<?php
/**
 * Forms: forms, the field editor, entries, import/export, settings.
 *
 * @package BYLTCommerce
 */

defined( 'ABSPATH' ) || exit;

class Bylt_Forms_Admin {

	const PAGE   = 'bylt-forms';
	const ACTION = 'bylt_forms_admin';

	/** @var Bylt_Forms */
	private $forms;

	public function __construct( Bylt_Forms $forms ) {
		$this->forms = $forms;
	}

	public function init() {
		add_action( 'admin_post_bylt_form_file', array( $this, 'download_file' ) );
		add_action( 'admin_menu', array( $this, 'menu' ), 22 );
		add_action( 'admin_post_' . self::ACTION, array( $this, 'handle' ) );
		add_filter( 'bylt_module_settings_urls', array( $this, 'settings_url' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'assets' ) );
	}

	/** Staff-only link to an entry's uploaded file. */
	public static function file_url( $entry_id, $key ) {
		return wp_nonce_url( add_query_arg( array( 'action' => 'bylt_form_file', 'entry' => (int) $entry_id, 'key' => $key ), admin_url( 'admin-post.php' ) ), 'bylt_form_file_' . (int) $entry_id );
	}

	public function download_file() {
		$id  = isset( $_GET['entry'] ) ? absint( $_GET['entry'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification -- checked next.
		$key = isset( $_GET['key'] ) ? sanitize_key( wp_unslash( $_GET['key'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification
		check_admin_referer( 'bylt_form_file_' . $id );
		if ( ! current_user_can( Bylt_Admin::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to open this file.', 'byltcommerce-toolkit' ), '', array( 'response' => 403 ) );
		}
		$e     = Bylt_Forms_Store::entry( $id );
		$files = $e ? Bylt_Forms_Store::entry_files( $e ) : array();
		if ( ! isset( $files[ $key ] ) ) {
			wp_die( esc_html__( 'File not found.', 'byltcommerce-toolkit' ), '', array( 'response' => 404 ) );
		}
		Bylt_Forms_Files::serve( $files[ $key ], isset( $e['data'][ $key ] ) ? (string) $e['data'][ $key ] : 'file' );
	}

	public static function url( $args = array() ) {
		return add_query_arg( array_merge( array( 'page' => self::PAGE ), $args ), admin_url( 'admin.php' ) );
	}

	public function settings_url( $urls ) {
		$urls['forms'] = self::url();
		return $urls;
	}

	public function menu() {
		$new  = Bylt_Forms_Store::entries( array( 'status' => 'new', 'per_page' => 1 ) )['total'];
		$base = 'admin.php?page=' . self::PAGE;
		Bylt_Admin::app_menu(
			self::PAGE,
			__( 'Forms', 'byltcommerce-toolkit' ),
			array( $this, 'render' ),
			'dashicons-feedback',
			58.8,
			array(
				self::PAGE                   => __( 'All forms', 'byltcommerce-toolkit' ),
				$base . '&tab=entries'       => __( 'Entries', 'byltcommerce-toolkit' ),
				$base . '&form=new'          => __( 'Add form', 'byltcommerce-toolkit' ),
				$base . '&tab=io'            => __( 'Import / Export', 'byltcommerce-toolkit' ),
				$base . '&tab=settings'      => __( 'Settings', 'byltcommerce-toolkit' ),
			),
			'',
			$new
		);
	}

	public function assets( $hook ) {
		if ( false === strpos( (string) $hook, self::PAGE ) ) {
			return;
		}
		wp_enqueue_script( 'bylt-forms-admin', $this->forms->url( 'assets/forms-admin.js' ), array(), BYLT_VERSION, true );
		wp_localize_script(
			'bylt-forms-admin',
			'byltFormsAdmin',
			array(
				'previewUrl' => home_url( '/' ),
				'nonce'      => wp_create_nonce( 'bylt_form_preview' ),
				'i18n'       => array(
					'title'   => __( 'Preview', 'byltcommerce-toolkit' ),
					'desktop' => __( 'Desktop', 'byltcommerce-toolkit' ),
					'tablet'  => __( 'Tablet', 'byltcommerce-toolkit' ),
					'phone'   => __( 'Phone', 'byltcommerce-toolkit' ),
					'guest'   => __( 'Visitor', 'byltcommerce-toolkit' ),
					'user'    => __( 'Logged in', 'byltcommerce-toolkit' ),
					'viewAs'  => __( 'View as', 'byltcommerce-toolkit' ),
					'close'   => __( 'Close', 'byltcommerce-toolkit' ),
					'note'    => __( 'Unsaved changes are included. Submitting checks the fields but sends nothing.', 'byltcommerce-toolkit' ),
					'pickField' => __( '— Field —', 'byltcommerce-toolkit' ),
				),
			)
		);
	}

	/* ---------------------------------------------------------------------
	 * Page
	 * ------------------------------------------------------------------- */

	private function tabs( $current ) {
		$new  = Bylt_Forms_Store::entries( array( 'status' => 'new', 'per_page' => 1 ) )['total'];
		$tabs = array(
			'forms'    => __( 'Forms', 'byltcommerce-toolkit' ),
			'entries'  => __( 'Entries', 'byltcommerce-toolkit' ) . ( $new ? ' (' . (int) $new . ')' : '' ),
			'io'       => __( 'Import / Export', 'byltcommerce-toolkit' ),
			'settings' => __( 'Settings', 'byltcommerce-toolkit' ),
		);
		echo '<nav class="nav-tab-wrapper" style="margin-bottom:12px">';
		foreach ( $tabs as $k => $label ) {
			echo '<a class="nav-tab ' . ( $k === $current ? 'nav-tab-active' : '' ) . '" href="' . esc_url( self::url( array( 'tab' => $k ) ) ) . '">' . esc_html( $label ) . '</a>';
		}
		echo '</nav>';
	}

	private function form_start( $do, $id = '', $attrs = '' ) {
		echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" ' . $attrs . '>'; // phpcs:ignore WordPress.Security.EscapeOutput -- fixed strings.
		echo '<input type="hidden" name="action" value="' . esc_attr( self::ACTION ) . '"><input type="hidden" name="do" value="' . esc_attr( $do ) . '"><input type="hidden" name="id" value="' . esc_attr( $id ) . '">';
		wp_nonce_field( self::ACTION . '_' . $do . '_' . $id );
	}

	public function render() {
		if ( ! current_user_can( Bylt_Admin::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to view forms.', 'byltcommerce-toolkit' ) );
		}
		// phpcs:disable WordPress.Security.NonceVerification -- display only.
		$tab   = isset( $_GET['tab'] ) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : 'forms';
		$form  = isset( $_GET['form'] ) ? sanitize_key( wp_unslash( $_GET['form'] ) ) : '';
		$entry = isset( $_GET['entry'] ) ? absint( $_GET['entry'] ) : 0;
		$msg   = isset( $_GET['msg'] ) ? sanitize_text_field( wp_unslash( $_GET['msg'] ) ) : '';
		$err   = ! empty( $_GET['err'] );
		// phpcs:enable
		echo '<div class="wrap bylt-wrap bylt-forms-wrap"><h1>' . esc_html__( 'Forms', 'byltcommerce-toolkit' ) . '</h1>';
		if ( $msg ) {
			echo '<div class="notice notice-' . ( $err ? 'error' : 'success' ) . ' is-dismissible"><p>' . esc_html( $msg ) . '</p></div>';
		}
		if ( $entry ) {
			$this->render_entry( $entry );
		} elseif ( $form ) {
			$this->render_editor( $form );
		} else {
			$this->tabs( $tab );
			switch ( $tab ) {
				case 'entries':
					$this->render_entries();
					break;
				case 'io':
					$this->render_io();
					break;
				case 'settings':
					$this->render_settings();
					break;
				default:
					$this->render_forms();
			}
		}
		echo '</div>';
	}

