<?php
/** Administrator-initiated, single-use Call Talk connection with PKCE. */
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

const CALL_TALK_WIDGET_CONNECTION_KEY = 'call_talk_widget_connection';
const CALL_TALK_WIDGET_CONNECT_TTL    = 600;

add_action( 'admin_post_call_talk_widget_connect', 'call_talk_widget_handle_connect' );
add_action( 'admin_post_call_talk_widget_connect_callback', 'call_talk_widget_handle_connect_callback' );
add_action( 'admin_post_call_talk_widget_disconnect', 'call_talk_widget_handle_disconnect' );

/** HTTP/private hosts require an explicit opt-in on a local development site. */
function call_talk_widget_allows_local_http(): bool {
	return defined( 'CALL_TALK_WIDGET_ALLOW_LOCAL_HTTP' )
		&& true === CALL_TALK_WIDGET_ALLOW_LOCAL_HTTP
		&& in_array( wp_get_environment_type(), array( 'local', 'development' ), true );
}

function call_talk_widget_connection(): array {
	$value = get_option( CALL_TALK_WIDGET_CONNECTION_KEY, array() );
	return is_array( $value ) ? $value : array();
}

function call_talk_widget_settings_url(): string {
	return admin_url( 'options-general.php?page=call-talk-widget' );
}

function call_talk_widget_service_base(): string {
	$script = call_talk_widget_get_string( CALL_TALK_WIDGET_SCRIPT_URL_KEY, CALL_TALK_WIDGET_DEFAULT_SCRIPT_URL );
	if ( ! call_talk_widget_is_valid_script_url( $script ) ) {
		return '';
	}
	$parts = wp_parse_url( $script );
	return strtolower( $parts['scheme'] ) . '://' . $parts['host'] . ( isset( $parts['port'] ) ? ':' . $parts['port'] : '' );
}

function call_talk_widget_valid_service_base( string $base ): bool {
	$parts = wp_parse_url( $base );
	return is_array( $parts ) && isset( $parts['scheme'], $parts['host'] )
		&& ! isset( $parts['user'] ) && ! isset( $parts['pass'] ) && ! isset( $parts['query'] ) && ! isset( $parts['fragment'] )
		&& ( ! isset( $parts['path'] ) || '' === $parts['path'] )
		&& call_talk_widget_is_valid_script_url( $base . '/widget.js' );
}

/** All requests have a fixed integration path and never follow redirects. */
function call_talk_widget_service_request( string $base, string $path, string $method, array $body = array(), string $credential = '' ) {
	if ( ! call_talk_widget_valid_service_base( $base )
		|| ! in_array( $path, array( '/api/integrations/wordpress/requests', '/api/integrations/wordpress/token', '/api/integrations/wordpress/connection' ), true ) ) {
		return new WP_Error( 'service_url', __( 'The Call Talk service address is invalid. Use a trusted HTTPS deployment in Advanced Settings.', 'call-talk-widget' ) );
	}
	$headers = array( 'Accept' => 'application/json' );
	if ( '' !== $credential ) {
		$headers['Authorization'] = 'Bearer ' . $credential;
	}
	$args = array( 'method' => $method, 'timeout' => 20, 'redirection' => 0, 'headers' => $headers, 'limit_response_size' => 32768 );
	if ( 'POST' === $method ) {
		$args['headers']['Content-Type'] = 'application/json';
		$args['body']                    = wp_json_encode( $body );
	}
	$local_host_filter = static function ( $external, $host, $url ) use ( $base ) {
		return wp_parse_url( $base, PHP_URL_HOST ) === $host && 0 === strpos( $url, $base . '/' ) ? true : $external;
	};
	$local_ports_filter = static function ( $ports ) use ( $base ) {
		$port = wp_parse_url( $base, PHP_URL_PORT );
		if ( $port ) {
			$ports[] = $port;
		}
		return $ports;
	};
	if ( call_talk_widget_allows_local_http() ) {
		add_filter( 'http_request_host_is_external', $local_host_filter, 10, 3 );
		add_filter( 'http_allowed_safe_ports', $local_ports_filter );
	}
	try {
		$response = 'POST' === $method ? wp_safe_remote_post( $base . $path, $args ) : wp_safe_remote_request( $base . $path, $args );
	} finally {
		remove_filter( 'http_request_host_is_external', $local_host_filter, 10 );
		remove_filter( 'http_allowed_safe_ports', $local_ports_filter );
	}
	return $response;
}

function call_talk_widget_random_secret(): string {
	return rtrim( strtr( base64_encode( random_bytes( 32 ) ), '+/', '-_' ), '=' );
}

function call_talk_widget_pending_key(): string {
	return 'call_talk_widget_connect_' . get_current_user_id();
}

