<?php
/**
 * Settings page and option accessors.
 *
 * Environments pair a Studio host with an API base so they can never mismatch.
 * Selecting "production" resolves both URLs automatically; "custom" lets you
 * enter non-standard hosts (e.g. a staging contour).
 *
 * @package Fabrixa_Studio
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Fabrixa_Settings {

	const OPT_APP_KEY        = 'fabrixa_application_key';
	const OPT_ENVIRONMENT    = 'fabrixa_environment';
	const OPT_CUSTOM_STUDIO  = 'fabrixa_custom_studio_url';
	const OPT_CUSTOM_API     = 'fabrixa_custom_api_base';
	const OPT_WEBHOOK_SECRET = 'fabrixa_webhook_secret';

	/**
	 * Environment a fresh install starts on, and the fallback for a stored value
	 * that is no longer a known environment.
	 */
	const DEFAULT_ENVIRONMENT = 'production';

	/**
	 * Paired Studio + API hosts per environment.
	 * Studio host dictates which API backend it talks to, so they travel together.
	 */
	private static function environments() {
		return array(
			'production' => array(
				'label'  => __( 'Production', 'fabrixa-studio' ),
				'studio' => 'https://studio.fabrixa.com',
				'api'    => 'https://api.fabrixa.com',
			),
			'custom'     => array(
				'label'  => __( 'Custom', 'fabrixa-studio' ),
				'studio' => '',
				'api'    => '',
			),
		);
	}

	private static $instance = null;

	public static function instance() {
		if ( null === self::$instance ) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	private function __construct() {
		add_action( 'admin_menu', array( $this, 'add_menu' ) );
		add_action( 'admin_init', array( $this, 'register_settings' ) );
	}

	public function add_menu() {
		/*
		 * manage_options, not manage_woocommerce. The screen holds the webhook
		 * secret, and options.php requires manage_options to save it anyway — so a
		 * shop manager could previously open a page they could not submit, while
		 * reading the secret out of its markup.
		 */
		add_submenu_page(
			'woocommerce',
			__( 'Fabrixa Studio', 'fabrixa-studio' ),
			__( 'Fabrixa Studio', 'fabrixa-studio' ),
			'manage_options',
			'fabrixa-studio',
			array( $this, 'render_page' )
		);
	}

	public function register_settings() {
		register_setting( 'fabrixa_studio', self::OPT_APP_KEY, array( 'sanitize_callback' => 'sanitize_text_field' ) );
		register_setting( 'fabrixa_studio', self::OPT_ENVIRONMENT, array( 'sanitize_callback' => array( $this, 'sanitize_environment' ) ) );
		register_setting( 'fabrixa_studio', self::OPT_CUSTOM_STUDIO, array( 'sanitize_callback' => 'esc_url_raw' ) );
		register_setting( 'fabrixa_studio', self::OPT_CUSTOM_API, array( 'sanitize_callback' => 'esc_url_raw' ) );
		register_setting( 'fabrixa_studio', self::OPT_WEBHOOK_SECRET, array( 'sanitize_callback' => array( $this, 'sanitize_secret_webhook' ) ) );
	}

	/**
	 * Keep a stored secret when the field comes back empty.
	 *
	 * The settings screen never renders the secret, so every ordinary save
	 * submits an empty field — and a disabled field (one a constant has taken
	 * over) submits nothing at all, which reaches here as null. Both mean "no new
	 * value", not "erase it".
	 *
	 * The cost is that a secret cannot be cleared from this screen, only replaced.
	 * Clearing it is what the constant and a database edit are for; silently
	 * losing one to a stray save is the worse failure.
	 *
	 * @param string|null $value  Submitted value.
	 * @param string      $option Option being saved.
	 * @return string
	 */
	private function sanitize_secret( $value, $option ) {
		$value = sanitize_text_field( (string) $value );

		return ( '' === $value ) ? (string) get_option( $option, '' ) : $value;
	}

	/**
	 * @param string|null $value Submitted value.
	 * @return string
	 */
	public function sanitize_secret_webhook( $value ) {
		return $this->sanitize_secret( $value, self::OPT_WEBHOOK_SECRET );
	}

