<?php
/**
 * CVE checks prompt: says plainly when new CVEs are not being checked, and switches a check on
 * with one click.
 *
 * WHY THIS EXISTS
 * ---------------
 * Both checks that notice a NEW vulnerability are opt-in and off on a default install, because
 * WordPress.org requires that no outbound call happens until the admin asks for it:
 *
 *   - PHP Advisory Alerts (CSDT_Php_Advisory, csdt_php_advisory_alerts). Off, the php.net
 *     snapshot is never fetched on a schedule.
 *   - CVE lookups (CSDT_Vuln_Recheck, csdt_devtools_external_lookups_enabled). Off, the daily
 *     plugin, theme, core and server software re-check never runs.
 *
 * With both off, the only CVE lookup that happens is one the admin starts by hand (a security
 * scan, which needs an AI key, or Check host software), so a CVE published after that is never
 * reported. The site said nothing about it. The owner chose "prompt to switch on": stay opt-in,
 * but say so on the plugin's own screens and in the Site Audit and the weekly report, and make
 * turning each check on one click.
 *
 * What this class does NOT do: switch anything on by itself, fetch anything, or write anything
 * on a page view. The notice reads two options and one user meta row. Every write is an AJAX
 * click with a nonce and manage_options, refused to a minted test session by CSDT_Ajax.
 *
 * @package CloudScale_Cyber_DevTools
 */

defined( 'ABSPATH' ) || exit;

/**
 * The "new CVEs are not being checked" prompt and its one-click enables.
 */
final class CSDT_Cve_Checks {

	/** User meta: when this user last dismissed the notice (unix time). Swept by uninstall's csdt_ prefix. */
	const META_DISMISSED = 'csdt_cve_checks_prompt_dismissed';

	/** A dismissed notice comes back after this long while a check is still off. */
	const SNOOZE = 30 * DAY_IN_SECONDS;

	/** The two checks, by short id. */
	const PHP     = 'php';
	const LOOKUPS = 'lookups';

	/**
	 * Test-only clock. Null in production.
	 *
	 * @var int|null
	 */
	public static $now_override = null;

	/** Current time. */
	private static function now(): int {
		return null !== self::$now_override ? self::$now_override : time();
	}

	/** Hooks. Called from CSDT_DevTools::init(). */
	public static function register(): void {
		add_action( 'admin_notices', array( __CLASS__, 'render_notice' ), 20, 0 );
		CSDT_Ajax::register( 'wp_ajax_csdt_cve_checks_enable_php', array( 'CSDT_Cve_Checks', 'ajax_enable_php' ), array( 'refuse_test_session' => true ) );
		CSDT_Ajax::register( 'wp_ajax_csdt_cve_checks_enable_lookups', array( 'CSDT_Cve_Checks', 'ajax_enable_lookups' ), array( 'refuse_test_session' => true ) );
		CSDT_Ajax::register( 'wp_ajax_csdt_cve_checks_dismiss', array( 'CSDT_Cve_Checks', 'ajax_dismiss' ) );
	}

	// ── State ──────────────────────────────────────────────────────────────

	/**
	 * Which checks are on. Reads options only.
	 *
	 * @return array{php:bool,lookups:bool}
	 */
	public static function state(): array {
		return array(
			self::PHP     => class_exists( 'CSDT_Php_Advisory' ) && CSDT_Php_Advisory::is_enabled(),
			self::LOOKUPS => class_exists( 'CSDT_Vuln_Recheck' ) && CSDT_Vuln_Recheck::is_enabled(),
		);
	}

	/**
	 * The checks that are off, in display order.
	 *
	 * @param array|null $state state(), or null to read it.
	 * @return string[] Subset of PHP, LOOKUPS.
	 */
	public static function off( ?array $state = null ): array {
		$state = null === $state ? self::state() : $state;
		$out   = array();
		foreach ( array( self::LOOKUPS, self::PHP ) as $which ) {
			if ( empty( $state[ $which ] ) ) {
				$out[] = $which;
			}
		}
		return $out;
	}

