<?php
/**
 * Accessible merchant configuration and customer spin form.
 *
 * @package DevoynxRewards
 */

namespace Devoynx\Rewards\Programs;

use Devoynx\Rewards\Database\ProgramStore;

defined( 'ABSPATH' ) || exit;

/** Native forms work without JavaScript; all outcomes come from the server. */
final class SpinUI {

	/**
	 * Campaign service.
	 *
	 * @var Spin
	 */
	private $service;

	/**
	 * Inject the accounting service.
	 *
	 * @param Spin $service Spin engine.
	 */
	public function __construct( Spin $service ) {
		$this->service = $service; }

	/** Attach only authenticated forms and scoped screens. */
	public function register() {
		add_filter( 'devoynx_rewards_admin_tabs', array( $this, 'tabs' ) );
		add_action( 'devoynx_rewards_admin_tab', array( $this, 'render_admin' ) );
		add_action( 'admin_post_devoynx_rewards_spin_settings', array( $this, 'save' ) );
		add_action( 'admin_post_devoynx_rewards_spin', array( $this, 'play' ) );
		add_action( 'devoynx_rewards_wallet_after_activity', array( $this, 'render_wallet' ), 25 );
	}

	/**
	 * Add one useful merchant destination.
	 *
	 * @param array $tabs Existing navigation.
	 * @return array
	 */
	public function tabs( $tabs ) {
		$tabs['spin'] = __( 'Spin campaign', 'devoynx-rewards' );
		return $tabs; }

	/** Save validated configuration while holding the same campaign lock as spins. */
	public function save() {
		if ( 'POST' !== sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ?? '' ) ) || ! current_user_can( 'manage_devoynx_rewards' ) ) {
			wp_die( esc_html__( 'Permission denied.', 'devoynx-rewards' ), 403 ); }
		check_admin_referer( 'devoynx_rewards_spin_settings' );
		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Every field is allowlisted and bounded by the service validator before saving.
		$settings = $this->service->sanitize( isset( $_POST['spin'] ) ? wp_unslash( $_POST['spin'] ) : array() );
		if ( ! is_wp_error( $settings ) ) {
			try {
				( new ProgramStore() )->locked(
					'spin:campaign',
					'spin_campaign',
					static function ( $row ) use ( $settings ) {
						update_option( Spin::OPTION, $settings, false );
						if ( 'new' === $row['status'] ) {
							( new ProgramStore() )->save(
								$row,
								array(
									'spent' => 0,
									'spins' => 0,
								),
								'active'
							); }
					}
				);
			} catch ( \Throwable $error ) {
				$settings = $this->service->error( 'failed' ); }
		}
		wp_safe_redirect(
			add_query_arg(
				array(
					'page'       => 'devoynx-rewards',
					'tab'        => 'spin',
					'spin_saved' => is_wp_error( $settings ) ? 'invalid' : 'saved',
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/** Mutate only on an authenticated, nonce-verified POST, never on a shareable GET. */
	public function play() {
		if ( 'POST' !== sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ?? '' ) ) || ! get_current_user_id() ) {
			wp_die( esc_html__( 'Permission denied.', 'devoynx-rewards' ), 403 ); }
		check_admin_referer( 'devoynx_rewards_spin' );
		$request = isset( $_POST['spin_request'] ) && is_string( $_POST['spin_request'] ) ? sanitize_text_field( wp_unslash( $_POST['spin_request'] ) ) : '';
		$result  = $this->service->spin( get_current_user_id(), $request );
		$query   = is_wp_error( $result ) ? array( 'spin_error' => $result->get_error_code() ) : array( 'spin_result' => $request );
		wp_safe_redirect( add_query_arg( $query, wc_get_account_endpoint_url( 'rewards' ) ) . '#devoynx-spin' );
		exit;
	}