	/**
	 * Placeholder standing in for a secret that is never rendered.
	 *
	 * @param bool $stored Whether a value is saved.
	 * @return string
	 */
	private static function secret_placeholder( $stored ) {
		return $stored
			? '••••••••••••'
			: __( 'not set', 'fabrixa-studio' );
	}

	public function sanitize_environment( $value ) {
		$envs = self::environments();
		return isset( $envs[ $value ] ) ? $value : self::DEFAULT_ENVIRONMENT;
	}

	/* ---- Static getters used across the plugin ---- */

	public static function app_key() {
		return get_option( self::OPT_APP_KEY, '' );
	}

	/**
	 * Shared secret for verifying incoming webhooks.
	 *
	 * A wp-config.php constant wins over the stored option so production secrets
	 * can live outside the database.
	 */
	public static function webhook_secret() {
		if ( defined( 'FABRIXA_WEBHOOK_SECRET' ) && FABRIXA_WEBHOOK_SECRET ) {
			return FABRIXA_WEBHOOK_SECRET;
		}
		return get_option( self::OPT_WEBHOOK_SECRET, '' );
	}

	/**
	 * Currently selected environment.
	 *
	 * Validated against the known set on read, not just on save: a site that was
	 * configured before an environment was retired still has the old value in the
	 * database, and studio_url() would index a key that no longer exists.
	 */
	public static function environment() {
		$stored = get_option( self::OPT_ENVIRONMENT, self::DEFAULT_ENVIRONMENT );
		$envs   = self::environments();

		return isset( $envs[ $stored ] ) ? $stored : self::DEFAULT_ENVIRONMENT;
	}

	public static function studio_url() {
		$env = self::environment();
		if ( 'custom' === $env ) {
			return untrailingslashit( get_option( self::OPT_CUSTOM_STUDIO, '' ) );
		}
		$envs = self::environments();
		return untrailingslashit( $envs[ $env ]['studio'] );
	}

	public static function api_base() {
		$env = self::environment();
		if ( 'custom' === $env ) {
			return untrailingslashit( get_option( self::OPT_CUSTOM_API, '' ) );
		}
		$envs = self::environments();
		return untrailingslashit( $envs[ $env ]['api'] );
	}

