<?php
/**
 * Admin screen: upload, preview, confirm, results (Tools > Draftdrop).
 *
 * @package Draftdrop
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Admin UI and request handlers.
 */
class Draftdrop_Admin {

	const SLUG            = 'draftdrop';
	const MAX_FILES       = 20;
	const MAX_FILE_BYTES  = 1048576; // 1 MB per file.
	const MAX_TOTAL_BYTES = 4194304; // 4 MB per batch.

	/**
	 * Register hooks.
	 *
	 * @return void
	 */
	public static function init() {
		add_action( 'admin_menu', array( __CLASS__, 'menu' ) );
		add_action( 'admin_post_draftdrop_preview', array( __CLASS__, 'handle_preview' ) );
		add_action( 'admin_post_draftdrop_import', array( __CLASS__, 'handle_import' ) );
	}

	/**
	 * Add Tools > Draftdrop.
	 *
	 * @return void
	 */
	public static function menu() {
		add_management_page(
			__( 'Draftdrop', 'draftdrop' ),
			__( 'Draftdrop', 'draftdrop' ),
			'edit_posts',
			self::SLUG,
			array( __CLASS__, 'render' )
		);
	}

	/**
	 * Whether the current user may use the importer.
	 *
	 * @return bool
	 */
	private static function allowed() {
		return current_user_can( 'edit_posts' ) && current_user_can( 'upload_files' );
	}

	/**
	 * Redirect back to the screen.
	 *
	 * @param array $args Query args.
	 * @return void
	 */
	private static function redirect( array $args ) {
		$args['page'] = self::SLUG;
		wp_safe_redirect( add_query_arg( $args, admin_url( 'tools.php' ) ) );
		exit;
	}

	/**
	 * Clean a token from the request.
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	private static function token( $value ) {
		return preg_replace( '/[^A-Za-z0-9]/', '', (string) $value );
	}

	/**
	 * Step 1: read uploaded files and store them for the preview.
	 *
	 * @return void
	 */
	public static function handle_preview() {
		if ( ! self::allowed() ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'draftdrop' ), '', array( 'response' => 403 ) );
		}
		check_admin_referer( 'draftdrop_preview' );

		$files = self::read_uploads();
		if ( is_wp_error( $files ) ) {
			self::redirect( array( 'draftdrop_error' => $files->get_error_code() ) );
		}

		$token = wp_generate_password( 16, false );
		set_transient(
			'draftdrop_p_' . $token,
			array(
				'user'  => get_current_user_id(),
				'files' => $files,
			),
			HOUR_IN_SECONDS
		);
		self::redirect( array( 'draftdrop_preview' => $token ) );
	}

	/**
	 * Read and validate uploaded files (they are never stored on disk by us).
	 *
	 * @return array|WP_Error List of array( name, raw ).
	 */
	private static function read_uploads() {
		// The nonce is verified in handle_preview(), the only caller.
		// phpcs:disable WordPress.Security.NonceVerification.Missing
		if ( ! isset( $_FILES['draftdrop_files']['name'], $_FILES['draftdrop_files']['tmp_name'], $_FILES['draftdrop_files']['error'] ) ) {
			return new WP_Error( 'no_files' );
		}
		if ( ! is_array( $_FILES['draftdrop_files']['name'] ) || ! is_array( $_FILES['draftdrop_files']['tmp_name'] ) || ! is_array( $_FILES['draftdrop_files']['error'] ) ) {
			return new WP_Error( 'no_files' );
		}
		// Names are sanitized as file names. Temp paths are generated by PHP and are only ever used after is_uploaded_file().
		$names  = array_map( 'sanitize_file_name', $_FILES['draftdrop_files']['name'] );
		$tmps   = array_map( 'sanitize_text_field', $_FILES['draftdrop_files']['tmp_name'] );
		$errors = array_map( 'absint', $_FILES['draftdrop_files']['error'] );
		// phpcs:enable WordPress.Security.NonceVerification.Missing

		if ( count( $names ) > self::MAX_FILES ) {
			return new WP_Error( 'too_many' );
		}

