<?php
/**
 * The storefront screens CrewCommerce adds to My Account: Team Dashboard,
 * Manage Team, Pending Approvals and My Requests.
 */

if (!defined('ABSPATH')) {
    exit;
}

class CrewCommerce_Frontend_Dashboard {

    private static $instance = null;

    /** My Account endpoints this class registers. */
    const ENDPOINTS = array('crewcommerce-dashboard', 'crewcommerce-team', 'crewcommerce-approvals', 'crewcommerce-my-requests');

    public static function get_instance() {
        if (null === self::$instance) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    private function __construct() {
        add_action('init', array($this, 'init'));
    }

    public function init() {
        // Registered on 'init', WordPress's documented hook for
        // add_rewrite_endpoint(), so it works whatever order plugins load in.
        $this->add_woocommerce_endpoints();

        add_filter('query_vars', array($this, 'add_query_vars'));
        add_filter('woocommerce_get_query_vars', array($this, 'add_woocommerce_query_vars'));
        add_filter('woocommerce_account_menu_items', array($this, 'add_account_menu_items'));
        add_action('woocommerce_account_crewcommerce-dashboard_endpoint', array($this, 'dashboard_content'));
        add_action('woocommerce_account_crewcommerce-team_endpoint', array($this, 'team_management_content'));
        add_action('woocommerce_account_crewcommerce-approvals_endpoint', array($this, 'approvals_content'));
        add_action('woocommerce_account_crewcommerce-my-requests_endpoint', array($this, 'my_requests_content'));

        add_action('wp_ajax_crewcommerce_frontend_remove_member', array($this, 'ajax_remove_member'));
        add_action('wp_ajax_crewcommerce_frontend_update_role', array($this, 'ajax_update_role'));
        add_action('wp_ajax_crewcommerce_frontend_approve_order', array($this, 'ajax_approve_order'));
        add_action('wp_ajax_crewcommerce_frontend_claim_approval', array($this, 'ajax_claim_approval'));
        add_action('wp_ajax_crewcommerce_frontend_reject_order', array($this, 'ajax_reject_order'));
        add_action('wp_ajax_crewcommerce_frontend_cancel_approval', array($this, 'ajax_cancel_approval'));

        add_shortcode('crewcommerce_dashboard', array($this, 'dashboard_shortcode'));

        add_filter('woocommerce_checkout_fields', array($this, 'add_approval_notice_to_checkout'));

        // Tell the requester, on the order confirmation page, that the order
        // they just placed is held for approval rather than on its way.
        add_filter('woocommerce_thankyou_order_received_text', array($this, 'approval_order_received_text'), 10, 2);
    }

    public function add_woocommerce_endpoints() {
        foreach (self::ENDPOINTS as $endpoint) {
            add_rewrite_endpoint($endpoint, EP_ROOT | EP_PAGES);
        }

        // Flush once per endpoint set, so a site that was active before an
        // endpoint was added picks it up.
        if (get_option('crewcommerce_endpoints_version') !== CREWCOMMERCE_ENDPOINTS_VERSION) {
            flush_rewrite_rules();
            update_option('crewcommerce_endpoints_version', CREWCOMMERCE_ENDPOINTS_VERSION);
        }

        add_action('template_redirect', array($this, 'handle_fallback_requests'));
    }

    public function add_query_vars($vars) {
        $vars[] = 'crewcommerce_action';
        return $vars;
    }

    public function add_woocommerce_query_vars($vars) {
        foreach (self::ENDPOINTS as $endpoint) {
            $vars[$endpoint] = $endpoint;
        }
        return $vars;
    }

    /**
     * ?crewcommerce_action=… fallback for sites whose rewrite rules can't
     * serve the endpoints (some local development setups).
     */
    public function handle_fallback_requests() {
        if (!is_account_page() || !is_user_logged_in()) {
            return;
        }

        $action = get_query_var('crewcommerce_action', '');
        $map    = array(
            'dashboard'   => 'dashboard_content',
            'team'        => 'team_management_content',
            'approvals'   => 'approvals_content',
            'my-requests' => 'my_requests_content',
        );

        if (isset($map[$action])) {
            $method = $map[$action];
            add_filter('woocommerce_account_content', function () use ($method) {
                ob_start();
                $this->$method();
                return ob_get_clean();
            });
        }
    }

    public function add_account_menu_items($items) {
        $user_id       = get_current_user_id();
        $team_accounts = CrewCommerce_Team_Accounts::get_instance();

        if (!$team_accounts->get_user_company($user_id)) {
            return $items;
        }

        $user_role = $team_accounts->get_user_role($user_id);
        $new_items = array();

        foreach ($items as $key => $item) {
            $new_items[$key] = $item;

            if ('orders' !== $key) {
                continue;
            }

            $new_items['crewcommerce-dashboard'] = __('Team Dashboard', 'crewcommerce');

            if (in_array($user_role, array('admin', 'manager'), true)) {
                $new_items['crewcommerce-team'] = __('Manage Team', 'crewcommerce');

                $pending = count(CrewCommerce_Approvals::get_instance()->get_pending_approvals($user_id));
                $new_items['crewcommerce-approvals'] = $pending > 0
                    /* translators: %d: number of orders waiting for approval */
                    ? sprintf(__('Pending Approvals (%d)', 'crewcommerce'), $pending)
                    : __('Pending Approvals', 'crewcommerce');
            }