	/**
	 * Render actual consumption, safeguards and every configured outcome.
	 *
	 * @param string $tab Current merchant tab.
	 */
	public function render_admin( $tab ) {
		if ( 'spin' !== $tab || ! current_user_can( 'manage_devoynx_rewards' ) ) {
			return; }
		$config   = $this->service->settings();
		$campaign = $this->service->campaign();
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only result on a capability-gated screen.
		$saved  = isset( $_GET['spin_saved'] ) ? sanitize_key( wp_unslash( $_GET['spin_saved'] ) ) : '';
		$fields = array(
			'budget'           => array( __( 'Lifetime campaign point budget', 'devoynx-rewards' ), 100000000 ),
			'max_spins'        => array( __( 'Lifetime campaign spin limit', 'devoynx-rewards' ), 100000 ),
			'per_customer'     => array( __( 'Lifetime spins per account', 'devoynx-rewards' ), 100 ),
			'interval_days'    => array( __( 'Days between spins', 'devoynx-rewards' ), 365 ),
			'account_age_days' => array( __( 'Minimum account age in days', 'devoynx-rewards' ), 365 ),
		);
		?>
		<section class="devoynx-panel"><h2><?php esc_html_e( 'One small moment of delight', 'devoynx-rewards' ); ?></h2>
		<p><?php esc_html_e( 'A no-purchase points promotion for signed-in customers. Rewards are selected on the server. Account age, waiting periods and hard campaign limits reduce abuse; they cannot prove one human per account. Use conservative budgets and review your programme rules before enabling.', 'devoynx-rewards' ); ?></p>
		<dl class="devoynx-diagnostics"><dt><?php esc_html_e( 'Points issued', 'devoynx-rewards' ); ?></dt><dd><?php echo esc_html( number_format_i18n( $campaign['spent'] ) ); ?></dd><dt><?php esc_html_e( 'Completed spins (including zero-point results)', 'devoynx-rewards' ); ?></dt><dd><?php echo esc_html( number_format_i18n( $campaign['spins'] ) ); ?></dd></dl>
		<?php
		if ( 'invalid' === $saved ) :
			?>
			<p role="alert"><?php echo esc_html( $this->service->error( 'configuration' )->get_error_message() ); ?></p>
			<?php
elseif ( 'saved' === $saved ) :
	?>
			<p role="status"><?php esc_html_e( 'Campaign settings saved. Existing results and limits used were preserved.', 'devoynx-rewards' ); ?></p><?php endif; ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><input type="hidden" name="action" value="devoynx_rewards_spin_settings" /><?php wp_nonce_field( 'devoynx_rewards_spin_settings' ); ?>
		<label class="devoynx-form__check"><input type="checkbox" name="spin[enabled]" value="1" <?php checked( $config['enabled'], 1 ); ?> /><?php esc_html_e( 'Enable the spin campaign', 'devoynx-rewards' ); ?></label>
		<div class="devoynx-definition-grid"><fieldset class="devoynx-definition"><legend><?php esc_html_e( 'Eligibility and safeguards', 'devoynx-rewards' ); ?></legend>
		<label><?php esc_html_e( 'Campaign name', 'devoynx-rewards' ); ?><input required maxlength="80" name="spin[name]" value="<?php echo esc_attr( $config['name'] ); ?>" /></label>
		<?php
		foreach ( $fields as $key => $field ) :
			?>
			<label><?php echo esc_html( $field[0] ); ?><input required type="number" min="1" max="<?php echo esc_attr( $field[1] ); ?>" step="1" name="<?php echo esc_attr( 'spin[' . $key . ']' ); ?>" value="<?php echo esc_attr( $config[ $key ] ); ?>" /></label><?php endforeach; ?>
		</fieldset><fieldset class="devoynx-definition"><legend><?php esc_html_e( 'Server-selected outcomes', 'devoynx-rewards' ); ?></legend>
		<p><?php esc_html_e( 'Each outcome chance is its weight divided by all weights. Zero points is a valid outcome. At least one outcome must award points.', 'devoynx-rewards' ); ?></p>
		<div class="devoynx-spin-outcomes" data-dyr-repeat="spin" data-dyr-list="spin-outcomes">
		<?php
		foreach ( $config['rewards'] as $index => $reward ) {
			$this->outcome_fields( $index, $reward );
		}
		?>
		</div>
		<template data-dyr-template="spin-outcome"><?php $this->outcome_fields( 0, array() ); ?></template>
		<p><button type="button" class="button" data-dyr-add="spin-outcome" data-dyr-list="spin-outcomes"><?php esc_html_e( 'Add outcome', 'devoynx-rewards' ); ?></button></p>
		</fieldset></div>
		<p><?php esc_html_e( 'Changing settings or pausing never resets consumed limits or old results. The campaign pauses when it cannot cover its largest reward, keeping the displayed odds unchanged. Spin rewards are not linked to purchases and are not reversed by unrelated order refunds.', 'devoynx-rewards' ); ?></p>
		<?php submit_button( __( 'Save spin campaign', 'devoynx-rewards' ) ); ?></form></section>
		<?php
	}

