<?php
/**
 * CloudScale Code Block, Uninstall
 *
 * Removes all plugin data when the plugin is deleted from the WordPress admin.
 * This file is called automatically by WordPress on plugin deletion.
 *
 * @package CSDT_DevTools
 * @since   1.0.0
 */

if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
    exit;
}

// Current option names.
$csdt_options = array(
    'csdt_devtools_code_default_theme',
    'csdt_devtools_code_theme_pair',
    'csdt_devtools_anthropic_key',
    'csdt_devtools_gemini_key',
    'csdt_devtools_openai_key',
    'csdt_devtools_ai_provider',
    'csdt_devtools_security_model',
    'csdt_devtools_deep_scan_model',
    'csdt_devtools_security_prompt',
    'csdt_devtools_safe_headers_enabled',
    'csdt_devtools_sec_headers_ack',
    'csdt_devtools_csp_enabled',
    'csdt_devtools_csp_mode',
    'csdt_devtools_csp_services',
    'csdt_devtools_csp_custom',
    'csdt_csp_presets_migrated',
    'csdt_devtools_csp_backup',
    'csdt_devtools_brute_force_enabled',
    'csdt_wplogin_auto_block_threshold',
    'csdt_devtools_login_hide_enabled',
    'csdt_devtools_login_slug',
    'csdt_devtools_2fa_method',
    'csdt_devtools_perf_monitor_enabled',
    'csdt_devtools_smtp_host',
    'csdt_devtools_smtp_port',
    'csdt_devtools_smtp_user',
    'csdt_devtools_smtp_pass',
    // Was 'csdt_devtools_smtp_from', which the code never writes, the real
    // option is _from_email, so the From address survived every uninstall.
    'csdt_devtools_smtp_from_email',
    // The email log stores bodies (up to 100 KB each, 100 entries), so leaving
    // it behind on uninstall is both stale data and a privacy problem.
    'csdt_devtools_email_log',
    'csdt_devtools_email_log_enabled',
    'csdt_devtools_smtp_from_name',
    'csdt_devtools_smtp_enabled',
    'csdt_devtools_smtp_encryption',
    'csdt_telegram_login_valid_user',
    'csdt_telegram_login_invalid_user',
    'csdt_telegram_rest_auth_fail',
    'csdt_telegram_scan_result',
    'csdt_telegram_threat_monitor',
    'csdt_telegram_php_errors',
    'csdt_fpm_token',
    'csdt_fpm_last_event',
    'csdt_fpm_event_log',
    'csdt_threat_monitor_enabled',
    'csdt_threat_file_integrity_enabled',
    'csdt_integrity_legacy_default_on',
    'csdt_integrity_default_migrated',
    'csdt_threat_new_admin_enabled',
    'csdt_threat_probe_enabled',
    'csdt_threat_probe_threshold',
    'csdt_threat_last_file_alert',
    'csdt_threat_last_admin_alert',
    'csdt_threat_last_probe_alert',
    'csdt_file_integrity_wp_ver',
    'csdt_file_integrity_baseline',
    'csdt_security_scan_v2',
    'csdt_deep_scan_v1',
    'csdt_scan_history',
    'csdt_site_audit_cache',
    'csdt_devtools_cf_zone_id',
    'csdt_devtools_cf_api_token',
    'csdt_ip_blocklist',
    'csdt_ip_blocklist_active',
    'csdt_ip_blocklist_shape',
    // Ended blocks, retained since 1.10.583 so the panel can show one list instead of a live
    // list plus a separate audit table. Added here in the same change that created it, the
    // note below records what happens when that is left for later.
    'csdt_ip_block_history',
    // The whole auto-block family was absent from this list, so an uninstall left
    // behind the enabled flag, thresholds, allowlist, the rolling per-IP event
    // ledger and the record of how many times each address had been blocked
    // before. A reinstall therefore inherited another site's escalation history.
    'csdt_autoblock_enabled',
    'csdt_autoblock_threshold',
    'csdt_autoblock_api_threshold',
    'csdt_autoblock_window',
    'csdt_autoblock_allowlist',
    'csdt_autoblock_counts',
    'csdt_autoblock_offences',
    'csdt_autoblock_log',
    'csdt_autoblock_counters_broken',
    'csdt_own_public_ips',
    'csdt_own_observed_ips',
    // Alert quiet windows (CSDT_Alert_Window), since 1.10.938.
    'csdt_alert_windows',
    // Comment guard opt-ins, the site-wide comment ceiling and the Cloudflare comment
    // rule's last known state (1.10.958).
    'csdt_comment_guard_enforce_block_markup',
    'csdt_comment_guard_refuse_flagged',
    'csdt_comment_guard_refuse_duplicates',
    'csdt_comment_guard_block_links',
    'csdt_comment_ceiling_mode',
    'csdt_comment_ceiling_limit',
    'csdt_comment_ceiling_last',
    'csdt_comment_min_gap',
    'csdt_comment_gap_last',
    'csdt_host_alarms_enabled',
    'csdt_host_alarms_limits',
    'csdt_host_alarms_state',
    'csdt_tls_expiry_enabled',
    'csdt_tls_expiry_hosts',
    'csdt_tls_expiry_state',
    // PHP Advisory Alerts (CSDT_Php_Advisory).
    'csdt_php_runtime',
    'csdt_php_advisory_sent',
    'csdt_php_advisory_alerts',
    'csdt_php_advisory_state',
    // Recent web fatals, kept by the shutdown handler for Upgrade Verification (CSDT_Monitor).
    'csdt_fatal_times',
    // Out of Band Heartbeat (CSDT_Uptime_Heartbeat): the v1 names prod already had, the last
    // scheduled result, and the persistence-watch change counter it sends.
    'csdt_uptime_enabled',
    'csdt_uptime_worker_url',
    'csdt_uptime_token',
    'csdt_uptime_last',
    'csdt_persistence_changes',
    // Upgrade Verification (CSDT_Upgrade_Verify). Its two cron hooks are csdt_ prefixed, so the
    // sweep below removes them.
    'csdt_upgrade_verify_enabled',
    'csdt_upgrade_verify_notify_pass',
    'csdt_upgrade_verify_fingerprint',
    'csdt_upgrade_verify_pending',
    'csdt_upgrade_verify_runs',
    // Edge WAF Push (CSDT_Edge_Waf). Its cron hook is csdt_ prefixed, so the sweep below removes
    // it. The rules it pushed stay at the edge: uninstall makes no call, and the panel's
    // "Remove everything we pushed" is how they are taken away.
    'csdt_edge_waf_mode',
    'csdt_edge_waf_state',
    'csdt_edge_admin_ips',
    // CloudScale Edge Gateway (CSDT_Edge_Gateway). Removing csdt_edge_gateways deletes every
    // pairing secret, so no gateway token works after uninstall. Its events table is dropped below.
    'csdt_edge_gateways',
    'csdt_edge_gw_settings',
    'csdt_edge_gw_runtime',
    'csdt_edge_gw_health',
    'csdt_edge_gw_state_meta',
    'csdt_edge_gw_admin_ips',
    'csdt_edge_gw_bypass',
    'csdt_edge_gw_alerted',
    'csdt_edge_gw_schema',
    // Emergency Lockdown (CSDT_Lockdown). No cron; its transients go with the prefix sweep.
    // Removing the state lifts every rule, which is what an uninstalled plugin should leave.
    'csdt_lockdown_state',
    'csdt_lockdown_settings',
    'csdt_lockdown_link_key',
    'csdt_lockdown_links',
    'csdt_lockdown_events',
    'csdt_cf_comment_rule_state',
    'csdt_cf_last_failure',
    'csdt_cf_last_check',
    // Schema version for the counter table dropped below. Leaving it behind made a
    // reinstall believe the table existed when it had just been removed.
    'csdt_storage_schema',
    'csdt_github_sync_db_version',
    // Core verification state (1.10.446). The two file_integrity_* options above
    // are the retired mtime baseline, kept in this list because existing installs
    // still carry them and the baseline held a row per core file.
    'csdt_integrity_result',
    'csdt_integrity_state',
    'csdt_integrity_alerted',
    'csdt_alert_delivery_last',
    'csdt_firewall_mode',
    'csdt_firewall_disabled_rules',
    'csdt_firewall_enforced_opt_in',
    'csdt_firewall_exceptions',
    'csdt_crawler_verify_mode',
    'csdt_crawler_verdicts',
    'csdt_crawler_verify_stats',
    // Virtual patching (1.10.1055).
    'csdt_vpatch_mode',
    'csdt_vpatch_feed',
    'csdt_vpatch_applicable',
    'csdt_vpatch_last_error',
    'csdt_firewall_skip_capability',
    'csdt_firewall_no_rules',
    'csdt_live_traffic_enabled',
    'csdt_integrity_plugins',
    'csdt_integrity_plugin_state',
    // Country rules (1.10.458).
    'csdt_geoblock_enabled',
    'csdt_geoblock_mode',
    'csdt_geoblock_countries',
    'csdt_geoblock_scope',
    'csdt_geoblock_stats',
    // Vulnerable-component shields (1.10.776). No new table: shields are config, not
    // events, and their refusals are rows in csdt_firewall_log which is already dropped
    // below.
    'csdt_shield_candidates',
    'csdt_shield_active',
    'csdt_shield_surfaces',
    'csdt_shield_last_lift',
);