/** Returns an authorization URL; activation never calls this function. */
function call_talk_widget_start_connection() {
	if ( ! current_user_can( 'manage_options' ) ) {
		return new WP_Error( 'permission', __( 'Only a WordPress administrator can connect this website.', 'call-talk-widget' ) );
	}
	$base = call_talk_widget_service_base();
	$site = site_url( '/' );
	if ( '' === $base || ( 'https' !== wp_parse_url( $site, PHP_URL_SCHEME ) && ! call_talk_widget_allows_local_http() ) ) {
		return new WP_Error( 'https_required', __( 'Use HTTPS for this website and the Call Talk service before connecting.', 'call-talk-widget' ) );
	}
	$state    = call_talk_widget_random_secret();
	$verifier = call_talk_widget_random_secret();
	$pending  = array(
		'user_id' => get_current_user_id(), 'state' => $state, 'verifier' => $verifier,
		'session_hash' => hash( 'sha256', wp_get_session_token() ),
		'base' => $base, 'site_url' => $site, 'expires_at' => time() + CALL_TALK_WIDGET_CONNECT_TTL,
	);
	set_transient( call_talk_widget_pending_key(), $pending, CALL_TALK_WIDGET_CONNECT_TTL );
	$response = call_talk_widget_service_request(
		$base,
		'/api/integrations/wordpress/requests',
		'POST',
		array(
			'site_url' => $site,
			'callback_url' => admin_url( 'admin-post.php?action=call_talk_widget_connect_callback' ),
			'state' => $state,
			'code_challenge' => rtrim( strtr( base64_encode( hash( 'sha256', $verifier, true ) ), '+/', '-_' ), '=' ),
		)
	);
	if ( is_wp_error( $response ) || 201 !== wp_remote_retrieve_response_code( $response ) ) {
		delete_transient( call_talk_widget_pending_key() );
		return new WP_Error( 'request_failed', __( 'Call Talk could not start the connection. Check the service address and try again.', 'call-talk-widget' ) );
	}
	$data = json_decode( wp_remote_retrieve_body( $response ), true );
	if ( ! is_array( $data ) || ! isset( $data['request_id'], $data['authorization_url'] )
		|| ! is_string( $data['request_id'] ) || ! preg_match( '/^[A-Za-z0-9-]{1,128}$/', $data['request_id'] )
		|| $base . '/integrations/wordpress/connect/' . rawurlencode( $data['request_id'] ) !== $data['authorization_url'] ) {
		delete_transient( call_talk_widget_pending_key() );
		return new WP_Error( 'invalid_authorization', __( 'Call Talk returned an unexpected authorization address. No connection was saved. Try again.', 'call-talk-widget' ) );
	}
	return $data['authorization_url'];
}

