<?php
/**
 * Two-factor authentication (2FA) screens outside the sign-in form.
 *
 * @package Aslansheed\OTP
 */

namespace Aslansheed\OTP\Frontend;

use Aslansheed\OTP\Auth\Two_Factor;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Lets users manage their authenticator on their profile, on the WooCommerce
 * account page and through a shortcode, and lets administrators reset it.
 */
final class Two_Factor_Ui {

	const SCRIPT = 'aslansheed-otp-twofa';

	/**
	 * Registers the hooks.
	 *
	 * @return void
	 */
	public static function register() {
		add_shortcode( 'aslansheed_two_factor', array( __CLASS__, 'shortcode' ) );
		add_action( 'show_user_profile', array( __CLASS__, 'profile_section' ) );
		add_action( 'edit_user_profile', array( __CLASS__, 'profile_section' ) );
		add_action( 'edit_user_profile_update', array( __CLASS__, 'save_profile' ) );
		add_action( 'personal_options_update', array( __CLASS__, 'save_profile' ) );
		add_action( 'woocommerce_account_dashboard', array( __CLASS__, 'account_section' ), 20 );
	}

	/**
	 * Returns every text the scripts need for the second step.
	 *
	 * @return array<string, string>
	 */
	public static function strings() {
		return array(
			'tf_title'          => __( 'Two-factor authentication (2FA)', 'aslansheed-login' ),
			'tf_hint'           => __( 'Enter the 6-digit code from your authenticator app.', 'aslansheed-login' ),
			'tf_code'           => __( 'Authentication code', 'aslansheed-login' ),
			'tf_use_recovery'   => __( 'Use a recovery code instead', 'aslansheed-login' ),
			'tf_use_app'        => __( 'Use the authenticator app instead', 'aslansheed-login' ),
			'tf_recovery_label' => __( 'Recovery code', 'aslansheed-login' ),
			'tf_recovery_hint'  => __( 'Enter one of the recovery codes you saved. Each one works once.', 'aslansheed-login' ),
			'tf_setup_title'    => __( 'Secure your account', 'aslansheed-login' ),
			'tf_setup_required' => __( 'This site requires 2FA. Scan the QR code with Google Authenticator or a similar app, then enter the 6-digit code it shows.', 'aslansheed-login' ),
			'tf_setup_offered'  => __( 'Add a second step to keep your account safe. Scan the QR code with Google Authenticator or a similar app, then enter the 6-digit code it shows.', 'aslansheed-login' ),
			'tf_cant_scan'      => __( 'Cannot scan the code? Enter this key in your app instead:', 'aslansheed-login' ),
			'tf_enable'         => __( 'Turn on', 'aslansheed-login' ),
			'tf_not_now'        => __( 'Not now', 'aslansheed-login' ),
			'tf_codes_title'    => __( 'Save your recovery codes', 'aslansheed-login' ),
			'tf_codes_hint'     => __( 'If you lose your phone, each of these codes lets you sign in once. They are shown only now, so keep them somewhere safe.', 'aslansheed-login' ),
			'tf_copy'           => __( 'Copy codes', 'aslansheed-login' ),
			'tf_copied'         => __( 'Copied', 'aslansheed-login' ),
			'tf_continue'       => __( 'I saved them, continue', 'aslansheed-login' ),
			'tf_done'           => __( 'Done', 'aslansheed-login' ),
			'tf_on'             => __( 'Two-factor authentication (2FA) is on.', 'aslansheed-login' ),
			'tf_off'            => __( 'Two-factor authentication (2FA) is off.', 'aslansheed-login' ),
			/* translators: %d: number of recovery codes left. */
			'tf_left'           => __( 'Recovery codes left: %d', 'aslansheed-login' ),
			'tf_set_up'         => __( 'Set up an authenticator app', 'aslansheed-login' ),
			'tf_turn_off'       => __( 'Turn off', 'aslansheed-login' ),
			'tf_new_codes'      => __( 'Get new recovery codes', 'aslansheed-login' ),
			'tf_confirm_code'   => __( 'Enter a code from your app, or a recovery code, to confirm.', 'aslansheed-login' ),
			'tf_cancel'         => __( 'Cancel', 'aslansheed-login' ),
			'tf_required_note'  => __( 'This site requires 2FA, so it cannot be turned off.', 'aslansheed-login' ),
			'tf_unavailable'    => __( 'Two-factor authentication (2FA) is not available for your account.', 'aslansheed-login' ),
			'verify'            => __( 'Verify', 'aslansheed-login' ),
			'network'           => __( 'Connection problem. Please try again.', 'aslansheed-login' ),
		);
	}