	public function render_page() {
		$current_env = self::environment();
		$envs        = self::environments();
		?>
		<div class="wrap">
			<h1><?php esc_html_e( 'Fabrixa Studio Settings', 'fabrixa-studio' ); ?></h1>
			<form method="post" action="options.php">
				<?php settings_fields( 'fabrixa_studio' ); ?>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><label for="<?php echo esc_attr( self::OPT_APP_KEY ); ?>"><?php esc_html_e( 'Application Key', 'fabrixa-studio' ); ?></label></th>
						<td>
							<input name="<?php echo esc_attr( self::OPT_APP_KEY ); ?>" id="<?php echo esc_attr( self::OPT_APP_KEY ); ?>" type="text" class="regular-text" value="<?php echo esc_attr( self::app_key() ); ?>" />
							<p class="description"><?php esc_html_e( 'Public key used to embed Fabrixa Studio and load customization previews.', 'fabrixa-studio' ); ?></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr( self::OPT_ENVIRONMENT ); ?>"><?php esc_html_e( 'Environment', 'fabrixa-studio' ); ?></label></th>
						<td>
							<select name="<?php echo esc_attr( self::OPT_ENVIRONMENT ); ?>" id="<?php echo esc_attr( self::OPT_ENVIRONMENT ); ?>">
								<?php foreach ( $envs as $key => $env ) : ?>
									<option value="<?php echo esc_attr( $key ); ?>" <?php selected( $current_env, $key ); ?>>
										<?php echo esc_html( $env['label'] ); ?><?php echo '' !== $env['studio'] ? ' (' . esc_html( wp_parse_url( $env['studio'], PHP_URL_HOST ) ) . ')' : ''; ?>
									</option>
								<?php endforeach; ?>
							</select>
							<p class="description"><?php esc_html_e( 'Studio host and API base are paired automatically. Use Custom for a non-standard contour.', 'fabrixa-studio' ); ?></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr( self::OPT_CUSTOM_STUDIO ); ?>"><?php esc_html_e( 'Custom Studio URL', 'fabrixa-studio' ); ?></label></th>
						<td>
							<input name="<?php echo esc_attr( self::OPT_CUSTOM_STUDIO ); ?>" id="<?php echo esc_attr( self::OPT_CUSTOM_STUDIO ); ?>" type="url" class="regular-text" value="<?php echo esc_attr( get_option( self::OPT_CUSTOM_STUDIO, '' ) ); ?>" placeholder="https://studio.example.com" />
							<p class="description"><?php esc_html_e( 'Only used when Environment is set to Custom.', 'fabrixa-studio' ); ?></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr( self::OPT_CUSTOM_API ); ?>"><?php esc_html_e( 'Custom API Base URL', 'fabrixa-studio' ); ?></label></th>
						<td>
							<input name="<?php echo esc_attr( self::OPT_CUSTOM_API ); ?>" id="<?php echo esc_attr( self::OPT_CUSTOM_API ); ?>" type="url" class="regular-text" value="<?php echo esc_attr( get_option( self::OPT_CUSTOM_API, '' ) ); ?>" placeholder="https://api.example.com" />
							<p class="description"><?php esc_html_e( 'Only used when Environment is set to Custom.', 'fabrixa-studio' ); ?></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><label for="<?php echo esc_attr( self::OPT_WEBHOOK_SECRET ); ?>"><?php esc_html_e( 'Webhook Secret', 'fabrixa-studio' ); ?></label></th>
						<td>
							<?php
							$secret_locked = defined( 'FABRIXA_WEBHOOK_SECRET' ) && FABRIXA_WEBHOOK_SECRET;
							$secret_stored = '' !== (string) get_option( self::OPT_WEBHOOK_SECRET, '' );
							?>
							<input name="<?php echo esc_attr( self::OPT_WEBHOOK_SECRET ); ?>" id="<?php echo esc_attr( self::OPT_WEBHOOK_SECRET ); ?>" type="password" class="regular-text" value="" autocomplete="new-password" placeholder="<?php echo esc_attr( self::secret_placeholder( $secret_stored ) ); ?>" <?php disabled( $secret_locked, true ); ?> />
							<p class="description">
								<?php esc_html_e( 'Shared secret from the Fabrixa dashboard, used to verify the x-webhook-signature header. Without it, incoming webhooks are rejected.', 'fabrixa-studio' ); ?>
								<?php if ( $secret_stored && ! $secret_locked ) : ?>
									<br /><?php esc_html_e( 'A secret is saved. Leave this empty to keep it, or type a new one to replace it.', 'fabrixa-studio' ); ?>
								<?php endif; ?>
								<?php if ( $secret_locked ) : ?>
									<br /><strong><?php esc_html_e( 'Currently set via the FABRIXA_WEBHOOK_SECRET constant in wp-config.php, which takes precedence.', 'fabrixa-studio' ); ?></strong>
								<?php endif; ?>
							</p>
						</td>
					</tr>
					<tr>
						<th scope="row"><?php esc_html_e( 'Webhook URL', 'fabrixa-studio' ); ?></th>
						<td>
							<input type="text" class="large-text code" readonly value="<?php echo esc_attr( Fabrixa_Webhook::url() ); ?>" onfocus="this.select();" />
							<p class="description"><?php esc_html_e( 'Register this URL in Fabrixa for the order.created and order.updated events.', 'fabrixa-studio' ); ?></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><?php esc_html_e( 'Resolved endpoints', 'fabrixa-studio' ); ?></th>
						<td>
							<p class="description">
								<?php esc_html_e( 'Studio:', 'fabrixa-studio' ); ?> <code><?php echo esc_html( self::studio_url() ); ?></code><br />
								<?php esc_html_e( 'API base:', 'fabrixa-studio' ); ?> <code><?php echo esc_html( self::api_base() ); ?></code>
							</p>
						</td>
					</tr>
				</table>
				<?php submit_button(); ?>
			</form>
		</div>
		<?php
	}
}