		$files = array();
		$total = 0;
		foreach ( $names as $i => $name ) {
			$error = isset( $errors[ $i ] ) ? (int) $errors[ $i ] : UPLOAD_ERR_NO_FILE;
			if ( UPLOAD_ERR_NO_FILE === $error ) {
				continue;
			}
			if ( UPLOAD_ERR_OK !== $error ) {
				return new WP_Error( 'upload_failed' );
			}
			$name = (string) $name;
			$ext  = strtolower( pathinfo( $name, PATHINFO_EXTENSION ) );
			if ( ! in_array( $ext, array( 'md', 'markdown' ), true ) ) {
				return new WP_Error( 'bad_type' );
			}
			$tmp = isset( $tmps[ $i ] ) ? (string) $tmps[ $i ] : '';
			if ( '' === $tmp || ! is_uploaded_file( $tmp ) ) {
				return new WP_Error( 'upload_failed' );
			}
			$size = filesize( $tmp );
			if ( false === $size || $size > self::MAX_FILE_BYTES ) {
				return new WP_Error( 'too_big' );
			}
			$total += $size;
			if ( $total > self::MAX_TOTAL_BYTES ) {
				return new WP_Error( 'too_big' );
			}
			$raw = file_get_contents( $tmp ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- reading a local upload temp file.
			if ( false === $raw ) {
				return new WP_Error( 'upload_failed' );
			}
			$files[] = array(
				'name' => $name,
				'raw'  => $raw,
			);
		}

		if ( empty( $files ) ) {
			return new WP_Error( 'no_files' );
		}
		return $files;
	}

	/**
	 * Step 2: create posts for the selected files.
	 *
	 * @return void
	 */
	public static function handle_import() {
		if ( ! self::allowed() ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'draftdrop' ), '', array( 'response' => 403 ) );
		}
		check_admin_referer( 'draftdrop_import' );

		$token = isset( $_POST['token'] ) ? self::token( sanitize_text_field( wp_unslash( $_POST['token'] ) ) ) : '';
		$data  = get_transient( 'draftdrop_p_' . $token );
		if ( ! is_array( $data ) || get_current_user_id() !== (int) $data['user'] ) {
			self::redirect( array( 'draftdrop_error' => 'expired' ) );
		}

		$selected = isset( $_POST['selected'] ) ? array_map( 'absint', (array) wp_unslash( $_POST['selected'] ) ) : array();

		if ( function_exists( 'wp_raise_memory_limit' ) ) {
			wp_raise_memory_limit( 'admin' );
		}

		$results = array();
		foreach ( $selected as $index ) {
			if ( ! isset( $data['files'][ $index ] ) ) {
				continue;
			}
			$file = $data['files'][ $index ];
			$item = Draftdrop_Importer::prepare( $file['raw'], $file['name'] );

			if ( ! empty( $item['errors'] ) ) {
				$results[] = array(
					'title'   => '' !== $item['title'] ? $item['title'] : $file['name'],
					'post_id' => 0,
					'status'  => '',
					'notes'   => $item['errors'],
					'error'   => true,
				);
				continue;
			}

			$created   = Draftdrop_Importer::create( $item );
			$results[] = array(
				'title'   => $item['title'],
				'post_id' => $created['post_id'],
				'status'  => $item['status'],
				'notes'   => array_merge( $item['notes'], $created['notes'], '' !== $created['error'] ? array( $created['error'] ) : array() ),
				'error'   => '' !== $created['error'],
			);
		}

		delete_transient( 'draftdrop_p_' . $token );
		set_transient(
			'draftdrop_r_' . $token,
			array(
				'user'    => get_current_user_id(),
				'results' => $results,
			),
			HOUR_IN_SECONDS
		);
		self::redirect( array( 'draftdrop_done' => $token ) );
	}

	/**
	 * Screen router.
	 *
	 * @return void
	 */
	public static function render() {
		if ( ! self::allowed() ) {
			wp_die( esc_html__( 'You are not allowed to access this page.', 'draftdrop' ), '', array( 'response' => 403 ) );
		}

		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- read-only screen routing; every write is nonce-protected.
		$preview = isset( $_GET['draftdrop_preview'] ) ? self::token( sanitize_text_field( wp_unslash( $_GET['draftdrop_preview'] ) ) ) : '';
		$done    = isset( $_GET['draftdrop_done'] ) ? self::token( sanitize_text_field( wp_unslash( $_GET['draftdrop_done'] ) ) ) : '';
		$error   = isset( $_GET['draftdrop_error'] ) ? sanitize_key( wp_unslash( $_GET['draftdrop_error'] ) ) : '';
		// phpcs:enable

		echo '<div class="wrap"><h1>' . esc_html__( 'Draftdrop', 'draftdrop' ) . '</h1>';

		if ( '' !== $error ) {
			echo '<div class="notice notice-error"><p>' . esc_html( self::error_message( $error ) ) . '</p></div>';
		}

		if ( '' !== $preview ) {
			self::render_preview( $preview );
		} elseif ( '' !== $done ) {
			self::render_results( $done );
		} else {
			self::render_upload();
		}