	/**
	 * A check's name, as the notice, the finding and the report print it.
	 *
	 * @param string $which PHP or LOOKUPS.
	 * @return string
	 */
	public static function label( string $which ): string {
		return self::PHP === $which ? 'PHP advisory alerts' : 'CVE lookups';
	}

	/**
	 * What switching a check on sends, in one short sentence. One wording for the notice, the
	 * panels, the finding and the report, matching readme.txt's External services entries.
	 *
	 * @param string $which PHP or LOOKUPS.
	 * @return string
	 */
	public static function sends( string $which ): string {
		if ( self::PHP === $which ) {
			return 'Downloads a public list of php.net security releases from api.cloudscale.consulting every 6 hours. Sends nothing about this site.';
		}
		return 'Once a day, sends each installed plugin and theme slug, your WordPress version and server software versions to api.cloudscale.consulting, one per request, never your site URL. Also turns on the own-IP lookup fallback.';
	}

	/** The button text for a check. */
	public static function button_text( string $which ): string {
		return self::PHP === $which ? 'Turn on PHP advisory alerts' : 'Turn on CVE lookups';
	}

	// ── The notice ─────────────────────────────────────────────────────────

	/**
	 * Whether a screen is one of this plugin's own. WordPress gives the one page three hook
	 * suffixes (see CSDT_DevTools::enqueue_admin_assets()); the screen id is the same string.
	 *
	 * @param string $screen_id get_current_screen()->id.
	 * @return bool
	 */
	public static function is_plugin_screen( string $screen_id ): bool {
		$slug = CSDT_DevTools::TOOLS_SLUG;
		return in_array( $screen_id, array( 'toplevel_page_' . $slug, 'tools_page_' . $slug, 'admin_page_' . $slug ), true );
	}

	/**
	 * Whether this user dismissed the notice less than SNOOZE ago.
	 *
	 * @param int $user_id User.
	 * @param int $now     Time.
	 * @return bool
	 */
	public static function is_snoozed( int $user_id, int $now ): bool {
		if ( $user_id <= 0 ) {
			return false;
		}
		$at = (int) get_user_meta( $user_id, self::META_DISMISSED, true );
		return $at > 0 && ( $now - $at ) < self::SNOOZE;
	}

	/**
	 * Whether the notice shows. Read-only.
	 *
	 * @param string $screen_id Current screen id.
	 * @param int    $user_id   Current user.
	 * @return bool
	 */
	public static function should_show( string $screen_id, int $user_id ): bool {
		if ( ! self::is_plugin_screen( $screen_id ) || ! current_user_can( 'manage_options' ) ) {
			return false;
		}
		if ( array() === self::off() ) {
			return false;
		}
		return ! self::is_snoozed( $user_id, self::now() );
	}

	/** admin_notices: the prompt, on this plugin's screens only. */
	public static function render_notice(): void {
		try {
			$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
			$id     = is_object( $screen ) && isset( $screen->id ) ? (string) $screen->id : '';
			if ( ! self::should_show( $id, (int) get_current_user_id() ) ) {
				return;
			}
			$off = self::off();
		} catch ( \Throwable $e ) {
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
			return;
		}
		$names = array_map( array( __CLASS__, 'label' ), $off );
		?>
		<div class="notice notice-warning" id="csdt-cve-checks-notice" style="padding:10px 14px;">
			<p style="margin:0 0 6px;font-size:14px;">
				<strong><?php esc_html_e( 'New CVEs are not being checked.', 'cloudscale-cyber-devtools' ); ?></strong>
				<?php
				/* translators: %s: the names of the checks that are off, joined with "and". */
				echo esc_html( sprintf( __( 'Off: %s. Both are off by default and nothing is sent until you turn one on.', 'cloudscale-cyber-devtools' ), implode( ' and ', $names ) ) );
				?>
			</p>
			<?php
			foreach ( $off as $which ) {
				self::render_enable_button( $which, 'notice' );
			}
			?>
			<p style="margin:8px 0 0;display:flex;align-items:center;gap:10px;flex-wrap:wrap;">
				<button type="button" class="button-link" id="csdt-cve-checks-dismiss"><?php esc_html_e( 'Remind me in 30 days', 'cloudscale-cyber-devtools' ); ?></button>
				<span id="csdt-cve-checks-notice-msg" style="font-size:13px;"></span>
				<?php
				CSDT_DevTools::render_explain_btn(
					'cve-checks-notice',
					'New CVEs are not being checked',
					array(
						array(
							'name' => 'What a default install checks',
							'rec'  => 'Info',
							'html' => '<p>Nothing on a schedule. A CVE is looked up only when you start a security scan or click Check host software. A vulnerability published after that is not reported until you check again.</p>',
						),
						array(
							'name' => 'PHP advisory alerts',
							'rec'  => 'Recommended',
							'html' => '<p>' . esc_html( self::sends( self::PHP ) ) . ' Alerts when php.net announces or ships a security release for your PHP.</p>',
						),
						array(
							'name' => 'CVE lookups',
							'rec'  => 'Recommended',
							'html' => '<p>' . esc_html( self::sends( self::LOOKUPS ) ) . ' Alerts on a new known vulnerability in anything installed.</p>',
						),
						array(
							'name' => 'Turning them off again',
							'rec'  => 'Info',
							'html' => '<p>Both switches are on the AI Security Scan tab: CVE Alerts and PHP Advisory Alerts. Untick and save to stop them. Remind me in 30 days hides this notice for you only.</p>',
						),
					),
					'',
					true
				);
				?>
			</p>
		</div>
		<?php
	}

