<?php
/**
 * Accessible basic referral settings, explicit consent and private progress.
 *
 * @package DevoynxRewards
 */

namespace Devoynx\Rewards\Programs;

use Devoynx\Rewards\Admin\CustomerField;
use Devoynx\Rewards\Database\ProgramStore;

defined( 'ABSPATH' ) || exit;

/** Native forms keep all points decisions on the server. */
final class ReferralsUI {

	/** Referral service.
	 *
	 * @var Referrals
	 */
	private $service;

	/**
	 * Inject the service.
	 *
	 * @param Referrals $service Referrals.
	 */
	public function __construct( Referrals $service ) {
		$this->service = $service;
	}

	/** Register authenticated POST actions and owner-scoped displays. */
	public function register() {
		add_filter( 'devoynx_rewards_admin_tabs', array( $this, 'tabs' ) );
		add_action( 'devoynx_rewards_admin_tab', array( $this, 'render_admin' ) );
		add_action( 'devoynx_rewards_wallet_after_activity', array( $this, 'render_wallet' ), 24 );
		add_action( 'admin_post_devoynx_rewards_basic_referral_settings', array( $this, 'save' ) );
		add_action( 'admin_post_devoynx_rewards_basic_referral_accept', array( $this, 'accept' ) );
		add_action( 'admin_post_devoynx_rewards_basic_referral_reconcile', array( $this, 'reconcile' ) );
	}

	/**
	 * Register the Free basic-referral settings tab.
	 *
	 * @param array $tabs Navigation.
	 * @return array
	 */
	public function tabs( $tabs ) {
		$tabs['basic-referrals'] = __( 'Basic referrals', 'devoynx-rewards' );
		return $tabs;
	}

	/**
	 * Gate writes before each handler's nonce check.
	 *
	 * @param bool $merchant Whether merchant permission is required.
	 */
	private function authorize( $merchant = false ) {
		if ( 'POST' !== sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ?? '' ) ) || ! get_current_user_id() || ( $merchant && ! current_user_can( 'manage_devoynx_rewards' ) ) ) {
			wp_die( esc_html__( 'Permission denied.', 'devoynx-rewards' ), 403 );
		}
	}

	/** Save bounded, explicit merchant economics. */
	public function save() {
		$this->authorize( true );
		check_admin_referer( 'devoynx_rewards_basic_referral_settings' );
		$config = array( 'enabled' => isset( $_POST['enabled'] ) ? 1 : 0 );
		foreach ( array( 'referrer_points', 'friend_points' ) as $field ) {
			$config[ $field ] = isset( $_POST[ $field ] ) && is_scalar( $_POST[ $field ] ) ? min( 100000, absint( $_POST[ $field ] ) ) : 0;
		}
		$config['minimum_order'] = isset( $_POST['minimum_order'] ) && is_string( $_POST['minimum_order'] ) ? min( 1000000, max( 0, (float) wc_format_decimal( sanitize_text_field( wp_unslash( $_POST['minimum_order'] ) ) ) ) ) : 10;
		update_option( Referrals::OPTION, $config, false );
		wp_safe_redirect(
			add_query_arg(
				array(
					'page'           => 'devoynx-rewards',
					'tab'            => 'basic-referrals',
					'referral_saved' => 1,
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/** Consent uses the logged-in identity, never a posted recipient or point amount. */
	public function accept() {
		$this->authorize();
		check_admin_referer( 'devoynx_rewards_basic_referral_accept' );
		$code   = isset( $_POST['referral_code'] ) && is_string( $_POST['referral_code'] ) ? sanitize_text_field( wp_unslash( $_POST['referral_code'] ) ) : '';
		$result = $this->service->accept( $code );
		wp_safe_redirect( add_query_arg( 'basic_referral_status', is_wp_error( $result ) ? 'unavailable' : 'accepted', wc_get_account_endpoint_url( 'rewards' ) ) . '#devoynx-basic-referral' );
		exit;
	}

	/** Retry a single real order without manufacturing or bypassing eligibility. */
	public function reconcile() {
		$this->authorize( true );
		check_admin_referer( 'devoynx_rewards_basic_referral_reconcile' );
		$id     = isset( $_POST['order_id'] ) && is_scalar( $_POST['order_id'] ) ? absint( $_POST['order_id'] ) : 0;
		$result = $this->service->process( $id );
		$status = is_wp_error( $result ) ? 'failed' : ( $result['status'] ?? 'none' );
		wp_safe_redirect(
			add_query_arg(
				array(
					'page'               => 'devoynx-rewards',
					'tab'                => 'basic-referrals',
					'referral_reconcile' => $status,
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/**
	 * Localized state labels, never raw internal error or payload strings.
	 *
	 * @param string $status State.
	 * @return string
	 */
	public function label( $status ) {
		$labels = array(
			'pending'  => __( 'Waiting for a qualifying payment', 'devoynx-rewards' ),
			'awarded'  => __( 'Awarded; refunds may reduce points', 'devoynx-rewards' ),
			'reversed' => __( 'Reversed after refund', 'devoynx-rewards' ),
			'erased'   => __( 'Closed by privacy request', 'devoynx-rewards' ),
		);
		return $labels[ $status ] ?? __( 'Not eligible or needs review', 'devoynx-rewards' );
	}

