<?php
/**
 * A record of Telegram alerts this site actually sent.
 *
 * The Mail tab has shown an email log for a long time. Telegram is where every security
 * alert on this install actually goes, and there was no record of it anywhere, so the
 * question "did that alert go out, and what did it say" could only be answered by reading
 * Telegram itself, which tells you nothing about the ones that FAILED.
 *
 * Captured through the `http_api_debug` action rather than inside CSDT_Telegram.
 * That is not stylistic. CSDT_Telegram is a shared class shipped by five plugins, and
 * on this install the copy that actually loads belongs to cloudscale-backup, not to this
 * plugin, verified by reflection on the live site. Adding the logging to this plugin's copy
 * would have been a silent no-op, which is the single most common failure mode in this
 * codebase. Hooking the HTTP layer instead:
 *
 *   - works no matter which plugin's copy of the shared class is loaded,
 *   - captures alerts sent by the OTHER plugins too, which is what an operator wants,
 *   - needs no coordinated deploy across five repositories,
 *   - and cannot drift when the shared class changes.
 *
 * The cost is one strpos() per outbound HTTP request, which is why the URL test comes first
 * and everything else after it.
 *
 * The bot token appears in the Telegram API URL. It is never stored here.
 *
 * @package CloudScale_Cyber_DevTools
 * @since   1.10.488
 */

defined( 'ABSPATH' ) || exit;

class CSDT_Alert_Log {

	/** Rolling log of sent alerts, newest first. */
	const OPTION = 'csdt_alert_log';

	/**
	 * Entries kept.
	 *
	 * Matches the email log's cap. Held in an option rather than a table because alerts are
	 * rate-limited upstream, CSDT_Auto_Block caps at 5 per 15 minutes and CS Monitor
	 * batches per page load, so this cannot grow the way an unthrottled log would.
	 */
	const MAX = 100;

	/** Longest message body kept, characters. */
	const BODY_MAX = 600;

	/** Registers the capture. */
	public static function init(): void {
		add_action( 'http_api_debug', array( __CLASS__, 'capture' ), 10, 5 );
	}

	/**
	 * Records a Telegram API call and whether it succeeded.
	 *
	 * @since 1.10.488
	 * @param mixed  $response The response or WP_Error.
	 * @param string $context  'response'.
	 * @param string $class    Transport class.
	 * @param array  $args     Request args.
	 * @param string $url      Request URL.
	 */
	public static function capture( $response, $context, $class, $args, $url ): void {
		try {
			// Cheapest possible test first: this action fires for every outbound HTTP
			// request the site makes, including AI calls and update checks.
			if ( ! is_string( $url ) || false === strpos( $url, 'api.telegram.org' ) ) {
				return;
			}
			if ( false === strpos( $url, '/sendMessage' ) ) {
				return; // getMe, getUpdates and friends are not alerts.
			}

			$body = '';
			if ( is_array( $args ) && isset( $args['body'] ) ) {
				$posted = $args['body'];
				if ( is_string( $posted ) ) {
					// JSON FIRST, because that is what CSDT_Telegram::send() posts:
					// wp_json_encode( [ 'chat_id' => ..., 'text' => ... ] ) with an
					// application/json header. Only parse_str() was tried, which on
					// '{"chat_id":"1","text":"..."}' yields one nonsense key and no 'text',
					// so EVERY entry in this log stored an empty body, and because
					// level_from() reads the body, every entry also recorded level 'info'.
					// A log whose whole purpose is "what did that alert say" answered
					// nothing, and its severity column said nothing was ever wrong. Verified
					// on the live site: 29 entries, all body:"" and level:"info", including
					// the CRITICAL alerts sent that day.
					//
					// parse_str() is kept as the fallback: a form-encoded sender (another
					// plugin's copy of the shared class, or a hand-rolled wp_remote_post)
					// must still be captured.
					$decoded_body = json_decode( $posted, true );
					if ( is_array( $decoded_body ) ) {
						$posted = $decoded_body;
					} else {
						$parsed = array();
						parse_str( $posted, $parsed );
						$posted = $parsed;
					}
				}
				if ( is_array( $posted ) ) {
					$body = (string) ( $posted['text'] ?? '' );
				}
			}