	/**
	 * Render one repeatable server-selected outcome.
	 *
	 * @param int   $index Outcome index.
	 * @param array $reward Saved outcome.
	 */
	private function outcome_fields( $index, $reward ) {
		$reward = wp_parse_args(
			$reward,
			array(
				'points' => '',
				'weight' => '',
			)
		);
		$prefix = 'spin[rewards][' . absint( $index ) . ']';
		?>
		<div class="devoynx-spin-outcome" data-dyr-row>
		<label><?php esc_html_e( 'Outcome', 'devoynx-rewards' ); ?> <span data-dyr-row-number><?php echo esc_html( absint( $index ) + 1 ); ?></span>: <?php esc_html_e( 'points', 'devoynx-rewards' ); ?><input type="number" min="0" max="10000" step="1" name="<?php echo esc_attr( $prefix . '[points]' ); ?>" value="<?php echo esc_attr( $reward['points'] ); ?>" /></label>
		<label><?php esc_html_e( 'Weight', 'devoynx-rewards' ); ?><input type="number" min="1" max="1000" step="1" name="<?php echo esc_attr( $prefix . '[weight]' ); ?>" value="<?php echo esc_attr( $reward['weight'] ); ?>" /></label>
		<div class="devoynx-repeat-actions"><button type="button" class="button" data-dyr-move="up"><?php esc_html_e( 'Move up', 'devoynx-rewards' ); ?></button><button type="button" class="button" data-dyr-move="down"><?php esc_html_e( 'Move down', 'devoynx-rewards' ); ?></button><button type="button" class="button button-link-delete" data-dyr-remove><?php esc_html_e( 'Remove', 'devoynx-rewards' ); ?></button></div>
		</div>
		<?php
	}

