<?php
/**
 * Plugin Name:       FocalScore: Website Audit & AI Readiness Check
 * Description:       Scan your website with FocalScore from your dashboard: a score, the fixes worth the most, and how customers, Google and AI assistants see your site. Nothing is sent until you agree.
 * Version:           1.0.3
 * Requires at least: 6.0
 * Requires PHP:      7.4
 * Author:            FocalScore
 * Author URI:        https://focalscore.com/
 * License:           GPLv2 or later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain:       focalscore
 *
 * @package FocalScore
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

define( 'FOCALSCORE_VERSION', '1.0.3' );
define( 'FOCALSCORE_API', 'https://focalscore.com/api/plugin' );
/* The consent wording's version: the FocalScore service refuses a scan without the current one. */
define( 'FOCALSCORE_CONSENT_VERSION', '2026-11-01b' );

/*
 * Nothing in this plugin contacts FocalScore until the site's administrator
 * ticks the consent box and presses "Scan my site". There is no activation
 * ping, no usage tracking and no request on page load before that.
 */

/**
 * The plugin's one page, under Tools.
 */
function focalscore_admin_menu() {
	add_management_page(
		__( 'FocalScore', 'focalscore' ),
		__( 'FocalScore', 'focalscore' ),
		'manage_options',
		'focalscore',
		'focalscore_render_page'
	);
}
add_action( 'admin_menu', 'focalscore_admin_menu' );

/**
 * Its script and style, loaded from the plugin itself and only on its page.
 *
 * @param string $hook The current admin page.
 */
function focalscore_assets( $hook ) {
	if ( 'tools_page_focalscore' !== $hook ) {
		return;
	}
	wp_enqueue_style( 'focalscore-admin', plugins_url( 'assets/admin.css', __FILE__ ), array(), FOCALSCORE_VERSION );
	wp_enqueue_script( 'focalscore-admin', plugins_url( 'assets/admin.js', __FILE__ ), array(), FOCALSCORE_VERSION, true );
}
add_action( 'admin_enqueue_scripts', 'focalscore_assets' );

/**
 * The address FocalScore fetches to confirm a scan request came from this site.
 *
 * It is public on purpose: the FocalScore server calls it while the
 * administrator's scan request is being confirmed, and that server has no
 * WordPress login. It never reveals the one-time token FocalScore issued: it
 * answers FocalScore's random challenge with an HMAC of it keyed by the token,
 * which proves the site holds the token without disclosing it. It answers only
 * while a scan the administrator started is being confirmed (a few seconds,
 * five minutes at most); otherwise it returns 404.
 */
function focalscore_rest_routes() {
	register_rest_route(
		'focalscore/v1',
		'/verify',
		array(
			'methods'             => WP_REST_Server::READABLE,
			// Intentionally public: called by the FocalScore server, not a logged-in user. It reveals nothing.
			'permission_callback' => '__return_true',
			'callback'            => 'focalscore_rest_verify',
			'args'                => array(
				'challenge' => array(
					'description'       => __( 'A random challenge from FocalScore: 1 to 64 lowercase hexadecimal characters.', 'focalscore' ),
					'type'              => 'string',
					'required'          => true,
					'validate_callback' => 'focalscore_valid_challenge',
					'sanitize_callback' => 'sanitize_text_field',
				),
			),
		)
	);
}
add_action( 'rest_api_init', 'focalscore_rest_routes' );

/**
 * Whether a challenge is 1 to 64 lowercase hexadecimal characters.
 *
 * @param mixed $value The challenge parameter.
 * @return bool
 */
function focalscore_valid_challenge( $value ) {
	return is_string( $value ) && 1 === preg_match( '/^[a-f0-9]{1,64}$/D', $value );
}

/**
 * The proof that this site holds the one-time token, for FocalScore's
 * challenge. The token itself is never returned.
 *
 * @param WP_REST_Request $request The request, with a validated challenge.
 * @return WP_REST_Response
 */
function focalscore_rest_verify( $request ) {
	$token = get_transient( 'focalscore_verify_token' );
	if ( ! is_string( $token ) || '' === $token ) {
		$response = new WP_REST_Response( null, 404 );
	} else {
		$challenge = (string) $request->get_param( 'challenge' );
		$response  = new WP_REST_Response( array( 'proof' => hash_hmac( 'sha256', $challenge, $token ) ), 200 );
	}
	$response->header( 'Cache-Control', 'no-store' );
	return $response;
}