			$r     = CSDT_Http::json( $response );
			$code  = $r['code'];
			$error = '';
			if ( 0 === $code ) {
				$error = $r['error'];
			} elseif ( $code < 200 || $code > 299 ) {
				// Telegram explains refusals in the body, a revoked token, the bot
				// removed from the chat, and that explanation is the whole value of
				// logging a failure at all.
				$error = CSDT_Http::reason( $r );
			}

			self::add(
				array(
					'at'     => time(),
					'body'   => self::trim_body( $body ),
					'level'  => self::level_from( $body ),
					'code'   => $code,
					'ok'     => ( '' === $error ),
					'error'  => (string) substr( $error, 0, 200 ),
				)
			);

			// The one point every alert passes, whichever plugin sent it, so other channels
			// (CSDT_Webhook) listen here instead of at each of the ~35 send() call sites.
			// Fired whether or not Telegram accepted it: a second channel is most useful
			// exactly when the first one failed.
			if ( function_exists( 'do_action' ) ) {
				do_action( 'csdt_alert_captured', $body, self::level_from( $body ) );
			}
		} catch ( \Throwable $e ) {
			// A log must never be able to break the thing it is logging, least of all the
			// alert channel. Not routed through CSDT_Monitor either: CS Monitor raises
			// Telegram alerts, so logging an exception from inside the Telegram send path
			// could send another alert and recurse.
			return;
		}
	}

	/**
	 * Cuts a body down for storage.
	 *
	 * The token is in the URL, never the body, so there is nothing secret to strip here,
	 * but the body can be long, and 100 full alert texts in one option row is a page of
	 * wp_options nobody needs.
	 *
	 * @since 1.10.488
	 * @param string $body Message text.
	 * @return string
	 */
	public static function trim_body( string $body ): string {
		$body = trim( $body );
		if ( strlen( $body ) <= self::BODY_MAX ) {
			return $body;
		}
		return substr( $body, 0, self::BODY_MAX ) . '…';
	}

	/**
	 * The severity a message announces about itself.
	 *
	 * Read from the prefix CSDT_Telegram::alert_prefix() puts on every message, so
	 * this needs no cooperation from the shared class. Falls back to 'info' rather than
	 * guessing, because a wrong severity in a log is worse than an absent one.
	 *
	 * @since 1.10.488
	 * @param string $body Message text.
	 * @return string One of critical|warning|info.
	 */
	public static function level_from( string $body ): string {
		// No text, no verdict. This returned 'info' for an empty body, so when the capture
		// silently stopped extracting the body, it parsed JSON as form-encoded for months,
		// every entry in the log claimed the mildest severity there is. 29 rows on the live
		// site read "info" including that day's CRITICAL alerts. A missing measurement must
		// never render as good news; it has to say it is missing.
		if ( '' === trim( $body ) ) {
			return 'unknown';
		}
		if ( false !== strpos( $body, '🚨' ) || false !== stripos( $body, 'CRITICAL' ) ) {
			return 'critical';
		}
		if ( false !== strpos( $body, '⚠️' ) || false !== stripos( $body, 'WARNING' ) ) {
			return 'warning';
		}
		return 'info';
	}

	/**
	 * Records a delivery failure on a channel other than Telegram (the webhook).
	 *
	 * Kept in the same log so "did that alert go out" has one answer. The entry carries its
	 * channel, and recent_failures() leaves it out, because that count is the panel's claim
	 * about Telegram specifically.
	 *
	 * @since 1.10.958
	 * @param string $channel Channel key, e.g. 'webhook'.
	 * @param string $title   What was being sent.
	 * @param string $error   Why it failed.
	 * @param int    $code    HTTP status, 0 for a transport failure.
	 * @param string $level   Level of the message.
	 */
	public static function record_channel_failure( string $channel, string $title, string $error, int $code, string $level ): void {
		try {
			self::add(
				array(
					'at'      => time(),
					'channel' => $channel,
					'body'    => self::trim_body( '[' . $channel . '] ' . $title ),
					'level'   => in_array( $level, array( 'critical', 'warning', 'info' ), true ) ? $level : 'info',
					'code'    => $code,
					'ok'      => false,
					'error'   => (string) substr( $error, 0, 200 ),
				)
			);
		} catch ( \Throwable $e ) {
			return;
		}
	}

