<?php
/**
 * The admin area: the payments list, one payment's screen, and the settings.
 *
 * @package CryptowayButton
 */

namespace CryptowayButton;

defined( 'ABSPATH' ) || exit;

final class Admin {

    public const PAGE          = 'cryptoway-button';
    public const PAGE_SETTINGS = 'cryptoway-button-settings';
    public const PAGE_TEXTS    = 'cryptoway-button-texts';
    public const GROUP         = 'cryptoway_button';
    public const GROUP_TEXTS   = 'cryptoway_button_texts';

    /** One-off notice shown on the plugin's own screens after an action. */
    private const NOTICE_TRANSIENT = 'cryptoway_button_notice';

    /**
     * Payments whose paid content the owner may open by hand once settled with the payer. Not one held
     * by the AML check: Cryptoway decides on it.
     */
    private const GRANTABLE = [ Payment::STATUS_LATE, Payment::STATUS_HOLD, Payment::STATUS_UNDERPAID, Payment::STATUS_EXPIRED ];

    public function register(): void {
        add_action( 'admin_menu', [ $this, 'menu' ] );
        add_action( 'admin_init', [ $this, 'register_settings' ] );
        add_action( 'admin_enqueue_scripts', [ $this, 'enqueue' ] );
        add_action( 'admin_notices', [ $this, 'notices' ] );

        add_action( 'admin_post_cryptoway_button_check', [ $this, 'handle_check' ] );
        add_action( 'admin_post_cryptoway_button_import', [ $this, 'handle_import' ] );
        add_action( 'admin_post_cryptoway_button_clear_log', [ $this, 'handle_clear_log' ] );
        add_action( 'admin_post_cryptoway_button_access', [ $this, 'handle_access' ] );
        add_action( 'admin_post_cryptoway_button_delete', [ $this, 'handle_delete' ] );
    }

    public static function payments_url(): string {
        return add_query_arg( 'page', self::PAGE, admin_url( 'admin.php' ) );
    }

    public static function settings_url(): string {
        return add_query_arg( 'page', self::PAGE_SETTINGS, admin_url( 'admin.php' ) );
    }

    public function menu(): void {
        add_menu_page(
            __( 'Cryptoway Payment', 'cryptoway-button' ),
            __( 'Cryptoway Payment', 'cryptoway-button' ),
            'manage_options',
            self::PAGE,
            [ $this, 'render_payments' ],
            Brand::menu_icon(),
            58
        );
        add_submenu_page( self::PAGE, __( 'Payments', 'cryptoway-button' ), __( 'Payments', 'cryptoway-button' ), 'manage_options', self::PAGE, [ $this, 'render_payments' ] );
        add_submenu_page( self::PAGE, __( 'Settings', 'cryptoway-button' ), __( 'Settings', 'cryptoway-button' ), 'manage_options', self::PAGE_SETTINGS, [ $this, 'render_settings' ] );
        add_submenu_page( self::PAGE, __( 'Payment statuses', 'cryptoway-button' ), __( 'Payment statuses', 'cryptoway-button' ), 'manage_options', self::PAGE_TEXTS, [ $this, 'render_texts' ] );
    }

    public function enqueue( string $hook ): void {
        if ( ! str_contains( $hook, self::PAGE ) ) {
            return;
        }

        wp_enqueue_style( 'cryptoway-button-admin', CRYPTOWAY_BUTTON_URL . 'assets/css/admin.css', [], Plugin::asset_version( 'assets/css/admin.css' ) );
    }

    private function is_own_screen(): bool {
        $screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;

        return $screen instanceof \WP_Screen && str_contains( (string) $screen->id, self::PAGE );
    }

    /** Notices only on the plugin's own screens: the rest of the admin is not its business. */
    public function notices(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            return;
        }

        $screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;

        // Cryptoway refuses the keys from this server's address: said wherever the owner looks first.
        $refused = (int) get_option( ApiClient::IP_REFUSED, 0 );

        if ( Settings::keys_present() && $refused > time() - DAY_IN_SECONDS
            && ( ( $screen instanceof \WP_Screen && in_array( $screen->id, [ 'dashboard', 'plugins' ], true ) ) || $this->is_own_screen() ) ) {
            echo '<div class="notice notice-error"><p><strong>' . esc_html( sprintf(
                /* translators: %s: date and time of the last refusal */
                __( 'Cryptoway refused this site\'s keys from this server\'s address ("Invalid IP"), last at %s.', 'cryptoway-button' ),
                self::format_time( $refused )
            ) ) . '</strong> '
                . esc_html__( 'Until it is fixed, visitors cannot start payments, and payments already started wait for their check. To fix it, in your Cryptoway account open the project and add to Allowed IPs the address this server uses to go online, or its range: your hosting provider can tell you which. Then save the settings here again: this notice goes away when Cryptoway accepts the keys.', 'cryptoway-button' )
                . '</p></div>';
        }

        // Right after activation the owner is on the Plugins screen: one pointer there until the keys are in.
        if ( $screen instanceof \WP_Screen && 'plugins' === $screen->id ) {
            if ( ! Settings::keys_present() ) {
                printf(
                    '<div class="notice notice-info"><p>%s</p></div>',
                    sprintf(
                        /* translators: %s: link to the settings screen */
                        esc_html__( 'Cryptoway Payment is active. Add the Project ID and Secret key in %s to start taking payments.', 'cryptoway-button' ),
                        '<a href="' . esc_url( self::settings_url() ) . '">' . esc_html__( 'Settings', 'cryptoway-button' ) . '</a>'
                    )
                );
            }
            return;
        }

        if ( ! $this->is_own_screen() ) {
            return;
        }

        $notice = get_transient( self::NOTICE_TRANSIENT );

        if ( is_array( $notice ) && ! empty( $notice['text'] ) ) {
            delete_transient( self::NOTICE_TRANSIENT );
            printf(
                '<div class="notice notice-%1$s is-dismissible"><p>%2$s</p></div>',
                esc_attr( in_array( $notice['type'] ?? '', [ 'success', 'error', 'warning', 'info' ], true ) ? $notice['type'] : 'info' ),
                esc_html( (string) $notice['text'] )
            );
        }

        if ( ! Settings::keys_present() ) {
            $on_settings = str_contains( (string) $screen->id, self::PAGE_SETTINGS );
            printf(
                '<div class="notice notice-warning"><p>%s</p></div>',
                $on_settings
                    ? esc_html__( 'Add the Project ID and Secret key below to start taking payments.', 'cryptoway-button' )
                    : sprintf(
                        /* translators: %s: link to the settings screen */
                        esc_html__( 'Add the Project ID and Secret key in %s to start taking payments.', 'cryptoway-button' ),
                        '<a href="' . esc_url( self::settings_url() ) . '">' . esc_html__( 'Settings', 'cryptoway-button' ) . '</a>'
                    )
            );
        } elseif ( '' === CallbackKey::stored() ) {
            echo '<div class="notice notice-warning"><p>' . esc_html__( 'The callback key has not been received from Cryptoway yet. Payment notifications cannot be verified until it is: save the settings again to retry.', 'cryptoway-button' ) . '</p></div>';
        }
    }

    private static function set_notice( string $type, string $text ): void {
        set_transient( self::NOTICE_TRANSIENT, [ 'type' => $type, 'text' => $text ], MINUTE_IN_SECONDS );
    }

    // ------------------------------------------------------------------ settings

    public function register_settings(): void {
        register_setting( self::GROUP, Settings::OPTION, [
            'type'              => 'array',
            'sanitize_callback' => [ $this, 'sanitize_settings' ],
            'default'           => Settings::DEFAULTS,
        ] );
        register_setting( self::GROUP_TEXTS, Settings::TEXTS_OPTION, [
            'type'              => 'array',
            'sanitize_callback' => [ $this, 'sanitize_texts' ],
            'default'           => [],
        ] );
    }

    /**
     * Visitor texts: only known keys, plain text, and only where the owner wrote something else.
     *
     * @param mixed $input
     * @return array<string, string>
     */
    public function sanitize_texts( $input ): array {
        $out       = [];
        $catalogue = Texts::catalogue();

        foreach ( (array) $input as $key => $value ) {
            if ( ! is_string( $key ) || ! isset( $catalogue[ $key ] ) || ! is_scalar( $value ) ) {
                continue;
            }
            $value = trim( sanitize_text_field( (string) $value ) );
            if ( '' !== $value && $value !== $catalogue[ $key ]['default'] ) {
                $out[ $key ] = $value;
            }
        }

        return $out;
    }

    /**
     * Clean the submitted settings. A blank Secret key keeps the stored one; the callback
     * key is fetched from Cryptoway with the keys about to be saved.
     *
     * @param mixed $input
     */
    public function sanitize_settings( $input ): array {
        $input = is_array( $input ) ? $input : [];

        // Not the settings form: the plugin's own write of the stored array (copying the keys, the
        // callback key), or WordPress sanitizing the form's result a second time when the option is
        // first created. The form never sends a callback key. Only types are checked: nothing is
        // switched on or off and Cryptoway is not asked again.
        if ( array_key_exists( 'callback_key', $input ) ) {
            return self::clean_stored( $input );
        }

        $current = Settings::all();
        $out     = $current;

        $out['api_key_id'] = self::clean_key( (string) ( $input['api_key_id'] ?? '' ) );

        $secret = self::clean_key( (string) ( $input['api_key_secret'] ?? '' ) );
        if ( '' !== $secret ) {
            $out['api_key_secret'] = $secret;
        }

        $lifetime        = (int) ( $input['lifetime'] ?? Settings::DEFAULT_LIFETIME );
        $out['lifetime'] = max( Settings::MIN_LIFETIME, min( Settings::MAX_LIFETIME, $lifetime > 0 ? $lifetime : Settings::DEFAULT_LIFETIME ) );

        $currency        = strtoupper( sanitize_text_field( (string) ( $input['currency'] ?? 'USD' ) ) );
        $out['currency'] = in_array( $currency, Settings::CURRENCIES, true ) ? $currency : 'USD';

        $out['email_enabled'] = 'yes' === ( $input['email_enabled'] ?? '' ) ? 'yes' : 'no';
        $out['email_to']      = sanitize_email( (string) ( $input['email_to'] ?? '' ) );

        // Coins for the on-site picker: only ids Cryptoway lists; all of them ticked is stored as "no restriction".
        $available = Coins::available();
        $ticked    = [];
        foreach ( (array) ( $input['coins'] ?? [] ) as $symbol ) {
            $symbol = Coins::normalise( sanitize_text_field( (string) $symbol ) );
            if ( in_array( $symbol, $available, true ) ) {
                $ticked[] = $symbol;
            }
        }
        $ticked       = array_values( array_unique( $ticked ) );
        $out['coins'] = count( $ticked ) >= count( $available ) ? [] : $ticked;
        unset( $out['texts'] ); // Visitor texts moved to their own option (2026-10-12).

        $keys_changed = $out['api_key_id'] !== $current['api_key_id'] || $out['api_key_secret'] !== $current['api_key_secret'];

        if ( '' === $out['api_key_id'] || '' === $out['api_key_secret'] ) {
            $out['callback_key'] = '';
            return $out;
        }

        // The callback key signs notifications: it comes from the project, never from a field.
        $fetched = CallbackKey::fetch( new ApiClient( $out['api_key_id'], $out['api_key_secret'] ) );

        if ( $fetched['ok'] ) {
            $out['callback_key'] = $fetched['key'];
            self::set_notice( 'success', __( 'Cryptoway accepted the keys. Payment notifications are set up.', 'cryptoway-button' ) );
        } else {
            if ( $keys_changed ) {
                $out['callback_key'] = '';
            }
            self::set_notice( 'error', sprintf(
                /* translators: %s: reason */
                __( 'Cryptoway did not confirm the keys: %s', 'cryptoway-button' ),
                $fetched['error']
            ) );
        }

        // The coin list for on-site payments, refreshed along with the keys.
        if ( $fetched['ok'] ) {
            Coins::refresh_available();
        }

        return $out;
    }

    private static function clean_key( string $value ): string {
        return trim( sanitize_text_field( $value ) );
    }

    /** The stored settings array, type by type, as it is: for the plugin's own writes. */
    private static function clean_stored( array $input ): array {
        $out = array_merge( Settings::DEFAULTS, array_intersect_key( $input, Settings::DEFAULTS ) );

        foreach ( [ 'api_key_id', 'api_key_secret', 'callback_key' ] as $key ) {
            $out[ $key ] = self::clean_key( is_scalar( $out[ $key ] ) ? (string) $out[ $key ] : '' );
        }

        $lifetime        = (int) $out['lifetime'];
        $out['lifetime'] = max( Settings::MIN_LIFETIME, min( Settings::MAX_LIFETIME, $lifetime > 0 ? $lifetime : Settings::DEFAULT_LIFETIME ) );
        $currency        = strtoupper( is_scalar( $out['currency'] ) ? (string) $out['currency'] : '' );
        $out['currency'] = in_array( $currency, Settings::CURRENCIES, true ) ? $currency : 'USD';
        $out['email_enabled'] = 'yes' === $out['email_enabled'] ? 'yes' : 'no';
        $out['email_to']      = sanitize_email( is_scalar( $out['email_to'] ) ? (string) $out['email_to'] : '' );
        $out['coins']         = is_array( $out['coins'] ) ? array_values( array_filter( array_map( static fn( $s ): string => Coins::normalise( is_scalar( $s ) ? (string) $s : '' ), $out['coins'] ) ) ) : [];

        return $out;
    }

    public function render_settings(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            return;
        }

        $s        = Settings::all();
        $sources  = Settings::importable_sources();
        $log      = array_reverse( Log::lines() );
        $has_keys = Settings::keys_present();
        ?>
        <div class="wrap cwbtn-admin">
            <h1><?php esc_html_e( 'Cryptoway Payment — Settings', 'cryptoway-button' ); ?></h1>

            <form method="post" action="options.php">
                <?php settings_fields( self::GROUP ); ?>
                <table class="form-table" role="presentation">
                    <tr>
                        <th scope="row"><label for="cwbtn-api-key-id">Project ID</label></th>
                        <td>
                            <input type="text" id="cwbtn-api-key-id" class="regular-text code" name="<?php echo esc_attr( Settings::OPTION ); ?>[api_key_id]" value="<?php echo esc_attr( (string) $s['api_key_id'] ); ?>" autocomplete="off">
                            <p class="description"><?php esc_html_e( 'In your Cryptoway account: Projects → your project → API keys.', 'cryptoway-button' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="cwbtn-api-key-secret">Secret key</label></th>
                        <td>
                            <input type="password" id="cwbtn-api-key-secret" class="regular-text code" name="<?php echo esc_attr( Settings::OPTION ); ?>[api_key_secret]" value="" autocomplete="new-password"
                                placeholder="<?php echo '' !== (string) $s['api_key_secret'] ? esc_attr__( 'A key is saved — type a new one to replace it', 'cryptoway-button' ) : ''; ?>">
                            <p class="description"><?php esc_html_e( 'Stored on this site, never shown again. It only signs requests; the key that signs notifications is fetched from Cryptoway by itself.', 'cryptoway-button' ); ?></p>
                            <?php if ( $sources ) : ?>
                                <p>
                                    <?php foreach ( $sources as $source => $label ) : ?>
                                        <a class="button" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=cryptoway_button_import&source=' . $source ), 'cryptoway_button_import_' . $source ) ); ?>">
                                            <?php
                                            /* translators: %s: plugin name */
                                            echo esc_html( sprintf( __( 'Use the keys from %s', 'cryptoway-button' ), $label ) );
                                            ?>
                                        </a>
                                    <?php endforeach; ?>
                                </p>
                            <?php endif; ?>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="cwbtn-lifetime"><?php esc_html_e( 'Time to pay', 'cryptoway-button' ); ?></label></th>
                        <td>
                            <input type="number" id="cwbtn-lifetime" class="small-text" name="<?php echo esc_attr( Settings::OPTION ); ?>[lifetime]" value="<?php echo esc_attr( (string) Settings::lifetime() ); ?>" min="<?php echo (int) Settings::MIN_LIFETIME; ?>" max="<?php echo (int) Settings::MAX_LIFETIME; ?>" step="1">
                            <span><?php esc_html_e( 'minutes', 'cryptoway-button' ); ?></span>
                            <p class="description"><?php esc_html_e( '15–1440 minutes. The coin amount is fixed for this long.', 'cryptoway-button' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="cwbtn-currency"><?php esc_html_e( 'Currency', 'cryptoway-button' ); ?></label></th>
                        <td>
                            <select id="cwbtn-currency" name="<?php echo esc_attr( Settings::OPTION ); ?>[currency]">
                                <?php foreach ( Settings::CURRENCIES as $code ) : ?>
                                    <option value="<?php echo esc_attr( $code ); ?>" <?php selected( Settings::currency(), $code ); ?>><?php echo esc_html( $code ); ?></option>
                                <?php endforeach; ?>
                            </select>
                            <p class="description"><?php esc_html_e( 'The currency amounts are entered in. A button can name another one.', 'cryptoway-button' ); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><?php esc_html_e( 'E-mail', 'cryptoway-button' ); ?></th>
                        <td>
                            <label for="cwbtn-email-enabled">
                                <input type="checkbox" id="cwbtn-email-enabled" name="<?php echo esc_attr( Settings::OPTION ); ?>[email_enabled]" value="yes" <?php checked( Settings::email_enabled() ); ?>>
                                <?php esc_html_e( 'E-mail me about payments', 'cryptoway-button' ); ?>
                            </label>
                            <p>
                                <label for="cwbtn-email-to" class="screen-reader-text"><?php esc_html_e( 'Address for these e-mails', 'cryptoway-button' ); ?></label>
                                <input type="email" id="cwbtn-email-to" class="regular-text" name="<?php echo esc_attr( Settings::OPTION ); ?>[email_to]" value="<?php echo esc_attr( (string) $s['email_to'] ); ?>" placeholder="<?php echo esc_attr( (string) get_option( 'admin_email' ) ); ?>" aria-describedby="cwbtn-email-to-help">
                            </p>
                            <p class="description" id="cwbtn-email-to-help"><?php esc_html_e( 'Paid payments and every payment that needs a review. Leave the address empty to use the site administrator\'s one.', 'cryptoway-button' ); ?></p>
                        </td>
                    </tr>
                    <?php if ( $has_keys ) : ?>
                        <?php
                        $available = Coins::picker( implode( ',', Coins::available() ) );
                        $enabled   = Settings::enabled_coins();
                        ?>
                        <tr>
                            <th scope="row"><?php esc_html_e( 'Coins on the page', 'cryptoway-button' ); ?></th>
                            <td>
                                <fieldset class="cwbtn-admin__coins">
                                    <legend class="screen-reader-text"><?php esc_html_e( 'Coins on the page', 'cryptoway-button' ); ?></legend>
                                    <?php foreach ( $available as $symbol => $label ) : ?>
                                        <label class="cwbtn-admin__coin">
                                            <input type="checkbox" name="<?php echo esc_attr( Settings::OPTION ); ?>[coins][]" value="<?php echo esc_attr( $symbol ); ?>" <?php checked( in_array( $symbol, $enabled, true ) ); ?>>
                                            <?php echo esc_html( $label ); ?>
                                        </label>
                                    <?php endforeach; ?>
                                </fieldset>
                                <p class="description"><?php esc_html_e( 'What a visitor can choose when paying right on the page (coin, address, QR code). The list comes from Cryptoway and refreshes by itself; a button can narrow it further.', 'cryptoway-button' ); ?></p>
                            </td>
                        </tr>
                    <?php endif; ?>
                </table>
                <?php submit_button(); ?>
            </form>

            <h2><?php esc_html_e( 'How to add a button', 'cryptoway-button' ); ?></h2>
            <p><?php esc_html_e( 'In the block editor, add the "Cryptoway Payment" block and pick where the visitor pays: on the Cryptoway page, or right on your site. On a classic editor or in a widget, use the shortcode:', 'cryptoway-button' ); ?></p>
            <ul class="cwbtn-admin__shortcodes">
                <li><code>[cryptoway amount="50" currency="USD"]</code> — <?php esc_html_e( 'a fixed amount', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="free" amounts="5,10,25" label="Support us"]</code> — <?php esc_html_e( 'the visitor picks or types the amount', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="free" pay="onsite"]</code> — <?php esc_html_e( 'paid right on the page: coin, address and QR code', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="50" after="redirect" redirect="/thank-you/"]</code> — <?php esc_html_e( 'a thank-you page after the payment', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="free" fields="name,email,message"]</code> — <?php esc_html_e( 'ask the payer for a name, an e-mail or a message', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="50" color="#1f8a5b" text_color="#ffffff" radius="8" size="large" width="full"]</code> — <?php esc_html_e( 'your own colours, corners, size and width; without them the button looks like the other buttons of your theme', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="20" pay="onsite" qr="no"]</code> — <?php esc_html_e( 'payment on the page without the QR code: the address and the amount only', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="free" amounts="5,10,25" frame="yes"]</code> — <?php esc_html_e( 'the form in a card with a border and padding', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="free" amounts="10,25,50" skin="cryptoway"]</code> — <?php esc_html_e( 'the ready-made dark card (skin="dark"), or the Cryptoway card with the mark on the button', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway id="article-1" amount="3" access="30"]…[/cryptoway]</code> — <?php esc_html_e( 'paid content: what you put between the tags (text, links, a video) opens only after payment, for as many days as "access" says; the payer\'s e-mail is asked for and gets the access link. Give each paid shortcode its own id: then editing its text or price keeps access for those who paid', 'cryptoway-button' ); ?></li>
                <li><code>[cryptoway amount="50" class="my-button"]</code> — <?php esc_html_e( 'your own CSS class on the button\'s wrapper', 'cryptoway-button' ); ?></li>
            </ul>
            <p class="description"><?php echo esc_html( sprintf(
                /* translators: %s: URL of the notification endpoint */
                __( 'Payment notifications arrive at %s. It must be reachable from the internet.', 'cryptoway-button' ),
                rest_url( Rest::NAMESPACE . '/webhook' )
            ) ); ?></p>

            <h2><?php esc_html_e( 'Recent errors', 'cryptoway-button' ); ?></h2>
            <?php if ( ! $log ) : ?>
                <p class="description"><?php esc_html_e( 'Nothing to report.', 'cryptoway-button' ); ?></p>
            <?php else : ?>
                <table class="widefat striped cwbtn-admin__log">
                    <tbody>
                    <?php foreach ( array_slice( $log, 0, 30 ) as $line ) : ?>
                        <tr>
                            <td class="cwbtn-admin__log-time"><?php echo esc_html( self::format_time( (int) $line['t'] ) ); ?></td>
                            <td><?php echo esc_html( (string) $line['m'] ); ?></td>
                        </tr>
                    <?php endforeach; ?>
                    </tbody>
                </table>
                <p><a class="button" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=cryptoway_button_clear_log' ), 'cryptoway_button_clear_log' ) ); ?>"><?php esc_html_e( 'Clear', 'cryptoway-button' ); ?></a></p>
            <?php endif; ?>
        </div>
        <?php
    }

    // ------------------------------------------------------------------ payments

    /** The "Texts" screen: what a visitor reads after the click, by payment state. */
    public function render_texts(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            return;
        }

        $own_texts = Settings::texts();
        ?>
        <div class="wrap cwbtn-admin">
            <h1><?php esc_html_e( 'Payment statuses', 'cryptoway-button' ); ?></h1>
            <p class="description"><?php esc_html_e( 'What a visitor reads after the click, by payment state. Leave a field empty to keep the standard wording (shown in grey). The form itself (the button, amounts, fields) is edited in each button.', 'cryptoway-button' ); ?></p>

            <form method="post" action="options.php">
                <?php settings_fields( self::GROUP_TEXTS ); ?>
                <table class="form-table cwbtn-admin__texts" role="presentation">
                    <?php foreach ( Texts::catalogue() as $text_key => $text ) : ?>
                        <tr>
                            <th scope="row"><label for="cwbtn-text-<?php echo esc_attr( $text_key ); ?>"><?php echo esc_html( $text['label'] ); ?></label></th>
                            <td>
                                <input type="text" id="cwbtn-text-<?php echo esc_attr( $text_key ); ?>" class="large-text" name="<?php echo esc_attr( Settings::TEXTS_OPTION ); ?>[<?php echo esc_attr( $text_key ); ?>]" value="<?php echo esc_attr( $own_texts[ $text_key ] ?? '' ); ?>" placeholder="<?php echo esc_attr( $text['default'] ); ?>">
                                <?php if ( ! empty( $text['placeholders'] ) ) : ?>
                                    <p class="description"><?php echo esc_html( $text['placeholders'] ); ?></p>
                                <?php endif; ?>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                </table>
                <?php submit_button(); ?>
            </form>
        </div>
        <?php
    }

    public function render_payments(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            return;
        }

        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- which payment to show; read-only.
        $id = isset( $_GET['payment'] ) ? absint( wp_unslash( $_GET['payment'] ) ) : 0;

        if ( $id > 0 ) {
            $payment = Payment::get( $id );

            if ( $payment ) {
                $this->render_payment( $payment );
                return;
            }
        }

