<?php
/**
 * Settings page del plugin.
 *
 * @package ChatBotWeb
 */

namespace ChatBotWeb;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Página de configuración del plugin y diagnóstico de la conexión con BotPar.
 */
final class Settings {

	/** Resultado del último test de conexión (transient, 1 hora). */
	private const TEST_TRANSIENT = 'chat_bot_web_test_result';

	/**
	 * Instancia única.
	 *
	 * @var Settings|null
	 */
	private static ?Settings $instance = null;

	/**
	 * Devuelve la instancia única.
	 *
	 * @return Settings
	 */
	public static function instance(): Settings {
		if ( null === self::$instance ) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	/**
	 * Valores por default de todas las opciones.
	 *
	 * @return array
	 */
	public static function defaults(): array {
		return array(
			'public_key'          => '',
			'api_base'            => '',
			'identify_user'       => 0,
			'insertion'           => 'auto',
			'excluded_paths'      => '',
			'excluded_post_types' => array(),
			'hide_on_mobile'      => 0,
			'hide_for_logged_in'  => 0,
			'debug_mode'          => 0,
		);
	}

	/**
	 * Registra los hooks del panel de administración.
	 *
	 * @return void
	 */
	public function boot(): void {
		add_action( 'admin_menu', array( $this, 'register_menu' ) );
		add_action( 'admin_init', array( $this, 'register_settings' ) );
		add_action( 'admin_post_chat_bot_web_test', array( $this, 'handle_test' ) );
		add_filter( 'plugin_action_links_' . plugin_basename( CHAT_BOT_WEB_PLUGIN_FILE ), array( $this, 'add_settings_link' ) );
	}

	/**
	 * Agrega la página bajo Ajustes.
	 *
	 * @return void
	 */
	public function register_menu(): void {
		add_options_page(
			__( 'BotPar', 'botpar' ),
			__( 'BotPar', 'botpar' ),
			'manage_options',
			'botpar',
			array( $this, 'render_page' )
		);
	}

	/**
	 * Registra la opción con su callback de saneamiento.
	 *
	 * @return void
	 */
	public function register_settings(): void {
		register_setting(
			'chat_bot_web_group',
			CHAT_BOT_WEB_OPTION,
			array(
				'type'              => 'array',
				'sanitize_callback' => array( $this, 'sanitize' ),
				'default'           => self::defaults(),
			)
		);
	}

	/**
	 * Sanea y valida todo lo que llega del formulario.
	 *
	 * @param mixed $input Valor crudo enviado por el usuario.
	 * @return array Opciones saneadas.
	 */
	public function sanitize( $input ): array {
		$defaults = self::defaults();
		if ( ! is_array( $input ) ) {
			return $defaults;
		}

		$out = array();

		$public_key = isset( $input['public_key'] ) ? trim( (string) $input['public_key'] ) : '';
		if ( '' !== $public_key && ! preg_match( '/^widget_pk_[a-f0-9]{20,}$/', $public_key ) ) {
			add_settings_error(
				'chat_bot_web',
				'invalid_public_key',
				__( 'That public key does not look valid. It has to start with widget_pk_.', 'botpar' )
			);
			$public_key = '';
		}
		$out['public_key'] = $public_key;

		$api_base = isset( $input['api_base'] ) ? trim( (string) $input['api_base'] ) : '';
		if ( '' !== $api_base ) {
			// Sólo https: por acá viajan la conversación y la PII del visitante. Con http
			// el navegador además bloquearía la request por mixed content en cualquier
			// sitio servido por TLS. `esc_url_raw` con allowlist de protocolos devuelve ''
			// si el esquema no está permitido.
			$https_only = esc_url_raw( $api_base, array( 'https' ) );
			if ( '' === $https_only ) {
				add_settings_error(
					'chat_bot_web',
					'invalid_api_base',
					__( 'The API base has to be a valid https:// URL. It was left empty so the default is used.', 'botpar' )
				);
			}
			$api_base = $https_only;
		}
		$out['api_base'] = $api_base;