            $new_items['crewcommerce-my-requests'] = __('My Requests', 'crewcommerce');
        }

        return $new_items;
    }

    /**
     * URL of a CrewCommerce My Account screen. 'team' maps to the
     * crewcommerce-team endpoint, and so on.
     */
    public function get_dashboard_url($action) {
        if (strpos(home_url(), 'localhost') !== false || strpos(home_url(), '127.0.0.1') !== false) {
            return add_query_arg('crewcommerce_action', $action, wc_get_page_permalink('myaccount'));
        }
        return wc_get_account_endpoint_url('crewcommerce-' . $action);
    }

    public function dashboard_shortcode($atts) {
        if (!is_user_logged_in()) {
            return '<p>' . esc_html__('Please log in to see your team dashboard.', 'crewcommerce') . '</p>';
        }

        $atts = shortcode_atts(array('view' => 'dashboard'), $atts);

        ob_start();
        switch ($atts['view']) {
            case 'team':
                $this->team_management_content();
                break;
            case 'approvals':
                $this->approvals_content();
                break;
            case 'my-requests':
                $this->my_requests_content();
                break;
            default:
                $this->dashboard_content();
        }
        return ob_get_clean();
    }

    private function role_label($role) {
        $labels = array(
            'admin'     => __('Admin', 'crewcommerce'),
            'manager'   => __('Manager', 'crewcommerce'),
            'requester' => __('Requester', 'crewcommerce'),
        );
        return isset($labels[$role]) ? $labels[$role] : ucfirst((string) $role);
    }

    public function dashboard_content() {
        $user_id       = get_current_user_id();
        $team_accounts = CrewCommerce_Team_Accounts::get_instance();
        $company_id    = $team_accounts->get_user_company($user_id);

        if (!$company_id) {
            echo '<p>' . esc_html__('You are not part of a company yet.', 'crewcommerce') . '</p>';
            return;
        }

        /**
         * Fires at the top of the Team Dashboard.
         *
         * @param int $user_id    The viewer.
         * @param int $company_id Their company.
         */
        do_action('crewcommerce_team_dashboard_before', $user_id, (int) $company_id);

        $company       = get_post($company_id);
        $company_name  = $company ? $company->post_title : __('Your company', 'crewcommerce');
        $user_role     = $team_accounts->get_user_role($user_id);
        $team_members  = $team_accounts->get_team_members($company_id);
        $can_manage    = in_array($user_role, array('admin', 'manager'), true);
        $pending       = $can_manage ? CrewCommerce_Approvals::get_instance()->get_pending_approvals($user_id) : array();
        $recent_orders = wc_get_orders(array(
            'customer_id' => $user_id,
            'limit'       => 5,
            'orderby'     => 'date',
            'order'       => 'DESC',
        ));
        ?>
        <div class="crewcommerce-frontend-dashboard">
            <div class="crewcommerce-dashboard-header">
                <h2><?php echo esc_html($company_name); ?> – <?php esc_html_e('Team Dashboard', 'crewcommerce'); ?></h2>
                <p class="user-role">
                    <?php
                    printf(
                        /* translators: %s: the viewer's role, e.g. Manager */
                        esc_html__('Your role: %s', 'crewcommerce'),
                        '<strong>' . esc_html($this->role_label($user_role)) . '</strong>'
                    );
                    ?>
                </p>
            </div>

            <div class="crewcommerce-dashboard-grid">
                <div class="crewcommerce-dashboard-card">
                    <h3><?php esc_html_e('Team Overview', 'crewcommerce'); ?></h3>
                    <div class="team-stats">
                        <div class="stat-item">
                            <span class="stat-number"><?php echo esc_html(count($team_members)); ?></span>
                            <span class="stat-label"><?php esc_html_e('Team Members', 'crewcommerce'); ?></span>
                        </div>
                        <?php if (!empty($pending)) : ?>
                        <div class="stat-item pending">
                            <span class="stat-number"><?php echo esc_html(count($pending)); ?></span>
                            <span class="stat-label"><?php esc_html_e('Pending Approvals', 'crewcommerce'); ?></span>
                        </div>
                        <?php endif; ?>
                    </div>

                    <?php if ($can_manage) : ?>
                    <div class="dashboard-actions">
                        <a href="<?php echo esc_url($this->get_dashboard_url('team')); ?>" class="button"><?php esc_html_e('Manage Team', 'crewcommerce'); ?></a>
                        <?php if (!empty($pending)) : ?>
                        <a href="<?php echo esc_url($this->get_dashboard_url('approvals')); ?>" class="button button-primary"><?php esc_html_e('Review Approvals', 'crewcommerce'); ?></a>
                        <?php endif; ?>
                    </div>
                    <?php endif; ?>
                </div>

                <div class="crewcommerce-dashboard-card">
                    <h3><?php esc_html_e('Recent Orders', 'crewcommerce'); ?></h3>
                    <?php if (!empty($recent_orders)) : ?>
                    <div class="recent-orders-list">
                        <?php foreach ($recent_orders as $order) : ?>
                        <div class="order-item">
                            <div class="order-info">
                                <strong>#<?php echo esc_html($order->get_order_number()); ?></strong>
                                <span class="order-date"><?php echo esc_html(wc_format_datetime($order->get_date_created())); ?></span>
                            </div>
                            <div class="order-status"><?php echo esc_html(wc_get_order_status_name($order->get_status())); ?></div>
                            <div class="order-total"><?php echo wp_kses_post($order->get_formatted_order_total()); ?></div>
                        </div>
                        <?php endforeach; ?>
                    </div>
                    <a href="<?php echo esc_url(wc_get_account_endpoint_url('orders')); ?>" class="view-all-link"><?php esc_html_e('View All Orders', 'crewcommerce'); ?></a>
                    <?php else : ?>
                    <p><?php esc_html_e('No recent orders.', 'crewcommerce'); ?></p>
                    <?php endif; ?>
                </div>

