<?php
/**
 * Setup assistant.
 *
 * @package Dealroot
 */

namespace Dealroot\Admin;

use Dealroot\Geo;
use Dealroot\Health;
use Dealroot\Installer;
use Dealroot\Kses;
use Dealroot\Live;
use Dealroot\Notifier;
use Dealroot\Settings;
use Dealroot\Visits;

defined( 'ABSPATH' ) || exit;

/**
 * Walks a new user through the few things Dealroot needs: the forms, what to count, a test
 * enquiry, notifications and cookie consent. Every step can be skipped and changed later.
 */
class Setup_Page {

	const PAGE = 'dealroot-setup';

	/**
	 * Option with the steps that were seen and the time the assistant was finished.
	 */
	const OPTION = 'dealroot_setup';

	/**
	 * Campaign of the test link.
	 */
	const TEST_CAMPAIGN = 'setup-check';

	/**
	 * Consent plugins by folder: name and whether they report consent through the WP Consent API.
	 */
	const CONSENT_PLUGINS = array(
		'complianz-gdpr'                           => array( 'Complianz', true ),
		'complianz-gdpr-premium'                   => array( 'Complianz', true ),
		'cookie-law-info'                          => array( 'CookieYes', true ),
		'cookiebot'                                => array( 'Cookiebot', true ),
		'real-cookie-banner'                       => array( 'Real Cookie Banner', true ),
		'real-cookie-banner-pro'                   => array( 'Real Cookie Banner', true ),
		'gdpr-cookie-compliance'                   => array( 'GDPR Cookie Compliance', true ),
		'cookie-notice'                            => array( 'Cookie Notice', true ),
		'iubenda-cookie-law-solution'              => array( 'iubenda', true ),
		'borlabs-cookie'                           => array( 'Borlabs Cookie', false ),
		'uk-cookie-consent'                        => array( 'Termly', false ),
		'cookie-script-com'                        => array( 'Cookie-Script', false ),
		'usercentrics-consent-management-platform' => array( 'Usercentrics', false ),
	);

	/**
	 * Hooks.
	 */
	public function register() {
		add_action( 'admin_post_dealroot_setup', array( $this, 'handle_save' ) );
		add_action( 'admin_post_dealroot_setup_dismiss', array( $this, 'handle_dismiss' ) );
		add_action( 'wp_ajax_dealroot_setup_check', array( $this, 'ajax_check' ) );
		add_action( 'wp_ajax_dealroot_setup_chat', array( $this, 'ajax_chat' ) );
		add_action( 'wp_ajax_dealroot_setup_telegram', array( $this, 'ajax_telegram' ) );
		add_action( 'admin_notices', array( $this, 'notice' ) );
	}

	/**
	 * Steps in their order.
	 *
	 * @return array<string, string>
	 */
	public static function steps() {
		return array(
			'forms'    => __( 'Forms', 'dealroot' ),
			'tracking' => __( 'What to count', 'dealroot' ),
			'test'     => __( 'Test enquiry', 'dealroot' ),
			'alerts'   => __( 'Notifications', 'dealroot' ),
			'consent'  => __( 'Cookie consent', 'dealroot' ),
		);
	}

	/**
	 * Address of a step.
	 *
	 * @param string $step Step key, or "done".
	 * @param array  $args Further query arguments.
	 * @return string
	 */
	public static function url( $step = '', array $args = array() ) {
		return Shell::url( self::PAGE, array_filter( array_merge( array( 'step' => $step ), $args ) ) );
	}

	/**
	 * Stored progress.
	 *
	 * @return array{seen: string[], finished: int, notice: int}
	 */
	public static function state() {
		$state = get_option( self::OPTION, array() );
		$state = is_array( $state ) ? $state : array();

		return array(
			'seen'     => array_values( array_intersect( (array) ( $state['seen'] ?? array() ), array_keys( self::steps() ) ) ),
			'finished' => (int) ( $state['finished'] ?? 0 ),
			'notice'   => (int) ( $state['notice'] ?? 0 ),
		);
	}

	/**
	 * Whether the assistant was gone through to the end.
	 *
	 * @return bool
	 */
	public static function finished() {
		return self::state()['finished'] > 0;
	}

	/**
	 * Called on activation: a first activation asks once, on the plugins screen, to set up.
	 */
	public static function activated() {
		if ( false !== get_option( self::OPTION ) ) {
			return;
		}

		add_option(
			self::OPTION,
			array(
				'seen'     => array(),
				'finished' => 0,
				'notice'   => 1,
			),
			'',
			false
		);
	}

	/**
	 * Stores progress.
	 *
	 * @param array $changes Keys of the state to change.
	 */
	private static function update_state( array $changes ) {
		update_option( self::OPTION, array_merge( self::state(), $changes ), false );
	}

	/**
	 * Notice after the first activation, on the plugins screen and the dashboard only.
	 */
	public function notice() {
		$screen = get_current_screen();

		if ( ! $screen || ! in_array( $screen->id, array( 'plugins', 'dashboard' ), true ) || ! current_user_can( 'manage_options' ) ) {
			return;
		}

		$state = self::state();
		if ( ! $state['notice'] || $state['finished'] || $state['seen'] ) {
			return;
		}