/**
 * A JSON call to the FocalScore service.
 *
 * @param string     $method GET or POST.
 * @param string     $path   The API path after /api/plugin.
 * @param array|null $body   The JSON body for a POST.
 * @return array{ok: bool, status: int, data: array}
 */
function focalscore_api( $method, $path, $body = null ) {
	$args = array(
		'timeout' => 30,
		'headers' => array(
			'Content-Type' => 'application/json',
			'Accept'       => 'application/json',
		),
	);
	if ( null !== $body ) {
		$args['body'] = wp_json_encode( $body );
	}
	$url      = FOCALSCORE_API . $path;
	$response = 'POST' === $method ? wp_remote_post( $url, $args ) : wp_remote_get( $url, $args );
	if ( is_wp_error( $response ) ) {
		return array(
			'ok'     => false,
			'status' => 0,
			'data'   => array( 'error' => __( 'We could not reach FocalScore. Check your connection and try again.', 'focalscore' ) ),
		);
	}
	$status = (int) wp_remote_retrieve_response_code( $response );
	$data   = json_decode( wp_remote_retrieve_body( $response ), true );
	return array(
		'ok'     => $status >= 200 && $status < 300,
		'status' => $status,
		'data'   => is_array( $data ) ? $data : array(),
	);
}

/**
 * The form's handler: no consent, no scan. Only then are the site's address
 * and the email sent, and only to FocalScore.
 */
function focalscore_handle_scan() {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You are not allowed to do that.', 'focalscore' ) );
	}
	check_admin_referer( 'focalscore_scan' );
	$back = admin_url( 'tools.php?page=focalscore' );

	$consent = isset( $_POST['focalscore_consent'] ) && '1' === sanitize_text_field( wp_unslash( $_POST['focalscore_consent'] ) );
	if ( ! $consent ) {
		// The founder's rule: without the box ticked, nothing is sent.
		focalscore_notice( 'error', __( 'Tick the box to agree before scanning. Nothing was sent to FocalScore.', 'focalscore' ) );
		wp_safe_redirect( $back );
		exit;
	}
	$email = isset( $_POST['focalscore_email'] ) ? sanitize_email( wp_unslash( $_POST['focalscore_email'] ) ) : '';
	if ( ! is_email( $email ) ) {
		focalscore_notice( 'error', __( 'Enter a valid email for your report. Nothing was sent to FocalScore.', 'focalscore' ) );
		wp_safe_redirect( $back );
		exit;
	}

	$given = gmdate( 'c' );
	update_option(
		'focalscore_consent',
		array(
			'version' => FOCALSCORE_CONSENT_VERSION,
			'at'      => $given,
			'email'   => $email,
		),
		false
	);

	$start = focalscore_api(
		'POST',
		'/start',
		array(
			'site'    => home_url( '/' ),
			'email'   => $email,
			'consent' => array(
				'given'   => true,
				'version' => FOCALSCORE_CONSENT_VERSION,
				'at'      => $given,
			),
			'plugin'  => FOCALSCORE_VERSION,
		)
	);
	if ( ! $start['ok'] || empty( $start['data']['token'] ) ) {
		focalscore_notice( 'error', focalscore_error_text( $start ) );
		wp_safe_redirect( $back );
		exit;
	}

	// Hold the one-time token privately while FocalScore checks (focalscore_rest_verify answers its challenge), then drop it.
	set_transient( 'focalscore_verify_token', sanitize_text_field( $start['data']['token'] ), 5 * MINUTE_IN_SECONDS );
	$verify = focalscore_api( 'POST', '/verify', array( 'token' => $start['data']['token'] ) );
	delete_transient( 'focalscore_verify_token' );
	if ( ! $verify['ok'] || empty( $verify['data']['scanId'] ) ) {
		focalscore_notice( 'error', focalscore_error_text( $verify ) );
		wp_safe_redirect( $back );
		exit;
	}

	update_option(
		'focalscore_scan',
		array(
			'id'          => sanitize_text_field( $verify['data']['scanId'] ),
			'key'         => sanitize_text_field( $verify['data']['key'] ),
			'unsubscribe' => isset( $verify['data']['unsubscribe'] ) ? sanitize_text_field( $verify['data']['unsubscribe'] ) : '',
			'email'       => $email,
			'at'          => $given,
		),
		false
	);
	delete_transient( 'focalscore_result' );
	wp_safe_redirect( $back );
	exit;
}
add_action( 'admin_post_focalscore_scan', 'focalscore_handle_scan' );