	/**
	 * Distinguish a processing failure from an unpaid invitation.
	 *
	 * @param array $row Receipt.
	 * @return string
	 */
	private function progress( $row ) {
		$data = json_decode( $row['payload'], true );
		return ! empty( $data['needs_review'] ) ? __( 'Processing needs review; contact the store if it persists', 'devoynx-rewards' ) : $this->label( $row['status'] );
	}

	/**
	 * Render policy, real recent receipts and an explicit reconciliation tool.
	 *
	 * @param string $tab Active tab.
	 */
	public function render_admin( $tab ) {
		if ( 'basic-referrals' !== $tab || ! current_user_can( 'manage_devoynx_rewards' ) ) {
			return;
		}
		$config = $this->service->settings();
		global $wpdb;
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only pagination on a capability-gated screen.
		$page = isset( $_GET['referral_page'] ) ? max( 1, absint( $_GET['referral_page'] ) ) : 1;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Capability-gated, bounded current report on the custom workflow table.
		$rows = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM %i WHERE kind = 'basic_referral' ORDER BY id DESC LIMIT 26 OFFSET %d", $wpdb->prefix . 'devoynx_rewards_program_records', 25 * ( $page - 1 ) ), ARRAY_A );
		?>
		<section class="devoynx-panel"><h2><?php esc_html_e( 'A rewarding first introduction', 'devoynx-rewards' ); ?></h2>
		<p><?php esc_html_e( 'Customers explicitly accept a link or code before their first paid purchase. One invitation per account and billing mailbox. No rewards for self-referrals, existing paid customers or unpaid orders. The first qualifying payment after acceptance earns the frozen points below.', 'devoynx-rewards' ); ?></p>
		<?php
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only confirmation, not a write.
		if ( isset( $_GET['referral_saved'] ) ) :
			?>
		<p role="status"><?php esc_html_e( 'Basic referral settings saved.', 'devoynx-rewards' ); ?></p><?php endif; ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><input type="hidden" name="action" value="devoynx_rewards_basic_referral_settings" /><?php wp_nonce_field( 'devoynx_rewards_basic_referral_settings' ); ?>
		<label class="devoynx-form__check"><input type="checkbox" name="enabled" value="1" <?php checked( $config['enabled'] ); ?> /><?php esc_html_e( 'Enable basic referrals', 'devoynx-rewards' ); ?></label>
		<div class="devoynx-definition">
		<?php
		foreach ( array(
			'referrer_points' => __( 'Points for the inviter', 'devoynx-rewards' ),
			'friend_points'   => __( 'Points for the friend', 'devoynx-rewards' ),
		) as $field => $label ) :
			?>
		<label><?php echo esc_html( $label ); ?><input required type="number" name="<?php echo esc_attr( $field ); ?>" value="<?php echo esc_attr( $config[ $field ] ); ?>" min="0" max="100000" step="1" /></label><?php endforeach; ?>
		<label><?php esc_html_e( 'Minimum paid order total in store currency', 'devoynx-rewards' ); ?><input required type="number" name="minimum_order" value="<?php echo esc_attr( $config['minimum_order'] ); ?>" min="0" max="1000000" step="0.01" /></label></div>
		<p><?php esc_html_e( 'The minimum uses the final cash order total, including shipping and tax, after coupons and point redemption. A positive cash payment in the store currency is required. Below-minimum payments do not earn a referral; the first later qualifying payment can. Partial cash refunds reverse each award proportionally, rounded half-up; spent points become correction debt. Cancelling a paid order without a cash refund does not reverse points.', 'devoynx-rewards' ); ?></p>