/** Consume state before exchange, so the callback cannot be replayed. */
function call_talk_widget_complete_connection( string $state, string $code, string $error = '' ) {
	if ( ! current_user_can( 'manage_options' ) ) {
		return new WP_Error( 'permission', __( 'Only a WordPress administrator can complete this connection.', 'call-talk-widget' ) );
	}
	$pending = get_transient( call_talk_widget_pending_key() );
	if ( ! is_array( $pending ) || ! isset( $pending['state'], $pending['verifier'], $pending['user_id'], $pending['session_hash'], $pending['expires_at'], $pending['base'], $pending['site_url'] )
		|| get_current_user_id() !== $pending['user_id'] || time() >= $pending['expires_at']
		|| ! hash_equals( $pending['session_hash'], hash( 'sha256', wp_get_session_token() ) )
		|| ! hash_equals( $pending['state'], $state ) ) {
		return new WP_Error( 'invalid_state', __( 'This connection link has expired or belongs to another WordPress session. Start Connect to Call Talk again.', 'call-talk-widget' ) );
	}
	delete_transient( call_talk_widget_pending_key() );
	if ( '' !== $error ) {
		return new WP_Error( 'access_denied', __( 'The connection was cancelled in Call Talk. Your existing settings were kept.', 'call-talk-widget' ) );
	}
	if ( ! preg_match( '/^[A-Za-z0-9_-]{20,256}$/', $code ) ) {
		return new WP_Error( 'invalid_code', __( 'Call Talk did not return a valid connection code. Start the connection again.', 'call-talk-widget' ) );
	}
	$response = call_talk_widget_service_request( $pending['base'], '/api/integrations/wordpress/token', 'POST', array( 'code' => $code, 'code_verifier' => $pending['verifier'] ) );
	if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
		return new WP_Error( 'exchange_failed', __( 'Call Talk could not finish the connection. The code may have expired. Start the connection again.', 'call-talk-widget' ) );
	}
	$data = json_decode( wp_remote_retrieve_body( $response ), true );
	if ( ! call_talk_widget_valid_connection_response( $data, $pending ) ) {
		return new WP_Error( 'invalid_connection', __( 'Call Talk returned an unexpected connection response. No settings were changed. Try connecting again.', 'call-talk-widget' ) );
	}
	$previous_connection = call_talk_widget_connection();
	$connection = array(
		'connection_id' => $data['connection_id'], 'credential' => $data['connection_token'], 'base' => $pending['base'],
		'site' => $data['site'], 'account' => $data['account'], 'dashboard_url' => $data['dashboard_url'],
		'connected_at' => time(),
	);
	// Restricted service credentials are never registered as Settings API or REST options.
	update_option( CALL_TALK_WIDGET_CONNECTION_KEY, $connection, false );
	update_option( CALL_TALK_WIDGET_TOKEN_KEY, $data['widget_token'] );
	update_option( CALL_TALK_WIDGET_COMPANY_KEY, '' );
	update_option( CALL_TALK_WIDGET_SCRIPT_URL_KEY, $pending['base'] . '/widget.js' );
	update_option( CALL_TALK_WIDGET_CONSENT_KEY, 1 );
	update_option( CALL_TALK_WIDGET_ENABLED_KEY, 1 );
	if ( isset( $previous_connection['connection_id'], $previous_connection['base'], $previous_connection['credential'] )
		&& $previous_connection['connection_id'] !== $connection['connection_id']
		&& is_string( $previous_connection['base'] ) && is_string( $previous_connection['credential'] ) ) {
		// A different company/service gets a new connection. Revoke only on the old service origin.
		// Cleanup failure must not undo the newly approved, successfully saved connection.
		call_talk_widget_service_request( $previous_connection['base'], '/api/integrations/wordpress/connection', 'DELETE', array(), $previous_connection['credential'] );
	}
	return true;
}

function call_talk_widget_valid_connection_response( $data, array $pending ): bool {
	if ( ! is_array( $data ) || ! isset( $data['connection_id'], $data['connection_token'], $data['widget_token'], $data['site']['url'], $data['site']['domain'], $data['account']['company_id'], $data['account']['company_name'], $data['dashboard_url'] ) ) {
		return false;
	}
	foreach ( array( 'connection_id', 'connection_token', 'widget_token', 'dashboard_url' ) as $key ) {
		if ( ! is_string( $data[ $key ] ) || '' === $data[ $key ] ) {
			return false;
		}
	}
	return strlen( $data['connection_token'] ) <= 4096 && ! preg_match( '/[\x00-\x20\x7f]/', $data['connection_token'] )
		&& preg_match( '/^[A-Za-z0-9_-]{1,160}$/', $data['widget_token'] )
		&& is_string( $data['site']['url'] ) && rtrim( $data['site']['url'], '/' ) === rtrim( $pending['site_url'], '/' )
		&& is_string( $data['site']['domain'] ) && is_scalar( $data['account']['company_id'] ) && is_string( $data['account']['company_name'] )
		&& $pending['base'] . '/admin/widget-installation' === $data['dashboard_url'];
}