	private function render_forms() {
		$forms  = Bylt_Forms_Store::all();
		$counts = Bylt_Forms_Store::counts();
		echo '<p>';
		foreach ( Bylt_Forms::templates() as $key => $t ) {
			/* translators: %s: template name */
			echo '<a class="button' . ( 'contact' === $key ? ' button-primary' : '' ) . '" href="' . esc_url( self::url( array( 'form' => 'new', 'template' => $key ) ) ) . '">' . esc_html( 'blank' === $key ? __( 'Blank form', 'byltcommerce-toolkit' ) : sprintf( __( 'New %s', 'byltcommerce-toolkit' ), strtolower( $t['name'] ) ) ) . '</a> ';
		}
		echo '</p>';
		echo '<table class="widefat striped"><thead><tr><th>' . esc_html__( 'Form', 'byltcommerce-toolkit' ) . '</th><th>' . esc_html__( 'Type', 'byltcommerce-toolkit' ) . '</th><th>' . esc_html__( 'Shortcode', 'byltcommerce-toolkit' ) . '</th><th>' . esc_html__( 'On page', 'byltcommerce-toolkit' ) . '</th><th>' . esc_html__( 'Entries', 'byltcommerce-toolkit' ) . '</th></tr></thead><tbody>';
		if ( ! $forms ) {
			echo '<tr><td colspan="5">' . esc_html__( 'No forms yet. Start with a contact or quote form above.', 'byltcommerce-toolkit' ) . '</td></tr>';
		}
		foreach ( $forms as $f ) {
			$c   = isset( $counts[ $f['id'] ] ) ? $counts[ $f['id'] ] : array();
			$all = array_sum( $c );
			$new = isset( $c['new'] ) ? $c['new'] : 0;
			$pg  = $f['settings']['page_id'];
			echo '<tr><td><a href="' . esc_url( self::url( array( 'form' => $f['id'] ) ) ) . '"><strong>' . esc_html( $f['name'] ) . '</strong></a><br><span class="description">' . esc_html( sprintf( /* translators: %d: count */ _n( '%d field', '%d fields', count( $f['fields'] ), 'byltcommerce-toolkit' ), count( $f['fields'] ) ) ) . '</span></td>';
			$kinds = Bylt_Forms::kinds();
			echo '<td>' . esc_html( isset( $kinds[ $f['settings']['kind'] ] ) ? $kinds[ $f['settings']['kind'] ] : $f['settings']['kind'] ) . '</td>';
			echo '<td><code>[bylt_form id="' . (int) $f['id'] . '"]</code></td>';
			echo '<td>' . ( $pg && get_post( $pg ) ? '<a href="' . esc_url( get_permalink( $pg ) ) . '">' . esc_html( get_the_title( $pg ) ) . '</a>' : '—' ) . '</td>';
			echo '<td><a href="' . esc_url( self::url( array( 'tab' => 'entries', 'form_id' => $f['id'] ) ) ) . '">' . (int) $all . '</a>' . ( $new ? ' <span class="bylt-count">' . esc_html( sprintf( /* translators: %d: count */ __( '%d new', 'byltcommerce-toolkit' ), $new ) ) . '</span>' : '' ) . '</td></tr>';
		}
		echo '</tbody></table>';
		echo '<p class="description" style="margin-top:12px">' . esc_html__( 'Add a form to any page with the "BYLTCommerce Form" block or its shortcode.', 'byltcommerce-toolkit' ) . '</p>';
	}

	/* ---------------------------------------------------------------------
	 * Editor
	 * ------------------------------------------------------------------- */

	private static function type_labels() {
		return array(
			'text'       => __( 'Text', 'byltcommerce-toolkit' ),
			'email'      => __( 'Email', 'byltcommerce-toolkit' ),
			'tel'        => __( 'Phone', 'byltcommerce-toolkit' ),
			'textarea'   => __( 'Paragraph', 'byltcommerce-toolkit' ),
			'number'     => __( 'Number', 'byltcommerce-toolkit' ),
			'date'       => __( 'Date', 'byltcommerce-toolkit' ),
			'url'        => __( 'Website', 'byltcommerce-toolkit' ),
			'select'     => __( 'Dropdown', 'byltcommerce-toolkit' ),
			'radio'      => __( 'Choose one', 'byltcommerce-toolkit' ),
			'checkboxes' => __( 'Choose several', 'byltcommerce-toolkit' ),
			'consent'    => __( 'Consent checkbox', 'byltcommerce-toolkit' ),
			'hidden'     => __( 'Hidden', 'byltcommerce-toolkit' ),
			'html'       => __( 'Heading / text', 'byltcommerce-toolkit' ),
			'password'   => __( 'Password', 'byltcommerce-toolkit' ),
			'file'       => __( 'File upload', 'byltcommerce-toolkit' ),
		);
	}

	/** Comparisons offered in the conditions editor. */
	private static function op_labels() {
		return array(
			'is'           => __( 'is', 'byltcommerce-toolkit' ),
			'is_not'       => __( 'is not', 'byltcommerce-toolkit' ),
			'contains'     => __( 'contains', 'byltcommerce-toolkit' ),
			'not_contains' => __( 'doesn\'t contain', 'byltcommerce-toolkit' ),
			'empty'        => __( 'is empty', 'byltcommerce-toolkit' ),
			'not_empty'    => __( 'is filled in', 'byltcommerce-toolkit' ),
			'gt'           => __( 'is more than', 'byltcommerce-toolkit' ),
			'lt'           => __( 'is less than', 'byltcommerce-toolkit' ),
		);
	}

	/** One condition row; the field list is filled in by forms-admin.js from the rows on screen. */
	private static function rule_row( $n, $j, array $r, array $labels ) {
		$r   = array_merge( array( 'field' => '', 'op' => 'is', 'value' => '' ), $r );
		$rn  = $n . '[cond][rules][' . $j . ']';
		$out = '<div class="bylt-fe-rule">';
		$out .= '<select name="' . esc_attr( $rn ) . '[field]" class="bylt-fe-rule-field" data-value="' . esc_attr( $r['field'] ) . '" aria-label="' . esc_attr__( 'Field', 'byltcommerce-toolkit' ) . '">';
		$out .= '<option value="">' . esc_html__( '— Field —', 'byltcommerce-toolkit' ) . '</option>';
		if ( '' !== $r['field'] ) {
			$out .= '<option value="' . esc_attr( $r['field'] ) . '" selected>' . esc_html( isset( $labels[ $r['field'] ] ) ? $labels[ $r['field'] ] : $r['field'] ) . '</option>';
		}
		$out .= '</select><select name="' . esc_attr( $rn ) . '[op]" class="bylt-fe-rule-op" aria-label="' . esc_attr__( 'Comparison', 'byltcommerce-toolkit' ) . '">';
		foreach ( self::op_labels() as $k => $l ) {
			$out .= '<option value="' . esc_attr( $k ) . '" ' . selected( $r['op'], $k, false ) . '>' . esc_html( $l ) . '</option>';
		}
		$out .= '</select><input type="text" name="' . esc_attr( $rn ) . '[value]" class="bylt-fe-rule-value" value="' . esc_attr( $r['value'] ) . '" aria-label="' . esc_attr__( 'Value', 'byltcommerce-toolkit' ) . '" placeholder="' . esc_attr__( 'Value', 'byltcommerce-toolkit' ) . '">';
		$out .= '<button type="button" class="button-link button-link-delete bylt-fe-rule-remove" aria-label="' . esc_attr__( 'Remove condition', 'byltcommerce-toolkit' ) . '">✕</button></div>';
		return $out;
	}