		<p><?php esc_html_e( 'Changing settings affects new invitations only. Pausing stops new acceptance and awards, but refunds still reconcile. Accounts with changed billing identity or more than 100 paid orders require review. Processing failures retry up to three times; use the single-order tool below if needed. Basic receipt emails use the separate email settings.', 'devoynx-rewards' ); ?></p>
		<?php submit_button( __( 'Save basic referrals', 'devoynx-rewards' ) ); ?></form></section>
		<section class="devoynx-panel"><h2><?php esc_html_e( 'Reconcile an order', 'devoynx-rewards' ); ?></h2><p><?php esc_html_e( 'Recheck a known order after resolving a processing failure. This cannot override eligibility or create an invitation retroactively. Deleted refunds and edited historical order economics require a reviewed manual ledger adjustment.', 'devoynx-rewards' ); ?></p>
		<?php
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Allowlisted informational status only.
		$status = isset( $_GET['referral_reconcile'] ) && is_string( $_GET['referral_reconcile'] ) ? sanitize_key( wp_unslash( $_GET['referral_reconcile'] ) ) : '';
		if ( $status ) :
			?>
		<p role="status"><?php echo esc_html( $this->label( $status ) ); ?></p><?php endif; ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><input type="hidden" name="action" value="devoynx_rewards_basic_referral_reconcile" /><?php wp_nonce_field( 'devoynx_rewards_basic_referral_reconcile' ); ?><label><?php esc_html_e( 'Order ID', 'devoynx-rewards' ); ?><input required type="number" name="order_id" min="1" step="1" /></label><?php submit_button( __( 'Reconcile referral', 'devoynx-rewards' ), 'secondary' ); ?></form></section>
		<section class="devoynx-panel"><h2><?php esc_html_e( 'Basic invitations', 'devoynx-rewards' ); ?></h2><div class="devoynx-basic-referral__table"><table class="widefat striped"><thead><tr><th scope="col"><?php esc_html_e( 'Friend account', 'devoynx-rewards' ); ?></th><th scope="col"><?php esc_html_e( 'Order', 'devoynx-rewards' ); ?></th><th scope="col"><?php esc_html_e( 'Progress', 'devoynx-rewards' ); ?></th></tr></thead><tbody>
		<?php
		foreach ( array_slice( $rows, 0, 25 ) as $row ) :
			?>
			<tr><td><?php echo esc_html( CustomerField::label( $row['user_id'] ) ); ?></td><td><?php echo esc_html( $row['order_id'] ? '#' . $row['order_id'] : '—' ); ?></td><td><?php echo esc_html( $this->progress( $row ) ); ?></td></tr><?php endforeach; ?>
		<?php
		if ( ! $rows ) :
			?>
			<tr><td colspan="3"><?php esc_html_e( 'No invitations yet. Enable the program so customers can find their link in the rewards wallet.', 'devoynx-rewards' ); ?></td></tr><?php endif; ?></tbody></table></div>
		<nav class="devoynx-report-pages" aria-label="<?php esc_attr_e( 'Basic invitation pages', 'devoynx-rewards' ); ?>">
		<?php
		if ( $page > 1 ) :
			?>
			<a class="button" href="<?php echo esc_url( add_query_arg( 'referral_page', $page - 1 ) ); ?>"><?php esc_html_e( 'Previous page', 'devoynx-rewards' ); ?></a><?php endif; ?>
		<?php
		if ( count( $rows ) > 25 ) :
			?>
			<a class="button" href="<?php echo esc_url( add_query_arg( 'referral_page', $page + 1 ) ); ?>"><?php esc_html_e( 'Next page', 'devoynx-rewards' ); ?></a><?php endif; ?>
		</nav></section>
		<?php
	}