                <div class="crewcommerce-dashboard-card">
                    <h3><?php esc_html_e('Team Members', 'crewcommerce'); ?></h3>
                    <div class="team-members-preview">
                        <?php foreach (array_slice($team_members, 0, 5) as $member) : ?>
                        <div class="member-item">
                            <div class="member-info">
                                <strong><?php echo esc_html($member->display_name); ?></strong>
                                <span class="member-role role-<?php echo esc_attr($member->role); ?>"><?php echo esc_html($this->role_label($member->role)); ?></span>
                            </div>
                        </div>
                        <?php endforeach; ?>

                        <?php if (count($team_members) > 5) : ?>
                        <p class="more-members">
                            <?php
                            /* translators: %d: number of further team members */
                            echo esc_html(sprintf(__('and %d more…', 'crewcommerce'), count($team_members) - 5));
                            ?>
                        </p>
                        <?php endif; ?>
                    </div>

                    <?php if ($can_manage) : ?>
                    <a href="<?php echo esc_url($this->get_dashboard_url('team')); ?>" class="view-all-link"><?php esc_html_e('Manage All Members', 'crewcommerce'); ?></a>
                    <?php endif; ?>
                </div>
            </div>
        </div>
        <?php
    }

    public function team_management_content() {
        $user_id       = get_current_user_id();
        $team_accounts = CrewCommerce_Team_Accounts::get_instance();
        $company_id    = (int) $team_accounts->get_user_company($user_id);
        $user_role     = $team_accounts->get_user_role($user_id);

        if (!$company_id || !in_array($user_role, array('admin', 'manager'), true)) {
            echo '<p>' . esc_html__('You do not have permission to manage this team.', 'crewcommerce') . '</p>';
            return;
        }

        $company      = get_post($company_id);
        $company_name = $company ? $company->post_title : __('your company', 'crewcommerce');
        $team_members = $team_accounts->get_team_members($company_id);
        $admin_id     = get_post_meta($company_id, '_company_admin', true);

        /**
         * Extra columns for the Manage Team table, as key => heading. Each
         * row's cell is rendered by the crewcommerce_manage_team_column_{key}
         * action.
         *
         * @param array $columns    Extra columns.
         * @param int   $company_id The company.
         */
        $extra_columns = (array) apply_filters('crewcommerce_manage_team_columns', array(), $company_id);
        ?>
        <div class="crewcommerce-team-management">
            <div class="team-header">
                <h2>
                    <?php
                    /* translators: %s: company name */
                    echo esc_html(sprintf(__('Manage Team – %s', 'crewcommerce'), $company_name));
                    ?>
                </h2>
                <button type="button" class="button button-primary" id="add-member-btn"><?php esc_html_e('Add Team Member', 'crewcommerce'); ?></button>
            </div>

            <?php
            /**
             * Fires above the team table on Manage Team.
             *
             * @param int $company_id The company.
             * @param int $user_id    The viewer (a Manager or the Admin).
             */
            do_action('crewcommerce_manage_team_before_members', $company_id, $user_id);
            ?>