foreach ( $csdt_options as $csdt_opt ) {
    delete_option( $csdt_opt );
}

// ── Everything else with our prefix ──────────────────────────────────────────
// The explicit list above documents intent for the options a reader would look for first.
// It is not, and cannot be, complete: a sweep on 2026-08-09 found 126 options written by
// the plugin that no entry in it removed. A hand-maintained list of every option a growing
// plugin writes will always drift, and the drift is invisible, nothing fails when an option
// is left behind. Round 22 showed it drifts the OTHER way too, opening a finding on each of
// eleven entries naming options nothing writes; those have been removed.
//
// So the prefix does the work, transients included, since a transient is an option row too.
// Names from before the csdt_ prefix are not swept here: CSDT_DevTools::migrate_legacy_names()
// renames them on the first admin request after an update, so none are left to remove.
//
// The shared licence class's transients carry the csdt_ prefix in this plugin's copy, so the
// same sweep covers them.
global $wpdb; // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- WordPress core global
foreach ( array( 'csdt\_%', '\_transient\_csdt\_%', '\_transient\_timeout\_csdt\_%', '\_transient\_csdt%', '\_transient\_timeout\_csdt%' ) as $csdt_like ) {
    $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- uninstall; there is no caching layer to invalidate at this point
        $wpdb->prepare( 'DELETE FROM %i WHERE option_name LIKE %s', $wpdb->options, $csdt_like )
    );
}