        $table = new PaymentsTable();
        $table->prepare_items();
        ?>
        <div class="wrap cwbtn-admin">
            <h1 class="wp-heading-inline"><?php esc_html_e( 'Cryptoway payments', 'cryptoway-button' ); ?></h1>
            <hr class="wp-header-end">
            <?php $table->views(); ?>
            <form method="get">
                <input type="hidden" name="page" value="<?php echo esc_attr( self::PAGE ); ?>">
                <?php
                $table->search_box( __( 'Search payments', 'cryptoway-button' ), 'cwbtn' );
                $table->display();
                ?>
            </form>
        </div>
        <?php
    }

    private function render_payment( Payment $payment ): void {
        $manager = new PaymentManager( $payment );
        $rows    = [
            __( 'Status', 'cryptoway-button' )      => $payment->status_label_now(),
            __( 'For', 'cryptoway-button' )         => $payment->title(),
            __( 'Amount', 'cryptoway-button' )      => Amounts::fiat( $payment->amount(), $payment->currency() ),
        ];

        $rows = array_merge( $rows, $manager->amount_rows() );

        if ( '' !== $payment->symbol() ) {
            $rows[ __( 'Coin', 'cryptoway-button' ) ] = Coins::label( $payment->symbol() );
        }
        if ( '' !== $payment->tx_hash() ) {
            $rows[ __( 'Transaction hash', 'cryptoway-button' ) ] = $payment->tx_hash();
        }
        if ( '' !== $payment->address() ) {
            $rows[ __( 'Address', 'cryptoway-button' ) ] = $payment->address();
        }
        if ( '' !== $payment->invoice_id() ) {
            $rows[ __( 'Invoice', 'cryptoway-button' ) ] = $payment->invoice_id();
        }
        if ( '' !== $payment->deadline() ) {
            $rows[ __( 'Pay before', 'cryptoway-button' ) ] = self::format_time( (int) strtotime( $payment->deadline() ) );
        }

        $rows[ __( 'Started', 'cryptoway-button' ) ] = self::format_time( $payment->created_at() );
        $rows[ __( 'Where', 'cryptoway-button' ) ]   = Button::PAY_ONSITE === $payment->mode()
            ? __( 'On the page', 'cryptoway-button' )
            : __( 'Cryptoway payment page', 'cryptoway-button' );

        $source = $payment->source_post();
        if ( $source > 0 ) {
            $rows[ __( 'Page', 'cryptoway-button' ) ] = (string) get_the_title( $source );
        }

        foreach ( $payment->payer() as $field => $value ) {
            $label = match ( $field ) {
                'name'  => __( 'Name', 'cryptoway-button' ),
                'email' => __( 'E-mail', 'cryptoway-button' ),
                default => __( 'Message', 'cryptoway-button' ),
            };
            $rows[ $label ] = $value;
        }

        $paid_content = Button::AFTER_CONTENT === $payment->after();
        $until        = $paid_content ? Button::access_until( $payment ) : 0;

        if ( $paid_content ) {
            $rows[ __( 'Access to the paid content', 'cryptoway-button' ) ] = match ( true ) {
                '' !== $payment->meta( Payment::META_ACCESS_REVOKED ) => __( 'Closed by hand', 'cryptoway-button' ),
                $until > time()                                        => sprintf(
                    /* translators: %s: date and time */
                    __( 'Open until %s', 'cryptoway-button' ),
                    self::format_time( $until )
                ),
                $until > 0                                             => __( 'The access period is over', 'cryptoway-button' ),
                default                                                => __( 'Not open', 'cryptoway-button' ),
            };
        }

        $check_url  = wp_nonce_url( admin_url( 'admin-post.php?action=cryptoway_button_check&payment=' . $payment->id() ), 'cryptoway_button_check_' . $payment->id() );
        $access_url = static fn( string $op ): string => wp_nonce_url( admin_url( 'admin-post.php?action=cryptoway_button_access&op=' . $op . '&payment=' . $payment->id() ), 'cryptoway_button_access_' . $payment->id() );
        $delete_url = wp_nonce_url( admin_url( 'admin-post.php?action=cryptoway_button_delete&payment=' . $payment->id() ), 'cryptoway_button_delete_' . $payment->id() );
        $can_grant  = $paid_content && ! $payment->is_settled() && '' !== ( $payment->payer()['email'] ?? '' )
            && in_array( $payment->status(), self::GRANTABLE, true );
        ?>
        <div class="wrap cwbtn-admin">
            <h1 class="wp-heading-inline">
                <?php
                /* translators: %d: payment number */
                echo esc_html( sprintf( __( 'Payment #%d', 'cryptoway-button' ), $payment->id() ) );
                ?>
            </h1>
            <a href="<?php echo esc_url( self::payments_url() ); ?>" class="page-title-action"><?php esc_html_e( 'All payments', 'cryptoway-button' ); ?></a>
            <hr class="wp-header-end">