            <div class="team-members-table">
                <table class="crewcommerce-table">
                    <thead>
                        <tr>
                            <th><?php esc_html_e('Name', 'crewcommerce'); ?></th>
                            <th><?php esc_html_e('Role', 'crewcommerce'); ?></th>
                            <?php foreach ($extra_columns as $label) : ?>
                            <th><?php echo esc_html($label); ?></th>
                            <?php endforeach; ?>
                            <th><?php esc_html_e('Joined', 'crewcommerce'); ?></th>
                            <th><?php esc_html_e('Actions', 'crewcommerce'); ?></th>
                        </tr>
                    </thead>
                    <tbody>
                        <?php
                        foreach ($team_members as $member) :
                            $is_company_admin = ($admin_id == $member->user_id);
                            $is_current_user  = ($member->user_id == $user_id);
                            ?>
                        <tr data-user-id="<?php echo esc_attr($member->user_id); ?>">
                            <td>
                                <span class="member-name"><?php echo esc_html($member->display_name); ?></span>
                                <?php if ($is_company_admin) : ?>
                                <span class="company-admin-badge"><?php esc_html_e('Company Admin', 'crewcommerce'); ?></span>
                                <?php endif; ?>
                                <span class="member-email"><?php echo esc_html($member->user_email); ?></span>
                            </td>
                            <td class="member-role-cell">
                                <?php if ($is_current_user && $is_company_admin) : ?>
                                    <span class="role-display"><?php echo esc_html($this->role_label($member->role)); ?></span>
                                    <small class="role-note"><?php esc_html_e('Your own role can’t be changed here.', 'crewcommerce'); ?></small>
                                <?php else : ?>
                                <select class="role-select" data-user-id="<?php echo esc_attr($member->user_id); ?>" data-original-value="<?php echo esc_attr($member->role); ?>"<?php echo $is_company_admin ? ' data-is-admin="1"' : ''; ?>>
                                    <option value="requester" <?php selected($member->role, 'requester'); ?>><?php esc_html_e('Requester', 'crewcommerce'); ?></option>
                                    <option value="manager" <?php selected($member->role, 'manager'); ?>><?php esc_html_e('Manager', 'crewcommerce'); ?></option>
                                    <?php
                                    // Only the current Admin's row offers "Admin": the seat moves by demoting
                                    // the Admin, never by promoting someone else.
                                    if ($is_company_admin) :
                                        ?>
                                    <option value="admin" <?php selected($member->role, 'admin'); ?>><?php esc_html_e('Admin', 'crewcommerce'); ?></option>
                                    <?php endif; ?>
                                </select>
                                <?php endif; ?>
                            </td>
                            <?php foreach (array_keys($extra_columns) as $column_key) : ?>
                            <td>
                                <?php
                                /**
                                 * Renders one extra Manage Team cell.
                                 *
                                 * @param object $member     The member row (user_id, role, display_name…).
                                 * @param int    $company_id The company.
                                 */
                                do_action('crewcommerce_manage_team_column_' . sanitize_key($column_key), $member, $company_id);
                                ?>
                            </td>
                            <?php endforeach; ?>
                            <td class="member-joined"><?php echo esc_html(date_i18n(_x('M j, Y', 'short date in the team list', 'crewcommerce'), strtotime($member->created_at))); ?></td>
                            <td class="member-actions">
                                <?php if (!$is_current_user && !$is_company_admin) : ?>
                                <button type="button" class="button button-small remove-member" data-user-id="<?php echo esc_attr($member->user_id); ?>"><?php esc_html_e('Remove', 'crewcommerce'); ?></button>
                                <?php elseif ($is_current_user) : ?>
                                <span class="current-user"><?php esc_html_e('(You)', 'crewcommerce'); ?></span>
                                <?php else : ?>
                                <span class="admin-protected"><?php esc_html_e('(Protected)', 'crewcommerce'); ?></span>
                                <?php endif; ?>
                            </td>
                        </tr>
                        <?php endforeach; ?>
                    </tbody>
                </table>
            </div>
        </div>

        <div id="add-member-modal" class="crewcommerce-modal" style="display:none;">
            <div class="modal-content" role="dialog" aria-modal="true" aria-labelledby="add-member-title">
                <div class="modal-header">
                    <h3 id="add-member-title"><?php esc_html_e('Invite Team Member', 'crewcommerce'); ?></h3>
                    <button type="button" class="modal-close" aria-label="<?php esc_attr_e('Close', 'crewcommerce'); ?>">&times;</button>
                </div>
                <form id="add-member-form">
                    <div class="form-group">
                        <label for="member-email"><?php esc_html_e('Email address', 'crewcommerce'); ?></label>
                        <input type="email" id="member-email" name="email" required>
                        <small><?php esc_html_e('We’ll send an invitation. If the person has no account yet, one is created for them.', 'crewcommerce'); ?></small>
                    </div>
                    <div class="form-group">
                        <label for="member-role"><?php esc_html_e('Role', 'crewcommerce'); ?></label>
                        <select id="member-role" name="role">
                            <option value="requester"><?php esc_html_e('Requester — places orders', 'crewcommerce'); ?></option>
                            <option value="manager"><?php esc_html_e('Manager — approves orders and manages the team', 'crewcommerce'); ?></option>
                            <?php if ('admin' === $user_role) : ?>
                            <option value="admin"><?php esc_html_e('Admin — full control of the team', 'crewcommerce'); ?></option>
                            <?php endif; ?>
                        </select>
                    </div>
                    <div class="form-actions">
                        <button type="submit" class="button button-primary"><?php esc_html_e('Send Invitation', 'crewcommerce'); ?></button>
                        <button type="button" class="button modal-close"><?php esc_html_e('Cancel', 'crewcommerce'); ?></button>
                    </div>
                </form>
            </div>
        </div>
        <?php
    }

    public function approvals_content() {
        $user_id   = get_current_user_id();
        $user_role = CrewCommerce_Team_Accounts::get_instance()->get_user_role($user_id);

        if (!in_array($user_role, array('admin', 'manager'), true)) {
            echo '<p>' . esc_html__('You do not have permission to approve orders.', 'crewcommerce') . '</p>';
            return;
        }

        $approvals   = CrewCommerce_Approvals::get_instance();
        $pending     = $approvals->get_pending_approvals($user_id);
        $stale_hours = $approvals->get_stale_hours();
        $now         = current_time('timestamp'); // phpcs:ignore WordPress.DateTime.CurrentTimeTimestamp.Requested -- compared with created_at, which is stored in site time.
        ?>
        <div class="crewcommerce-approvals">
            <div class="crewcommerce-approvals-heading">
                <h2><?php esc_html_e('Pending Approvals', 'crewcommerce'); ?></h2>
                <?php if (!empty($pending)) : ?>
                <span class="crewcommerce-approvals-count">
                    <?php
                    /* translators: %d: number of orders waiting for approval */
                    echo esc_html(sprintf(_n('%d waiting', '%d waiting', count($pending), 'crewcommerce'), count($pending)));
                    ?>
                </span>
                <?php endif; ?>
            </div>

            <?php if (empty($pending)) : ?>
            <div class="no-approvals">
                <p><?php esc_html_e('Nothing is waiting for your approval.', 'crewcommerce'); ?></p>
                <a href="<?php echo esc_url($this->get_dashboard_url('dashboard')); ?>" class="button"><?php esc_html_e('Back to Dashboard', 'crewcommerce'); ?></a>
            </div>
            <?php else : ?>