// User meta and post meta, by prefix for the same reason as the options above: the
// hand-written list this replaced named a key nothing ever wrote and missed the pending
// TOTP secret, the email-verify token and the events cursor that were left behind.
// Includes csdt_cve_checks_prompt_dismissed (CSDT_Cve_Checks, when each admin last hid the
// "new CVEs are not being checked" notice). The two switches it turns on go with the csdt_ options.
$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- uninstall
    $wpdb->prepare( 'DELETE FROM %i WHERE meta_key LIKE %s', $wpdb->usermeta, 'csdt\_%' )
);
$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- uninstall
    $wpdb->prepare( 'DELETE FROM %i WHERE meta_key LIKE %s', $wpdb->postmeta, '\_csdt\_%' )
);
// The comment guard's note on each comment it held or marked spam.
$wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- uninstall
    $wpdb->prepare( 'DELETE FROM %i WHERE meta_key LIKE %s', $wpdb->commentmeta, '\_csdt\_%' )
);

// Every scheduled task this plugin registered, found in the cron array rather than
// listed: fourteen hooks are scheduled across the plugin and a list would drift.
foreach ( (array) _get_cron_array() as $csdt_ts => $csdt_hooks ) {
    foreach ( array_keys( (array) $csdt_hooks ) as $csdt_hook ) {
        if ( 0 === strpos( (string) $csdt_hook, 'csdt_' ) ) {
            wp_clear_scheduled_hook( (string) $csdt_hook );
        }
    }
}

// The Out of Band Heartbeat's must-use loader, written only by its Install loader button. Its
// schedule is deliberately not csdt_ prefixed (so deactivation leaves it running), which is why
// the sweep above does not reach it. Found through core's own mu-plugin listing, and deleted
// only when the file carries the loader's header, so a same-named file of someone else's stays.
wp_clear_scheduled_hook( 'cloudscale_hb_fallback' );
foreach ( (array) wp_get_mu_plugins() as $csdt_mu ) {
    if ( 'cloudscale-heartbeat-loader.php' !== basename( (string) $csdt_mu ) || ! is_readable( (string) $csdt_mu ) ) {
        continue;
    }
    // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- the header of a local PHP file this plugin wrote; never a URL
    $csdt_head = (string) file_get_contents( (string) $csdt_mu, false, null, 0, 4096 );
    if ( false !== strpos( $csdt_head, 'Plugin Name: CloudScale Heartbeat Loader' ) ) {
        wp_delete_file( (string) $csdt_mu );
    }
}

// The directories the plugin created under uploads: its own log, image backups made
// before recompression, the GeoIP database (cloudscale-cyber-devtools/geo, csdt-geo before
// 1.10.889). Nothing else of the user's lives there.
$csdt_upload = wp_upload_dir();
if ( empty( $csdt_upload['error'] ) && ! empty( $csdt_upload['basedir'] ) ) {
    require_once ABSPATH . 'wp-admin/includes/file.php';
    if ( WP_Filesystem() ) {
        global $wp_filesystem; // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- WordPress core global
        // Every name carries the plugin prefix. The unprefixed pre-1.10.873 'social-formats'
        // is not swept: a name without the prefix may belong to someone else.
        foreach ( array( 'cloudscale-cyber-devtools', 'cloudscale-cyber-devtools-logs', 'cloudscale-cyber-devtools-image-backups', 'csdt-geo', 'csdt-social-formats' ) as $csdt_dir ) {
            $csdt_path = trailingslashit( $csdt_upload['basedir'] ) . $csdt_dir;
            if ( $wp_filesystem->is_dir( $csdt_path ) ) {
                $wp_filesystem->rmdir( $csdt_path, true );
            }
        }
    }
}

// ── Tables ───────────────────────────────────────────────────────────────────
// No table was ever dropped here. wp_csdt_github_blocks has been created since
// 1.9.0 and survived every uninstall, and its schema-version option survived too,
// so a reinstall read a current version against a table it had not verified.
// Dropped explicitly rather than through a helper, because uninstall.php runs
// without the plugin loaded and cannot rely on any of its classes.
// One literal statement per table, so the csdt_ prefix is visible on the line that drops it.
// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange -- uninstall
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . 'csdt_ip_events' ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . 'csdt_firewall_log' ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . 'csdt_activity_log' ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . 'csdt_live_traffic' ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . 'csdt_github_blocks' ) );
$wpdb->query( $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . 'csdt_edge_events' ) );
// phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange