<?php
/**
 * Integrity scan page.
 */
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

global $wpdb;
$guardforge_table = $wpdb->prefix . 'guardforge_integrity';

$guardforge_last_scan_id = (int) get_option( GUARDFORGE_Integrity::SCAN_ID_OPTION, 0 );
// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- plugin-owned table ($wpdb->prefix + a literal) that no WordPress API reads; every value is a prepare placeholder or a fragment prepared on its own.
$guardforge_file_total        = (int) $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$guardforge_table} WHERE scan_id = %d", $guardforge_last_scan_id ) );
$guardforge_last         = GUARDFORGE_Options::get( 'integrity_last_scan' );
$guardforge_scanned      = isset( $_GET['scanned'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only: a result our own redirect carries back from a nonce-checked action; it is only printed, escaped.
$guardforge_changed      = ( isset( $_GET['changed'] ) ? absint( wp_unslash( $_GET['changed'] ) ) : 0 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only: a result our own redirect carries back from a nonce-checked action; it is only printed, escaped.
$guardforge_removed      = ( isset( $_GET['removed'] ) ? absint( wp_unslash( $_GET['removed'] ) ) : 0 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only: a result our own redirect carries back from a nonce-checked action; it is only printed, escaped.
// phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- plugin-owned table ($wpdb->prefix + a literal) that no WordPress API reads; every value is a prepare placeholder or a fragment prepared on its own.
$guardforge_rows         = $guardforge_last_scan_id ? $wpdb->get_results( $wpdb->prepare(
    "SELECT * FROM {$guardforge_table} WHERE scan_id = %d ORDER BY file_path ASC LIMIT 200",
    $guardforge_last_scan_id
) ) : [];
// phpcs:enable PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared

// What the last scan actually flagged. The 200-row table further down is every
// file that was verified, and deliberately gets no buttons: an unchanged file
// has nothing to explain, and two hundred spend controls on one screen is a
// trap rather than a feature.
$guardforge_summary   = (array) get_option( GUARDFORGE_Integrity::LAST_RESULT_OPTION, [] );
$guardforge_explainer = class_exists( 'GUARDFORGE_Event_Explainer' ) ? GUARDFORGE_Event_Explainer::instance() : null;
$guardforge_findings  = $guardforge_explainer ? $guardforge_explainer->scan_findings() : [];
if ( $guardforge_explainer ) {
    $guardforge_explainer->prime( $guardforge_findings );
}

// What the published hashes made of the last scan. Every class is present at
// nought, so nothing below has to test for a key.
$guardforge_classes  = array_merge( GUARDFORGE_Integrity::empty_counts(), (array) ( $guardforge_summary['classes'] ?? [] ) );
$guardforge_flagged  = (array) ( $guardforge_summary['flagged'] ?? [] );
$guardforge_shown    = count( $guardforge_flagged );
$guardforge_total    = (int) ( $guardforge_summary['flagged_total'] ?? $guardforge_shown );
$guardforge_scopes   = (array) ( $guardforge_summary['unreferenced'] ?? [] );
$guardforge_queued   = (array) ( $guardforge_summary['queued'] ?? [] );
$guardforge_restored = isset( $_GET['restored'] ) ? absint( wp_unslash( $_GET['restored'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only: a result our own redirect carries back from a nonce-checked action; it is only printed, escaped.
$guardforge_reason   = isset( $_GET['reason'] ) ? sanitize_text_field( wp_unslash( $_GET['reason'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only: a result our own redirect carries back from a nonce-checked action; it is only printed, escaped.
$guardforge_file     = isset( $_GET['file'] ) ? sanitize_text_field( wp_unslash( $_GET['file'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only: a result our own redirect carries back from a nonce-checked action; it is only printed, escaped.
$guardforge_unexpected  = ( isset( $_GET['unexpected'] ) ? absint( wp_unslash( $_GET['unexpected'] ) ) : 0 ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only: a result our own redirect carries back from a nonce-checked action; it is only printed, escaped.

$guardforge_class_label = [
    'official'     => __( 'Official', 'guardforge' ),
    'modified'     => __( 'Modified', 'guardforge' ),
    'unexpected'   => __( 'Not in the official build', 'guardforge' ),
    'missing'      => __( 'Missing', 'guardforge' ),
    'unreferenced' => __( 'No reference', 'guardforge' ),
];
?>
<div class="wrap">
    <?php GUARDFORGE_Admin_Header::render( __( 'File integrity', 'guardforge' ), __( 'Every file checked against the hashes wordpress.org publishes', 'guardforge' ) ); ?>

    <?php if ( $guardforge_explainer ) { GUARDFORGE_Event_Explainer::render_notice(); } ?>