		$dismiss = wp_nonce_url( admin_url( 'admin-post.php?action=dealroot_setup_dismiss' ), 'dealroot_setup_dismiss' );
		?>
		<div class="notice notice-info dealroot-setup-notice">
			<p>
				<strong><?php esc_html_e( 'Dealroot is active.', 'dealroot' ); ?></strong>
				<?php esc_html_e( 'Set it up in about three minutes: find your forms, send a test enquiry and choose how you hear about new leads.', 'dealroot' ); ?>
			</p>
			<p>
				<a class="button button-primary" href="<?php echo esc_url( self::url() ); ?>"><?php esc_html_e( 'Start setup', 'dealroot' ); ?></a>
				<a class="button-link" href="<?php echo esc_url( $dismiss ); ?>"><?php esc_html_e( 'Not now', 'dealroot' ); ?></a>
			</p>
		</div>
		<?php
	}

	/**
	 * Hides the notice.
	 */
	public function handle_dismiss() {
		check_admin_referer( 'dealroot_setup_dismiss' );

		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You are not allowed to change these settings.', 'dealroot' ), 403 );
		}

		self::update_state( array( 'notice' => 0 ) );

		wp_safe_redirect( wp_get_referer() ? wp_get_referer() : admin_url( 'plugins.php' ) );
		exit;
	}

	/**
	 * Current step from the address.
	 *
	 * @return string
	 */
	private static function current() {
		$step = isset( $_GET['step'] ) ? sanitize_key( wp_unslash( $_GET['step'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended

		if ( 'done' === $step || isset( self::steps()[ $step ] ) ) {
			return $step;
		}

		return 'forms';
	}

	/**
	 * Step after the given one.
	 *
	 * @param string $step Step key.
	 * @return string Key, or "done".
	 */
	private static function next( $step ) {
		$keys  = array_keys( self::steps() );
		$index = array_search( $step, $keys, true );

		return false !== $index && isset( $keys[ $index + 1 ] ) ? $keys[ $index + 1 ] : 'done';
	}

	/**
	 * Step before the given one.
	 *
	 * @param string $step Step key.
	 * @return string Key, or an empty string for the first step.
	 */
	private static function previous( $step ) {
		$keys  = array_keys( self::steps() );
		$index = 'done' === $step ? count( $keys ) : array_search( $step, $keys, true );

		return $index ? $keys[ $index - 1 ] : '';
	}

	/**
	 * Whether a step has what it asks for, for the tick in the list of steps.
	 *
	 * @param string $step Step key.
	 * @return bool
	 */
	private static function complete( $step ) {
		switch ( $step ) {
			case 'forms':
				return null !== Form_Scan::last();
			case 'test':
				return (bool) self::test_lead( 0 );
			case 'alerts':
				return Settings::get( 'telegram_enabled' ) && '' !== Settings::get( 'telegram_token' ) && '' !== Settings::get( 'telegram_chat_id' );
			default:
				return in_array( $step, self::state()['seen'], true );
		}
	}

	/**
	 * Data for the script of the screen.
	 *
	 * @return array
	 */
	public static function script_data() {
		return array(
			'ajaxUrl'  => admin_url( 'admin-ajax.php' ),
			'nonce'    => wp_create_nonce( 'dealroot_setup' ),
			'since'    => time(),
			'visits'   => Visits::recent( 1 ),
			'live'     => Live::enabled(),
			'visit'    => __( 'Your visit was counted.', 'dealroot' ),
			/* translators: %s: title or address of a page */
			'onPage'   => __( 'You are on the site now: %s', 'dealroot' ),
			/* translators: 1: name or email of the person, 2: name of the form */
			'lead'     => __( 'Lead received: %1$s, sent with “%2$s”.', 'dealroot' ),
			'leadOnly' => __( 'Lead received.', 'dealroot' ),
			'open'     => __( 'Open the lead', 'dealroot' ),
			'looking'  => __( 'Looking for your chat…', 'dealroot' ),
			'sending'  => __( 'Sending…', 'dealroot' ),
			'sent'     => __( 'Sent. Check Telegram.', 'dealroot' ),
			'failed'   => __( 'Something went wrong. Please reload the page and try again.', 'dealroot' ),
		);
	}

	/**
	 * Saves a step and moves on.
	 */
	public function handle_save() {
		check_admin_referer( 'dealroot_setup' );

		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You are not allowed to change these settings.', 'dealroot' ), 403 );
		}

		$step = isset( $_POST['step'] ) ? sanitize_key( wp_unslash( $_POST['step'] ) ) : '';
		$go   = isset( $_POST['go'] ) ? sanitize_key( wp_unslash( $_POST['go'] ) ) : 'next';

		if ( ! isset( self::steps()[ $step ] ) ) {
			wp_safe_redirect( self::url() );
			exit;
		}

		if ( 'skip' !== $go && 'back' !== $go ) {
			$changes = $this->posted( $step );

			if ( $changes ) {
				update_option( Settings::OPTION, array_merge( Settings::all(), $changes ) );
			}
		}

		$state = self::state();
		if ( 'back' !== $go ) {
			$state['seen'][] = $step;
		}