	/** @var array<string, string> key => label of the form being edited, for condition rows. */
	private $labels = array();

	private function field_row( $i, array $f ) {
		$f      = array_merge( Bylt_Forms_Store::blank_field(), $f );
		$n      = 'fields[' . $i . ']';
		$opts   = implode( "\n", (array) $f['options'] );
		$locked = ! empty( $f['locked'] );
		$on     = $locked || ! empty( $f['enabled'] );
		$row    = 'bylt-fe-row' . ( $on ? '' : ' is-off' ) . ( $locked ? ' is-locked' : '' ) . ( ! empty( $f['cond']['action'] ) ? ' has-cond' : '' );
		echo '<div class="' . esc_attr( $row ) . '" data-type="' . esc_attr( $f['type'] ) . '" data-show="' . esc_attr( $f['show'] ) . '">';
		echo '<div class="bylt-fe-head"><span class="bylt-fe-handle" aria-hidden="true">⋮⋮</span>';
		if ( $locked ) {
			// Locked by the form type: the type can't change, so it's sent as a hidden value.
			echo '<input type="hidden" name="' . esc_attr( $n ) . '[type]" value="' . esc_attr( $f['type'] ) . '"><input type="hidden" name="' . esc_attr( $n ) . '[locked]" value="1">';
			echo '<span class="bylt-fe-type bylt-fe-type--fixed" title="' . esc_attr__( 'This field is part of the form type and can\'t be removed or switched off.', 'byltcommerce-toolkit' ) . '"><span class="dashicons dashicons-lock" aria-hidden="true"></span> ' . esc_html( isset( self::type_labels()[ $f['type'] ] ) ? self::type_labels()[ $f['type'] ] : $f['type'] ) . '</span>';
		} else {
			echo '<select name="' . esc_attr( $n ) . '[type]" class="bylt-fe-type" aria-label="' . esc_attr__( 'Field type', 'byltcommerce-toolkit' ) . '">';
			foreach ( self::type_labels() as $k => $l ) {
				echo '<option value="' . esc_attr( $k ) . '" ' . selected( $f['type'], $k, false ) . '>' . esc_html( $l ) . '</option>';
			}
			echo '</select>';
		}
		echo '<input type="text" class="bylt-fe-label" name="' . esc_attr( $n ) . '[label]" value="' . esc_attr( $f['label'] ) . '" placeholder="' . esc_attr__( 'Label', 'byltcommerce-toolkit' ) . '" aria-label="' . esc_attr__( 'Label', 'byltcommerce-toolkit' ) . '">';
		if ( $locked ) {
			echo '<span class="bylt-fe-req bylt-fe-req--fixed">' . esc_html( $f['required'] ? __( 'Required', 'byltcommerce-toolkit' ) : __( 'Optional', 'byltcommerce-toolkit' ) ) . '</span>';
		} else {
			echo '<label class="bylt-fe-req"><input type="checkbox" name="' . esc_attr( $n ) . '[required]" value="1" ' . checked( $f['required'], true, false ) . '> ' . esc_html__( 'Required', 'byltcommerce-toolkit' ) . '</label>';
		}
		echo '<label class="bylt-fe-on" title="' . esc_attr__( 'Show this field on the form', 'byltcommerce-toolkit' ) . '"><input type="hidden" name="' . esc_attr( $n ) . '[enabled]" value="0"><input type="checkbox" class="bylt-switch bylt-fe-enabled" name="' . esc_attr( $n ) . '[enabled]" value="1" ' . checked( $on, true, false ) . disabled( $locked, true, false ) . '><span class="bylt-fe-on-text" data-on="' . esc_attr__( 'On', 'byltcommerce-toolkit' ) . '" data-off="' . esc_attr__( 'Off', 'byltcommerce-toolkit' ) . '">' . esc_html( $on ? __( 'On', 'byltcommerce-toolkit' ) : __( 'Off', 'byltcommerce-toolkit' ) ) . '</span></label>';
		echo '<span class="bylt-fe-if" title="' . esc_attr__( 'Shown or hidden by conditions (Options)', 'byltcommerce-toolkit' ) . '">' . esc_html__( 'Conditional', 'byltcommerce-toolkit' ) . '</span>';
		echo '<span class="bylt-fe-tools"><button type="button" class="button-link bylt-fe-more" aria-expanded="false">' . esc_html__( 'Options', 'byltcommerce-toolkit' ) . '</button> <button type="button" class="button-link bylt-fe-up" aria-label="' . esc_attr__( 'Move up', 'byltcommerce-toolkit' ) . '">↑</button> <button type="button" class="button-link bylt-fe-down" aria-label="' . esc_attr__( 'Move down', 'byltcommerce-toolkit' ) . '">↓</button>';
		if ( ! $locked ) {
			echo ' <button type="button" class="button-link button-link-delete bylt-fe-remove" aria-label="' . esc_attr__( 'Remove field', 'byltcommerce-toolkit' ) . '">✕</button>';
		}
		echo '</span></div>';
		echo '<div class="bylt-fe-body" hidden>';
		if ( $locked ) {
			echo '<p class="bylt-fe-locked-note">' . esc_html__( 'Part of this form type: you can change the wording, width and classes, but not remove it or switch it off.', 'byltcommerce-toolkit' ) . '</p>';
		}
		echo '<label class="bylt-fe-choices">' . esc_html__( 'Choices (one per line)', 'byltcommerce-toolkit' ) . '<textarea name="' . esc_attr( $n ) . '[options]" rows="4">' . esc_textarea( $opts ) . '</textarea></label>';
		echo '<label class="bylt-fe-text">' . esc_html__( 'Text (for Heading / text)', 'byltcommerce-toolkit' ) . '<textarea name="' . esc_attr( $n ) . '[help_html]" rows="3">' . esc_textarea( 'html' === $f['type'] ? $f['help'] : '' ) . '</textarea></label>';
		echo '<label>' . esc_html__( 'Placeholder', 'byltcommerce-toolkit' ) . '<input type="text" name="' . esc_attr( $n ) . '[placeholder]" value="' . esc_attr( $f['placeholder'] ) . '"></label>';
		echo '<label>' . esc_html__( 'Help text', 'byltcommerce-toolkit' ) . '<input type="text" name="' . esc_attr( $n ) . '[help]" value="' . esc_attr( 'html' === $f['type'] ? '' : $f['help'] ) . '"></label>';
		echo '<label class="bylt-fe-nopass">' . esc_html__( 'Default value', 'byltcommerce-toolkit' ) . '<input type="text" name="' . esc_attr( $n ) . '[default]" value="' . esc_attr( $f['default'] ) . '"></label>';
		echo '<label class="bylt-fe-nopass">' . esc_html__( 'Fill from link parameter', 'byltcommerce-toolkit' ) . '<input type="text" name="' . esc_attr( $n ) . '[param]" value="' . esc_attr( $f['param'] ) . '"></label>';
		echo '<label>' . esc_html__( 'Width', 'byltcommerce-toolkit' ) . '<select name="' . esc_attr( $n ) . '[width]"><option value="full" ' . selected( $f['width'], 'full', false ) . '>' . esc_html__( 'Full', 'byltcommerce-toolkit' ) . '</option><option value="half" ' . selected( $f['width'], 'half', false ) . '>' . esc_html__( 'Half', 'byltcommerce-toolkit' ) . '</option></select></label>';
		echo '<label>' . esc_html__( 'CSS class', 'byltcommerce-toolkit' ) . '<input type="text" name="' . esc_attr( $n ) . '[css]" value="' . esc_attr( $f['css'] ) . '" placeholder="my-class another-class"></label>';
		if ( $locked ) {
			echo '<input type="hidden" name="' . esc_attr( $n ) . '[key]" value="' . esc_attr( $f['key'] ) . '">';
		} else {
			echo '<label>' . esc_html__( 'Show to', 'byltcommerce-toolkit' ) . '<select name="' . esc_attr( $n ) . '[show]" class="bylt-fe-show">';
			foreach ( array( 'all' => __( 'Everyone', 'byltcommerce-toolkit' ), 'guests' => __( 'Visitors who aren\'t logged in', 'byltcommerce-toolkit' ), 'users' => __( 'Logged-in customers', 'byltcommerce-toolkit' ) ) as $k => $l ) {
				echo '<option value="' . esc_attr( $k ) . '" ' . selected( $f['show'], $k, false ) . '>' . esc_html( $l ) . '</option>';
			}
			echo '</select></label>';
			echo '<label class="bylt-fe-map">' . esc_html__( 'Save to customer', 'byltcommerce-toolkit' ) . '<select name="' . esc_attr( $n ) . '[map]"><option value="">' . esc_html__( '— Don\'t save —', 'byltcommerce-toolkit' ) . '</option>';
			foreach ( Bylt_Forms::map_targets() as $k => $l ) {
				echo '<option value="' . esc_attr( $k ) . '"' . ( 0 === strpos( $k, 'file:' ) ? ' class="is-file"' : '' ) . ' ' . selected( $f['map'], $k, false ) . '>' . esc_html( $l ) . '</option>';
			}
			echo '</select><small class="description">' . esc_html__( 'Copied to the customer\'s account when they\'re logged in, or when the form creates one.', 'byltcommerce-toolkit' ) . '</small></label>';
			echo '<label>' . esc_html__( 'Key (used in emails as {key} and in exports)', 'byltcommerce-toolkit' ) . '<input type="text" class="bylt-fe-key" name="' . esc_attr( $n ) . '[key]" value="' . esc_attr( $f['key'] ) . '" pattern="[a-z0-9_]*"' . ( '' === $f['key'] ? ' data-auto="1"' : '' ) . '></label>';
			$c     = is_array( $f['cond'] ) ? $f['cond'] : array();
			$act   = isset( $c['action'] ) ? $c['action'] : '';
			$rules = ! empty( $c['rules'] ) ? $c['rules'] : array( array() );
			echo '<div class="bylt-fe-cond' . ( $act ? ' is-on' : '' ) . '" data-n="' . esc_attr( $n ) . '"><div class="bylt-fe-cond-head">';
			echo '<label>' . esc_html__( 'Conditions', 'byltcommerce-toolkit' ) . '<select name="' . esc_attr( $n ) . '[cond][action]" class="bylt-fe-cond-action">';
			foreach ( array( '' => __( 'Always show this field', 'byltcommerce-toolkit' ), 'show' => __( 'Show this field only if', 'byltcommerce-toolkit' ), 'hide' => __( 'Hide this field if', 'byltcommerce-toolkit' ) ) as $k => $l ) {
				echo '<option value="' . esc_attr( $k ) . '" ' . selected( $act, $k, false ) . '>' . esc_html( $l ) . '</option>';
			}
			echo '</select></label>';
			echo '<label class="bylt-fe-cond-match">' . esc_html__( 'Match', 'byltcommerce-toolkit' ) . '<select name="' . esc_attr( $n ) . '[cond][match]">';
			echo '<option value="all" ' . selected( isset( $c['match'] ) ? $c['match'] : 'all', 'all', false ) . '>' . esc_html__( 'all of these', 'byltcommerce-toolkit' ) . '</option>';
			echo '<option value="any" ' . selected( isset( $c['match'] ) ? $c['match'] : 'all', 'any', false ) . '>' . esc_html__( 'any of these', 'byltcommerce-toolkit' ) . '</option>';
			echo '</select></label></div><div class="bylt-fe-rules">';
			foreach ( array_values( $rules ) as $j => $r ) {
				echo self::rule_row( $n, $j, $r, $this->labels ); // phpcs:ignore WordPress.Security.EscapeOutput -- built from escaped parts.
			}
			echo '</div><button type="button" class="button-link bylt-fe-rule-add">+ ' . esc_html__( 'Add condition', 'byltcommerce-toolkit' ) . '</button>';
			echo '<p class="description">' . esc_html__( 'Hidden fields aren\'t required, checked or saved. For choices, type the choice exactly as written; for a consent box use "is filled in".', 'byltcommerce-toolkit' ) . '</p>';
			echo '<template class="bylt-fe-rule-tpl">' . self::rule_row( $n, '__j__', array(), array() ) . '</template></div>'; // phpcs:ignore WordPress.Security.EscapeOutput -- built from escaped parts.
		}
		echo '</div></div>';
	}