	/**
	 * Accessible owner-only wheel, exact odds, eligibility and immutable result.
	 *
	 * @param int $user_id Wallet owner.
	 */
	public function render_wallet( $user_id ) {
		if ( ! $user_id || get_current_user_id() !== (int) $user_id ) {
			return; }
		$config = $this->service->settings();
		if ( ! $config['enabled'] ) {
			return; }
		$customer = $this->service->customer( $user_id );
		$campaign = $this->service->campaign();
		$user     = get_userdata( $user_id );
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reading an owner-scoped immutable receipt, never performing a spin.
		$request = isset( $_GET['spin_result'] ) && is_string( $_GET['spin_result'] ) ? sanitize_text_field( wp_unslash( $_GET['spin_result'] ) ) : '';
		$result  = $this->service->receipt( $user_id, $request );
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Allowlisted read-only public status message.
		$error  = isset( $_GET['spin_error'] ) ? sanitize_key( wp_unslash( $_GET['spin_error'] ) ) : '';
		$reason = '';
		if ( time() < strtotime( $user->user_registered . ' UTC' ) + $config['account_age_days'] * DAY_IN_SECONDS ) {
			$reason = 'age'; }
		if ( $customer['next_at'] > time() ) {
			$reason = 'frequency'; }
		if ( $customer['spins'] >= $config['per_customer'] ) {
			$reason = 'limit'; }
		if ( $campaign['spins'] >= $config['max_spins'] || $config['budget'] - $campaign['spent'] < max( array_column( $config['rewards'], 'points' ) ) ) {
			$reason = 'budget'; }
		$weights       = array_sum( array_column( $config['rewards'], 'weight' ) );
		$wheel_rewards = $result['rewards'] ?? $config['rewards'];
		$wheel_weight  = array_sum( array_column( $wheel_rewards, 'weight' ) );
		$position      = 0;
		$stops         = array();
		$angle         = 0;
		$colors        = array( '#5758c9', '#9ba9e8', '#255b70', '#7eafaa', '#aa6b9e', '#e9bc84' );
		foreach ( $wheel_rewards as $index => $reward ) {
			$next    = $position + $reward['weight'] / $wheel_weight * 360;
			$stops[] = $colors[ $index % count( $colors ) ] . ' ' . round( $position, 3 ) . 'deg ' . round( $next, 3 ) . 'deg';
			if ( $result && $index === $result['outcome'] ) {
				$angle = 0 - ( $position + $next ) / 2; }
			$position = $next;
		}
		?>
		<section id="devoynx-spin" class="devoynx-spin" aria-labelledby="devoynx-spin-title">
		<div class="devoynx-spin__visual" aria-hidden="true"><span class="devoynx-spin__pointer">▼</span><div class="devoynx-spin__wheel" style="<?php echo esc_attr( 'background:conic-gradient(' . implode( ',', $stops ) . ');transform:rotate(' . round( $angle, 3 ) . 'deg)' ); ?>"></div><span class="devoynx-spin__center"><?php esc_html_e( 'Rewards', 'devoynx-rewards' ); ?></span></div>
		<div class="devoynx-spin__content"><h3 id="devoynx-spin-title"><?php echo esc_html( $config['name'] ); ?></h3>
		<p><?php /* translators: 1: minimum account age in days, 2: interval in days, 3: lifetime spin limit. */ echo esc_html( sprintf( __( 'No-purchase entry for accounts at least %1$d days old. One spin every %2$d days, up to %3$d spins per account.', 'devoynx-rewards' ), $config['account_age_days'], $config['interval_days'], $config['per_customer'] ) ); ?></p>
		<?php
		if ( $result ) :
			?>
			<p class="devoynx-spin__result" role="status"><?php /* translators: %s: points awarded. */ echo esc_html( $result['points'] ? sprintf( __( 'You won %s points! Your wallet reflects any outstanding refund corrections.', 'devoynx-rewards' ), number_format_i18n( $result['points'] ) ) : __( 'No points this time. This spin still counts toward your limit.', 'devoynx-rewards' ) ); ?></p><?php endif; ?>
		<?php
		if ( $error ) :
			?>
			<p role="alert"><?php echo esc_html( $this->service->error( $error )->get_error_message() ); ?></p><?php endif; ?>
		<p><?php esc_html_e( 'Current odds for your next eligible spin:', 'devoynx-rewards' ); ?></p>
		<ul class="devoynx-spin__odds" aria-label="<?php esc_attr_e( 'Reward probabilities', 'devoynx-rewards' ); ?>" tabindex="0">
		<?php
		foreach ( $config['rewards'] as $reward ) :
			?>
			<li><?php /* translators: 1: point reward, 2: percentage chance. */ echo esc_html( sprintf( __( '%1$s points · %2$s%% chance', 'devoynx-rewards' ), number_format_i18n( $reward['points'] ), number_format_i18n( $reward['weight'] / $weights * 100, 2 ) ) ); ?></li><?php endforeach; ?></ul>
		<p><?php /* translators: 1: spins used, 2: allowed spins. */ echo esc_html( sprintf( __( '%1$d of %2$d spins used.', 'devoynx-rewards' ), $customer['spins'], $config['per_customer'] ) ); ?>
		<?php
		if ( $customer['next_at'] > time() ) :
			?>
			<time datetime="<?php echo esc_attr( gmdate( 'c', $customer['next_at'] ) ); ?>"><?php /* translators: %s: local date and time. */ echo esc_html( sprintf( __( 'Next eligible: %s', 'devoynx-rewards' ), wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $customer['next_at'] ) ) ); ?></time><?php endif; ?></p>
		<?php
		if ( $reason ) :
			?>
			<p><?php echo esc_html( $this->service->error( $reason )->get_error_message() ); ?></p><?php else : ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><input type="hidden" name="action" value="devoynx_rewards_spin" /><input type="hidden" name="spin_request" value="<?php echo esc_attr( wp_generate_uuid4() ); ?>" /><?php wp_nonce_field( 'devoynx_rewards_spin' ); ?><button type="submit"><?php esc_html_e( 'Spin for free', 'devoynx-rewards' ); ?></button></form>
		<?php endif; ?>
		<p class="devoynx-spin__note"><?php esc_html_e( 'Subject to the campaign reward limit. The server selects and saves your outcome; refreshing does not draw again.', 'devoynx-rewards' ); ?></p></div></section>
		<?php
	}
}