		$target = 'back' === $go ? self::previous( $step ) : self::next( $step );

		self::update_state(
			array(
				'seen'     => array_values( array_unique( $state['seen'] ) ),
				'finished' => 'done' === $target ? time() : $state['finished'],
			)
		);

		wp_safe_redirect( self::url( '' !== $target ? $target : $step ) );
		exit;
	}

	/**
	 * Settings sent with a step.
	 *
	 * @param string $step Step key.
	 * @return array
	 */
	private function posted( $step ) {
		// phpcs:disable WordPress.Security.NonceVerification.Missing -- Checked in handle_save().
		$input = isset( $_POST['dealroot'] ) && is_array( $_POST['dealroot'] ) ? wp_unslash( $_POST['dealroot'] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Every value goes through Settings::sanitize().
		// phpcs:enable

		$fields = array(
			'tracking' => array( 'count_visits', 'track_clicks', 'form_stats', 'geo_cities', 'live_view', 'ai_enabled' ),
			'alerts'   => array( 'telegram_enabled', 'telegram_token', 'telegram_chat_id', 'digest_enabled', 'digest_recipients' ),
			'consent'  => array( 'consent_mode' ),
		);

		if ( ! isset( $fields[ $step ] ) ) {
			return array();
		}

		$changes = array();
		foreach ( $fields[ $step ] as $key ) {
			$changes[ $key ] = isset( $input[ $key ] ) && is_scalar( $input[ $key ] ) ? (string) $input[ $key ] : '';
		}

		// The digest goes to the site's email address when no one else is entered.
		if ( isset( $changes['digest_recipients'] ) && get_option( 'admin_email' ) === trim( $changes['digest_recipients'] ) ) {
			$changes['digest_recipients'] = '';
		}

		return $changes;
	}

	/**
	 * Latest lead sent through the test link.
	 *
	 * @param int $since Unix time, 0 for any time.
	 * @return object|null
	 */
	private static function test_lead( $since ) {
		global $wpdb;

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
		return $wpdb->get_row(
			$wpdb->prepare(
				'SELECT id, name, email, phone, form_name FROM %i WHERE created_at >= %s AND ( campaign = %s OR last_campaign = %s ) ORDER BY id DESC LIMIT 1',
				Installer::table(),
				gmdate( 'Y-m-d H:i:s', max( 0, (int) $since ) ),
				self::TEST_CAMPAIGN,
				self::TEST_CAMPAIGN
			)
		);
	}

	/**
	 * What arrived since the test step was opened: the visit, the visitor on the live screen
	 * and the lead.
	 */
	public function ajax_check() {
		check_ajax_referer( 'dealroot_setup', 'nonce' );

		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( null, 403 );
		}

		$since = isset( $_POST['since'] ) ? absint( $_POST['since'] ) : time();
		$lead  = self::test_lead( $since - 60 );
		$page  = '';

		foreach ( Live::current() as $visitor ) {
			if ( strtotime( $visitor->updated . ' UTC' ) >= $since ) {
				$page = '' !== (string) $visitor->title ? (string) $visitor->title : (string) $visitor->page;
				break;
			}
		}

		$who = '';
		if ( $lead ) {
			foreach ( array( 'name', 'email', 'phone' ) as $key ) {
				if ( '' !== (string) $lead->$key ) {
					$who = (string) $lead->$key;
					break;
				}
			}
		}

		wp_send_json_success(
			array(
				'visits' => Visits::recent( 1 ),
				'page'   => $page,
				'lead'   => $lead ? array(
					'who'  => $who,
					'form' => (string) $lead->form_name,
					'url'  => Shell::url( Admin::PAGE, array( 'lead' => (int) $lead->id ) ),
				) : null,
			)
		);
	}

	/**
	 * Bot token from the request; the masked value stands for the stored token.
	 *
	 * @return string
	 */
	private static function posted_token() {
		$token = isset( $_POST['token'] ) ? trim( sanitize_text_field( wp_unslash( $_POST['token'] ) ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Checked by the callers.
		$saved = (string) Settings::get( 'telegram_token' );

		return '' !== $saved && Settings::masked_token( $saved ) === $token ? $saved : $token;
	}

	/**
	 * Finds the chat in which the bot was last written to.
	 */
	public function ajax_chat() {
		check_ajax_referer( 'dealroot_setup', 'nonce' );

		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( null, 403 );
		}

		$chat = Notifier::find_chat( self::posted_token() );

		if ( is_wp_error( $chat ) ) {
			wp_send_json_error( array( 'message' => $chat->get_error_message() ) );
		}

		wp_send_json_success( $chat );
	}

	/**
	 * Sends a test message with the values in the form, before they are saved.
	 */
	public function ajax_telegram() {
		check_ajax_referer( 'dealroot_setup', 'nonce' );