		$out['identify_user']      = ! empty( $input['identify_user'] ) ? 1 : 0;
		$out['debug_mode']         = ! empty( $input['debug_mode'] ) ? 1 : 0;
		$out['hide_on_mobile']     = ! empty( $input['hide_on_mobile'] ) ? 1 : 0;
		$out['hide_for_logged_in'] = ! empty( $input['hide_for_logged_in'] ) ? 1 : 0;

		$insertion        = isset( $input['insertion'] ) ? sanitize_key( (string) $input['insertion'] ) : 'auto';
		$out['insertion'] = in_array( $insertion, array( 'auto', 'manual' ), true ) ? $insertion : 'auto';

		// Se aceptan sólo tipos de contenido que existan y sean públicos: si un plugin que
		// registraba un tipo se desactiva, su valor guardado deja de tener efecto en vez de
		// quedar excluyendo algo que ya no existe.
		$types                      = isset( $input['excluded_post_types'] ) && is_array( $input['excluded_post_types'] )
			? array_map( 'sanitize_key', $input['excluded_post_types'] )
			: array();
		$out['excluded_post_types'] = array_values( array_intersect( $types, self::public_post_types() ) );

		$paths                 = isset( $input['excluded_paths'] ) ? (string) $input['excluded_paths'] : '';
		$paths                 = sanitize_textarea_field( $paths );
		$out['excluded_paths'] = $paths;

		return $out;
	}

	/**
	 * Nombres de los tipos de contenido públicos registrados en el sitio.
	 *
	 * @return array<int, string>
	 */
	public static function public_post_types(): array {
		return array_values( get_post_types( array( 'public' => true ), 'names' ) );
	}

	/**
	 * Agrega "Settings" a las acciones del plugin en la lista de plugins.
	 *
	 * @param array $links Links existentes.
	 * @return array
	 */
	public function add_settings_link( array $links ): array {
		$url           = admin_url( 'options-general.php?page=botpar' );
		$settings_link = '<a href="' . esc_url( $url ) . '">' . esc_html__( 'Settings', 'botpar' ) . '</a>';
		array_unshift( $links, $settings_link );
		return $links;
	}

	/**
	 * Handler del botón "Test connection". Guarda el resultado y vuelve a la página.
	 *
	 * @return void
	 */
	public function handle_test(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'botpar' ), '', array( 'response' => 403 ) );
		}
		check_admin_referer( 'chat_bot_web_test' );

		$opts   = wp_parse_args( get_option( CHAT_BOT_WEB_OPTION, array() ), self::defaults() );
		$result = self::run_connection_test( $opts );
		set_transient( self::TEST_TRANSIENT, $result, HOUR_IN_SECONDS );

		Logger::log(
			'Connection test executed.',
			array(
				'result' => $result['status'],
				'origin' => $result['origin'],
			)
		);

		wp_safe_redirect( admin_url( 'options-general.php?page=botpar' ) );
		exit;
	}

	/**
	 * Origin del sitio (esquema + host + puerto, sin path).
	 *
	 * `home_url()` puede traer subdirectorio (instalaciones en /blog); un header Origin
	 * con path es inválido.
	 *
	 * Público porque Diagnostics lo muestra en Salud del sitio: es el dato que hay que
	 * comparar contra la lista de dominios permitidos del panel.
	 *
	 * @return string
	 */
	public static function site_origin(): string {
		$parts = wp_parse_url( home_url() );
		if ( ! is_array( $parts ) || empty( $parts['scheme'] ) || empty( $parts['host'] ) ) {
			return home_url();
		}
		$origin = $parts['scheme'] . '://' . $parts['host'];
		if ( ! empty( $parts['port'] ) ) {
			$origin .= ':' . $parts['port'];
		}
		return $origin;
	}

	/**
	 * Consulta el endpoint de config del widget reproduciendo la request del navegador.
	 *
	 * Es el único momento en que el plugin habla con el backend desde PHP: el tráfico del
	 * chat va siempre browser → BotPar, sin pasar por WordPress.
	 *
	 * @param array $opts Opciones ya mergeadas con los defaults.
	 * @return array{status:string,message:string,origin:string,checked_at:int}
	 */
	private static function run_connection_test( array $opts ): array {
		$origin = self::site_origin();
		$result = array(
			'status'     => 'error',
			'message'    => '',
			'origin'     => $origin,
			'checked_at' => time(),
		);

		$public_key = isset( $opts['public_key'] ) ? (string) $opts['public_key'] : '';
		if ( '' === $public_key ) {
			$result['message'] = __( 'You have not entered the public key yet.', 'botpar' );
			return $result;
		}

		/**
		 * Timeout (en segundos) de las llamadas del plugin al backend de BotPar.
		 *
		 * @param int $timeout Timeout por default.
		 */
		$timeout = (int) apply_filters( 'chat_bot_web_request_timeout', 10 );

		$response = wp_remote_get(
			Injector::api_base( $opts ) . '/api/widgets/' . rawurlencode( $public_key ) . '/config',
			array(
				'timeout'     => max( 1, $timeout ),
				'redirection' => 2,
				'headers'     => array(
					// El backend valida la allowlist de dominios contra el header Origin.
					// Mandamos el del sitio para reproducir exactamente la request del
					// navegador: sin este header la validación responde 403 siempre y el
					// diagnóstico no serviría para nada.
					'Origin' => $origin,
				),
				'user-agent'  => 'BotPar-WP/' . CHAT_BOT_WEB_VERSION . '; ' . $origin,
			)
		);

		if ( is_wp_error( $response ) ) {
			$result['message'] = sprintf(
				/* translators: %s: network error message returned by WordPress. */
				__( 'Could not reach BotPar: %s. This is usually a firewall, a proxy, or an outbound restriction on your host.', 'botpar' ),
				$response->get_error_message()
			);
			return $result;
		}

		$code = (int) wp_remote_retrieve_response_code( $response );

		if ( 200 === $code ) {
			$result['status']  = 'ok';
			$result['message'] = sprintf(
				/* translators: %s: site origin, e.g. https://mysite.com */
				__( 'Connection OK. The widget responds and %s is on the allowed domains list.', 'botpar' ),
				$origin
			);
			return $result;
		}

		if ( 403 === $code ) {
			$result['status']  = 'warning';
			$result['message'] = sprintf(
				/* translators: %s: site origin, e.g. https://mysite.com */
				__( '%s is not on the allowed domains list of the widget. Add it in your panel (Widgets → your widget → General → Allowed domains) and test again.', 'botpar' ),
				$origin
			);
			return $result;
		}

		if ( 404 === $code ) {
			$result['message'] = __( 'Widget not found or inactive. The key may have been rotated: copy it again from Widgets → Installation.', 'botpar' );
			return $result;
		}

		$result['message'] = sprintf(
			/* translators: %d: HTTP status code. */
			__( 'The backend responded with HTTP %d.', 'botpar' ),
			$code
		);
		return $result;
	}

	/**
	 * Pinta el resultado del último test, si lo hay.
	 *
	 * @return void
	 */
	private function render_test_result(): void {
		$result = get_transient( self::TEST_TRANSIENT );

		if ( ! is_array( $result ) || empty( $result['status'] ) || empty( $result['message'] ) ) {
			echo '<p>' . esc_html__( 'You have not tested the connection yet. It is the fastest way to know whether the widget will show up on your site.', 'botpar' ) . '</p>';
			return;
		}

		$classes = array(
			'ok'      => 'notice-success',
			'warning' => 'notice-warning',
			'error'   => 'notice-error',
		);
		$status  = isset( $classes[ $result['status'] ] ) ? $result['status'] : 'error';

		printf(
			'<div class="notice %1$s inline"><p>%2$s</p></div>',
			esc_attr( $classes[ $status ] ),
			esc_html( (string) $result['message'] )
		);

		if ( ! empty( $result['checked_at'] ) ) {
			printf(
				'<p class="description">%s</p>',
				esc_html(
					sprintf(
						/* translators: %s: date and time of the last check. */
						__( 'Last checked: %s', 'botpar' ),
						wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $result['checked_at'] )
					)
				)
			);
		}
	}