		echo '</div>';
	}

	/**
	 * Human-readable error.
	 *
	 * @param string $code Error code.
	 * @return string
	 */
	private static function error_message( $code ) {
		$messages = array(
			'no_files'      => __( 'Choose at least one .md file.', 'draftdrop' ),
			'too_many'      => __( 'Too many files. The limit is 20 per batch.', 'draftdrop' ),
			'too_big'       => __( 'A file or the whole batch is too large (1 MB per file, 4 MB per batch).', 'draftdrop' ),
			'bad_type'      => __( 'Only .md and .markdown files are accepted.', 'draftdrop' ),
			'upload_failed' => __( 'The upload failed. Please try again.', 'draftdrop' ),
			'expired'       => __( 'The preview has expired. Upload the files again.', 'draftdrop' ),
		);
		return isset( $messages[ $code ] ) ? $messages[ $code ] : __( 'Something went wrong.', 'draftdrop' );
	}

	/**
	 * Upload form and format help.
	 *
	 * @return void
	 */
	private static function render_upload() {
		?>
		<p><?php esc_html_e( 'Upload Markdown files with front matter. You will see a preview before anything is created. Posts are saved as drafts.', 'draftdrop' ); ?></p>
		<form method="post" enctype="multipart/form-data" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="draftdrop_preview" />
			<?php wp_nonce_field( 'draftdrop_preview' ); ?>
			<p><input type="file" name="draftdrop_files[]" accept=".md,.markdown" multiple required /></p>
			<?php submit_button( __( 'Preview import', 'draftdrop' ) ); ?>
		</form>

		<h2><?php esc_html_e( 'File format', 'draftdrop' ); ?></h2>
		<pre style="background:#fff;border:1px solid #c3c4c7;padding:12px;overflow:auto;"><?php echo esc_html( self::example_file() ); ?></pre>
		<p><?php esc_html_e( 'Only title is required. Allowed statuses: draft, pending. SEO fields are written in the format used by Yoast SEO.', 'draftdrop' ); ?></p>
		<?php
	}

	/**
	 * Example file shown on the upload screen.
	 *
	 * @return string
	 */
	private static function example_file() {
		return "---\n" .
			"title: Car Rental in Tenerife: Complete Guide\n" .
			"slug: car-rental-tenerife-guide\n" .
			"category: Guides\n" .
			"tags: [tenerife, car rental]\n" .
			"excerpt: A short summary of the article.\n" .
			"seo_title: Car Rental in Tenerife (2026 Guide)\n" .
			"meta_description: Everything you need to know before renting a car in Tenerife.\n" .
			"focus_keyword: car rental tenerife\n" .
			"featured_image: https://example.com/images/tenerife.jpg\n" .
			"image_alt: Rental car on a coastal road\n" .
			"status: draft\n" .
			"---\n\n" .
			"The article body in Markdown. HTML is allowed and is sanitized.\n";
	}

	/**
	 * Preview table.
	 *
	 * @param string $token Preview token.
	 * @return void
	 */
	private static function render_preview( $token ) {
		$data = get_transient( 'draftdrop_p_' . $token );
		if ( ! is_array( $data ) || get_current_user_id() !== (int) $data['user'] ) {
			echo '<div class="notice notice-error"><p>' . esc_html( self::error_message( 'expired' ) ) . '</p></div>';
			self::render_upload();
			return;
		}