/**
 * Forget the scan and the consent: the plugin sends nothing more until the box is ticked again.
 */
function focalscore_handle_forget() {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You are not allowed to do that.', 'focalscore' ) );
	}
	check_admin_referer( 'focalscore_forget' );
	delete_option( 'focalscore_consent' );
	delete_option( 'focalscore_scan' );
	delete_transient( 'focalscore_result' );
	focalscore_notice( 'success', __( 'Cleared from WordPress. The plugin will send nothing to FocalScore until you agree and scan again. This did not change anything at FocalScore.', 'focalscore' ) );
	wp_safe_redirect( admin_url( 'tools.php?page=focalscore' ) );
	exit;
}
add_action( 'admin_post_focalscore_forget', 'focalscore_handle_forget' );

/**
 * Stop marketing emails: tell FocalScore, and say "done" only when it confirms.
 */
function focalscore_handle_unsubscribe() {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You are not allowed to do that.', 'focalscore' ) );
	}
	check_admin_referer( 'focalscore_unsubscribe' );
	$scan = get_option( 'focalscore_scan' );
	if ( is_array( $scan ) && ! empty( $scan['unsubscribe'] ) ) {
		$res = focalscore_api( 'POST', '/unsubscribe', array( 'token' => $scan['unsubscribe'] ) );
		if ( $res['ok'] ) {
			focalscore_notice( 'success', __( 'Done. FocalScore will send no more tips or offers to this email. Your report stays available.', 'focalscore' ) );
		} else {
			focalscore_notice( 'error', focalscore_error_text( $res ) );
		}
	}
	wp_safe_redirect( admin_url( 'tools.php?page=focalscore' ) );
	exit;
}
add_action( 'admin_post_focalscore_unsubscribe', 'focalscore_handle_unsubscribe' );

/**
 * A message for the next page load.
 *
 * @param string $type    success or error.
 * @param string $message The text.
 */
function focalscore_notice( $type, $message ) {
	set_transient(
		'focalscore_notice_' . get_current_user_id(),
		array(
			'type'    => $type,
			'message' => $message,
		),
		MINUTE_IN_SECONDS
	);
}

/**
 * The service's own words for a refusal, or a plain fallback.
 *
 * @param array $res A focalscore_api() result.
 * @return string
 */
function focalscore_error_text( $res ) {
	if ( ! empty( $res['data']['error'] ) && is_string( $res['data']['error'] ) ) {
		return $res['data']['error'];
	}
	return __( 'FocalScore could not start the scan. Try again in a minute.', 'focalscore' );
}

/**
 * The scan's summary from FocalScore: cached briefly while it runs, kept once done.
 *
 * @param array $scan The saved scan (id and key).
 * @return array
 */
function focalscore_result( $scan ) {
	$cached = get_transient( 'focalscore_result' );
	if ( is_array( $cached ) && isset( $cached['id'] ) && $cached['id'] === $scan['id'] ) {
		return $cached['data'];
	}
	$res  = focalscore_api( 'GET', '/result?scan=' . rawurlencode( $scan['id'] ) . '&key=' . rawurlencode( $scan['key'] ) );
	$data = $res['ok'] ? $res['data'] : array( 'status' => 'unavailable' );
	$keep = ( isset( $data['status'] ) && 'done' === $data['status'] ) ? DAY_IN_SECONDS : 15;
	set_transient(
		'focalscore_result',
		array(
			'id'   => $scan['id'],
			'data' => $data,
		),
		$keep
	);
	return $data;
}

/**
 * The plugin's page.
 */
function focalscore_render_page() {
	if ( ! current_user_can( 'manage_options' ) ) {
		return;
	}
	$scan    = get_option( 'focalscore_scan' );
	$consent = get_option( 'focalscore_consent' );
	$email   = is_array( $consent ) && ! empty( $consent['email'] ) ? $consent['email'] : get_option( 'admin_email' );
	$notice  = get_transient( 'focalscore_notice_' . get_current_user_id() );
	delete_transient( 'focalscore_notice_' . get_current_user_id() );
	$site = wp_parse_url( home_url( '/' ), PHP_URL_HOST );
	?>
	<div class="wrap focalscore">
		<h1><?php esc_html_e( 'FocalScore', 'focalscore' ); ?></h1>

		<?php if ( is_array( $notice ) ) : ?>
			<div class="notice notice-<?php echo 'success' === $notice['type'] ? 'success' : 'error'; ?>"><p><?php echo esc_html( $notice['message'] ); ?></p></div>
		<?php endif; ?>