	/**
	 * Prepends an entry and trims the log.
	 *
	 * @since 1.10.488
	 * @param array $entry Log entry.
	 */
	private static function add( array $entry ): void {
		$log = get_option( self::OPTION, array() );
		if ( ! is_array( $log ) ) {
			$log = array();
		}
		array_unshift( $log, $entry );
		update_option( self::OPTION, array_slice( $log, 0, self::MAX ), false );
	}

	/**
	 * The log, newest first.
	 *
	 * @since 1.10.488
	 * @return array<int,array<string,mixed>>
	 */
	public static function entries(): array {
		$log = get_option( self::OPTION, array() );
		return is_array( $log ) ? $log : array();
	}

	/**
	 * How many of the last N alerts failed to reach Telegram.
	 *
	 * Exists so the panel can lead with the number that matters. A log of successes is
	 * reassuring; a count of failures is actionable.
	 *
	 * @since 1.10.488
	 * @return int
	 */
	public static function recent_failures(): int {
		$n = 0;
		foreach ( self::entries() as $entry ) {
			if ( ! empty( $entry['channel'] ) ) {
				continue; // A webhook failure is shown in the table, not counted against Telegram.
			}
			if ( empty( $entry['ok'] ) ) {
				++$n;
			}
		}
		return $n;
	}

	/**
	 * What the log says about Telegram delivery, for the panel's banner.
	 *
	 * The banner used to give one number for the whole log and blame the bot token. On a log
	 * that reaches back a month, that reported a DNS outage from weeks ago as a present
	 * fault while every recent alert was arriving. Whether delivery works NOW is decided by
	 * the newest attempt, so that is reported apart from the history.
	 *
	 * @param array $entries Log entries, newest first.
	 * @return array{total:int,failures:int,latest_failed:bool,last_failure:int,since_ok:int}
	 */
	public static function delivery_summary( array $entries ): array {
		$out = array(
			'total'         => 0,
			'failures'      => 0,
			'latest_failed' => false,
			'last_failure'  => 0,
			'since_ok'      => 0,
		);
		foreach ( $entries as $entry ) {
			if ( ! is_array( $entry ) || ! empty( $entry['channel'] ) ) {
				continue; // A webhook failure says nothing about Telegram.
			}
			++$out['total'];
			if ( ! empty( $entry['ok'] ) ) {
				if ( 0 === $out['failures'] ) {
					++$out['since_ok'];
				}
				continue;
			}
			if ( 1 === $out['total'] ) {
				$out['latest_failed'] = true;
			}
			if ( 0 === $out['failures'] ) {
				$out['last_failure'] = (int) ( $entry['at'] ?? 0 );
			}
			++$out['failures'];
		}
		return $out;
	}