		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( null, 403 );
		}

		$chat   = isset( $_POST['chat'] ) ? sanitize_text_field( wp_unslash( $_POST['chat'] ) ) : '';
		$result = Notifier::send_telegram(
			self::posted_token(),
			$chat,
			/* translators: %s: site name. */
			sprintf( __( 'Dealroot is connected to %s. New leads will appear here.', 'dealroot' ), wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ) )
		);

		if ( is_wp_error( $result ) ) {
			wp_send_json_error( array( 'message' => $result->get_error_message() ) );
		}

		wp_send_json_success();
	}

	/**
	 * Consent plugins that are active.
	 *
	 * @return array<string, bool> Name => whether it works with the WP Consent API.
	 */
	public static function consent_plugins() {
		$found = array();

		foreach ( (array) get_option( 'active_plugins', array() ) as $file ) {
			$folder = strtok( (string) $file, '/' );

			if ( isset( self::CONSENT_PLUGINS[ $folder ] ) ) {
				$found[ self::CONSENT_PLUGINS[ $folder ][0] ] = self::CONSENT_PLUGINS[ $folder ][1];
			}
		}

		return $found;
	}

	/**
	 * Whether the WP Consent API is there.
	 *
	 * @return bool
	 */
	private static function consent_api() {
		return class_exists( '\WP_CONSENT_API' ) || function_exists( 'wp_has_consent' );
	}

	/**
	 * Page output.
	 */
	public function render() {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}

		$step  = self::current();
		$steps = self::steps();
		$keys  = array_keys( $steps );

		Shell::open(
			'',
			__( 'Set up Dealroot', 'dealroot' ),
			array(
				'description' => __( 'Five short steps. Each one can be skipped and changed later in the settings.', 'dealroot' ),
				'class'       => 'dealroot-setup-page',
				'back'        => array(
					'url'   => Shell::url( Admin::PAGE ),
					'label' => __( 'Overview', 'dealroot' ),
				),
			)
		);
		?>
		<div class="dealroot-setup">
			<ol class="dealroot-setup__rail" aria-label="<?php esc_attr_e( 'Steps', 'dealroot' ); ?>">
				<?php foreach ( $steps as $key => $label ) : ?>
					<?php
					$classes = array();
					if ( $key === $step ) {
						$classes[] = 'is-current';
					}
					if ( self::complete( $key ) ) {
						$classes[] = 'is-done';
					}
					?>
					<li class="<?php echo esc_attr( implode( ' ', $classes ) ); ?>">
						<a href="<?php echo esc_url( self::url( $key ) ); ?>"<?php echo $key === $step ? ' aria-current="step"' : ''; ?>><?php echo esc_html( $label ); ?></a>
					</li>
				<?php endforeach; ?>
			</ol>

			<div class="dealroot-setup__body">
				<?php if ( 'done' === $step ) : ?>
					<?php $this->done(); ?>
				<?php else : ?>
					<p class="dealroot-setup__count">
						<?php
						/* translators: 1: number of the step, 2: number of steps */
						echo esc_html( sprintf( __( 'Step %1$s of %2$s', 'dealroot' ), number_format_i18n( (int) array_search( $step, $keys, true ) + 1 ), number_format_i18n( count( $keys ) ) ) );
						?>
					</p>
					<?php
					if ( 'forms' === $step ) {
						$this->step_forms();
					} else {
						$this->open_form( $step );
						call_user_func( array( $this, 'step_' . $step ) );
						$this->close_form( $step );
					}
					?>
				<?php endif; ?>
			</div>
		</div>
		<?php
		Shell::close();
	}

	/**
	 * Opens the form of a step.
	 *
	 * @param string $step Step key.
	 */
	private function open_form( $step ) {
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="dealroot-panel dealroot-setup__step" data-step="<?php echo esc_attr( $step ); ?>">
			<input type="hidden" name="action" value="dealroot_setup">
			<input type="hidden" name="step" value="<?php echo esc_attr( $step ); ?>">
			<?php wp_nonce_field( 'dealroot_setup' ); ?>
		<?php
	}

	/**
	 * Buttons and the end of the form of a step.
	 *
	 * @param string $step      Step key.
	 * @param bool   $has_input Whether the step has settings; otherwise there is nothing to skip.
	 */
	private function close_form( $step, $has_input = true ) {
		$last = 'done' === self::next( $step );
		?>
			<div class="dealroot-setup__actions">
				<?php if ( self::previous( $step ) ) : ?>
					<button type="submit" name="go" value="back" class="dealroot-button dealroot-button--quiet" formnovalidate><?php esc_html_e( 'Back', 'dealroot' ); ?></button>
				<?php endif; ?>
				<span class="dealroot-setup__spacer"></span>
				<?php if ( $has_input && 'test' !== $step ) : ?>
					<button type="submit" name="go" value="skip" class="dealroot-button dealroot-button--quiet" formnovalidate><?php esc_html_e( 'Skip', 'dealroot' ); ?></button>
				<?php endif; ?>
				<button type="submit" name="go" value="next" class="dealroot-button dealroot-button--primary"><?php echo $last ? esc_html__( 'Finish', 'dealroot' ) : esc_html__( 'Continue', 'dealroot' ); ?></button>
			</div>
		</form>
		<?php
	}

	/**
	 * Step 1: the forms of the site.
	 */
	private function step_forms() {
		$scan         = Form_Scan::last();
		$integrations = Health::active_integrations();
		$forms        = $scan ? Forms_Page::summary() : array();
		$on           = array_filter( wp_list_pluck( $forms, 'on' ) );
		?>
		<section class="dealroot-panel dealroot-setup__step" data-step="forms">
			<h2><?php esc_html_e( 'Which forms bring you enquiries?', 'dealroot' ); ?></h2>
			<p class="dealroot-setup__lead"><?php esc_html_e( 'Dealroot opens the pages of your site like a visitor and lists every form on them: those of form plugins, those your theme builds itself and those without a form tag.', 'dealroot' ); ?></p>

