<?php
namespace FrontGlut\Core;

defined( 'ABSPATH' ) || exit;

// phpcs:disable WordPress.DB.DirectDatabaseQuery -- queries target the plugin's own prefixed tables (names are constants, values are prepared).

class Audit {

	public static function init() {
		add_action( 'wp_login', function ( $login, $user ) {
			self::log( 'login', $login, '', $user->ID );
		}, 10, 2 );
		add_action( 'wp_login_failed', function ( $login ) {
			self::log( 'login_failed', $login, '', 0 );
		} );
		add_action( 'user_register', function ( $id ) {
			self::log( 'user_register', (string) $id, '', $id );
		} );
		add_action( 'delete_user', function ( $id ) {
			self::log( 'user_deleted', (string) $id );
		} );
		add_action( 'frontglut_daily', array( __CLASS__, 'prune' ) );
	}

	public static function log( $event, $object = '', $details = '', $user_id = null ) {
		global $wpdb;
		if ( null === $user_id ) {
			$user_id = get_current_user_id();
		}
		$wpdb->insert( $wpdb->prefix . 'frontglut_audit', array(
			'user_id' => (int) $user_id,
			'event'   => substr( sanitize_key( $event ), 0, 60 ),
			'object'  => substr( sanitize_text_field( (string) $object ), 0, 120 ),
			'details' => is_scalar( $details ) ? (string) $details : wp_json_encode( $details ),
			'ip'      => self::stored_ip(),
			'created' => current_time( 'mysql', true ),
		) );
	}

	public static function ip() {
		$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
		// Behind a reverse proxy/CDN, hook this filter to return the real client address.
		return (string) apply_filters( 'frontglut_client_ip', $ip );
	}

	/**
	 * IP address as stored in the activity log and on guest submissions: anonymised
	 * (last part removed) unless the admin opted in to full addresses under Settings → General.
	 */
	public static function stored_ip() {
		$ip = self::ip();
		return Settings::get( 'general.audit_full_ip' ) ? $ip : wp_privacy_anonymize_ip( $ip );
	}

	public static function prune() {
		global $wpdb;
		$days = max( 1, (int) Settings::get( 'general.audit_retention', 90 ) );
		$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->prefix}frontglut_audit WHERE created < %s", gmdate( 'Y-m-d H:i:s', time() - $days * DAY_IN_SECONDS ) ) );
	}
}