	/**
	 * Owner-only invitation and aggregate progress, with no friend's personal/order data.
	 *
	 * @param int $user_id Wallet owner.
	 */
	public function render_wallet( $user_id ) {
		if ( ! $user_id || get_current_user_id() !== (int) $user_id ) {
			return;
		}
		$config = $this->service->settings();
		$row    = ( new ProgramStore() )->find( 'referral:friend:' . $user_id );
		global $wpdb;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Owner-filtered aggregate counts contain no friend's identity or purchase details.
		$counts = $wpdb->get_results( $wpdb->prepare( "SELECT status,COUNT(*) total FROM %i WHERE kind = 'basic_referral' AND group_key = %s GROUP BY status", $wpdb->prefix . 'devoynx_rewards_program_records', 'inviter:' . $user_id ), ARRAY_A );
		if ( ! $config['enabled'] && ! $row && ! $counts ) {
			return;
		}
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only prefill never accepts attribution.
		$incoming = isset( $_GET['dyr_invite'] ) && is_string( $_GET['dyr_invite'] ) ? sanitize_text_field( wp_unslash( $_GET['dyr_invite'] ) ) : '';
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only failure message; success comes from the persisted owner receipt.
		$failed = isset( $_GET['basic_referral_status'] ) && 'unavailable' === $_GET['basic_referral_status'];
		$optout = get_user_meta( $user_id, '_devoynx_rewards_referral_optout', true );
		?>
		<section id="devoynx-basic-referral" class="devoynx-basic-referral" aria-labelledby="devoynx-basic-referral-title"><p class="devoynx-wallet__eyebrow"><?php esc_html_e( 'Good things are worth sharing', 'devoynx-rewards' ); ?></p><h3 id="devoynx-basic-referral-title"><?php esc_html_e( 'Your basic referrals', 'devoynx-rewards' ); ?></h3>
		<?php
		if ( ! $config['enabled'] || $optout ) :
			?>
			<p><?php esc_html_e( 'New basic invitations are currently unavailable. Your recorded progress and refund adjustments remain visible.', 'devoynx-rewards' ); ?></p>
			<?php
		else :
			$code = $this->service->code( $user_id );
			?>
		<p>
			<?php
			/* translators: 1: inviter points, 2: friend points. */
			echo esc_html( sprintf( __( 'Invite a new customer: you receive %1$s points and your friend receives %2$s after their first qualifying payment.', 'devoynx-rewards' ), number_format_i18n( $config['referrer_points'] ), number_format_i18n( $config['friend_points'] ) ) );
			?>
			</p><div class="devoynx-basic-referral__grid"><label><?php esc_html_e( 'Shareable invitation link', 'devoynx-rewards' ); ?><input readonly type="text" value="<?php echo esc_attr( add_query_arg( 'dyr_invite', $code, wc_get_account_endpoint_url( 'rewards' ) ) ); ?>" /></label><label><?php esc_html_e( 'Invitation code', 'devoynx-rewards' ); ?><input readonly type="text" value="<?php echo esc_attr( $code ); ?>" /></label></div><?php endif; ?>
		<?php
		if ( $failed ) :
			?>
			<p role="alert"><?php echo esc_html( $this->service->error()->get_error_message() ); ?></p><?php endif; ?>
		<?php
		if ( $row ) :
			?>
			<div class="devoynx-basic-referral__progress" role="status"><h4><?php esc_html_e( 'Your accepted invitation', 'devoynx-rewards' ); ?></h4><p><?php echo esc_html( $this->progress( $row ) ); ?></p>
			<?php $terms = json_decode( $row['payload'], true ); ?>
			<p>
			<?php
			/* translators: 1: promised friend points, 2: minimum order total, 3: currency. */
			echo esc_html( sprintf( __( 'Your accepted terms: %1$s points after a qualifying payment of at least %2$s %3$s. Refunds and correction debt may reduce the available reward.', 'devoynx-rewards' ), number_format_i18n( $terms['friend_points'] ?? 0 ), wc_format_decimal( $terms['minimum_order'] ?? 0, wc_get_price_decimals() ), $terms['currency'] ?? get_woocommerce_currency() ) );
			?>
			</p><p><?php esc_html_e( 'See wallet activity for awards and corrections. The inviter only sees aggregate progress, never your email, name or order details here.', 'devoynx-rewards' ); ?></p></div>
			<?php
		elseif ( $config['enabled'] && ! $optout ) :
			?>
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><fieldset><legend><?php esc_html_e( 'Were you invited by a friend?', 'devoynx-rewards' ); ?></legend><input type="hidden" name="action" value="devoynx_rewards_basic_referral_accept" /><?php wp_nonce_field( 'devoynx_rewards_basic_referral_accept' ); ?><label><?php esc_html_e( 'Your friend’s basic invitation code', 'devoynx-rewards' ); ?><input required type="text" name="referral_code" maxlength="45" value="<?php echo esc_attr( $incoming ); ?>" autocapitalize="none" spellcheck="false" aria-describedby="devoynx-basic-referral-terms" /></label><p id="devoynx-basic-referral-terms">
			<?php
			/* translators: 1: minimum order value, 2: store currency code. */
			echo esc_html( sprintf( __( 'Accept before your first paid purchase. Use your account email at checkout. The first qualifying payment must be at least %1$s %2$s after discounts, including tax and shipping, and must be greater than zero. Self-referrals are not eligible. One invitation per account and mailbox; accepting cannot be undone or switched. Refunds proportionally reduce both rewards.', 'devoynx-rewards' ), wc_format_decimal( $config['minimum_order'], wc_get_price_decimals() ), get_woocommerce_currency() ) );
			?>
			</p><button type="submit"><?php esc_html_e( 'Accept invitation', 'devoynx-rewards' ); ?></button></fieldset></form><?php endif; ?>
		<h4><?php esc_html_e( 'Friends you invited', 'devoynx-rewards' ); ?></h4>
		<?php
		if ( ! $counts ) :
			?>
			<p><?php esc_html_e( 'No accepted invitations yet. Share your link directly with a friend who is new to this store.', 'devoynx-rewards' ); ?></p>
			<?php
else :
	?>
			<dl class="devoynx-basic-referral__counts">
			<?php
			foreach ( $counts as $count ) :
				?>
	<div><dt><?php echo esc_html( $this->label( $count['status'] ) ); ?></dt><dd><?php echo esc_html( number_format_i18n( $count['total'] ) ); ?></dd></div><?php endforeach; ?></dl><?php endif; ?></section>
		<?php
	}
}