                <?php
                /**
                 * Fires above the list of approvals waiting for the viewer.
                 *
                 * @param object[] $pending The waiting workflows.
                 * @param int      $user_id The viewer.
                 */
                do_action('crewcommerce_pending_approvals_before_list', $pending, $user_id);
                ?>

            <div class="approvals-list">
                <?php
                foreach ($pending as $workflow) :
                    $order = wc_get_order($workflow->order_id);
                    if (!$order) {
                        continue;
                    }

                    $requester     = get_user_by('ID', $workflow->requester_id);
                    $created       = strtotime($workflow->created_at);
                    $is_stale      = ($now - $created) >= ($stale_hours * HOUR_IN_SECONDS);
                    $is_unassigned = ('unassigned' === $workflow->status);
                    $classes       = 'approval-card' . ($is_stale ? ' approval-card-stale' : '') . ($is_unassigned ? ' approval-card-unassigned' : '');
                    ?>
                <div class="<?php echo esc_attr($classes); ?>" data-workflow-id="<?php echo esc_attr($workflow->id); ?>" data-status="<?php echo esc_attr($workflow->status); ?>">
                    <?php
                    /**
                     * Fires at the start of an approval card.
                     *
                     * @param object $workflow The workflow.
                     */
                    do_action('crewcommerce_approval_card_start', $workflow);
                    ?>
                    <div class="approval-card-body">
                        <div class="approval-header">
                            <h3>
                                <?php
                                /* translators: %s: order number */
                                echo esc_html(sprintf(__('Order #%s', 'crewcommerce'), $order->get_order_number()));
                                ?>
                            </h3>
                            <?php if ($is_unassigned) : ?>
                            <span class="approval-waiting-badge approval-unassigned-badge"><?php esc_html_e('Needs an approver', 'crewcommerce'); ?></span>
                            <?php else : ?>
                            <span class="approval-waiting-badge<?php echo $is_stale ? ' approval-waiting-stale' : ''; ?>">
                                <?php
                                /* translators: %s: how long the order has waited, e.g. 2 days */
                                echo esc_html(sprintf(__('Waiting %s', 'crewcommerce'), human_time_diff($created, $now)));
                                ?>
                            </span>
                            <?php endif; ?>
                        </div>

                        <div class="approval-details">
                            <div class="detail-row">
                                <span class="label"><?php esc_html_e('Requested by:', 'crewcommerce'); ?></span>
                                <span class="value"><?php echo esc_html($requester ? $requester->display_name : __('Unknown user', 'crewcommerce')); ?></span>
                            </div>
                            <div class="detail-row">
                                <span class="label"><?php esc_html_e('Total:', 'crewcommerce'); ?></span>
                                <span class="value"><?php echo wp_kses_post($order->get_formatted_order_total()); ?></span>
                            </div>
                            <div class="detail-row">
                                <span class="label"><?php esc_html_e('Items:', 'crewcommerce'); ?></span>
                                <span class="value"><?php echo esc_html($order->get_item_count()); ?></span>
                            </div>
                        </div>

                        <div class="order-items">
                            <h4><?php esc_html_e('Order items:', 'crewcommerce'); ?></h4>
                            <ul>
                                <?php foreach ($order->get_items() as $item) : ?>
                                <li><?php echo esc_html($item->get_name()); ?> × <?php echo esc_html($item->get_quantity()); ?></li>
                                <?php endforeach; ?>
                            </ul>
                        </div>

                        <?php if ($is_unassigned) : ?>
                        <p class="approval-unassigned-note"><?php esc_html_e('Nobody has been assigned to approve this order yet. Claim it to approve or reject it yourself.', 'crewcommerce'); ?></p>
                        <div class="approval-actions">
                            <div class="action-buttons">
                                <button type="button" class="button button-primary claim-btn" data-workflow-id="<?php echo esc_attr($workflow->id); ?>"><?php esc_html_e('Claim This Approval', 'crewcommerce'); ?></button>
                            </div>
                        </div>
                        <?php elseif (!CrewCommerce_Approvals::get_instance()->user_can_decide($workflow, get_current_user_id())) : ?>
                        <p class="approval-unassigned-note">
                            <?php
                            $decider = get_userdata((int) $workflow->approver_id);
                            echo esc_html($decider
                                /* translators: %s: name of the person who decides this order */
                                ? sprintf(__('Waiting for %s to approve or reject this order.', 'crewcommerce'), $decider->display_name)
                                : __('Waiting for another approver.', 'crewcommerce'));
                            ?>
                        </p>
                        <?php else : ?>
                        <div class="approval-actions">
                            <label class="screen-reader-text" for="approval-notes-<?php echo esc_attr($workflow->id); ?>"><?php esc_html_e('Notes', 'crewcommerce'); ?></label>
                            <textarea id="approval-notes-<?php echo esc_attr($workflow->id); ?>" class="approval-notes" placeholder="<?php esc_attr_e('Notes (optional to approve, required to reject)…', 'crewcommerce'); ?>"></textarea>
                            <div class="action-buttons">
                                <button type="button" class="button button-primary approve-btn" data-workflow-id="<?php echo esc_attr($workflow->id); ?>"><?php esc_html_e('Approve', 'crewcommerce'); ?></button>
                                <button type="button" class="button reject-btn" data-workflow-id="<?php echo esc_attr($workflow->id); ?>"><?php esc_html_e('Reject', 'crewcommerce'); ?></button>
                            </div>
                        </div>
                        <?php endif; ?>