            <div class="cwbtn-admin__columns">
                <div class="cwbtn-admin__card">
                    <table class="cwbtn-admin__details">
                        <?php foreach ( $rows as $label => $value ) : ?>
                            <tr>
                                <th scope="row"><?php echo esc_html( (string) $label ); ?></th>
                                <td>
                                    <?php if ( __( 'Status', 'cryptoway-button' ) === $label ) : ?>
                                        <span class="cwbtn-status cwbtn-status--<?php echo esc_attr( $payment->status() ); ?>"><?php echo esc_html( $value ); ?></span>
                                        <?php if ( $payment->needs_review() ) : ?>
                                            <span class="cwbtn-review"><?php esc_html_e( 'needs review', 'cryptoway-button' ); ?></span>
                                        <?php endif; ?>
                                    <?php else : ?>
                                        <?php echo esc_html( $value ); ?>
                                    <?php endif; ?>
                                </td>
                            </tr>
                        <?php endforeach; ?>
                    </table>
                    <?php if ( $paid_content && ! Button::paid_content_found( $payment ) ) : ?>
                        <div class="notice notice-warning inline"><p><?php esc_html_e( 'The button this payment was made with is no longer on its page, so its paid content cannot be shown to the payer. Put the button back, or give the payer what they paid for another way.', 'cryptoway-button' ); ?></p></div>
                    <?php endif; ?>
                    <p class="cwbtn-admin__actions">
                        <?php if ( '' !== $payment->invoice_id() && Settings::keys_present() ) : ?>
                            <a class="button button-secondary" href="<?php echo esc_url( $check_url ); ?>"><?php esc_html_e( 'Check with Cryptoway', 'cryptoway-button' ); ?></a>
                        <?php endif; ?>
                        <?php if ( $paid_content && '' !== $payment->meta( Payment::META_ACCESS_REVOKED ) ) : ?>
                            <a class="button button-secondary" href="<?php echo esc_url( $access_url( 'reopen' ) ); ?>"><?php esc_html_e( 'Open the access again', 'cryptoway-button' ); ?></a>
                        <?php elseif ( $paid_content && $until > time() ) : ?>
                            <a class="button button-secondary" href="<?php echo esc_url( $access_url( 'close' ) ); ?>" onclick="return confirm( <?php echo esc_attr( (string) wp_json_encode( __( 'Close the payer\'s access to the paid content (for example after a refund)?', 'cryptoway-button' ) ) ); ?> );"><?php esc_html_e( 'Close the access', 'cryptoway-button' ); ?></a>
                        <?php elseif ( $can_grant ) : ?>
                            <a class="button button-secondary" href="<?php echo esc_url( $access_url( 'grant' ) ); ?>" onclick="return confirm( <?php echo esc_attr( (string) wp_json_encode( __( 'Open the paid content to this payer and e-mail them the link? Do it when you have settled the payment with them.', 'cryptoway-button' ) ) ); ?> );"><?php esc_html_e( 'Open the access', 'cryptoway-button' ); ?></a>
                        <?php endif; ?>
                        <?php if ( ! in_array( $payment->status(), Payment::OPEN, true ) ) : ?>
                            <a class="button-link button-link-delete" href="<?php echo esc_url( $delete_url ); ?>" onclick="return confirm( <?php echo esc_attr( (string) wp_json_encode( __( 'Delete this payment and its history for good? A payer of paid content loses the access.', 'cryptoway-button' ) ) ); ?> );"><?php esc_html_e( 'Delete', 'cryptoway-button' ); ?></a>
                        <?php endif; ?>
                    </p>
                </div>

                <div class="cwbtn-admin__card">
                    <h2><?php esc_html_e( 'History', 'cryptoway-button' ); ?></h2>
                    <?php $history = array_reverse( $payment->history() ); ?>
                    <?php if ( ! $history ) : ?>
                        <p class="description"><?php esc_html_e( 'Nothing yet.', 'cryptoway-button' ); ?></p>
                    <?php else : ?>
                        <ul class="cwbtn-admin__history">
                            <?php foreach ( $history as $entry ) : ?>
                                <li>
                                    <span class="cwbtn-admin__history-time"><?php echo esc_html( self::format_time( (int) $entry['t'] ) ); ?></span>
                                    <span><?php echo esc_html( (string) $entry['m'] ); ?></span>
                                </li>
                            <?php endforeach; ?>
                        </ul>
                    <?php endif; ?>
                </div>
            </div>
        </div>
        <?php
    }

    /** A timestamp in the site's date format and time zone. */
    public static function format_time( int $timestamp ): string {
        if ( $timestamp <= 0 ) {
            return '—';
        }

        return wp_date( (string) get_option( 'date_format' ) . ' ' . (string) get_option( 'time_format' ), $timestamp );
    }

    // ------------------------------------------------------------------ actions

    public function handle_check(): void {
        $id = isset( $_GET['payment'] ) ? absint( wp_unslash( $_GET['payment'] ) ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- verified on the next line.

        if ( ! current_user_can( 'manage_options' ) || ! check_admin_referer( 'cryptoway_button_check_' . $id ) ) {
            wp_die( esc_html__( 'Not allowed.', 'cryptoway-button' ) );
        }

        $payment = Payment::get( $id );

        if ( $payment ) {
            ( new PaymentManager( $payment ) )->sync_status_from_api( 'manual' );
            self::set_notice( 'info', __( 'The payment was checked with Cryptoway. See the history for the result.', 'cryptoway-button' ) );
            wp_safe_redirect( $payment->admin_url() );
            exit;
        }

        wp_safe_redirect( self::payments_url() );
        exit;
    }

    public function handle_import(): void {
        $source = isset( $_GET['source'] ) ? sanitize_key( wp_unslash( $_GET['source'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- verified on the next line.