	/**
	 * One "Turn on" button with what it sends beside it. Used by the notice and by both panels;
	 * cs-cve-checks.js wires every .csdt-cve-enable by delegation.
	 *
	 * @param string $which   PHP or LOOKUPS.
	 * @param string $context 'notice' or 'panel', for the element ids.
	 * @return void
	 */
	public static function render_enable_button( string $which, string $context ): void {
		$which = self::PHP === $which ? self::PHP : self::LOOKUPS;
		$id    = 'csdt-cve-enable-' . $which . '-' . ( 'panel' === $context ? 'panel' : 'notice' );
		?>
		<div class="csdt-cve-enable-row" style="display:flex;align-items:center;gap:10px;flex-wrap:wrap;margin:6px 0;">
			<button type="button" class="button button-primary csdt-cve-enable" id="<?php echo esc_attr( $id ); ?>" data-check="<?php echo esc_attr( $which ); ?>"><?php echo esc_html( self::button_text( $which ) ); ?></button>
			<span class="csdt-cve-enable-sends" style="font-size:12px;color:#374151;max-width:640px;"><?php echo esc_html( self::sends( $which ) ); ?></span>
			<span class="csdt-cve-enable-msg" style="font-size:13px;"></span>
		</div>
		<?php
	}

	// ── AJAX ───────────────────────────────────────────────────────────────

	/** Turns PHP advisory alerts on and starts its cron. Never turns anything off. */
	public static function ajax_enable_php(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		update_option( CSDT_Php_Advisory::OPTION_ENABLED, '1', false );
		CSDT_Php_Advisory::sync_schedule();
		wp_send_json_success(
			array(
				'check' => self::PHP,
				'on'    => true,
				'msg'   => __( 'PHP advisory alerts are on. The first check runs within a few minutes.', 'cloudscale-cyber-devtools' ),
			)
		);
	}

	/** Turns CVE lookups on and starts the daily re-check. Never turns anything off. */
	public static function ajax_enable_lookups(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		update_option( CSDT_Vuln_Recheck::OPTION_ENABLED, '1' );
		CSDT_Vuln_Recheck::sync_schedule();
		wp_send_json_success(
			array(
				'check' => self::LOOKUPS,
				'on'    => true,
				'msg'   => __( 'CVE lookups are on. The first daily re-check runs in about two hours.', 'cloudscale-cyber-devtools' ),
			)
		);
	}

	/** Hides the notice for this user for SNOOZE. Writes this user's own meta only. */
	public static function ajax_dismiss(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		update_user_meta( get_current_user_id(), self::META_DISMISSED, self::now() );
		wp_send_json_success( array( 'msg' => __( 'Hidden for 30 days.', 'cloudscale-cyber-devtools' ) ) );
	}
}