	private function render_editor( $which ) {
		if ( 'new' === $which ) {
			// phpcs:ignore WordPress.Security.NonceVerification -- display only.
			$tpl  = isset( $_GET['template'] ) ? sanitize_key( wp_unslash( $_GET['template'] ) ) : 'contact';
			$tpls = Bylt_Forms::templates();
			$t    = isset( $tpls[ $tpl ] ) ? $tpls[ $tpl ] : $tpls['contact'];
			$form = array( 'id' => 0, 'name' => $t['name'], 'fields' => $t['fields'], 'settings' => array_merge( Bylt_Forms_Store::default_settings(), $t['settings'] ) );
		} else {
			$form = Bylt_Forms_Store::get( (int) $which );
			if ( ! $form ) {
				echo '<p>' . esc_html__( 'Form not found.', 'byltcommerce-toolkit' ) . '</p>';
				return;
			}
		}
		$s = $form['settings'];
		echo '<p><a href="' . esc_url( self::url() ) . '">← ' . esc_html__( 'All forms', 'byltcommerce-toolkit' ) . '</a></p>';
		$this->form_start( 'save', $form['id'], 'id="bylt-form-editor"' );
		echo '<div class="bylt-fe-top"><input type="text" name="name" class="bylt-fe-name" value="' . esc_attr( $form['name'] ) . '" aria-label="' . esc_attr__( 'Form name', 'byltcommerce-toolkit' ) . '" required>';
		echo '<button type="button" class="button bylt-fe-preview" id="bylt-fe-preview"><span class="dashicons dashicons-visibility" aria-hidden="true"></span> ' . esc_html__( 'Preview', 'byltcommerce-toolkit' ) . '</button></div>';
		do_action( 'bylt_form_editor_notice', $form );
		echo '<div class="bylt-fe-cols"><div class="bylt-fe-main"><h2>' . esc_html__( 'Fields', 'byltcommerce-toolkit' ) . '</h2><div id="bylt-fe-list">';
		foreach ( $form['fields'] as $f ) {
			if ( ! empty( $f['key'] ) ) {
				$this->labels[ $f['key'] ] = '' !== (string) $f['label'] ? (string) $f['label'] : (string) $f['key'];
			}
		}
		foreach ( array_values( $form['fields'] ) as $i => $f ) {
			$this->field_row( $i, $f );
		}
		echo '</div><template id="bylt-fe-template">';
		$this->field_row( '__i__', array( 'type' => 'text' ) );
		echo '</template><p><button type="button" class="button" id="bylt-fe-add">+ ' . esc_html__( 'Add field', 'byltcommerce-toolkit' ) . '</button></p></div>';

		$pages = get_pages( array( 'post_status' => 'publish' ) );
		$cats  = taxonomy_exists( 'product_cat' ) ? get_terms( array( 'taxonomy' => 'product_cat', 'hide_empty' => false ) ) : array();
		?>
		<div class="bylt-fe-side">
			<h2><?php esc_html_e( 'After sending', 'byltcommerce-toolkit' ); ?></h2>
			<label><?php esc_html_e( 'Button text', 'byltcommerce-toolkit' ); ?><input type="text" name="settings[submit_label]" value="<?php echo esc_attr( $s['submit_label'] ); ?>"></label>
			<label><?php esc_html_e( 'Thank-you message', 'byltcommerce-toolkit' ); ?><input type="text" name="settings[success]" value="<?php echo esc_attr( $s['success'] ); ?>"></label>
			<label><?php esc_html_e( 'Or go to this page', 'byltcommerce-toolkit' ); ?><input type="url" name="settings[redirect]" value="<?php echo esc_attr( $s['redirect'] ); ?>" placeholder="https://"></label>
			<label class="bylt-fe-check"><input type="checkbox" name="settings[store]" value="yes" <?php checked( $s['store'], 'yes' ); ?>> <?php esc_html_e( 'Save entries here', 'byltcommerce-toolkit' ); ?></label>

			<h2><?php esc_html_e( 'Spam protection', 'byltcommerce-toolkit' ); ?></h2>
			<p class="description"><?php esc_html_e( 'Always on: a hidden trap field and a signed time check (posts in under 3 seconds are dropped). Duplicate entries within 10 minutes are ignored.', 'byltcommerce-toolkit' ); ?></p>
			<label class="bylt-fe-check"><input type="checkbox" name="settings[spam_js]" value="yes" <?php checked( $s['spam_js'], 'yes' ); ?>> <?php esc_html_e( 'Only accept entries from a browser that ran the page (blocks most bots)', 'byltcommerce-toolkit' ); ?></label>
			<label><?php esc_html_e( 'Entries per visitor in 10 minutes', 'byltcommerce-toolkit' ); ?><input type="number" min="0" max="1000" class="small-text" name="settings[spam_rate]" value="<?php echo esc_attr( (string) $s['spam_rate'] ); ?>"><small class="description"><?php esc_html_e( '0 = no limit. Counted per IP address; store staff aren\'t limited.', 'byltcommerce-toolkit' ); ?></small></label>
			<label><?php esc_html_e( 'Links allowed in an entry', 'byltcommerce-toolkit' ); ?><input type="number" min="0" max="1000" class="small-text" name="settings[spam_links]" value="<?php echo esc_attr( (string) $s['spam_links'] ); ?>"><small class="description"><?php esc_html_e( 'More than this goes to Spam without an email. 0 = no limit. Website fields don\'t count.', 'byltcommerce-toolkit' ); ?></small></label>
			<label class="bylt-fe-check"><input type="checkbox" name="settings[protect]" value="yes" <?php checked( $s['protect'], 'yes' ); ?>> <?php esc_html_e( 'Also use Form Protection (Turnstile/reCAPTCHA) when it\'s set up', 'byltcommerce-toolkit' ); ?></label>