	/**
	 * Registers the script handles.
	 *
	 * @return void
	 */
	public static function register_assets() {
		if ( ! wp_script_is( 'aslansheed-otp-qr', 'registered' ) ) {
			wp_register_script( 'aslansheed-otp-qr', ASLANSHEED_OTP_URL . 'assets/js/vendor/qrcode.js', array(), Assets::version( 'assets/js/vendor/qrcode.js' ), true );
		}

		if ( ! wp_script_is( self::SCRIPT, 'registered' ) ) {
			wp_register_script( self::SCRIPT, ASLANSHEED_OTP_URL . 'assets/js/twofa.js', array( 'aslansheed-otp-qr' ), Assets::version( 'assets/js/twofa.js' ), true );
		}
	}

	/**
	 * Renders the management box for a user.
	 *
	 * @param int $user_id User id.
	 * @return string Escaped HTML.
	 */
	public static function render( $user_id ) {
		$user = get_userdata( $user_id );

		if ( ! $user || Two_Factor::is_off() ) {
			return '';
		}

		self::register_assets();
		wp_enqueue_script( self::SCRIPT );
		wp_enqueue_style( Assets::STYLE );

		$config = array(
			'rest'        => esc_url_raw( rest_url( 'aslansheed-otp/v1/' ) ),
			'nonce'       => wp_create_nonce( 'wp_rest' ),
			'available'   => Two_Factor::applies_to( $user ),
			'enabled'     => Two_Factor::is_enabled( (int) $user_id ),
			'can_disable' => Two_Factor::can_disable( $user ),
			'left'        => Two_Factor::recovery_left( (int) $user_id ),
			'accent'      => (string) \Aslansheed\OTP\Core\Options::get( 'forms.accent_color' ),
			'i18n'        => self::strings(),
		);

		return '<div class="aslansheed-otp aslansheed-twofa aslo-auto-dark" data-twofa="' . esc_attr( wp_json_encode( $config ) ) . '"><noscript>' . esc_html__( 'Please enable JavaScript to manage 2FA.', 'aslansheed-login' ) . '</noscript></div>';
	}

	/**
	 * Shortcode for the signed-in user.
	 *
	 * @return string
	 */
	public static function shortcode() {
		return is_user_logged_in() ? self::render( get_current_user_id() ) : '';
	}

	/**
	 * Shows the box on the WooCommerce account dashboard.
	 *
	 * @return void
	 */
	public static function account_section() {
		$box = self::shortcode();

		if ( '' !== $box ) {
			echo '<h3>' . esc_html__( 'Two-factor authentication (2FA)', 'aslansheed-login' ) . '</h3>';
			echo $box; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Escaped in render().
		}
	}

	/**
	 * Adds the section to the WordPress profile screen.
	 *
	 * @param \WP_User $user User being edited.
	 * @return void
	 */
	public static function profile_section( $user ) {
		if ( Two_Factor::is_off() ) {
			return;
		}

		echo '<h2>' . esc_html__( 'Two-factor authentication (2FA)', 'aslansheed-login' ) . '</h2><table class="form-table" role="presentation"><tr><th>' . esc_html__( 'Authenticator app', 'aslansheed-login' ) . '</th><td>';

		if ( get_current_user_id() === (int) $user->ID ) {
			echo self::render( (int) $user->ID ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Escaped in render().
		} else {
			echo '<p>' . esc_html( Two_Factor::is_enabled( (int) $user->ID ) ? __( 'Two-factor authentication (2FA) is on for this user.', 'aslansheed-login' ) : __( 'Two-factor authentication (2FA) is off for this user.', 'aslansheed-login' ) ) . '</p>';
		}

		if ( current_user_can( 'edit_user', $user->ID ) && get_current_user_id() !== (int) $user->ID && Two_Factor::is_enabled( (int) $user->ID ) ) {
			wp_nonce_field( 'aslansheed_twofa_reset_' . $user->ID, 'aslansheed_twofa_nonce' );
			echo '<label><input type="checkbox" name="aslansheed_twofa_reset" value="1" /> ' . esc_html__( 'Reset 2FA for this user (they will set it up again)', 'aslansheed-login' ) . '</label>';
		}

		echo '</td></tr></table>';
	}

	/**
	 * Lets an administrator reset the authenticator of another user.
	 *
	 * @param int $user_id User being saved.
	 * @return void
	 */
	public static function save_profile( $user_id ) {
		if ( empty( $_POST['aslansheed_twofa_reset'] ) || empty( $_POST['aslansheed_twofa_nonce'] ) ) {
			return;
		}

		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['aslansheed_twofa_nonce'] ) ), 'aslansheed_twofa_reset_' . $user_id ) ) {
			return;
		}

		if ( get_current_user_id() !== (int) $user_id && current_user_can( 'edit_user', $user_id ) ) {
			Two_Factor::reset( (int) $user_id, get_current_user_id() );
		}
	}
}