		<?php
		if ( is_array( $scan ) && ! empty( $scan['id'] ) ) {
			focalscore_render_result( $scan );
		}
		?>

		<div class="focalscore-card">
			<h2><?php echo esc_html( is_array( $scan ) ? __( 'Scan again', 'focalscore' ) : __( 'Check this website with FocalScore', 'focalscore' ) ); ?></h2>
			<p><?php esc_html_e( 'FocalScore checks up to 25 pages of your site against 396 checks: what stops visitors becoming customers, what Google and AI assistants see, speed, security and accessibility. You get a score and every fix, free.', 'focalscore' ); ?></p>
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="focalscore-form">
				<input type="hidden" name="action" value="focalscore_scan" />
				<?php wp_nonce_field( 'focalscore_scan' ); ?>
				<p>
					<label for="focalscore_email"><strong><?php esc_html_e( 'Email for your report', 'focalscore' ); ?></strong></label><br />
					<input type="email" id="focalscore_email" name="focalscore_email" class="regular-text" value="<?php echo esc_attr( $email ); ?>" required />
				</p>
				<p class="focalscore-consent">
					<label>
						<input type="checkbox" id="focalscore_consent" name="focalscore_consent" value="1" />
						<strong><?php esc_html_e( "I'm authorised to scan this site and I control this email address.", 'focalscore' ); ?></strong>
						<?php esc_html_e( "Send the site's address and my email to FocalScore (Astrolabix LLC) to run the scan and email my report. FocalScore will also email me website tips and offers for its paid services: three emails in the first week, then about weekly; I can unsubscribe anytime and keep my free report. Where the law requires it (for example in the EU, UK and Canada), FocalScore asks me separately before sending tips and offers.", 'focalscore' ); ?>
						<?php
						echo wp_kses(
							sprintf(
								/* translators: %s: link to the Terms of Service */
								__( 'I agree to the %s.', 'focalscore' ),
								'<a href="https://focalscore.com/terms" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Terms of Service', 'focalscore' ) . '</a>'
							),
							array(
								'a' => array(
									'href'   => array(),
									'target' => array(),
									'rel'    => array(),
								),
							)
						);
						?>
						<a href="https://focalscore.com/privacy#wordpress-plugin" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Privacy policy', 'focalscore' ); ?></a>
					</label>
				</p>
				<p class="focalscore-hint focalscore-sender"><?php esc_html_e( 'FocalScore · Astrolabix LLC, 30 N Gould St STE R, Sheridan, WY 82801, USA · info@focalscore.com', 'focalscore' ); ?></p>
				<p class="focalscore-hint"><?php esc_html_e( 'These choices are about the scan and email only. Analytics and advertising on focalscore.com are a separate choice you make there.', 'focalscore' ); ?></p>
				<p>
					<button type="submit" id="focalscore_scan" class="button button-primary" disabled>
						<?php
						/* translators: %s: this site's domain */
						echo esc_html( sprintf( __( 'Scan %s', 'focalscore' ), $site ) );
						?>
					</button>
					<span class="focalscore-hint"><?php esc_html_e( 'Tick the box to scan. Nothing is sent until you do.', 'focalscore' ); ?></span>
				</p>
			</form>
		</div>

		<?php if ( is_array( $consent ) || is_array( $scan ) ) : ?>
			<div class="focalscore-controls">
				<?php if ( is_array( $scan ) && ! empty( $scan['unsubscribe'] ) ) : ?>
					<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
						<input type="hidden" name="action" value="focalscore_unsubscribe" />
						<?php wp_nonce_field( 'focalscore_unsubscribe' ); ?>
						<button type="submit" class="button-link"><?php esc_html_e( 'Stop marketing emails', 'focalscore' ); ?></button>
						<span class="focalscore-hint"><?php esc_html_e( 'Tells FocalScore to stop sending tips and offers to this email. Your report stays available.', 'focalscore' ); ?></span>
					</form>
				<?php endif; ?>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
					<input type="hidden" name="action" value="focalscore_forget" />
					<?php wp_nonce_field( 'focalscore_forget' ); ?>
					<button type="submit" class="button-link"><?php esc_html_e( 'Clear this scan from WordPress', 'focalscore' ); ?></button>
					<span class="focalscore-hint"><?php esc_html_e( "Removes what this plugin saved on your site. It doesn't change anything at FocalScore.", 'focalscore' ); ?></span>
				</form>
				<p class="focalscore-hint">
					<?php
					printf(
						/* translators: %s: FocalScore's email address */
						esc_html__( 'To delete what FocalScore holds about you, email %s.', 'focalscore' ),
						'<a href="mailto:info@focalscore.com">info@focalscore.com</a>'
					);
					?>
				</p>
			</div>
		<?php endif; ?>
	</div>
	<?php
}

