_UI::normalize($input);
        $mode = $input['mode'] ?? 'demo';
        if (!is_string($mode) || !in_array($mode, ['demo', 'openai', 'anthropic', 'apeari'], true)) {
            return new WP_Error('apeari_settings', __('Nieprawidłowy dostawca.', 'apeari'));
        }
        $consent = ($input['consent'] ?? '') === '1';
        if ($mode !== 'demo' && !$consent) {
            return new WP_Error(
                'apeari_settings',
                __('Potwierdź przesyłanie wybranego kontekstu do dostawcy AI.', 'apeari'),
            );
        }
        $changes = [];
        $service_consent = ($input['service_consent'] ?? '') === '1';
        $installation = $input['apeari_key'] ?? '';
        $delete_installation = ($input['apeari_delete'] ?? '') === '1';
        if (
            !is_string($installation) ||
            ($installation !== '' && !preg_match('/^apeari_lite_[A-Za-z0-9_-]{43}$/D', $installation)) ||
            ($installation && $delete_installation)
        ) {
            return new WP_Error('apeari_settings', __('Nieprawidłowy token instalacji Lite.', 'apeari'));
        }
        if (
            $mode === 'apeari' &&
            (!$service_consent ||
                (!$installation && ($delete_installation || !APEARI_Providers::has_key('apeari'))))
        ) {
            return new WP_Error(
                'apeari_settings',
                __('Uzupełnij token Lite oraz zgodę na usługę Apeari.', 'apeari'),
            );
        }
        $installation_cipher = $installation
            ? APEARI_Provider_Secrets::encrypt('apeari', $installation)
            : null;
        if (is_wp_error($installation_cipher)) {
            return $installation_cipher;
        }
        foreach (['openai', 'anthropic'] as $provider) {
            $key = $input[$provider . '_key'] ?? '';
            $model = $input[$provider . '_model'] ?? '';
            $fast = $input[$provider . '_router_model'] ?? '';
            if (
                !is_string($key) ||
                !is_string($model) ||
                !is_string($fast) ||
                ($key && (strlen($key) < 20 || strlen($key) > 1024 || preg_match('/\s/', $key)))
            ) {
                return new WP_Error('apeari_settings', __('Nieprawidłowy klucz API.', 'apeari'));
            }
            foreach ([$model, $fast] as $value) {
                if ($value && !preg_match('/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/', $value)) {
                    return new WP_Error('apeari_settings', __('Nieprawidłowy model.', 'apeari'));
                }
            }
            $delete = ($input[$provider . '_delete'] ?? '') === '1';
            if ($key && $delete) {
                return new WP_Error('apeari_settings', __('Wybierz zapis albo usunięcie klucza.', 'apeari'));
            }
            $secret = $key ? APEARI_Provider_Secrets::encrypt($provider, $key) : null;
            if (is_wp_error($secret)) {
                return $secret;
            }
            if (
                $mode === $provider &&
                (!$model || (!$key && ($delete || !APEARI_Providers::has_key($provider))))
            ) {
                return new WP_Error(
                    'apeari_settings',
                    __('Uzupełnij klucz i model wybranego dostawcy.', 'apeari'),
                );
            }
            $changes[$provider] = compact('secret', 'delete', 'model', 'fast');
        }
        foreach ($changes as $provider => $change) {
            if ($change['delete']) {
                delete_option('apeari_secret_' . $provider);
            } elseif ($change['secret']) {
                update_option('apeari_secret_' . $provider, $change['secret'], false);
            }
            update_option('apeari_' . $provider . '_model', $change['model'], false);
            update_option('apeari_' . $provider . '_router_model', $change['fast'], false);
        }
        update_option('apeari_mode', $mode, false);
        if ($delete_installation) {
            delete_option('apeari_secret_apeari');
        } elseif ($installation_cipher) {
            update_option('apeari_secret_apeari', $installation_cipher, false);
        }
        update_option('apeari_service_consent', $service_consent, false);
        update_option('apeari_service_consent_version', $service_consent ? '2026-10-18-lite-1' : '', false);
        update_option('apeari_ai_consent', $consent, false);
        return true;
    }
    public static function save(): void
    {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('Brak dostępu.', 'apeari'), '', ['response' => 403]);
        }
        check_admin_referer('apeari_settings');
        $result = self::update(wp_unslash($_POST));
        if (is_wp_error($result)) {
            wp_die(esc_html($result->get_error_message()));
        }
        wp_safe_redirect(admin_url('options-general.php?page=apeari-settings&saved=1'));
        exit();
    }
    public static function render(): void
    {
        if (!current_user_can('manage_options')) {
            return;
        }
        require APEARI_PATH . 'views/settings.php';
    }
}