			<h2><?php esc_html_e( 'Design', 'byltcommerce-toolkit' ); ?></h2>
			<label><?php esc_html_e( 'CSS class for the form', 'byltcommerce-toolkit' ); ?><input type="text" name="settings[css_class]" value="<?php echo esc_attr( $s['css_class'] ); ?>" placeholder="my-form"></label>
			<p class="description"><?php esc_html_e( 'Add your own classes here or on any field (Options), then style them in Appearance → Customize → Additional CSS. Built-in classes: .bylt-form, .bylt-field, .bylt-field-{type}, .bylt-w-half, .bylt-form-submit.', 'byltcommerce-toolkit' ); ?></p>

			<h2><?php esc_html_e( 'Email to you', 'byltcommerce-toolkit' ); ?></h2>
			<label class="bylt-fe-check"><input type="checkbox" name="settings[notify]" value="yes" <?php checked( $s['notify'], 'yes' ); ?>> <?php esc_html_e( 'Email me each entry', 'byltcommerce-toolkit' ); ?></label>
			<label><?php esc_html_e( 'Send to', 'byltcommerce-toolkit' ); ?><input type="text" name="settings[notify_to]" value="<?php echo esc_attr( $s['notify_to'] ); ?>" placeholder="<?php echo esc_attr( get_option( 'admin_email' ) ); ?>"></label>
			<label><?php esc_html_e( 'Subject', 'byltcommerce-toolkit' ); ?><input type="text" name="settings[notify_subject]" value="<?php echo esc_attr( $s['notify_subject'] ); ?>"></label>

			<h2><?php esc_html_e( 'Email to them', 'byltcommerce-toolkit' ); ?></h2>
			<label class="bylt-fe-check"><input type="checkbox" name="settings[confirm]" value="yes" <?php checked( $s['confirm'], 'yes' ); ?>> <?php esc_html_e( 'Send a confirmation to the email they entered', 'byltcommerce-toolkit' ); ?></label>
			<label><?php esc_html_e( 'Subject', 'byltcommerce-toolkit' ); ?><input type="text" name="settings[confirm_subject]" value="<?php echo esc_attr( $s['confirm_subject'] ); ?>"></label>
			<label><?php esc_html_e( 'Message', 'byltcommerce-toolkit' ); ?><textarea name="settings[confirm_message]" rows="5"><?php echo esc_textarea( $s['confirm_message'] ); ?></textarea></label>
			<p class="description"><?php esc_html_e( 'Tags: {name}, {form}, {all_fields}, {site} and any field key in braces, e.g. {product}.', 'byltcommerce-toolkit' ); ?></p>

			<h2><?php esc_html_e( 'Type and placement', 'byltcommerce-toolkit' ); ?></h2>
			<label><?php esc_html_e( 'Form type', 'byltcommerce-toolkit' ); ?><select name="settings[kind]" id="bylt-fe-kind">
			<?php foreach ( Bylt_Forms::kinds() as $k => $l ) : ?>
				<option value="<?php echo esc_attr( $k ); ?>" <?php selected( $s['kind'], $k ); ?>><?php echo esc_html( $l ); ?></option>
			<?php endforeach; ?>
			</select></label>
			<label><?php esc_html_e( 'Page the form is on', 'byltcommerce-toolkit' ); ?><select name="settings[page_id]"><option value="0">—</option>
			<?php
			foreach ( $pages as $p ) :
				?>
				<option value="<?php echo (int) $p->ID; ?>" <?php selected( (int) $s['page_id'], (int) $p->ID ); ?>><?php echo esc_html( $p->post_title ); ?></option><?php endforeach; ?></select></label>
			<?php if ( function_exists( 'wc_get_product' ) ) : ?>
			<div class="bylt-fe-quote">
				<label><?php esc_html_e( '"Request a quote" button on product pages', 'byltcommerce-toolkit' ); ?><select name="settings[product_button]"><option value="no" <?php selected( $s['product_button'], 'no' ); ?>><?php esc_html_e( 'No', 'byltcommerce-toolkit' ); ?></option><option value="all" <?php selected( $s['product_button'], 'all' ); ?>><?php esc_html_e( 'On every product', 'byltcommerce-toolkit' ); ?></option><option value="cats" <?php selected( $s['product_button'], 'cats' ); ?>><?php esc_html_e( 'On products in these categories', 'byltcommerce-toolkit' ); ?></option></select></label>
				<?php if ( $cats && ! is_wp_error( $cats ) ) : ?>
				<div class="bylt-fe-cats">
					<?php
					foreach ( $cats as $c ) :
						?>
					<label class="bylt-fe-check"><input type="checkbox" name="settings[button_cats][]" value="<?php echo (int) $c->term_id; ?>" <?php checked( in_array( (int) $c->term_id, array_map( 'intval', (array) $s['button_cats'] ), true ) ); ?>> <?php echo esc_html( $c->name ); ?></label><?php endforeach; ?></div>
				<?php endif; ?>
				<label><?php esc_html_e( 'Button text', 'byltcommerce-toolkit' ); ?><input type="text" name="settings[button_label]" value="<?php echo esc_attr( $s['button_label'] ); ?>"></label>
				<p class="description"><?php esc_html_e( 'The button opens the form\'s page with the product filled in. Needs "Page the form is on". Call for Price can link here too.', 'byltcommerce-toolkit' ); ?></p>
			</div>
			<?php endif; ?>
		</div></div>
		<?php
		submit_button( $form['id'] ? __( 'Save form', 'byltcommerce-toolkit' ) : __( 'Create form', 'byltcommerce-toolkit' ) );
		echo '</form>';
		if ( $form['id'] ) {
			echo '<div class="bylt-fe-after">';
			if ( ! $s['page_id'] ) {
				$this->form_start( 'make_page', $form['id'], 'style="display:inline-block;margin-right:8px"' );
				echo '<button class="button">' . esc_html__( 'Create a page with this form', 'byltcommerce-toolkit' ) . '</button></form>';
			}
			echo '<code>[bylt_form id="' . (int) $form['id'] . '"]</code> ';
			$this->form_start( 'delete', $form['id'], 'style="display:inline-block;margin-left:12px"' );
			echo '<button class="button-link button-link-delete" onclick="return confirm(\'' . esc_js( __( 'Delete this form and all its entries?', 'byltcommerce-toolkit' ) ) . '\')">' . esc_html__( 'Delete form', 'byltcommerce-toolkit' ) . '</button></form></div>';
		}
	}

	/* ---------------------------------------------------------------------
	 * Entries
	 * ------------------------------------------------------------------- */

	private static function summary( array $e, $form ) {
		$bits = array();
		foreach ( $form ? $form['fields'] : array() as $f ) {
			if ( in_array( $f['type'], array( 'html', 'email', 'hidden', 'consent' ), true ) || in_array( $f['key'], array( 'name', 'full_name', 'first_name' ), true ) || empty( $e['data'][ $f['key'] ] ) ) {
				continue;
			}
			$bits[] = Bylt_Forms_Mailer::text( $e['data'][ $f['key'] ] );
			if ( count( $bits ) >= 2 ) {
				break;
			}
		}
		return wp_trim_words( implode( ' · ', $bits ), 18 );
	}