/**
 * The scan's summary: the score, the three biggest fixes, and the way to the full report.
 *
 * @param array $scan The saved scan.
 */
function focalscore_render_result( $scan ) {
	$r      = focalscore_result( $scan );
	$status = isset( $r['status'] ) ? $r['status'] : 'unavailable';
	echo '<div class="focalscore-card focalscore-result" data-status="' . esc_attr( $status ) . '">';
	if ( 'running' === $status ) {
		echo '<h2>' . esc_html__( 'Scanning your site…', 'focalscore' ) . '</h2>';
		echo '<p>' . esc_html__( 'This usually takes a few minutes. This page refreshes on its own; you can also leave it and come back.', 'focalscore' ) . '</p>';
	} elseif ( 'done' === $status ) {
		$score = isset( $r['score'] ) && null !== $r['score'] ? (int) $r['score'] : null;
		echo '<div class="focalscore-score">';
		if ( null !== $score ) {
			echo '<span class="focalscore-num">' . esc_html( (string) $score ) . '</span><span class="focalscore-of">/100</span>';
			if ( ! empty( $r['grade'] ) ) {
				/* translators: %s: letter grade */
				echo '<span class="focalscore-grade">' . esc_html( sprintf( __( 'Grade %s', 'focalscore' ), $r['grade'] ) ) . '</span>';
			}
		} else {
			echo '<span class="focalscore-grade">' . esc_html__( 'No score this time: your site turned our scanner away. The emailed report explains what to do.', 'focalscore' ) . '</span>';
		}
		echo '</div>';
		if ( ! empty( $r['top'] ) && is_array( $r['top'] ) ) {
			echo '<h3>' . esc_html__( 'Do these first', 'focalscore' ) . '</h3><ol class="focalscore-top">';
			foreach ( $r['top'] as $row ) {
				$name = isset( $row['name'] ) ? $row['name'] : '';
				$pts  = isset( $row['points'] ) && null !== $row['points'] ? ' (+' . number_format_i18n( (float) $row['points'], 1 ) . ' ' . __( 'points', 'focalscore' ) . ')' : '';
				echo '<li>' . esc_html( $name . $pts ) . '</li>';
			}
			echo '</ol>';
		}
		echo '<p><strong>' . esc_html__( 'Your full report, with every fix, is in your inbox.', 'focalscore' ) . '</strong> ';
		/* translators: %s: the email the report was sent to */
		echo esc_html( sprintf( __( 'Confirm the email we sent to %s to open it.', 'focalscore' ), $scan['email'] ) ) . '</p>';
		if ( ! empty( $r['reportUrl'] ) ) {
			echo '<p><a class="button" href="' . esc_url( $r['reportUrl'] ) . '" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Open the report', 'focalscore' ) . '</a></p>';
		}
		echo '<p class="focalscore-upsell">' . esc_html__( 'Want to know what ChatGPT says about your business? The AI Advanced Report is $49.', 'focalscore' ) . ' ';
		if ( ! empty( $r['reportUrl'] ) ) {
			echo '<a href="' . esc_url( $r['reportUrl'] . '#ai-offer' ) . '" target="_blank" rel="noopener noreferrer">' . esc_html__( 'See what it includes', 'focalscore' ) . '</a>';
		}
		echo '</p>';
		if ( null !== $score ) {
			echo '<p class="focalscore-review">' . esc_html__( 'Found this useful?', 'focalscore' ) . ' <a href="' . esc_url( 'https://wordpress.org/support/plugin/focalscore/reviews/#new-post' ) . '" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Leave a review on WordPress.org', 'focalscore' ) . '</a></p>';
		}
	} elseif ( 'failed' === $status ) {
		echo '<h2>' . esc_html__( 'The scan could not finish', 'focalscore' ) . '</h2>';
		echo '<p>' . esc_html( isset( $r['error'] ) ? $r['error'] : __( 'Try again later.', 'focalscore' ) ) . '</p>';
	} else {
		echo '<p>' . esc_html__( 'We could not read the scan from FocalScore just now. Reload this page in a minute.', 'focalscore' ) . '</p>';
	}
	echo '</div>';
}