                        <?php
                        /**
                         * Fires at the end of an approval card.
                         *
                         * @param object $workflow The workflow.
                         * @param string $context  'approver' here; 'requester' on My Requests.
                         */
                        do_action('crewcommerce_approval_card_end', $workflow, 'approver');
                        ?>
                    </div>
                </div>
                <?php endforeach; ?>
            </div>
            <?php endif; ?>
        </div>
        <?php
    }

    /**
     * Notice on the classic checkout for people whose orders may be held.
     */
    public function add_approval_notice_to_checkout($fields) {
        $user_id = get_current_user_id();
        if (!$user_id || !function_exists('wc_has_notice')) {
            return $fields;
        }

        $role = CrewCommerce_Team_Accounts::get_instance()->get_user_role($user_id);
        if ($role && in_array($role, CrewCommerce_Approvals::get_instance()->get_roles_checked(), true)) {
            // This filter runs more than once per page; only add the notice once.
            $notice = __('Some orders need your manager’s approval before they are processed.', 'crewcommerce');
            if (!wc_has_notice($notice, 'notice')) {
                wc_add_notice($notice, 'notice');
            }
        }

        return $fields;
    }

    /**
     * Order confirmation text for an order that was placed but is held for
     * approval. Runs on both the classic and block confirmation pages.
     */
    public function approval_order_received_text($text, $order) {
        if (!($order instanceof WC_Order) || !$order->has_status('pending-approval')) {
            return $text;
        }

        $settings = get_option('crewcommerce_settings', array());
        if (!empty($settings['approval_required_message'])) {
            return esc_html($settings['approval_required_message']);
        }

        $approvals = CrewCommerce_Approvals::get_instance();
        $workflow  = $approvals->get_order_workflow($order->get_id());
        $approver  = ($workflow && $workflow->approver_id) ? get_userdata($workflow->approver_id) : false;

        $message = $approver
            ? sprintf(
                /* translators: %s: approver's name */
                __('Thank you — your order has been received. It needs approval from %s before it is processed, and they have been emailed about it.', 'crewcommerce'),
                $approver->display_name
            )
            : __('Thank you — your order has been received. It needs approval before it is processed.', 'crewcommerce');

        // Nothing is charged at checkout for a held order.
        if ('pending' === $approvals->status_after_approval($order)) {
            $message .= ' ' . __('You have not been charged yet — once it is approved, we will email you a link to pay.', 'crewcommerce');
        }

        return esc_html($message) . ' ' . sprintf(
            '<a href="%s">%s</a>',
            esc_url(wc_get_account_endpoint_url('crewcommerce-my-requests')),
            esc_html__('Follow it under My Requests.', 'crewcommerce')
        );
    }

    /**
     * Read a value from the current AJAX request.
     */
    private function post_value($key, $type = 'int') {
        // phpcs:disable WordPress.Security.NonceVerification.Missing -- every caller checks the nonce first.
        if (!isset($_POST[$key])) {
            return 'int' === $type ? 0 : '';
        }
        $value = wp_unslash($_POST[$key]); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- sanitized below by type.
        // phpcs:enable
        switch ($type) {
            case 'key':
                return sanitize_key($value);
            case 'textarea':
                return sanitize_textarea_field($value);
            default:
                return absint($value);
        }
    }

    /**
     * The viewer's company, when they are its Manager or Admin. Ends the
     * request with an error otherwise.
     */
    private function require_team_manager() {
        $user_id       = get_current_user_id();
        $team_accounts = CrewCommerce_Team_Accounts::get_instance();
        $company_id    = (int) $team_accounts->get_user_company($user_id);

        if (!$company_id || !in_array($team_accounts->get_user_role($user_id), array('admin', 'manager'), true)) {
            wp_send_json_error(__('Insufficient permissions.', 'crewcommerce'));
        }

        return $company_id;
    }

    public function ajax_remove_member() {
        check_ajax_referer('crewcommerce_nonce', 'nonce');

        $company_id = $this->require_team_manager();
        $user_id    = $this->post_value('user_id');

        if ($user_id === get_current_user_id()) {
            wp_send_json_error(__('You cannot remove yourself.', 'crewcommerce'));
        }

        $team_accounts = CrewCommerce_Team_Accounts::get_instance();
        if ((int) $team_accounts->get_user_company($user_id) !== $company_id) {
            wp_send_json_error(__('That person is not on your team.', 'crewcommerce'));
        }

        // Only an Admin can remove or change another Admin.
        if ('admin' === $team_accounts->get_user_role($user_id) && 'admin' !== $team_accounts->get_user_role(get_current_user_id())) {
            wp_send_json_error(__('Only the company Admin can remove or change another Admin.', 'crewcommerce'));
        }

        $result = $team_accounts->remove_team_member($user_id, $company_id);

        if (is_wp_error($result)) {
            wp_send_json_error($result->get_error_message());
        } elseif ($result) {
            wp_send_json_success(__('Team member removed.', 'crewcommerce'));
        }
        wp_send_json_error(__('Could not remove the team member.', 'crewcommerce'));
    }

    public function ajax_update_role() {
        check_ajax_referer('crewcommerce_nonce', 'nonce');