/** Disable locally immediately; retain a failed revocation credential for retry. */
function call_talk_widget_disconnect() {
	if ( ! current_user_can( 'manage_options' ) ) {
		return new WP_Error( 'permission', __( 'Only a WordPress administrator can disconnect this website.', 'call-talk-widget' ) );
	}
	update_option( CALL_TALK_WIDGET_ENABLED_KEY, 0 );
	update_option( CALL_TALK_WIDGET_CONSENT_KEY, 0 );
	delete_transient( call_talk_widget_pending_key() );
	$connection = call_talk_widget_connection();
	if ( ! empty( $connection['credential'] ) && ! empty( $connection['base'] ) ) {
		$response = call_talk_widget_service_request( $connection['base'], '/api/integrations/wordpress/connection', 'DELETE', array(), $connection['credential'] );
		if ( is_wp_error( $response ) || ! in_array( wp_remote_retrieve_response_code( $response ), array( 204, 401, 404 ), true ) ) {
			return new WP_Error( 'revoke_failed', __( 'The widget is off on this website, but Call Talk could not confirm disconnection. Retry Disconnect when the service is available.', 'call-talk-widget' ) );
		}
	}
	delete_option( CALL_TALK_WIDGET_CONNECTION_KEY );
	update_option( CALL_TALK_WIDGET_TOKEN_KEY, '' );
	update_option( CALL_TALK_WIDGET_COMPANY_KEY, '' );
	return true;
}

function call_talk_widget_require_post_admin( string $nonce_action ): void {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You do not have permission to manage this connection.', 'call-talk-widget' ), '', array( 'response' => 403 ) );
	}
	$request_method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '';
	if ( 'POST' !== $request_method ) {
		wp_die( esc_html__( 'Submit the connection form from Call Talk settings.', 'call-talk-widget' ), '', array( 'response' => 405 ) );
	}
	check_admin_referer( $nonce_action );
}

function call_talk_widget_flash_and_redirect( $result, string $success ): void {
	set_transient( 'call_talk_widget_notice_' . get_current_user_id(), array( 'type' => is_wp_error( $result ) ? 'error' : 'success', 'message' => is_wp_error( $result ) ? $result->get_error_message() : $success ), 60 );
	wp_safe_redirect( call_talk_widget_settings_url() );
	exit;
}

function call_talk_widget_handle_connect(): void {
	call_talk_widget_require_post_admin( 'call_talk_widget_connect' );
	// Nonce-protected POST is the only entry point that starts an external request.
	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- The helper above verifies the connection nonce, administrator capability, and POST method.
	if ( ! isset( $_POST['call_talk_connect_consent'] ) || '1' !== $_POST['call_talk_connect_consent'] ) {
		call_talk_widget_flash_and_redirect( new WP_Error( 'consent', __( 'Review the service connection and select the permission checkbox before connecting.', 'call-talk-widget' ) ), '' );
	}
	$result = call_talk_widget_start_connection();
	if ( is_wp_error( $result ) ) {
		call_talk_widget_flash_and_redirect( $result, '' );
	}
	$allow_host = static function ( $hosts ) use ( $result ) {
		$hosts[] = wp_parse_url( $result, PHP_URL_HOST );
		return $hosts;
	};
	add_filter( 'allowed_redirect_hosts', $allow_host );
	wp_safe_redirect( $result );
	remove_filter( 'allowed_redirect_hosts', $allow_host );
	exit;
}

function call_talk_widget_handle_connect_callback(): void {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'Sign in as the WordPress administrator who started this connection.', 'call-talk-widget' ), '', array( 'response' => 403 ) );
	}
	nocache_headers();
	header( 'Referrer-Policy: no-referrer' );
	// The random, short-lived state and PKCE verifier replace a form nonce on this service callback.
	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Validated below using user-bound single-use state and the saved PKCE verifier.
	$state = isset( $_GET['state'] ) && is_string( $_GET['state'] ) ? sanitize_text_field( wp_unslash( $_GET['state'] ) ) : '';
	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Validated below using user-bound single-use state and the saved PKCE verifier.
	$code  = isset( $_GET['code'] ) && is_string( $_GET['code'] ) ? sanitize_text_field( wp_unslash( $_GET['code'] ) ) : '';
	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Validated below using user-bound single-use state and the saved PKCE verifier.
	$error = isset( $_GET['error'] ) && is_string( $_GET['error'] ) ? sanitize_text_field( wp_unslash( $_GET['error'] ) ) : '';
	$result = call_talk_widget_complete_connection( $state, $code, $error );
	call_talk_widget_flash_and_redirect( $result, __( 'Connected to Call Talk. The widget is enabled on this website.', 'call-talk-widget' ) );
}

function call_talk_widget_handle_disconnect(): void {
	call_talk_widget_require_post_admin( 'call_talk_widget_disconnect' );
	call_talk_widget_flash_and_redirect( call_talk_widget_disconnect(), __( 'Disconnected. The widget is off. Your Call Talk account and conversation history were kept.', 'call-talk-widget' ) );
}