			<?php if ( $integrations ) : ?>
				<p class="dealroot-setup__fact is-ok">
					<?php
					/* translators: %s: list of form plugins. */
					echo esc_html( sprintf( __( 'Connected automatically: %s.', 'dealroot' ), implode( ', ', $integrations ) ) );
					?>
				</p>
			<?php endif; ?>

			<?php if ( $forms ) : ?>
				<p class="dealroot-setup__fact is-ok">
					<?php
					echo esc_html(
						sprintf(
							/* translators: 1: number of forms saved as leads, 2: number of forms found */
							_n( '%1$s of %2$s form found is saved as leads.', '%1$s of %2$s forms found are saved as leads.', count( $forms ), 'dealroot' ),
							number_format_i18n( count( $on ) ),
							number_format_i18n( count( $forms ) )
						)
					);
					?>
				</p>
				<ul class="dealroot-setup__forms">
					<?php foreach ( array_slice( $forms, 0, 8 ) as $form ) : ?>
						<li class="<?php echo $form['on'] ? 'is-on' : 'is-off'; ?>">
							<strong><?php echo esc_html( $form['name'] ); ?></strong>
							<span><?php echo esc_html( $form['on'] ? $form['type'] : __( 'Not saved as leads', 'dealroot' ) ); ?></span>
						</li>
					<?php endforeach; ?>
				</ul>
				<?php if ( count( $forms ) > 8 ) : ?>
					<p class="dealroot-muted">
						<?php
						/* translators: %s: number of further forms */
						echo esc_html( sprintf( _n( 'and %s more form', 'and %s more forms', count( $forms ) - 8, 'dealroot' ), number_format_i18n( count( $forms ) - 8 ) ) );
						?>
					</p>
				<?php endif; ?>
				<p class="dealroot-muted"><?php esc_html_e( 'A newsletter sign-up is not saved as a lead. To change which forms count, open the Forms screen.', 'dealroot' ); ?></p>
			<?php elseif ( $scan ) : ?>
				<p class="dealroot-setup__fact"><?php esc_html_e( 'No forms were found on the pages that were scanned. Forms that only appear after a click are saved anyway as soon as a visitor sends one.', 'dealroot' ); ?></p>
			<?php endif; ?>

			<div class="dealroot-scan dealroot-setup__scan">
				<p>
					<button type="button" class="dealroot-button <?php echo $scan ? 'dealroot-button--secondary' : 'dealroot-button--primary'; ?>" id="dealroot-scan"><?php echo $scan ? esc_html__( 'Scan again', 'dealroot' ) : esc_html__( 'Scan site', 'dealroot' ); ?></button>
					<?php if ( $scan ) : ?>
						<a href="<?php echo esc_url( Shell::url( Forms_Page::PAGE ) ); ?>"><?php esc_html_e( 'Open the Forms screen', 'dealroot' ); ?></a>
					<?php else : ?>
						<span class="dealroot-muted"><?php esc_html_e( 'Takes about a minute. Nothing on your site changes.', 'dealroot' ); ?></span>
					<?php endif; ?>
				</p>
				<div class="dealroot-scan__progress" hidden>
					<progress max="100" value="0"></progress>
					<span class="dealroot-scan__status" role="status" aria-live="polite"></span>
				</div>
				<div class="notice notice-error inline dealroot-scan__error" hidden><p></p></div>
			</div>

			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="dealroot-setup__actions">
				<input type="hidden" name="action" value="dealroot_setup">
				<input type="hidden" name="step" value="forms">
				<?php wp_nonce_field( 'dealroot_setup' ); ?>
				<span class="dealroot-setup__spacer"></span>
				<?php if ( ! $scan ) : ?>
					<button type="submit" name="go" value="skip" class="dealroot-button dealroot-button--quiet"><?php esc_html_e( 'Skip', 'dealroot' ); ?></button>
				<?php endif; ?>
				<button type="submit" name="go" value="next" class="dealroot-button <?php echo $scan ? 'dealroot-button--primary' : 'dealroot-button--secondary'; ?>"><?php esc_html_e( 'Continue', 'dealroot' ); ?></button>
			</form>
		</section>
		<?php
	}

	/**
	 * A switch with its explanation.
	 *
	 * @param string $key   Setting key.
	 * @param string $label Label.
	 * @param string $help  One sentence below.
	 */
	private function toggle( $key, $label, $help ) {
		$id = 'dealroot-setup-' . $key;
		?>
		<div class="dealroot-setup__toggle">
			<input type="checkbox" class="dealroot-switch" id="<?php echo esc_attr( $id ); ?>" name="dealroot[<?php echo esc_attr( $key ); ?>]" value="1"<?php checked( (bool) Settings::get( $key ) ); ?>>
			<label for="<?php echo esc_attr( $id ); ?>">
				<strong><?php echo esc_html( $label ); ?></strong>
				<span><?php echo esc_html( $help ); ?></span>
			</label>
		</div>
		<?php
	}