	/** Renders the Telegram alert log on the Mail tab. */
	public static function render_panel(): void {
		$entries  = self::entries();
		$delivery = self::delivery_summary( $entries );
		$failures = $delivery['failures'];
		$muted    = class_exists( 'CSDT_Telegram' )
			&& is_callable( array( 'CSDT_Telegram', 'is_muted' ) )
			&& CSDT_Telegram::is_muted();
		?>
		<div class="cs-panel" id="cs-panel-alert-log">
			<div class="cs-section-header" style="background:linear-gradient(90deg,#0c4a6e 0%,#0369a1 100%);border-left:3px solid #38bdf8;">
				<span>📣 <?php esc_html_e( 'Telegram Alert Log', 'cloudscale-cyber-devtools' ); ?></span>
				<span class="cs-header-hint"><?php esc_html_e( 'Every alert this site sent, and every one that failed', 'cloudscale-cyber-devtools' ); ?></span>
				<?php
				CSDT_DevTools::render_explain_btn(
					'alertlog',
					'Telegram Alert Log',
					array(
						array(
							'name' => 'Why this exists next to the email log',
							'rec'  => 'How it works',
							'html' => 'Almost every security alert on this site goes to Telegram, not to email, and until now there was no record of it here at all. Telegram itself shows you the alerts that <em>arrived</em>, it can tell you nothing about the ones that failed to send, which are the ones worth knowing about.',
						),
						array(
							'name' => 'Where the entries come from',
							'rec'  => 'How it works',
							'html' => 'Captured at the HTTP layer, as the message leaves the site. That means it records alerts sent by <strong>any</strong> of the CloudScale plugins, not only this one, the Telegram helper is shared between them, and on this install the copy that loads belongs to the backup plugin.<br><br>A failure shows Telegram’s own explanation where it gave one: a revoked bot token, the bot removed from the chat, or no outbound HTTPS.',
						),
						array(
							'name' => 'What is stored',
							'rec'  => 'Privacy',
							'html' => 'The time, the severity, the outcome, and the first ' . esc_html( (string) self::BODY_MAX ) . ' characters of the message. The last ' . esc_html( (string) self::MAX ) . ' alerts are kept.<br><br>The bot token travels in the request URL and is <strong>never</strong> stored here.',
						),
						array(
							'name' => 'An empty log is not proof of silence',
							'rec'  => 'Honest limits',
							'html' => 'Alerts are rate-limited on purpose, the auto-blocker sends at most five in fifteen minutes, and the front-end error monitor batches per page load, so a quiet log during a busy attack is the throttle working, not a gap. The auto-block panel holds the complete record of blocks regardless of how many alerts went out.<br><br>This log also only covers alerts sent <em>since this feature shipped</em>. It is not backfilled.',
						),
					)
				);
				?>
			</div>
			<div class="cs-panel-body">

				<?php if ( $muted ) : ?>
				<div style="background:#fffbeb;border-left:4px solid #d97706;padding:10px 14px;border-radius:0 6px 6px 0;margin:0 0 14px;font-size:13px;color:#78350f;">
					<strong><?php esc_html_e( 'Alerts are muted.', 'cloudscale-cyber-devtools' ); ?></strong>
					<?php esc_html_e( 'Nothing is being sent, so nothing will appear below. This is the setting a restored copy of the site should have.', 'cloudscale-cyber-devtools' ); ?>
				</div>
				<?php endif; ?>

				<?php if ( $delivery['latest_failed'] ) : ?>
				<div style="background:#fef2f2;border-left:4px solid #dc2626;padding:10px 14px;border-radius:0 6px 6px 0;margin:0 0 14px;font-size:13px;color:#7f1d1d;">
					<strong><?php esc_html_e( 'The most recent alert did not reach Telegram.', 'cloudscale-cyber-devtools' ); ?></strong>
					<?php
					echo esc_html(
						sprintf(
							/* translators: 1: failed alerts, 2: alerts in the log. */
							__( '%1$d of the last %2$d alerts failed. The reason is beside each one below. If it is not a timeout or a DNS error, check the bot token and that the bot is still in the chat, then use Send Test.', 'cloudscale-cyber-devtools' ),
							$failures,
							$delivery['total']
						)
					);
					?>
				</div>
				<?php elseif ( $failures > 0 ) : ?>
				<div style="background:#f8fafc;border-left:4px solid #94a3b8;padding:10px 14px;border-radius:0 6px 6px 0;margin:0 0 14px;font-size:13px;color:#334155;">
					<strong><?php esc_html_e( 'Telegram delivery is working.', 'cloudscale-cyber-devtools' ); ?></strong>
					<?php
					echo esc_html(
						sprintf(
							/* translators: 1: alerts delivered since the last failure, 2: failed alerts, 3: alerts in the log, 4: date of the last failure. */
							_n(
								'The %1$d alert since the last failure was delivered. Earlier, %2$d of the last %3$d alerts did not arrive, the most recent on %4$s. The reason is beside each one below.',
								'The %1$d alerts since the last failure were delivered. Earlier, %2$d of the last %3$d alerts did not arrive, the most recent on %4$s. The reason is beside each one below.',
								$delivery['since_ok'],
								'cloudscale-cyber-devtools'
							),
							$delivery['since_ok'],
							$failures,
							$delivery['total'],
							wp_date( 'j M Y', $delivery['last_failure'] )
						)
					);
					?>
				</div>
				<?php endif; ?>