        $company_id    = $this->require_team_manager();
        $team_accounts = CrewCommerce_Team_Accounts::get_instance();
        $user_id       = $this->post_value('user_id');
        $new_role      = $this->post_value('role', 'key');

        if ((int) $team_accounts->get_user_company($user_id) !== $company_id) {
            wp_send_json_error(__('That person is not on your team.', 'crewcommerce'));
        }

        // Only an Admin can remove or change another Admin.
        if ('admin' === $team_accounts->get_user_role($user_id) && 'admin' !== $team_accounts->get_user_role(get_current_user_id())) {
            wp_send_json_error(__('Only the company Admin can remove or change another Admin.', 'crewcommerce'));
        }

        // The Admin seat only changes hands by demoting the current Admin,
        // never by assigning "admin" to someone else directly.
        if ('admin' === $new_role && get_post_meta($company_id, '_company_admin', true) != $user_id) {
            wp_send_json_error(__('The Admin role changes hands by changing the current Admin’s role, not by assigning it to someone else.', 'crewcommerce'));
        }

        $result = $team_accounts->update_member_role($user_id, $company_id, $new_role);

        if (is_wp_error($result)) {
            wp_send_json_error($result->get_error_message());
        } elseif ($result) {
            wp_send_json_success(__('Role updated.', 'crewcommerce'));
        }
        wp_send_json_error(__('Could not update the role.', 'crewcommerce'));
    }

    private function require_approver() {
        $role = CrewCommerce_Team_Accounts::get_instance()->get_user_role(get_current_user_id());
        if (!in_array($role, array('admin', 'manager'), true)) {
            wp_send_json_error(__('Insufficient permissions.', 'crewcommerce'));
        }
    }

    public function ajax_approve_order() {
        check_ajax_referer('crewcommerce_nonce', 'nonce');
        $this->require_approver();

        $workflow_id = $this->post_value('workflow_id');
        $approvals   = CrewCommerce_Approvals::get_instance();

        if ($approvals->approve_order($workflow_id, get_current_user_id(), $this->post_value('notes', 'textarea'))) {
            wp_send_json_success(array('message' => $approvals->get_decision_message($workflow_id, 'approved')));
        }
        wp_send_json_error($approvals->get_last_error() ?: __('Could not approve the order.', 'crewcommerce'));
    }

    public function ajax_claim_approval() {
        check_ajax_referer('crewcommerce_nonce', 'nonce');
        $this->require_approver();

        $result = CrewCommerce_Approvals::get_instance()->claim_approval($this->post_value('workflow_id'), get_current_user_id());

        if (is_wp_error($result)) {
            wp_send_json_error($result->get_error_message());
        }
        wp_send_json_success(__('Order claimed. You can now approve or reject it.', 'crewcommerce'));
    }

    public function ajax_reject_order() {
        check_ajax_referer('crewcommerce_nonce', 'nonce');
        $this->require_approver();

        $workflow_id = $this->post_value('workflow_id');
        $notes       = $this->post_value('notes', 'textarea');

        if ('' === $notes) {
            wp_send_json_error(__('A rejection reason is required.', 'crewcommerce'));
        }

        $approvals = CrewCommerce_Approvals::get_instance();
        if ($approvals->reject_order($workflow_id, get_current_user_id(), $notes)) {
            wp_send_json_success(array('message' => $approvals->get_decision_message($workflow_id, 'rejected')));
        }
        wp_send_json_error($approvals->get_last_error() ?: __('Could not reject the order.', 'crewcommerce'));
    }

    public function ajax_cancel_approval() {
        check_ajax_referer('crewcommerce_nonce', 'nonce');

        $result = CrewCommerce_Approvals::get_instance()->cancel_pending_approval($this->post_value('workflow_id'), get_current_user_id());

        if (is_wp_error($result)) {
            wp_send_json_error($result->get_error_message());
        }
        wp_send_json_success(__('Approval request cancelled. Your order is on hold.', 'crewcommerce'));
    }

    /**
     * My Requests: the requester's orders and where each one stands.
     */
    public function my_requests_content() {
        $user_id       = get_current_user_id();
        $team_accounts = CrewCommerce_Team_Accounts::get_instance();
        $company_id    = (int) $team_accounts->get_user_company($user_id);

        if (!$company_id) {
            echo '<p>' . esc_html__('You are not part of a company yet.', 'crewcommerce') . '</p>';
            return;
        }

        $approvals = CrewCommerce_Approvals::get_instance();
        $workflows = $approvals->get_requester_workflows($user_id, 50);

        // Also list orders that didn't need approval.
        $workflow_order_ids = array_map(function ($wf) {
            return (int) $wf->order_id;
        }, $workflows);

        foreach (wc_get_orders(array('customer_id' => $user_id, 'limit' => 50, 'orderby' => 'date', 'order' => 'DESC')) as $bare_order) {
            if (in_array((int) $bare_order->get_id(), $workflow_order_ids, true)) {
                continue;
            }
            $stub                = new stdClass();
            $stub->id            = 0;
            $stub->order_id      = $bare_order->get_id();
            $stub->requester_id  = $user_id;
            $stub->approver_id   = null;
            $stub->approver_name = null;
            $stub->status        = 'no_workflow';
            $stub->notes         = '';
            $stub->created_at    = $bare_order->get_date_created() ? $bare_order->get_date_created()->date('Y-m-d H:i:s') : '';
            $workflows[]         = $stub;
        }