	private function render_entries() {
		// phpcs:disable WordPress.Security.NonceVerification -- read-only filters.
		$form_id = isset( $_GET['form_id'] ) ? absint( $_GET['form_id'] ) : 0;
		$status  = isset( $_GET['status'] ) ? sanitize_key( wp_unslash( $_GET['status'] ) ) : '';
		$search  = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';
		$paged   = isset( $_GET['paged'] ) ? max( 1, absint( $_GET['paged'] ) ) : 1;
		// phpcs:enable
		$forms = array();
		foreach ( Bylt_Forms_Store::all() as $f ) {
			$forms[ $f['id'] ] = $f;
		}
		echo '<form method="get" style="margin:0 0 10px"><input type="hidden" name="page" value="' . esc_attr( self::PAGE ) . '"><input type="hidden" name="tab" value="entries">';
		echo '<select name="form_id"><option value="0">' . esc_html__( 'All forms', 'byltcommerce-toolkit' ) . '</option>';
		foreach ( $forms as $id => $f ) {
			echo '<option value="' . (int) $id . '" ' . selected( $form_id, $id, false ) . '>' . esc_html( $f['name'] ) . '</option>';
		}
		echo '</select> <select name="status"><option value="">' . esc_html__( 'Any status', 'byltcommerce-toolkit' ) . '</option>';
		foreach ( array( 'new' => __( 'New', 'byltcommerce-toolkit' ), 'read' => __( 'Read', 'byltcommerce-toolkit' ), 'spam' => __( 'Spam', 'byltcommerce-toolkit' ) ) as $k => $l ) {
			echo '<option value="' . esc_attr( $k ) . '" ' . selected( $status, $k, false ) . '>' . esc_html( $l ) . '</option>';
		}
		echo '</select> <input type="search" name="s" value="' . esc_attr( $search ) . '" placeholder="' . esc_attr__( 'Search entries', 'byltcommerce-toolkit' ) . '"> <button class="button">' . esc_html__( 'Filter', 'byltcommerce-toolkit' ) . '</button>';
		if ( $form_id ) {
			$args = array( 'action' => self::ACTION, 'do' => 'export_entries', 'id' => '', 'form_id' => $form_id, 'status' => $status );
			echo ' <a class="button" href="' . esc_url( wp_nonce_url( add_query_arg( array_merge( $args, array( 'format' => 'csv' ) ), admin_url( 'admin-post.php' ) ), self::ACTION . '_export_entries_' ) ) . '">' . esc_html__( 'Export CSV', 'byltcommerce-toolkit' ) . '</a>';
		}
		echo '</form>';

		$res = Bylt_Forms_Store::entries( array( 'form_id' => $form_id, 'status' => $status, 'search' => $search, 'page' => $paged ) );
		$this->form_start( 'bulk' );
		echo '<p><select name="bulk"><option value="">' . esc_html__( 'Bulk actions', 'byltcommerce-toolkit' ) . '</option><option value="read">' . esc_html__( 'Mark read', 'byltcommerce-toolkit' ) . '</option><option value="new">' . esc_html__( 'Mark new', 'byltcommerce-toolkit' ) . '</option><option value="spam">' . esc_html__( 'Mark spam', 'byltcommerce-toolkit' ) . '</option><option value="delete">' . esc_html__( 'Delete', 'byltcommerce-toolkit' ) . '</option></select> <button class="button">' . esc_html__( 'Apply', 'byltcommerce-toolkit' ) . '</button></p>';
		echo '<table class="widefat striped bylt-entries"><thead><tr><td class="check-column"><input type="checkbox" class="bylt-check-all" aria-label="' . esc_attr__( 'Select all', 'byltcommerce-toolkit' ) . '"></td><th>' . esc_html__( 'From', 'byltcommerce-toolkit' ) . '</th><th>' . esc_html__( 'Entry', 'byltcommerce-toolkit' ) . '</th><th>' . esc_html__( 'Form', 'byltcommerce-toolkit' ) . '</th><th>' . esc_html__( 'Received', 'byltcommerce-toolkit' ) . '</th></tr></thead><tbody>';
		if ( ! $res['items'] ) {
			echo '<tr><td colspan="5">' . esc_html__( 'No entries yet.', 'byltcommerce-toolkit' ) . '</td></tr>';
		}
		foreach ( $res['items'] as $e ) {
			$f    = isset( $forms[ $e['form_id'] ] ) ? $forms[ $e['form_id'] ] : null;
			$who  = $e['email'] ? $e['email'] : __( '(no email)', 'byltcommerce-toolkit' );
			$name = '';
			foreach ( array( 'name', 'full_name', 'first_name' ) as $k ) {
				if ( ! empty( $e['data'][ $k ] ) ) {
					$name = Bylt_Forms_Mailer::text( $e['data'][ $k ] );
					break;
				}
			}
			echo '<tr class="' . ( 'new' === $e['status'] ? 'bylt-entry-new' : '' ) . '"><th class="check-column"><input type="checkbox" name="ids[]" value="' . (int) $e['id'] . '"></th>';
			echo '<td><a href="' . esc_url( self::url( array( 'entry' => $e['id'] ) ) ) . '">' . ( 'new' === $e['status'] ? '<strong>' : '' ) . esc_html( $name ? $name : $who ) . ( 'new' === $e['status'] ? '</strong>' : '' ) . '</a>' . ( $name ? '<br><span class="description">' . esc_html( $who ) . '</span>' : '' ) . ( 'spam' === $e['status'] ? ' <span class="description">(' . esc_html__( 'spam', 'byltcommerce-toolkit' ) . ')</span>' : '' ) . '</td>';
			echo '<td>' . esc_html( self::summary( $e, $f ) ) . '</td>';
			echo '<td>' . esc_html( $f ? $f['name'] : '#' . $e['form_id'] ) . '</td>';
			echo '<td>' . esc_html( get_date_from_gmt( $e['created_gmt'], get_option( 'date_format' ) . ' ' . get_option( 'time_format' ) ) ) . '</td></tr>';
		}
		echo '</tbody></table></form>';
		$pages = (int) ceil( $res['total'] / 50 );
		if ( $pages > 1 ) {
			echo '<div class="tablenav"><div class="tablenav-pages">' . paginate_links( array( 'base' => add_query_arg( 'paged', '%#%' ), 'format' => '', 'current' => $paged, 'total' => $pages ) ) . '</div></div>'; // phpcs:ignore WordPress.Security.EscapeOutput
		}
	}