	/**
	 * Step 2: what Dealroot counts besides leads.
	 */
	private function step_tracking() {
		?>
		<h2><?php esc_html_e( 'What should Dealroot count?', 'dealroot' ); ?></h2>
		<p class="dealroot-setup__lead"><?php esc_html_e( 'Leads are always saved. These add the numbers around them. None of them stores names or IP addresses.', 'dealroot' ); ?></p>

		<?php
		$this->toggle( 'count_visits', __( 'Visits', 'dealroot' ), __( 'Daily totals per channel, so you see how many visitors became leads.', 'dealroot' ) );
		$this->toggle( 'track_clicks', __( 'Calls, WhatsApp and email clicks', 'dealroot' ), __( 'Clicks on your phone number, WhatsApp and email links, with the channel the visitor came from.', 'dealroot' ) );
		$this->toggle( 'form_stats', __( 'Forms started and left', 'dealroot' ), __( 'How many visitors start a form and how many send it. What they type is never sent.', 'dealroot' ) );
		$this->toggle( 'live_view', __( 'Live', 'dealroot' ), __( 'Who is on the site right now, which page they are on and whether they are filling in a form. Kept for ten minutes.', 'dealroot' ) );
		$this->toggle( 'geo_cities', __( 'Cities on the map', 'dealroot' ), __( 'Downloads the free DB-IP City Lite database (about 60 MB) to your site, so visits show the city, such as Hamburg, instead of only the country. The address itself is not stored.', 'dealroot' ) );
		$this->toggle( 'ai_enabled', __( 'AI assistant', 'dealroot' ), __( 'Sums up each enquiry in one sentence with its topics, marks urgent ones and spam, and writes a first draft of your answer on request. Without an account or key; email addresses and phone numbers are not sent.', 'dealroot' ) );
		?>

		<?php if ( Settings::get( 'geo_cities' ) ) : ?>
			<?php $status = Geo::status(); ?>
			<p class="dealroot-setup__fact<?php echo $status['ready'] ? ' is-ok' : ''; ?>">
				<?php
				if ( $status['ready'] ) {
					$check = Geo::check();
					echo esc_html(
						'' === $check['reason'] && '' !== $check['city']
							/* translators: %s: name of a city */
							? sprintf( __( 'The city database is ready. Your own visit would show as %s.', 'dealroot' ), $check['city'] )
							: __( 'The city database is ready.', 'dealroot' )
					);
				} else {
					esc_html_e( 'The city database is being downloaded in the background. It is ready in a few minutes; until then visits show the country.', 'dealroot' );
				}
				?>
			</p>
		<?php endif; ?>
		<?php
	}

	/**
	 * Step 3: a test enquiry through the test link.
	 */
	private function step_test() {
		$url  = home_url( '/' );
		$scan = Form_Scan::last();

		// The page of the first form that is saved as leads, so the test starts where the form is.
		if ( $scan ) {
			foreach ( Forms_Page::summary() as $form ) {
				if ( $form['on'] && '' !== $form['page'] ) {
					$url = $form['page'];
					break;
				}
			}
		}

		$url  = add_query_arg(
			array(
				'utm_source'   => 'dealroot',
				'utm_medium'   => 'test',
				'utm_campaign' => self::TEST_CAMPAIGN,
			),
			$url
		);
		$lead = self::test_lead( 0 );
		?>
		<h2><?php esc_html_e( 'Send yourself a test enquiry', 'dealroot' ); ?></h2>
		<p class="dealroot-setup__lead"><?php esc_html_e( 'Open your site through the test link, fill in a form and send it. Keep this page open: each check turns green as soon as it arrives.', 'dealroot' ); ?></p>

		<p><a class="dealroot-button dealroot-button--primary" href="<?php echo esc_url( $url ); ?>" target="_blank" rel="noopener" data-setup-test><?php esc_html_e( 'Open test link', 'dealroot' ); ?></a></p>

		<ul class="dealroot-setup__checks" data-setup-checks aria-live="polite">
			<?php if ( Settings::get( 'count_visits' ) ) : ?>
				<li data-check="visit"><?php esc_html_e( 'Waiting for your visit…', 'dealroot' ); ?></li>
			<?php endif; ?>
			<?php if ( Live::enabled() ) : ?>
				<li data-check="live"><?php esc_html_e( 'Waiting for you on the live screen…', 'dealroot' ); ?></li>
			<?php endif; ?>
			<li data-check="lead"><?php esc_html_e( 'Waiting for the enquiry…', 'dealroot' ); ?></li>
		</ul>

		<?php if ( $lead ) : ?>
			<p class="dealroot-muted"><?php esc_html_e( 'An earlier test lead is already in your list. You can send another one or continue.', 'dealroot' ); ?></p>
		<?php endif; ?>

		<details class="dealroot-setup__help">
			<summary><?php esc_html_e( 'Nothing arrives?', 'dealroot' ); ?></summary>
			<ul>
				<li><?php esc_html_e( 'A caching or optimization plugin may still serve your pages without the Dealroot script. Empty its cache and open the test link again.', 'dealroot' ); ?></li>
				<li><?php esc_html_e( 'If the visit arrives but the enquiry does not, the form is not saved as leads. Go back one step and check that it is switched on.', 'dealroot' ); ?></li>
				<li><?php esc_html_e( 'If your site waits for cookie consent, accept the cookie banner in the test window.', 'dealroot' ); ?></li>
			</ul>
		</details>
		<?php
	}

