<?php
/**
 * Accessible, nonce-protected guest claim forms.
 *
 * @package DevoynxRewards
 */

namespace Devoynx\Rewards\Programs;

defined( 'ABSPATH' ) || exit;

/** Native forms never award points from a shareable link or a GET request. */
final class GuestClaimsUI {

	/**
	 * Verified claims service.
	 *
	 * @var GuestClaims
	 */
	private $service;

	/**
	 * Inject the claims service.
	 *
	 * @param GuestClaims $service Claims.
	 */
	public function __construct( GuestClaims $service ) {
		$this->service = $service; }

	/** Register only authenticated actions and owner-scoped wallet content. */
	public function register() {
		add_filter( 'devoynx_rewards_admin_tabs', array( $this, 'tabs' ) );
		add_action( 'devoynx_rewards_admin_tab', array( $this, 'render_admin' ) );
		add_action( 'admin_post_devoynx_rewards_guest_settings', array( $this, 'save' ) );
		add_action( 'admin_post_devoynx_rewards_guest_challenge', array( $this, 'submit' ) );
		add_action( 'admin_post_devoynx_rewards_guest_claim', array( $this, 'submit' ) );
		add_action( 'devoynx_rewards_wallet_after_activity', array( $this, 'render_wallet' ), 20 );
	}

	/**
	 * Add merchant configuration.
	 *
	 * @param array $tabs Navigation.
	 * @return array
	 */
	public function tabs( $tabs ) {
		$tabs['guest-claims'] = __( 'Guest claims', 'devoynx-rewards' );
		return $tabs; }

	/** Save only bounded settings after capability and CSRF checks. */
	public function save() {
		$this->authorize( true );
		check_admin_referer( 'devoynx_rewards_guest_settings' );
		$days = isset( $_POST['window_days'] ) && is_scalar( $_POST['window_days'] ) ? absint( $_POST['window_days'] ) : 30;
		update_option(
			GuestClaims::OPTION,
			array(
				'enabled'     => isset( $_POST['enabled'] ) ? 1 : 0,
				'window_days' => min( 90, max( 1, $days ) ),
			),
			false
		);
		wp_safe_redirect(
			add_query_arg(
				array(
					'page'        => 'devoynx-rewards',
					'tab'         => 'guest-claims',
					'guest_saved' => '1',
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/** Issue a proof or claim, without trusting posted recipient or point amounts. */
	public function submit() {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read only the action allowlist to select the nonce checked below, before processing any claim data.
		$action = isset( $_POST['action'] ) && is_string( $_POST['action'] ) ? sanitize_key( wp_unslash( $_POST['action'] ) ) : '';
		if ( ! in_array( $action, array( 'devoynx_rewards_guest_challenge', 'devoynx_rewards_guest_claim' ), true ) ) {
			wp_die( esc_html__( 'Permission denied.', 'devoynx-rewards' ), 403 ); }
		$this->authorize();
		check_admin_referer( $action );
		$order_id  = isset( $_POST['order_id'] ) && is_scalar( $_POST['order_id'] ) ? absint( $_POST['order_id'] ) : 0;
		$token     = isset( $_POST['claim_code'] ) && is_string( $_POST['claim_code'] ) ? sanitize_text_field( wp_unslash( $_POST['claim_code'] ) ) : '';
		$challenge = 'devoynx_rewards_guest_challenge' === $action;
		$result    = $challenge ? $this->service->challenge( $order_id ) : $this->service->claim( $order_id, $token );
		$query     = array(
			'guest_order'  => $order_id,
			'guest_status' => is_wp_error( $result ) ? $result->get_error_code() : ( $challenge ? 'sent' : 'claimed' ),
		);
		wp_safe_redirect( add_query_arg( $query, wc_get_account_endpoint_url( 'rewards' ) ) . '#devoynx-guest-claims' );
		exit;
	}

	/**
	 * Central POST, session and capability gate; each handler then verifies its nonce.
	 *
	 * @param bool $merchant Whether merchant permission is required.
	 */
	private function authorize( $merchant = false ) {
		if ( 'POST' !== sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ?? '' ) ) || ! get_current_user_id() || ( $merchant && ! current_user_can( 'manage_devoynx_rewards' ) ) ) {
			wp_die( esc_html__( 'Permission denied.', 'devoynx-rewards' ), 403 ); }
	}

	/**
	 * Render honest opt-in scope and security limits.
	 *
	 * @param string $tab Merchant tab.
	 */
	public function render_admin( $tab ) {
		if ( 'guest-claims' !== $tab || ! current_user_can( 'manage_devoynx_rewards' ) ) {
			return; }
		$config = $this->service->settings();
		?>
		<section class="devoynx-panel"><h2><?php esc_html_e( 'Bring guest purchases into the wallet', 'devoynx-rewards' ); ?></h2>
		<p><?php esc_html_e( 'Capture new qualifying paid guest orders while enabled. Points are frozen at the earning rate at capture, but are not awarded until the customer proves access to the purchase billing mailbox. Earlier orders and legacy Pro guest records are not automatically imported.', 'devoynx-rewards' ); ?></p>
		<?php
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only, capability-gated confirmation.
		if ( isset( $_GET['guest_saved'] ) ) :
			?>
		<p role="status"><?php esc_html_e( 'Guest claim settings saved.', 'devoynx-rewards' ); ?></p><?php endif; ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><input type="hidden" name="action" value="devoynx_rewards_guest_settings" /><?php wp_nonce_field( 'devoynx_rewards_guest_settings' ); ?>
		<label class="devoynx-form__check"><input type="checkbox" name="enabled" value="1" <?php checked( $config['enabled'] ); ?> /><?php esc_html_e( 'Enable verified guest purchase claims', 'devoynx-rewards' ); ?></label>
		<div class="devoynx-definition"><label><?php esc_html_e( 'Days to claim newly captured purchases', 'devoynx-rewards' ); ?><input required type="number" name="window_days" min="1" max="90" step="1" value="<?php echo esc_attr( $config['window_days'] ); ?>" /></label></div>
		<p><?php esc_html_e( 'Codes expire in 20 minutes and allow five attempts. Resends require a one-minute wait, with at most three verification emails per mailbox per hour. Customers explicitly request these security messages; reward-email preferences do not suppress them. Your WordPress mail transport must work.', 'devoynx-rewards' ); ?></p>
		<p><?php esc_html_e( 'Pausing blocks new claims without deleting purchase history. Existing claim deadlines are preserved. Refunds reduce the final award through the purchase ledger. Changed purchases require merchant review; successful claims attach the WooCommerce order to the verified account.', 'devoynx-rewards' ); ?></p>
		<?php submit_button( __( 'Save guest claims', 'devoynx-rewards' ) ); ?></form></section>
		<?php
	}