	private function render_entry( $id ) {
		$e = Bylt_Forms_Store::entry( $id );
		echo '<p><a href="' . esc_url( self::url( array( 'tab' => 'entries' ) ) ) . '">← ' . esc_html__( 'All entries', 'byltcommerce-toolkit' ) . '</a></p>';
		if ( ! $e ) {
			echo '<p>' . esc_html__( 'Entry not found.', 'byltcommerce-toolkit' ) . '</p>';
			return;
		}
		if ( 'new' === $e['status'] ) {
			Bylt_Forms_Store::set_status( $e['id'], 'read' );
		}
		$form = Bylt_Forms_Store::get( $e['form_id'] );
		/* translators: 1: form name, 2: entry number */
		echo '<h2>' . esc_html( sprintf( __( '%1$s — entry #%2$d', 'byltcommerce-toolkit' ), $form ? $form['name'] : '#' . $e['form_id'], $e['id'] ) ) . '</h2>';
		echo '<table class="widefat" style="max-width:820px"><tbody>';
		$files = Bylt_Forms_Store::entry_files( $e );
		foreach ( Bylt_Forms_Mailer::rows( $form ? $form : array( 'fields' => array() ), $e['data'] ) as $key => $r ) {
			$cell = nl2br( esc_html( $r[1] ) );
			if ( isset( $files[ $key ] ) ) {
				$cell = Bylt_Forms_Files::path( $files[ $key ] )
					? '<a href="' . esc_url( self::file_url( $e['id'], (string) $key ) ) . '" target="_blank" rel="noopener"><span class="dashicons dashicons-media-default" aria-hidden="true"></span> ' . esc_html( $r[1] ) . '</a>'
					: esc_html( $r[1] ) . ' <span class="description">(' . esc_html__( 'file no longer available', 'byltcommerce-toolkit' ) . ')</span>';
			}
			echo '<tr><th style="width:30%">' . esc_html( $r[0] ) . '</th><td>' . $cell . '</td></tr>'; // phpcs:ignore WordPress.Security.EscapeOutput -- escaped above.
		}
		echo '</tbody></table><p class="description" style="margin-top:10px">';
		echo esc_html( get_date_from_gmt( $e['created_gmt'], get_option( 'date_format' ) . ' ' . get_option( 'time_format' ) ) );
		if ( $e['page_url'] ) {
			echo ' · <a href="' . esc_url( $e['page_url'] ) . '">' . esc_html__( 'Sent from this page', 'byltcommerce-toolkit' ) . '</a>';
		}
		if ( $e['product_id'] && function_exists( 'wc_get_product' ) && wc_get_product( $e['product_id'] ) ) {
			echo ' · ' . esc_html__( 'Product', 'byltcommerce-toolkit' ) . ': <a href="' . esc_url( get_edit_post_link( $e['product_id'] ) ) . '">' . esc_html( wc_get_product( $e['product_id'] )->get_name() ) . '</a>';
		}
		if ( $e['user_id'] && get_userdata( $e['user_id'] ) ) {
			echo ' · ' . esc_html__( 'Customer', 'byltcommerce-toolkit' ) . ': <a href="' . esc_url( get_edit_user_link( $e['user_id'] ) ) . '">' . esc_html( get_userdata( $e['user_id'] )->display_name ) . '</a>';
		}
		if ( $e['ip'] ) {
			echo ' · IP ' . esc_html( $e['ip'] );
		}
		echo '</p><p>';
		do_action( 'bylt_forms_entry_actions', $e, $form );
		if ( $e['email'] ) {
			$subject = $form ? 'Re: ' . $form['name'] : '';
			echo '<a class="button button-primary" href="' . esc_url( 'mailto:' . $e['email'] . '?subject=' . rawurlencode( $subject ) ) . '">' . esc_html__( 'Reply by email', 'byltcommerce-toolkit' ) . '</a> ';
		}
		echo '</p>';
		$this->form_start( 'entry_status', $e['id'], 'style="display:inline-block;margin-right:8px"' );
		echo '<input type="hidden" name="status" value="' . ( 'spam' === $e['status'] ? 'read' : 'spam' ) . '"><button class="button">' . esc_html( 'spam' === $e['status'] ? __( 'Not spam', 'byltcommerce-toolkit' ) : __( 'Mark as spam', 'byltcommerce-toolkit' ) ) . '</button></form>';
		$this->form_start( 'entry_status', $e['id'], 'style="display:inline-block;margin-right:8px"' );
		echo '<input type="hidden" name="status" value="new"><button class="button">' . esc_html__( 'Mark unread', 'byltcommerce-toolkit' ) . '</button></form>';
		$this->form_start( 'entry_delete', $e['id'], 'style="display:inline-block"' );
		echo '<button class="button-link button-link-delete" onclick="return confirm(\'' . esc_js( __( 'Delete this entry?', 'byltcommerce-toolkit' ) ) . '\')">' . esc_html__( 'Delete', 'byltcommerce-toolkit' ) . '</button></form>';
	}

	/* ---------------------------------------------------------------------
	 * Import / export, settings
	 * ------------------------------------------------------------------- */

	private function render_io() {
		$forms = Bylt_Forms_Store::all();
		echo '<div class="bylt-grid">';

		echo '<section class="bylt-panel"><h2>' . esc_html__( 'Export forms', 'byltcommerce-toolkit' ) . '</h2><p>' . esc_html__( 'A JSON file you can import on another site (or keep as a backup).', 'byltcommerce-toolkit' ) . '</p>';
		$this->form_start( 'export_forms' );
		if ( ! $forms ) {
			echo '<p><em>' . esc_html__( 'No forms yet.', 'byltcommerce-toolkit' ) . '</em></p>';
		}
		foreach ( $forms as $f ) {
			echo '<label class="bylt-fe-check"><input type="checkbox" name="form_ids[]" value="' . (int) $f['id'] . '" checked> ' . esc_html( $f['name'] ) . '</label>';
		}
		echo '<label class="bylt-fe-check" style="margin-top:8px"><input type="checkbox" name="with_entries" value="1"> ' . esc_html__( 'Include their entries', 'byltcommerce-toolkit' ) . '</label>';
		echo '<p><button class="button button-primary" ' . disabled( ! $forms, true, false ) . '>' . esc_html__( 'Download JSON', 'byltcommerce-toolkit' ) . '</button></p></form></section>';

		echo '<section class="bylt-panel"><h2>' . esc_html__( 'Export entries', 'byltcommerce-toolkit' ) . '</h2><p>' . esc_html__( 'CSV opens in Excel, Numbers or Google Sheets. JSON keeps everything for importing back.', 'byltcommerce-toolkit' ) . '</p>';
		$this->form_start( 'export_entries' );
		echo '<p><select name="form_id">';
		foreach ( $forms as $f ) {
			echo '<option value="' . (int) $f['id'] . '">' . esc_html( $f['name'] ) . '</option>';
		}
		echo '</select> <select name="format"><option value="csv">CSV</option><option value="json">JSON</option></select> <select name="status"><option value="">' . esc_html__( 'All but spam', 'byltcommerce-toolkit' ) . '</option><option value="new">' . esc_html__( 'New only', 'byltcommerce-toolkit' ) . '</option><option value="spam">' . esc_html__( 'Spam', 'byltcommerce-toolkit' ) . '</option></select></p>';
		echo '<p><button class="button button-primary" ' . disabled( ! $forms, true, false ) . '>' . esc_html__( 'Download', 'byltcommerce-toolkit' ) . '</button></p></form></section>';

		echo '<section class="bylt-panel"><h2>' . esc_html__( 'Import', 'byltcommerce-toolkit' ) . '</h2><p>' . esc_html__( 'A BYLTCommerce forms JSON file (forms, with or without entries), or a CSV of entries for one form. Importing the same file twice doesn\'t duplicate entries.', 'byltcommerce-toolkit' ) . '</p>';
		$this->form_start( 'import', '', 'enctype="multipart/form-data"' );
		echo '<p><input type="file" name="file" accept=".json,.csv,application/json,text/csv" required></p>';
		echo '<p><label>' . esc_html__( 'JSON: a form with the same name', 'byltcommerce-toolkit' ) . ' <select name="mode"><option value="merge">' . esc_html__( 'is reused (entries go into it)', 'byltcommerce-toolkit' ) . '</option><option value="copy">' . esc_html__( 'is kept; add a copy', 'byltcommerce-toolkit' ) . '</option></select></label></p>';
		echo '<p><label>' . esc_html__( 'CSV: import entries into', 'byltcommerce-toolkit' ) . ' <select name="form_id">';
		foreach ( $forms as $f ) {
			echo '<option value="' . (int) $f['id'] . '">' . esc_html( $f['name'] ) . '</option>';
		}
		echo '</select></label><br><span class="description">' . esc_html__( 'Column headings are matched to field labels or keys; "Submitted" and "Status" columns are used if present.', 'byltcommerce-toolkit' ) . '</span></p>';
		echo '<p><button class="button button-primary">' . esc_html__( 'Import', 'byltcommerce-toolkit' ) . '</button></p></form></section>';
		echo '</div>';
	}

	private function render_settings() {
		$s = $this->forms->settings();
		$this->form_start( 'settings' );
		echo '<table class="form-table" role="presentation"><tr><th scope="row"><label for="bylt-forms-ret">' . esc_html__( 'Keep entries for', 'byltcommerce-toolkit' ) . '</label></th><td><input id="bylt-forms-ret" type="number" min="0" class="small-text" name="retention_days" value="' . esc_attr( (int) $s['retention_days'] ) . '"> ' . esc_html__( 'days (0 = forever). Older entries are deleted daily.', 'byltcommerce-toolkit' ) . '</td></tr></table>';
		echo '<p class="description">' . esc_html__( 'Entries are included in Tools → Export Personal Data and Erase Personal Data (matched by email).', 'byltcommerce-toolkit' ) . '</p>';
		submit_button();
		echo '</form>';
	}

	/* ---------------------------------------------------------------------
	 * Actions
	 * ------------------------------------------------------------------- */

	private function back( array $args, $msg, $error = false ) {
		if ( $error ) {
			$args['err'] = 1;
		}
		wp_safe_redirect( self::url( array_merge( $args, array( 'msg' => $msg ) ) ) );
		exit;
	}

	private static function download( $filename, $type, $content ) {
		nocache_headers();
		header( 'Content-Type: ' . $type . '; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename=' . $filename );
		echo "\xEF\xBB\xBF" === substr( $content, 0, 3 ) || 'application/json' === $type ? $content : "\xEF\xBB\xBF" . $content; // phpcs:ignore WordPress.Security.EscapeOutput -- file download.
		exit;
	}