        $status_labels = array(
            'pending'     => array(__('Pending Approval', 'crewcommerce'), 'status-pending'),
            'unassigned'  => array(__('Unassigned', 'crewcommerce'), 'status-pending'),
            'approved'    => array(__('Approved', 'crewcommerce'), 'status-approved'),
            'rejected'    => array(__('Rejected', 'crewcommerce'), 'status-rejected'),
            'cancelled'   => array(__('Cancelled', 'crewcommerce'), 'status-cancelled'),
            'no_workflow' => array(__('Placed', 'crewcommerce'), 'status-placed'),
        );
        $now = current_time('timestamp'); // phpcs:ignore WordPress.DateTime.CurrentTimeTimestamp.Requested -- compared with created_at, stored in site time.
        ?>
        <div class="crewcommerce-my-requests">
            <?php
            /**
             * Fires at the top of My Requests.
             *
             * @param int $user_id    The viewer.
             * @param int $company_id Their company.
             */
            do_action('crewcommerce_my_requests_before', $user_id, $company_id);
            ?>

            <h2><?php esc_html_e('My Approval Requests', 'crewcommerce'); ?></h2>

            <?php if (empty($workflows)) : ?>
                <p><?php esc_html_e('You have not placed any orders yet.', 'crewcommerce'); ?></p>
            <?php else : ?>
            <div class="crewcommerce-requests-list">
                <?php
                foreach ($workflows as $wf) :
                    $order = wc_get_order($wf->order_id);
                    if (!$order) {
                        continue;
                    }
                    $status_info = isset($status_labels[$wf->status]) ? $status_labels[$wf->status] : array(ucfirst($wf->status), '');
                    if ('approved' === $wf->status && $order->needs_payment()) {
                        $status_info = array(__('Awaiting Payment', 'crewcommerce'), 'status-pending');
                    }
                    $is_waiting = in_array($wf->status, array('pending', 'unassigned'), true);
                    ?>
                <div class="request-card request-<?php echo esc_attr($wf->status); ?>" data-workflow-id="<?php echo esc_attr($wf->id); ?>">
                    <div class="request-header">
                        <div class="request-order">
                            <strong>
                                <?php
                                /* translators: %s: order number */
                                echo esc_html(sprintf(__('Order #%s', 'crewcommerce'), $order->get_order_number()));
                                ?>
                            </strong>
                            <span class="request-total"><?php echo wp_kses_post($order->get_formatted_order_total()); ?></span>
                        </div>
                        <span class="request-status-badge <?php echo esc_attr($status_info[1]); ?>"><?php echo esc_html($status_info[0]); ?></span>
                    </div>

                    <div class="request-meta">
                        <span class="meta-item">
                            <?php
                            /* translators: %s: date and time */
                            echo esc_html(sprintf(__('Submitted %s', 'crewcommerce'), date_i18n(get_option('date_format') . ' ' . get_option('time_format'), strtotime($wf->created_at))));
                            ?>
                        </span>
                        <?php if ($wf->approver_name) : ?>
                        <span class="meta-item">
                            <?php
                            /* translators: %s: approver's name */
                            echo esc_html(sprintf(__('Approver: %s', 'crewcommerce'), $wf->approver_name));
                            ?>
                        </span>
                        <?php elseif ('no_workflow' !== $wf->status) : ?>
                        <span class="meta-item meta-unassigned"><?php esc_html_e('No approver assigned yet', 'crewcommerce'); ?></span>
                        <?php endif; ?>
                        <?php if ($is_waiting) : ?>
                        <span class="meta-item meta-wait">
                            <?php
                            /* translators: %s: how long, e.g. 3 hours */
                            echo esc_html(sprintf(__('Waiting for %s', 'crewcommerce'), human_time_diff(strtotime($wf->created_at), $now)));
                            ?>
                        </span>
                        <?php endif; ?>
                    </div>

                    <?php if ($wf->notes && 'pending' !== $wf->status) : ?>
                    <div class="request-notes">
                        <strong><?php esc_html_e('Approver notes:', 'crewcommerce'); ?></strong>
                        <?php echo esc_html($wf->notes); ?>
                    </div>
                    <?php endif; ?>

                    <div class="request-items">
                        <ul>
                            <?php foreach ($order->get_items() as $item) : ?>
                            <li><?php echo esc_html($item->get_name()); ?> &times; <?php echo esc_html($item->get_quantity()); ?></li>
                            <?php endforeach; ?>
                        </ul>
                    </div>

                    <div class="request-actions">
                        <?php if ('pending' === $wf->status) : ?>
                        <button type="button" class="button cancel-request-btn" data-workflow-id="<?php echo esc_attr($wf->id); ?>" data-order-num="<?php echo esc_attr($order->get_order_number()); ?>"><?php esc_html_e('Cancel Request', 'crewcommerce'); ?></button>
                        <?php endif; ?>
                        <?php if ('approved' === $wf->status && $order->needs_payment()) : ?>
                        <a href="<?php echo esc_url($order->get_checkout_payment_url()); ?>" class="button button-primary"><?php esc_html_e('Pay Now', 'crewcommerce'); ?></a>
                        <?php endif; ?>
                        <a href="<?php echo esc_url($order->get_view_order_url()); ?>" class="button"><?php esc_html_e('View Order', 'crewcommerce'); ?></a>
                    </div>

                    <?php
                    if ($wf->id) {
                        /** This action is documented in approvals_content(). */
                        do_action('crewcommerce_approval_card_end', $wf, 'requester');
                    }
                    ?>
                </div>
                <?php endforeach; ?>
            </div>
            <?php endif; ?>
        </div>
        <?php
    }
}