/** Render metadata only: the restricted connection credential stays server-side. */
function call_talk_widget_render_connection_panel(): void {
	$connection = call_talk_widget_connection();
	$notice_key = 'call_talk_widget_notice_' . get_current_user_id();
	$notice     = get_transient( $notice_key );
	if ( is_array( $notice ) && isset( $notice['type'], $notice['message'] ) ) {
		delete_transient( $notice_key );
		?><div class="notice <?php echo 'error' === $notice['type'] ? 'notice-error' : 'notice-success'; ?> inline" role="status"><p><?php echo esc_html( $notice['message'] ); ?></p></div><?php
	}
	?>
	<div class="call-talk-connection-card">
		<?php if ( ! empty( $connection['credential'] ) ) : ?>
			<h2><?php esc_html_e( 'Connected to Call Talk', 'call-talk-widget' ); ?></h2>
			<p><?php echo esc_html( $connection['account']['company_name'] ?? '' ); ?> &middot; <?php echo esc_html( $connection['site']['domain'] ?? '' ); ?></p>
			<p><?php esc_html_e( 'Your public widget token was installed automatically. Your team answers visitors in the separate Call Talk dashboard.', 'call-talk-widget' ); ?></p>
			<?php if ( ! get_option( CALL_TALK_WIDGET_ENABLED_KEY, 0 ) || ! get_option( CALL_TALK_WIDGET_CONSENT_KEY, 0 ) ) : ?><p><?php esc_html_e( 'The widget is currently off. Reconnect or enable it in Manual Token Setup.', 'call-talk-widget' ); ?></p><?php endif; ?>
			<p><a class="button button-primary" href="<?php echo esc_url( $connection['base'] . '/admin/widget-installation' ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Open Call Talk Dashboard', 'call-talk-widget' ); ?><span class="screen-reader-text"> <?php esc_html_e( '(opens in a new tab)', 'call-talk-widget' ); ?></span></a></p>
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
				<input type="hidden" name="action" value="call_talk_widget_disconnect">
				<?php wp_nonce_field( 'call_talk_widget_disconnect' ); ?>
				<p><?php esc_html_e( 'Disconnect turns off this website widget and revokes its connection permission. It does not delete your Call Talk account or conversation history.', 'call-talk-widget' ); ?></p>
				<?php submit_button( __( 'Disconnect', 'call-talk-widget' ), 'secondary', 'submit', false ); ?>
			</form>
		<?php else : ?>
			<h2><?php esc_html_e( 'Connect This Website', 'call-talk-widget' ); ?></h2>
			<p><?php esc_html_e( 'Connect to Call Talk to set up the widget without copying a token. You can create a Call Talk account or sign in to an existing account, then approve this website.', 'call-talk-widget' ); ?></p>
		<?php endif; ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="call-talk-connect-form">
			<input type="hidden" name="action" value="call_talk_widget_connect">
			<?php wp_nonce_field( 'call_talk_widget_connect' ); ?>
			<p id="call-talk-connect-disclosure"><?php esc_html_e( 'Connecting sends this website URL and a temporary connection request to Call Talk. After you approve, the widget is enabled automatically: visitor browsers load Call Talk and send their page URL and title, IP address, browser information, and communication data when used. No WordPress password, email address, or user database is sent by this plugin.', 'call-talk-widget' ); ?> <a href="https://call-talk.app/privacy" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Privacy Policy', 'call-talk-widget' ); ?></a> &middot; <a href="https://call-talk.app/terms" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Terms of Service', 'call-talk-widget' ); ?></a></p>
			<p><label><input type="checkbox" name="call_talk_connect_consent" value="1" required aria-describedby="call-talk-connect-disclosure"> <?php esc_html_e( 'Allow this connection and enable the Call Talk widget after approval.', 'call-talk-widget' ); ?></label></p>
			<?php submit_button( empty( $connection['credential'] ) ? __( 'Connect to Call Talk', 'call-talk-widget' ) : __( 'Reconnect to Call Talk', 'call-talk-widget' ), empty( $connection['credential'] ) ? 'primary' : 'secondary', 'submit', false ); ?>
		</form>
	</div>
	<?php
}