	/**
	 * Pinta la página de configuración.
	 *
	 * @return void
	 */
	public function render_page(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		$opts = wp_parse_args( get_option( CHAT_BOT_WEB_OPTION, array() ), self::defaults() );
		?>
		<div class="wrap">
			<h1><?php esc_html_e( 'BotPar', 'botpar' ); ?></h1>
			<p>
				<?php
				echo wp_kses(
					__( 'Paste the <strong>public key</strong> of the widget you created in your BotPar panel (<em>Widgets → Installation</em>). The widget then appears automatically on the front end.', 'botpar' ),
					array(
						'strong' => array(),
						'em'     => array(),
					)
				);
				?>
			</p>

			<form method="post" action="options.php">
				<?php settings_fields( 'chat_bot_web_group' ); ?>

				<table class="form-table" role="presentation">
					<tbody>
						<tr>
							<th scope="row">
								<label for="cbw_public_key"><?php esc_html_e( 'Public key', 'botpar' ); ?></label>
							</th>
							<td>
								<input
									type="text"
									id="cbw_public_key"
									name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[public_key]"
									value="<?php echo esc_attr( $opts['public_key'] ); ?>"
									class="regular-text code"
									placeholder="widget_pk_..."
									autocomplete="off"
								/>
								<p class="description">
									<?php esc_html_e( 'Something like widget_pk_abc123… Do not confuse it with the secret key, which never goes here.', 'botpar' ); ?>
								</p>
							</td>
						</tr>

						<tr>
							<th scope="row">
								<label for="cbw_api_base"><?php esc_html_e( 'API base (optional)', 'botpar' ); ?></label>
							</th>
							<td>
								<input
									type="url"
									id="cbw_api_base"
									name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[api_base]"
									value="<?php echo esc_attr( $opts['api_base'] ); ?>"
									class="regular-text code"
									placeholder="https://app.botpar.com"
								/>
								<p class="description">
									<?php esc_html_e( 'Only if you use a custom domain for the backend. Leave it empty to use the default.', 'botpar' ); ?>
								</p>
							</td>
						</tr>

						<tr>
							<th scope="row"><?php esc_html_e( 'Visibility', 'botpar' ); ?></th>
							<td>
								<fieldset>
									<label>
										<input
											type="checkbox"
											name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[identify_user]"
											value="1"
											<?php checked( $opts['identify_user'], 1 ); ?>
										/>
										<?php esc_html_e( 'Auto-identify logged-in users (sends email and name as visitor metadata)', 'botpar' ); ?>
									</label>
								</fieldset>
							</td>
						</tr>

						<tr>
							<th scope="row"><?php esc_html_e( 'Where it appears', 'botpar' ); ?></th>
							<td>
								<fieldset>
									<label>
										<input
											type="radio"
											name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[insertion]"
											value="auto"
											<?php checked( $opts['insertion'], 'auto' ); ?>
										/>
										<?php esc_html_e( 'Everywhere on the site (recommended)', 'botpar' ); ?>
									</label>
									<br/>
									<label>
										<input
											type="radio"
											name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[insertion]"
											value="manual"
											<?php checked( $opts['insertion'], 'manual' ); ?>
										/>
										<?php esc_html_e( 'Only where I place it with the shortcode', 'botpar' ); ?>
										<code>[botpar]</code>
									</label>
									<p class="description">
										<?php esc_html_e( 'With the second option the widget only appears on pages where you add the shortcode. Useful if you only want support on a contact page or a landing page.', 'botpar' ); ?>
									</p>
								</fieldset>
							</td>
						</tr>