        if ( ! current_user_can( 'manage_options' ) || ! check_admin_referer( 'cryptoway_button_import_' . $source ) ) {
            wp_die( esc_html__( 'Not allowed.', 'cryptoway-button' ) );
        }

        if ( Settings::import_keys( $source ) ) {
            $fetched = CallbackKey::refresh();

            if ( $fetched['ok'] ) {
                Coins::refresh_available();
                self::set_notice( 'success', __( 'The keys were copied and Cryptoway accepted them.', 'cryptoway-button' ) );
            } else {
                self::set_notice( 'warning', sprintf(
                    /* translators: %s: reason */
                    __( 'The keys were copied, but Cryptoway did not confirm them: %s', 'cryptoway-button' ),
                    $fetched['error']
                ) );
            }
        } else {
            self::set_notice( 'error', __( 'No keys were found to copy.', 'cryptoway-button' ) );
        }

        wp_safe_redirect( self::settings_url() );
        exit;
    }

    public function handle_clear_log(): void {
        if ( ! current_user_can( 'manage_options' ) || ! check_admin_referer( 'cryptoway_button_clear_log' ) ) {
            wp_die( esc_html__( 'Not allowed.', 'cryptoway-button' ) );
        }

        Log::clear();
        wp_safe_redirect( self::settings_url() );
        exit;
    }

    /**
     * Paid content by hand: close the access (a refund), open it again, or open it for a payment that
     * was not confirmed automatically (late, held) once the owner has settled it with the payer.
     */
    public function handle_access(): void {
        $id = isset( $_GET['payment'] ) ? absint( wp_unslash( $_GET['payment'] ) ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- verified on the next line.

        if ( ! current_user_can( 'manage_options' ) || ! check_admin_referer( 'cryptoway_button_access_' . $id ) ) {
            wp_die( esc_html__( 'Not allowed.', 'cryptoway-button' ) );
        }

        $op      = isset( $_GET['op'] ) ? sanitize_key( wp_unslash( $_GET['op'] ) ) : '';
        $payment = Payment::get( $id );

        if ( ! $payment || Button::AFTER_CONTENT !== $payment->after() ) {
            wp_safe_redirect( self::payments_url() );
            exit;
        }

        $who = wp_get_current_user()->display_name;

        if ( 'close' === $op ) {
            $payment->set_meta( Payment::META_ACCESS_REVOKED, (string) time() );
            /* translators: %s: user name */
            $payment->add_history( sprintf( __( 'Access to the paid content closed by %s.', 'cryptoway-button' ), $who ) );
            self::set_notice( 'success', __( 'The access is closed. The payer\'s link no longer opens the content.', 'cryptoway-button' ) );
        } elseif ( 'reopen' === $op ) {
            $payment->delete_meta( Payment::META_ACCESS_REVOKED );
            /* translators: %s: user name */
            $payment->add_history( sprintf( __( 'Access to the paid content opened again by %s.', 'cryptoway-button' ), $who ) );
            self::set_notice( 'success', __( 'The access is open again for the rest of its period.', 'cryptoway-button' ) );
        } elseif ( 'grant' === $op && ! $payment->is_settled() && in_array( $payment->status(), self::GRANTABLE, true ) ) {
            $payment->delete_meta( Payment::META_ACCESS_REVOKED );
            $payment->set_meta( Payment::META_ACCESS_GRANTED, (string) time() );

            // The link goes out now: a later confirmation must not send it a second time.
            $sent = $payment->meta_array( Payment::META_EMAILED );
            if ( ! in_array( 'payer', $sent, true ) ) {
                $sent[] = 'payer';
                $payment->set_meta( Payment::META_EMAILED, $sent );
            }
            /* translators: %s: user name */
            $payment->add_history( sprintf( __( 'Access to the paid content opened by hand by %s; the link was e-mailed to the payer.', 'cryptoway-button' ), $who ) );
            Email::access_link( $payment );
            self::set_notice( 'success', __( 'The access is open and the link was e-mailed to the payer.', 'cryptoway-button' ) );
        }

        wp_safe_redirect( $payment->admin_url() );
        exit;
    }

    /** Delete a closed payment for good (an open one could still receive money). */
    public function handle_delete(): void {
        $id = isset( $_GET['payment'] ) ? absint( wp_unslash( $_GET['payment'] ) ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- verified on the next line.

        if ( ! current_user_can( 'manage_options' ) || ! check_admin_referer( 'cryptoway_button_delete_' . $id ) ) {
            wp_die( esc_html__( 'Not allowed.', 'cryptoway-button' ) );
        }

        $payment = Payment::get( $id );

        if ( $payment && ! in_array( $payment->status(), Payment::OPEN, true ) && $payment->delete() ) {
            /* translators: %d: payment number */
            self::set_notice( 'success', sprintf( __( 'Payment #%d was deleted.', 'cryptoway-button' ), $id ) );
        }

        wp_safe_redirect( self::payments_url() );
        exit;
    }

}