	/**
	 * Explicit two-step proof, without disclosing guest order data before verification.
	 *
	 * @param int $user_id Wallet owner.
	 */
	public function render_wallet( $user_id ) {
		if ( ! $user_id || get_current_user_id() !== (int) $user_id || ! $this->service->settings()['enabled'] ) {
			return; }
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only form prefill; never an ownership assertion.
		$order_id = isset( $_GET['guest_order'] ) && is_scalar( $_GET['guest_order'] ) ? absint( $_GET['guest_order'] ) : 0;
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Allowlisted read-only status; success is checked against the owner receipt below.
		$status  = isset( $_GET['guest_status'] ) && is_string( $_GET['guest_status'] ) ? sanitize_key( wp_unslash( $_GET['guest_status'] ) ) : '';
		$row     = $order_id ? ( new \Devoynx\Rewards\Database\ProgramStore() )->find( 'guest:order:' . $order_id ) : null;
		$claimed = $row && 'claimed' === $row['status'] && (int) $row['user_id'] === (int) $user_id;
		?>
		<section id="devoynx-guest-claims" class="devoynx-guest-claims" aria-labelledby="devoynx-guest-title"><h3 id="devoynx-guest-title"><?php esc_html_e( 'Purchased as a guest?', 'devoynx-rewards' ); ?></h3>
		<p><?php esc_html_e( 'Claim eligible purchase points using the same email on your account and your purchase. We will verify that you can access that mailbox before linking the purchase, including its order details, to this account. Refunds and outstanding corrections may reduce the points available.', 'devoynx-rewards' ); ?></p>
		<?php if ( $claimed ) : ?>
		<p role="status" class="devoynx-spin__result"><?php esc_html_e( 'Purchase claimed. View the award and any refund adjustments in your wallet activity; find the linked purchase in Orders.', 'devoynx-rewards' ); ?></p>
		<?php elseif ( 'sent' === $status ) : ?>
		<p role="status"><?php esc_html_e( 'If the order is eligible and matches your account email, a verification code has been sent to the purchase billing mailbox. Check spam too. Wait one minute before requesting another; no more than three codes are sent per hour.', 'devoynx-rewards' ); ?></p>
		<?php elseif ( $status && 'claimed' !== $status ) : ?>
		<p role="alert"><?php echo esc_html( $this->service->error( $status )->get_error_message() ); ?></p><?php endif; ?>
		<div class="devoynx-guest-claims__steps">
		<?php
		foreach ( array( 'challenge', 'claim' ) as $step ) :
			$challenge = 'challenge' === $step;
			$action    = 'devoynx_rewards_guest_' . $step;
			?>
		<form class="devoynx-guest-claims__step" method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><fieldset><legend><?php echo esc_html( $challenge ? __( '1. Request your code', 'devoynx-rewards' ) : __( '2. Verify and claim', 'devoynx-rewards' ) ); ?></legend><input type="hidden" name="action" value="<?php echo esc_attr( $action ); ?>" /><?php wp_nonce_field( $action ); ?>
		<label><?php esc_html_e( 'Order ID from your purchase confirmation', 'devoynx-rewards' ); ?><input required inputmode="numeric" type="number" min="1" step="1" name="order_id" value="<?php echo $order_id ? esc_attr( $order_id ) : ''; ?>" /></label>
			<?php
			if ( ! $challenge ) :
				?>
				<label><?php esc_html_e( 'Verification code', 'devoynx-rewards' ); ?><input required type="text" name="claim_code" minlength="32" maxlength="32" pattern="[a-f0-9]{32}" autocomplete="one-time-code" autocapitalize="none" spellcheck="false" aria-describedby="devoynx-guest-code-help" /></label><p id="devoynx-guest-code-help"><?php esc_html_e( 'Paste the 32-character code from your email. It expires in 20 minutes and allows five attempts.', 'devoynx-rewards' ); ?></p><?php endif; ?>
		<button type="submit"><?php echo esc_html( $challenge ? __( 'Email verification code', 'devoynx-rewards' ) : __( 'Verify and claim purchase', 'devoynx-rewards' ) ); ?></button></fieldset></form>
		<?php endforeach; ?></div>
		<p><?php esc_html_e( 'No eligible purchase yet? Only paid guest orders captured while this program is enabled can be claimed, before their deadline. Fully refunded, changed or previously claimed purchases are not eligible. Contact the store if you need help locating the order ID.', 'devoynx-rewards' ); ?></p></section>
		<?php
	}
}