<?php
/**
 * Plugin Name:       Boostiq by AI SEO Booster
 * Description:       AI SEO for WordPress. Audits every page, then writes the titles, meta descriptions, headings, schema, image alt text and internal links you approve. Requires an AI SEO Booster account.
 * Version:           1.0.36
 * Requires at least: 6.0
 * Requires PHP:      7.4
 * Author:            AI SEO Booster LLC
 * Plugin URI:        https://www.aiseobooster.ai
 * License:           GPL-2.0-or-later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain:       boostiq
 *
 * NAMING NOTE: the original spec used the option name `myaio_api_key` and the
 * REST namespace `my-seo/v1`. `myaio` is a competitor's brand — shipping their
 * namespace inside our client's site would be a mistake — so this uses
 * `c360_api_key` and `c360/v1` throughout.
 *
 * The `c360_` prefix, the `c360/v1` namespace and this file's own name stay
 * as they are, and deliberately, even though the product is now AI SEO
 * Booster everywhere a person can see. They are not branding, they are the
 * contract with sites already running this plugin: the platform calls
 * /wp-json/c360/v1/, reads the option `c360_api_key`, and WordPress
 * identifies the plugin by this filename. Renaming any of them would cut off
 * every installed copy the moment the server moved, and silently — the site
 * would simply stop being managed. Nothing a site owner reads says c360.
 *
 * SECURITY MODEL: every route is authenticated by a shared secret sent in the
 * X-API-Key header and compared with hash_equals(). There is no cookie/nonce
 * path, because the caller is our server, not a logged-in browser. The write
 * endpoint accepts a fixed, whitelisted set of fields only — it can never be
 * used to set arbitrary post meta.
 *
 * SLASHING (1.0.1): JSON request bodies arrive unslashed, but wp_insert_post(),
 * wp_update_post() and update_post_meta() all call wp_unslash() on what they are
 * given. Passing values straight through stripped every backslash, which turned
 * \u2019 into u2019 inside stored JSON-LD and broke any schema containing an
 * escaped quote. Values are now wp_slash()ed on the way in, exactly as core's own
 * REST controllers do, and never wp_unslash()ed first.
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/*
 * ONE COPY RUNS, AND IT IS NEVER A FATAL.
 *
 * Boostiq (this, the wordpress.org listing) and AI SEO Booster (the copy
 * installed on client sites) are one codebase under two names. Both declare
 * the same 73 `c360_*` functions, the same `c360/v1` REST namespace and the
 * same `c360_api_key` option, so two copies in one request is a fatal on
 * "Cannot redeclare c360_activate()" — which WordPress reports to the site
 * owner only as "Plugin could not be activated because it triggered a fatal
 * error". Every client site already runs the connector, so installing this
 * copy on one of them hit that every time.
 *
 * THE GUARD ONLY WORKS BECAUSE THIS FILE DECLARES NOTHING. PHP binds a
 * file's top-level functions when it compiles the file, before any statement
 * in it executes, so a check sitting above those declarations is compiled
 * into a file that has already redeclared them and never gets to run. The
 * implementation lives in includes/engine.php and is required below, after
 * this has decided it is safe.
 *
 * THIS COPY YIELDS, always and on purpose. The connector is what the
 * platform installed, authenticates against and updates, so a site that has
 * it keeps it.
 *
 * It reads `active_plugins` rather than asking what is loaded because
 * plugins load alphabetically: "boostiq/boostiq.php" loads BEFORE
 * "c360-seo-connector/...", so at this moment the connector has declared
 * nothing and a check for existing functions would see a clean site, load,
 * and leave the connector to be the one that dies. The option comes from the
 * database before any plugin runs, so it is true whatever the order —
 * including on the thirteen sites running an older connector with no guard
 * of its own. Those are fixed by this file alone.
 */
if ( ! function_exists( 'c360_connector_already_active' ) ) {
	/**
	 * The connector copy of this plugin, if this site has it switched on.
	 *
	 * @param string $self plugin_basename( __FILE__ ) for the caller.
	 * @return string Its plugin file, or '' when there is none.
	 */
	function c360_connector_already_active( $self ) {
		$active = (array) get_option( 'active_plugins', array() );
		if ( is_multisite() ) {
			$active = array_merge( $active, array_keys( (array) get_site_option( 'active_sitewide_plugins', array() ) ) );
		}
		foreach ( $active as $plugin ) {
			$plugin = (string) $plugin;
			if ( $plugin !== $self && preg_match( '#(^|/)c360-seo-connector\.php$#', $plugin ) ) {
				return $plugin;
			}
		}
		return '';
	}
}

$c360_clash = c360_connector_already_active( plugin_basename( __FILE__ ) );
if ( '' !== $c360_clash || defined( 'C360_CONNECTOR_VERSION' ) || function_exists( 'c360_activate' ) ) {
	add_action(
		'admin_notices',
		static function () use ( $c360_clash ) {
			if ( ! current_user_can( 'activate_plugins' ) ) {
				return;
			}
			$other = '' !== $c360_clash ? $c360_clash : 'AI SEO Booster';
			echo '<div class="notice notice-warning"><p><strong>Boostiq is installed but not running.</strong> '
				. 'This site already has the AI SEO Booster plugin active ('
				. esc_html( $other )
				. '). They are the same plugin under two names and share one set of settings, so only one runs at a time. '
				. 'Nothing is broken and nothing has been lost &mdash; this site is still connected through the plugin that was already here. '
				. 'You can safely delete this copy.</p></div>';
		}
	);
	return;
}

/* The main file's path, for hooks that must name the plugin WordPress knows. */
define( 'C360_PLUGIN_FILE', __FILE__ );

require_once __DIR__ . '/includes/engine.php';