						<tr>
							<th scope="row"><?php esc_html_e( 'Hide the widget', 'botpar' ); ?></th>
							<td>
								<fieldset>
									<label>
										<input
											type="checkbox"
											name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[hide_on_mobile]"
											value="1"
											<?php checked( $opts['hide_on_mobile'], 1 ); ?>
										/>
										<?php esc_html_e( 'On phones (screens narrower than 768px)', 'botpar' ); ?>
									</label>
									<br/>
									<label>
										<input
											type="checkbox"
											name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[hide_for_logged_in]"
											value="1"
											<?php checked( $opts['hide_for_logged_in'], 1 ); ?>
										/>
										<?php esc_html_e( 'From users logged in to this site', 'botpar' ); ?>
									</label>
								</fieldset>
							</td>
						</tr>

						<tr>
							<th scope="row"><?php esc_html_e( 'Exclude post types', 'botpar' ); ?></th>
							<td>
								<fieldset>
									<?php foreach ( self::public_post_types() as $type ) : ?>
										<?php $object = get_post_type_object( $type ); ?>
										<label>
											<input
												type="checkbox"
												name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[excluded_post_types][]"
												value="<?php echo esc_attr( $type ); ?>"
												<?php checked( in_array( $type, (array) $opts['excluded_post_types'], true ) ); ?>
											/>
											<?php echo esc_html( $object && isset( $object->labels->name ) ? $object->labels->name : $type ); ?>
										</label>
										<br/>
									<?php endforeach; ?>
									<p class="description">
										<?php esc_html_e( 'The widget is not shown when viewing content of the checked types.', 'botpar' ); ?>
									</p>
								</fieldset>
							</td>
						</tr>

						<tr>
							<th scope="row">
								<label for="cbw_excluded"><?php esc_html_e( 'Exclude pages', 'botpar' ); ?></label>
							</th>
							<td>
								<textarea
									id="cbw_excluded"
									name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[excluded_paths]"
									rows="4"
									class="large-text code"
									placeholder="/checkout&#10;/cart&#10;/legal/*"
								><?php echo esc_textarea( $opts['excluded_paths'] ); ?></textarea>
								<p class="description">
									<?php esc_html_e( 'One path per line. Supports * as a trailing wildcard.', 'botpar' ); ?>
								</p>
							</td>
						</tr>

						<tr>
							<th scope="row"><?php esc_html_e( 'Diagnostics', 'botpar' ); ?></th>
							<td>
								<fieldset>
									<label>
										<input
											type="checkbox"
											name="<?php echo esc_attr( CHAT_BOT_WEB_OPTION ); ?>[debug_mode]"
											value="1"
											<?php checked( $opts['debug_mode'], 1 ); ?>
										/>
										<?php esc_html_e( 'Enable debug mode', 'botpar' ); ?>
									</label>
									<p class="description">
										<?php esc_html_e( 'Records in the PHP error log why the widget was or was not shown on each page. Turn it on only while investigating a problem and turn it off afterwards: left enabled, the log grows without limit. It never records personal data about visitors.', 'botpar' ); ?>
									</p>
								</fieldset>
							</td>
						</tr>
					</tbody>
				</table>

				<?php submit_button(); ?>
			</form>

			<?php if ( ! empty( $opts['public_key'] ) ) : ?>
				<hr/>
				<h2><?php esc_html_e( 'Connection status', 'botpar' ); ?></h2>

				<?php $this->render_test_result(); ?>

				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
					<input type="hidden" name="action" value="chat_bot_web_test"/>
					<?php wp_nonce_field( 'chat_bot_web_test' ); ?>
					<?php submit_button( __( 'Test connection', 'botpar' ), 'secondary', 'submit', false ); ?>
				</form>

				<p class="description">
					<?php esc_html_e( 'Queries the BotPar backend with your key and the domain of this site, exactly as a visitor would. It catches the two most common reasons for the widget not appearing: a rotated key and a domain missing from the allowed list.', 'botpar' ); ?>
				</p>
			<?php endif; ?>
		</div>
		<?php
	}
}