	/**
	 * Step 4: who hears about new leads.
	 */
	private function step_alerts() {
		$token = Settings::masked_token( (string) Settings::get( 'telegram_token' ) );
		?>
		<h2><?php esc_html_e( 'How do you want to hear about new leads?', 'dealroot' ); ?></h2>
		<p class="dealroot-setup__lead"><?php esc_html_e( 'A message on Telegram for every new lead, and an email each Monday with the week in numbers.', 'dealroot' ); ?></p>

		<fieldset class="dealroot-setup__group" data-telegram>
			<legend>Telegram</legend>
			<?php $this->toggle( 'telegram_enabled', __( 'Send every new lead to Telegram', 'dealroot' ), __( 'With the name, the message and where the visitor came from.', 'dealroot' ) ); ?>
			<ol class="dealroot-setup__howto">
				<li>
					<?php
					echo wp_kses(
						__( 'In Telegram, open <a href="https://t.me/BotFather" target="_blank" rel="noopener">@BotFather</a>, send <code>/newbot</code> and copy the token it gives you.', 'dealroot' ),
						array(
							'a'    => array(
								'href'   => array(),
								'target' => array(),
								'rel'    => array(),
							),
							'code' => array(),
						)
					);
					?>
					<label class="screen-reader-text" for="dealroot-setup-token"><?php esc_html_e( 'Bot token', 'dealroot' ); ?></label>
					<input type="text" id="dealroot-setup-token" class="regular-text code" name="dealroot[telegram_token]" value="<?php echo esc_attr( $token ); ?>" placeholder="123456789:AA..." autocomplete="off" spellcheck="false">
				</li>
				<li>
					<?php esc_html_e( 'Write any message to your new bot, or add it to a group and write there. Then look for the chat.', 'dealroot' ); ?>
					<span class="dealroot-inline">
						<label class="screen-reader-text" for="dealroot-setup-chat"><?php esc_html_e( 'Chat ID', 'dealroot' ); ?></label>
						<input type="text" id="dealroot-setup-chat" class="regular-text code" name="dealroot[telegram_chat_id]" value="<?php echo esc_attr( (string) Settings::get( 'telegram_chat_id' ) ); ?>" placeholder="-1001234567890" spellcheck="false">
						<button type="button" class="button" data-find-chat><?php esc_html_e( 'Find my chat', 'dealroot' ); ?></button>
						<button type="button" class="button" data-test-telegram><?php esc_html_e( 'Send test message', 'dealroot' ); ?></button>
					</span>
					<span class="dealroot-setup__result" data-telegram-result role="status"></span>
				</li>
			</ol>
		</fieldset>

		<fieldset class="dealroot-setup__group">
			<legend><?php esc_html_e( 'Weekly email', 'dealroot' ); ?></legend>
			<?php $this->toggle( 'digest_enabled', __( 'Send a summary every Monday', 'dealroot' ), __( 'New leads, won deals and the channels that brought them, compared with the week before.', 'dealroot' ) ); ?>
			<p>
				<label for="dealroot-setup-recipients"><?php esc_html_e( 'Send it to', 'dealroot' ); ?></label>
				<input type="text" id="dealroot-setup-recipients" class="regular-text" name="dealroot[digest_recipients]" value="<?php echo esc_attr( '' !== Settings::get( 'digest_recipients' ) ? (string) Settings::get( 'digest_recipients' ) : (string) get_option( 'admin_email' ) ); ?>">
				<span class="description"><?php esc_html_e( 'Separate several addresses with commas.', 'dealroot' ); ?></span>
			</p>
		</fieldset>
		<?php
	}

	/**
	 * Step 5: cookie consent.
	 */
	private function step_consent() {
		$plugins = self::consent_plugins();
		$api     = self::consent_api();
		$current = (string) Settings::get( 'consent_mode' );
		$advice  = '';

		// Banners without the WP Consent API mostly set Google Consent Mode, which Dealroot reads too.
		if ( $plugins ) {
			$advice = 'wp_consent_api';
		}

		$options = array(
			'none'           => array(
				__( 'Do not wait for consent', 'dealroot' ),
				__( 'For sites without visitors from the EU or the UK, or when your legal advisor says the tracking needs no consent.', 'dealroot' ),
			),
			'wp_consent_api' => array(
				__( 'Wait for my cookie banner', 'dealroot' ),
				__( 'Dealroot starts once the visitor accepts marketing cookies: in Cookiebot, CookieYes or Complianz, in a banner with the WP Consent API such as Real Cookie Banner, or in any banner that sets Google Consent Mode v2.', 'dealroot' ),
			),
			'custom'         => array(
				__( 'My banner starts Dealroot itself', 'dealroot' ),
				__( 'For other banners: Dealroot waits until the banner runs dealroot.grantConsent() after the visitor agrees.', 'dealroot' ),
			),
		);
		?>
		<h2><?php esc_html_e( 'Cookie consent', 'dealroot' ); ?></h2>
		<p class="dealroot-setup__lead"><?php esc_html_e( 'In the EU, remembering how a visitor arrived usually needs their consent. Until it is given, Dealroot still saves enquiries, without the source.', 'dealroot' ); ?></p>