	/** Turn the editor's posted rows into fields. */
	public static function fields_from_post( array $rows ) {
		$out = array();
		foreach ( $rows as $r ) {
			if ( ! is_array( $r ) ) {
				continue;
			}
			if ( isset( $r['type'] ) && 'html' === $r['type'] ) {
				$r['help'] = isset( $r['help_html'] ) ? $r['help_html'] : '';
			}
			unset( $r['help_html'] );
			$r['required'] = ! empty( $r['required'] );
			$r['enabled']  = ! isset( $r['enabled'] ) || '0' !== (string) $r['enabled'];
			$out[]         = $r;
		}
		return $out;
	}

	public function handle() {
		$do = isset( $_REQUEST['do'] ) ? sanitize_key( wp_unslash( $_REQUEST['do'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification
		$id = isset( $_REQUEST['id'] ) ? sanitize_key( wp_unslash( $_REQUEST['id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification
		check_admin_referer( self::ACTION . '_' . $do . '_' . $id );
		if ( ! current_user_can( Bylt_Admin::cap() ) ) {
			wp_die( esc_html__( 'You are not allowed to do that.', 'byltcommerce-toolkit' ) );
		}
		$req = wp_unslash( $_REQUEST ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- sanitized by the store per field.

		switch ( $do ) {
			case 'save':
				$fid = Bylt_Forms_Store::save(
					array(
						'id'       => (int) $id,
						'name'     => isset( $req['name'] ) ? $req['name'] : '',
						'fields'   => self::fields_from_post( isset( $req['fields'] ) ? (array) $req['fields'] : array() ),
						'settings' => isset( $req['settings'] ) ? (array) $req['settings'] : array(),
					)
				);
				$this->forms->audit( 'form_saved', sprintf( 'Form #%d saved', $fid ) );
				$this->back( array( 'form' => $fid ), __( 'Form saved.', 'byltcommerce-toolkit' ) );
				break;

			case 'make_page':
				$form = Bylt_Forms_Store::get( (int) $id );
				if ( $form ) {
					$page = wp_insert_post(
						array(
							'post_type'    => 'page',
							'post_status'  => 'publish',
							'post_title'   => $form['name'],
							'post_content' => '<!-- wp:bylt/form {"formId":' . (int) $form['id'] . '} /-->',
						)
					);
					if ( $page && ! is_wp_error( $page ) ) {
						$form['settings']['page_id'] = $page;
						Bylt_Forms_Store::save( $form );
						$this->back( array( 'form' => $form['id'] ), __( 'Page created and published.', 'byltcommerce-toolkit' ) );
					}
				}
				$this->back( array(), __( 'Couldn\'t create the page.', 'byltcommerce-toolkit' ), true );
				break;

			case 'delete':
				Bylt_Forms_Store::delete( (int) $id );
				$this->forms->audit( 'form_deleted', sprintf( 'Form #%d and its entries deleted', (int) $id ) );
				$this->back( array(), __( 'Form deleted.', 'byltcommerce-toolkit' ) );
				break;

			case 'bulk':
				$ids  = isset( $req['ids'] ) ? array_map( 'absint', (array) $req['ids'] ) : array();
				$bulk = isset( $req['bulk'] ) ? sanitize_key( $req['bulk'] ) : '';
				if ( 'delete' === $bulk ) {
					$n = Bylt_Forms_Store::delete_entries( $ids );
				} else {
					$n = Bylt_Forms_Store::set_status( $ids, $bulk );
				}
				/* translators: %d: count */
				$this->back( array( 'tab' => 'entries' ), sprintf( _n( '%d entry updated.', '%d entries updated.', $n, 'byltcommerce-toolkit' ), $n ) );
				break;

			case 'entry_status':
				Bylt_Forms_Store::set_status( (int) $id, isset( $req['status'] ) ? sanitize_key( $req['status'] ) : 'read' );
				$this->back( 'new' === ( isset( $req['status'] ) ? $req['status'] : '' ) ? array( 'tab' => 'entries' ) : array( 'entry' => (int) $id ), __( 'Entry updated.', 'byltcommerce-toolkit' ) );
				break;

			case 'entry_delete':
				Bylt_Forms_Store::delete_entries( array( (int) $id ) );
				$this->back( array( 'tab' => 'entries' ), __( 'Entry deleted.', 'byltcommerce-toolkit' ) );
				break;

			case 'export_forms':
				$ids  = isset( $req['form_ids'] ) ? array_map( 'absint', (array) $req['form_ids'] ) : array();
				$json = Bylt_Forms_IO::export_json( $ids, ! empty( $req['with_entries'] ) );
				self::download( 'bylt-forms-' . gmdate( 'Y-m-d' ) . '.json', 'application/json', $json );
				break;

			case 'export_entries':
				$fid    = isset( $req['form_id'] ) ? absint( $req['form_id'] ) : 0;
				$status = isset( $req['status'] ) ? sanitize_key( $req['status'] ) : '';
				$form   = Bylt_Forms_Store::get( $fid );
				if ( ! $form ) {
					$this->back( array( 'tab' => 'io' ), __( 'Choose a form.', 'byltcommerce-toolkit' ), true );
				}
				$slug = sanitize_title( $form['name'] ) . '-entries-' . gmdate( 'Y-m-d' );
				if ( isset( $req['format'] ) && 'json' === $req['format'] ) {
					self::download( $slug . '.json', 'application/json', Bylt_Forms_IO::export_json( array( $fid ), true, $this->entry_filter( $status ) ) );
				}
				self::download( $slug . '.csv', 'text/csv', Bylt_Forms_IO::export_csv( $fid, $this->entry_filter( $status ) ) );
				break;

			case 'import':
				$file = isset( $_FILES['file'] ) ? $_FILES['file'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
				if ( ! $file || ! empty( $file['error'] ) || ! is_uploaded_file( $file['tmp_name'] ) ) {
					$this->back( array( 'tab' => 'io' ), __( 'Choose a file to import.', 'byltcommerce-toolkit' ), true );
				}
				$name = strtolower( sanitize_file_name( $file['name'] ) );
				if ( '.csv' === substr( $name, -4 ) ) {
					$r = Bylt_Forms_IO::import_csv( isset( $req['form_id'] ) ? absint( $req['form_id'] ) : 0, $file['tmp_name'] );
					if ( is_wp_error( $r ) ) {
						$this->back( array( 'tab' => 'io' ), $r->get_error_message(), true );
					}
					/* translators: 1: imported, 2: skipped, 3: matched columns */
					$this->back( array( 'tab' => 'io' ), sprintf( __( 'Imported %1$d entries (%2$d already there). Matched columns: %3$s.', 'byltcommerce-toolkit' ), $r['entries'], $r['skipped'], implode( ', ', $r['matched'] ) ) );
				}
				$r = Bylt_Forms_IO::import_json( file_get_contents( $file['tmp_name'] ), isset( $req['mode'] ) && 'copy' === $req['mode'] ? 'copy' : 'merge' ); // phpcs:ignore WordPress.WP.AlternativeFunctions
				if ( is_wp_error( $r ) ) {
					$this->back( array( 'tab' => 'io' ), $r->get_error_message(), true );
				}
				$this->forms->audit( 'forms_import', sprintf( 'Imported %d forms and %d entries', $r['forms_added'], $r['entries'] ) );
				/* translators: 1: new forms, 2: existing forms, 3: entries, 4: skipped */
				$this->back( array( 'tab' => 'io' ), sprintf( __( 'Added %1$d forms, matched %2$d existing, imported %3$d entries (%4$d skipped or already there).', 'byltcommerce-toolkit' ), $r['forms_added'], $r['forms_reused'], $r['entries'], $r['skipped'] ) );
				break;

			case 'settings':
				$this->forms->update_settings( array( 'retention_days' => isset( $req['retention_days'] ) ? max( 0, (int) $req['retention_days'] ) : 0 ) );
				$this->back( array( 'tab' => 'settings' ), __( 'Settings saved.', 'byltcommerce-toolkit' ) );
				break;
		}
		$this->back( array(), '' );
	}

	/** Entry filter for exports: a status, or everything except spam. */
	private function entry_filter( $status ) {
		return $status ? array( 'status' => $status ) : array( 'not_status' => 'spam' );
	}
}