		if ( ! defined( 'WPSEO_VERSION' ) ) {
			echo '<div class="notice notice-info"><p>' . esc_html__( 'Yoast SEO was not detected. SEO fields will still be saved and will be used once it is active.', 'draftdrop' ) . '</p></div>';
		}
		?>
		<?php
		$items      = array();
		$importable = 0;
		foreach ( $data['files'] as $index => $file ) {
			$items[ $index ] = Draftdrop_Importer::prepare( $file['raw'], $file['name'] );
			if ( empty( $items[ $index ]['errors'] ) ) {
				++$importable;
			}
		}
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="draftdrop_import" />
			<input type="hidden" name="token" value="<?php echo esc_attr( $token ); ?>" />
			<?php wp_nonce_field( 'draftdrop_import' ); ?>
			<table class="widefat striped">
				<thead><tr>
					<th style="width:30px"></th>
					<th><?php esc_html_e( 'File', 'draftdrop' ); ?></th>
					<th><?php esc_html_e( 'Post', 'draftdrop' ); ?></th>
					<th><?php esc_html_e( 'Taxonomy', 'draftdrop' ); ?></th>
					<th><?php esc_html_e( 'SEO', 'draftdrop' ); ?></th>
					<th><?php esc_html_e( 'Checks', 'draftdrop' ); ?></th>
				</tr></thead>
				<tbody>
				<?php foreach ( $data['files'] as $index => $file ) : ?>
					<?php
					$item    = Draftdrop_Importer::prepare( $file['raw'], $file['name'] );
					$blocked = ! empty( $item['errors'] );
					?>
					<tr>
						<td><input type="checkbox" name="selected[]" value="<?php echo esc_attr( (string) $index ); ?>" <?php checked( ! $blocked ); ?> <?php disabled( $blocked ); ?> /></td>
						<td><?php echo esc_html( $item['filename'] ); ?></td>
						<td>
							<strong><?php echo esc_html( $item['title'] ); ?></strong><br />
							<code><?php echo esc_html( $item['slug'] ); ?></code><br />
							<?php echo esc_html( $item['status'] ); ?>
						</td>
						<td>
							<?php echo esc_html( implode( ', ', $item['categories'] ) ); ?><br />
							<em><?php echo esc_html( implode( ', ', $item['tags'] ) ); ?></em>
						</td>
						<td>
							<?php echo esc_html( $item['seo_title'] ); ?><br />
							<?php echo esc_html( $item['meta_description'] ); ?><br />
							<code><?php echo esc_html( $item['focus_keyword'] ); ?></code>
							<?php if ( '' !== $item['featured_image'] ) : ?>
								<br /><small><?php esc_html_e( 'Image:', 'draftdrop' ); ?> <?php echo esc_html( $item['featured_image'] ); ?></small>
							<?php endif; ?>
						</td>
						<td>
							<?php foreach ( $item['errors'] as $message ) : ?>
								<div style="color:#b32d2e;">&#10007; <?php echo esc_html( $message ); ?></div>
							<?php endforeach; ?>
							<?php foreach ( $item['warnings'] as $message ) : ?>
								<div style="color:#996800;">&#9888; <?php echo esc_html( $message ); ?></div>
							<?php endforeach; ?>
							<?php foreach ( $item['notes'] as $message ) : ?>
								<div style="color:#50575e;">&#8505; <?php echo esc_html( $message ); ?></div>
							<?php endforeach; ?>
						</td>
					</tr>
				<?php endforeach; ?>
				</tbody>
			</table>
			<?php if ( $importable > 0 ) : ?>
				<?php submit_button( __( 'Create drafts', 'draftdrop' ) ); ?>
			<?php else : ?>
				<p><strong><?php esc_html_e( 'Nothing can be imported from these files. Fix the problems above and upload them again.', 'draftdrop' ); ?></strong></p>
			<?php endif; ?>
		</form>
		<p><a href="<?php echo esc_url( admin_url( 'tools.php?page=' . self::SLUG ) ); ?>"><?php esc_html_e( 'Start over', 'draftdrop' ); ?></a></p>
		<?php
	}

	/**
	 * Results table.
	 *
	 * @param string $token Results token.
	 * @return void
	 */
	private static function render_results( $token ) {
		$data = get_transient( 'draftdrop_r_' . $token );
		if ( ! is_array( $data ) || get_current_user_id() !== (int) $data['user'] ) {
			echo '<div class="notice notice-error"><p>' . esc_html( self::error_message( 'expired' ) ) . '</p></div>';
			self::render_upload();
			return;
		}
		?>
		<h2><?php esc_html_e( 'Import finished', 'draftdrop' ); ?></h2>
		<table class="widefat striped">
			<thead><tr>
				<th><?php esc_html_e( 'Title', 'draftdrop' ); ?></th>
				<th><?php esc_html_e( 'Result', 'draftdrop' ); ?></th>
				<th><?php esc_html_e( 'Notes', 'draftdrop' ); ?></th>
			</tr></thead>
			<tbody>
			<?php foreach ( $data['results'] as $row ) : ?>
				<tr>
					<td><?php echo esc_html( $row['title'] ); ?></td>
					<td>
						<?php if ( ! empty( $row['post_id'] ) ) : ?>
							<a href="<?php echo esc_url( (string) get_edit_post_link( (int) $row['post_id'], 'raw' ) ); ?>"><?php esc_html_e( 'Edit post', 'draftdrop' ); ?></a>
						<?php else : ?>
							<span style="color:#b32d2e;"><?php esc_html_e( 'Not created', 'draftdrop' ); ?></span>
						<?php endif; ?>
					</td>
					<td>
						<?php foreach ( $row['notes'] as $message ) : ?>
							<div><?php echo esc_html( $message ); ?></div>
						<?php endforeach; ?>
					</td>
				</tr>
			<?php endforeach; ?>
			</tbody>
		</table>
		<p><a class="button" href="<?php echo esc_url( admin_url( 'tools.php?page=' . self::SLUG ) ); ?>"><?php esc_html_e( 'Import more', 'draftdrop' ); ?></a></p>
		<?php
	}
}