		<?php if ( $plugins ) : ?>
			<p class="dealroot-setup__fact is-ok">
				<?php
				/* translators: %s: names of cookie banner plugins */
				echo esc_html( sprintf( __( 'Found on your site: %s.', 'dealroot' ), implode( ', ', array_keys( $plugins ) ) ) );
				?>
			</p>
		<?php endif; ?>

		<div class="dealroot-setup__choices" role="radiogroup" aria-label="<?php esc_attr_e( 'Cookie consent', 'dealroot' ); ?>">
			<?php foreach ( $options as $mode => $text ) : ?>
				<label class="dealroot-setup__choice">
					<input type="radio" name="dealroot[consent_mode]" value="<?php echo esc_attr( $mode ); ?>"<?php checked( $current, $mode ); ?>>
					<span>
						<strong>
							<?php echo esc_html( $text[0] ); ?>
							<?php if ( $mode === $advice ) : ?>
								<em class="dealroot-setup__advice"><?php esc_html_e( 'Fits your site', 'dealroot' ); ?></em>
							<?php endif; ?>
						</strong>
						<?php echo esc_html( $text[1] ); ?>
					</span>
				</label>
			<?php endforeach; ?>
		</div>

		<?php if ( 'wp_consent_api' === $advice && ! $api ) : ?>
			<p class="dealroot-setup__fact">
				<?php esc_html_e( 'Your banner talks to other plugins through the free WP Consent API plugin. Install it as well, or Dealroot keeps waiting.', 'dealroot' ); ?>
				<a href="<?php echo esc_url( admin_url( 'plugin-install.php?s=wp+consent+api&tab=search&type=term' ) ); ?>"><?php esc_html_e( 'Install WP Consent API', 'dealroot' ); ?></a>
			</p>
		<?php endif; ?>

		<p class="dealroot-muted"><?php esc_html_e( 'This is not legal advice. Ask your legal advisor which option fits your site.', 'dealroot' ); ?></p>
		<?php
	}

	/**
	 * End of the assistant: what is set up and what comes next.
	 */
	private function done() {
		$scan  = Form_Scan::last();
		$forms = $scan ? count( array_filter( wp_list_pluck( Forms_Page::summary(), 'on' ) ) ) : 0;
		$items = array(
			array(
				(bool) $forms || (bool) Health::active_integrations(),
				$forms
					/* translators: %s: number of forms */
					? sprintf( _n( '%s form is saved as leads.', '%s forms are saved as leads.', $forms, 'dealroot' ), number_format_i18n( $forms ) )
					: __( 'Forms are saved as soon as a visitor sends one.', 'dealroot' ),
			),
			array(
				(bool) self::test_lead( 0 ),
				self::test_lead( 0 ) ? __( 'The test enquiry arrived.', 'dealroot' ) : __( 'No test enquiry yet.', 'dealroot' ),
			),
			array(
				self::complete( 'alerts' ),
				self::complete( 'alerts' ) ? __( 'New leads go to Telegram.', 'dealroot' ) : __( 'No Telegram messages. New leads are on the overview.', 'dealroot' ),
			),
			array(
				'none' !== Settings::get( 'consent_mode' ),
				'none' !== Settings::get( 'consent_mode' ) ? __( 'Tracking waits for cookie consent.', 'dealroot' ) : __( 'Tracking does not wait for cookie consent.', 'dealroot' ),
			),
		);
		?>
		<section class="dealroot-panel dealroot-setup__step dealroot-setup__done">
			<h2><?php esc_html_e( 'Dealroot is set up', 'dealroot' ); ?></h2>
			<p class="dealroot-setup__lead"><?php esc_html_e( 'From now on every enquiry is saved with how the visitor found you. Mark a lead as won when it becomes a customer, and the reports show which channels bring you revenue.', 'dealroot' ); ?></p>
			<ul class="dealroot-setup__summary">
				<?php foreach ( $items as $item ) : ?>
					<li class="<?php echo $item[0] ? 'is-ok' : ''; ?>"><?php echo esc_html( $item[1] ); ?></li>
				<?php endforeach; ?>
			</ul>
			<div class="dealroot-setup__actions">
				<a class="dealroot-button dealroot-button--quiet" href="<?php echo esc_url( self::url( 'forms' ) ); ?>"><?php esc_html_e( 'Go through it again', 'dealroot' ); ?></a>
				<span class="dealroot-setup__spacer"></span>
				<?php if ( Live::enabled() ) : ?>
					<?php echo wp_kses( Shell::button( __( 'Open Live', 'dealroot' ), Shell::url( Live_Page::PAGE ), 'secondary' ), Kses::screen() ); ?>
				<?php endif; ?>
				<?php echo wp_kses( Shell::button( __( 'Go to the overview', 'dealroot' ), Shell::url( Admin::PAGE ), 'primary' ), Kses::screen() ); ?>
			</div>
		</section>
		<?php
	}
}