				<?php if ( empty( $entries ) ) : ?>
					<p style="color:#888;font-size:13px;margin:0">
						<?php esc_html_e( 'No Telegram alerts recorded yet. Alerts are logged here as they are sent; use Send Test on the notification channels panel to confirm the path works.', 'cloudscale-cyber-devtools' ); ?>
					</p>
				<?php else : ?>
				<div style="overflow-x:auto">
				<table style="width:100%;border-collapse:collapse;font-size:13px">
					<thead>
						<tr style="background:#f3f4f6;text-align:left">
							<th style="padding:7px 10px;border-bottom:1px solid #e0e0e0;white-space:nowrap"><?php esc_html_e( 'Time', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="padding:7px 10px;border-bottom:1px solid #e0e0e0;white-space:nowrap"><?php esc_html_e( 'Level', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="padding:7px 10px;border-bottom:1px solid #e0e0e0"><?php esc_html_e( 'Sent', 'cloudscale-cyber-devtools' ); ?></th>
						</tr>
					</thead>
					<tbody>
					<?php foreach ( $entries as $i => $entry ) : ?>
						<?php
						$level = (string) ( $entry['level'] ?? 'info' );
						$body  = (string) ( $entry['body'] ?? '' );
						// An entry with no text cannot be trusted about its severity either: the
						// stored level was DERIVED from that missing text. Rows written before the
						// capture was fixed say 'info' for alerts that were CRITICAL, so the
						// severity is shown as unknown rather than repeating a value that was
						// never measured. The row still carries what it does know, when the
						// alert went out, and whether Telegram accepted it.
						if ( '' === trim( $body ) ) {
							$level = 'unknown';
						}
						$dot   = 'critical' === $level
							? '#dc2626'
							: ( 'warning' === $level ? '#d97706' : ( 'unknown' === $level ? '#9ca3af' : '#0369a1' ) );
						$ok    = ! empty( $entry['ok'] );
						$bg    = 0 === $i % 2 ? '#fff' : '#fafafa';
						// The message sits on its own full-width row. As a fourth column it was
						// pushed off the right edge of a phone, where the log looked like one row
						// and a blank page.
						?>
						<tr style="background:<?php echo esc_attr( $bg ); ?>;vertical-align:top;">
							<td style="padding:7px 10px 2px;white-space:nowrap">
								<?php echo esc_html( wp_date( 'Y-m-d H:i T', (int) ( $entry['at'] ?? 0 ) ) ); ?>
							</td>
							<td style="padding:7px 10px 2px;white-space:nowrap">
								<span style="display:inline-block;width:8px;height:8px;border-radius:50%;background:<?php echo esc_attr( $dot ); ?>;margin-right:5px;"></span>
								<?php echo esc_html( $level ); ?>
							</td>
							<td style="padding:7px 10px 2px;word-break:break-word;">
								<?php if ( $ok ) : ?>
									<span style="color:#16a34a;">✓</span>
								<?php else : ?>
									<span style="color:#dc2626;">✕ <?php echo esc_html( (string) ( $entry['error'] ?? 'failed' ) ); ?></span>
								<?php endif; ?>
							</td>
						</tr>
						<tr style="background:<?php echo esc_attr( $bg ); ?>;">
							<td colspan="3" style="padding:2px 10px 9px;border-bottom:1px solid #f0f0f0;white-space:pre-wrap;word-break:break-word;color:#374151;">
								<?php if ( '' === trim( $body ) ) : ?>
									<?php
									// Say why the cell is empty. A blank cell reads as a broken log, and
									// this one WAS broken: the capture parsed a JSON request body as
									// form-encoded, so it stored the delivery result and threw the text
									// away. Rows from before that fix cannot be recovered, the text was
									// never received, so they are labelled rather than deleted, because
									// "an alert went out at this time and Telegram accepted it" is still
									// a true and useful record.
									?>
									<span style="color:#9ca3af;font-style:italic;">
										<?php esc_html_e( 'Text not recorded: logged before the capture fix, and not recoverable. The delivery result above is still accurate.', 'cloudscale-cyber-devtools' ); ?>
									</span>
								<?php else : ?>
									<?php echo esc_html( $body ); ?>
								<?php endif; ?>
							</td>
						</tr>
					<?php endforeach; ?>
					</tbody>
				</table>
				</div>
				<?php endif; ?>

			</div>
		</div>
		<?php
	}
}