    <?php if ( $guardforge_restored === 1 ) : ?>
        <div class="gf-notice gf-notice-ok">
            ✓ <?php
            /* translators: %s is the path of the file that was put back. */
            printf( esc_html__( '%s was replaced with the copy wordpress.org publishes. The old one is kept under uploads.', 'guardforge' ), '<code>' . esc_html( $guardforge_file ) . '</code>' );
            ?>
        </div>
    <?php elseif ( $guardforge_restored === 0 ) : ?>
        <div class="gf-notice gf-notice-warn">
            ⚠ <?php
            esc_html_e( 'Nothing was changed.', 'guardforge' );
            echo ' ';
            switch ( $guardforge_reason ) {
                case 'gf_restore_hash':
                    esc_html_e( 'What was downloaded did not match the official checksum, so it was thrown away.', 'guardforge' );
                    break;
                case 'gf_restore_unwritable':
                    esc_html_e( 'That file, or the directory holding it, is not writable by WordPress.', 'guardforge' );
                    break;
                case 'gf_restore_download':
                    esc_html_e( 'The original could not be downloaded from wordpress.org.', 'guardforge' );
                    break;
                case 'gf_restore_backup':
                    esc_html_e( 'The file being replaced could not be copied aside, and a restore that destroys the evidence is not worth having.', 'guardforge' );
                    break;
                default:
                    esc_html_e( 'That file is not one wordpress.org lists for this version.', 'guardforge' );
            }
            ?>
        </div>
    <?php endif; ?>

    <?php if ( $guardforge_scanned ) : ?>
        <div class="gf-notice <?php echo ( $guardforge_changed || $guardforge_removed || $guardforge_unexpected ) ? 'gf-notice-warn' : 'gf-notice-ok'; ?>">
            <?php if ( $guardforge_unexpected ) : ?>
                ⚠ <?php
                /* translators: %d is the number of files found that are not in the official build. */
                printf( esc_html( _n( 'Scan finished — %d file is not in the official build.', 'Scan finished — %d files are not in the official build.', $guardforge_unexpected, 'guardforge' ) ), (int) $guardforge_unexpected );
                ?>
            <?php elseif ( $guardforge_changed || $guardforge_removed ) : ?>
                ⚠ <?php
                /* translators: %1$d is the number of changed files, %2$d is the number of removed files. */
                printf( esc_html__( 'Scan finished — %1$d changed, %2$d removed files detected.', 'guardforge' ), (int) $guardforge_changed, (int) $guardforge_removed );
                ?>
            <?php else : ?>
                ✓ <?php esc_html_e( 'Scan finished — no changes detected.', 'guardforge' ); ?>
            <?php endif; ?>
        </div>
    <?php endif; ?>

    <div class="gf-stats">
        <div class="gf-stat">
            <div class="gf-stat-val"><?php echo esc_html( $guardforge_file_total ); ?></div>
            <div class="gf-stat-lbl"><?php esc_html_e( 'Files tracked', 'guardforge' ); ?></div>
        </div>
        <div class="gf-stat">
            <div class="gf-stat-val" style="font-size:15px;padding-top:9px"><?php echo $guardforge_last ? esc_html( $guardforge_last ) : '—'; ?></div>
            <div class="gf-stat-lbl"><?php esc_html_e( 'Last scan', 'guardforge' ); ?></div>
        </div>
        <div class="gf-stat">
            <div class="gf-stat-val"><?php esc_html_e( 'Daily', 'guardforge' ); ?></div>
            <div class="gf-stat-lbl"><?php esc_html_e( 'Cron cadence', 'guardforge' ); ?></div>
        </div>
    </div>

    <div class="gf-card" style="margin-bottom:24px">
        <div class="gf-card-head"><span class="dashicons dashicons-shield"></span><h3><?php esc_html_e( 'Against the official checksums', 'guardforge' ); ?></h3></div>
        <div style="padding:16px 18px">
            <?php if ( ! $guardforge_summary ) : ?>
                <p style="margin:0;color:var(--text-muted)"><?php esc_html_e( 'No scan has run yet. The first one builds the baseline and asks wordpress.org what this WordPress is supposed to contain.', 'guardforge' ); ?></p>
            <?php else : ?>
                <div class="gf-stats" style="margin-bottom:0">
                    <?php foreach ( $guardforge_class_label as $guardforge_key => $guardforge_label ) : ?>
                        <div class="gf-stat">
                            <div class="gf-stat-val" style="<?php echo $guardforge_key === 'unexpected' && $guardforge_classes['unexpected'] > 0 ? 'color:var(--status-error)' : ''; ?>"><?php echo esc_html( (string) (int) $guardforge_classes[ $guardforge_key ] ); ?></div>
                            <div class="gf-stat-lbl"><?php echo esc_html( $guardforge_label ); ?></div>
                        </div>
                    <?php endforeach; ?>
                </div>
                <p style="margin:14px 0 0;font-size:12px;color:var(--text-muted)">
                    <?php esc_html_e( 'WordPress publishes a hash for every file of core and of every plugin it hosts. "Not in the official build" means a file nobody published is sitting in that directory — which is what a backdoor looks like from here. "No reference" means nothing was checked: nobody publishes hashes for themes, or for a plugin that is premium, custom, or not on wordpress.org.', 'guardforge' ); ?>
                </p>
                <?php if ( ! empty( $guardforge_scopes['theme'] ) || ! empty( $guardforge_scopes['plugin'] ) || $guardforge_queued ) : ?>
                    <p style="margin:8px 0 0;font-size:12px;color:var(--text-muted)">
                        <?php if ( ! empty( $guardforge_scopes['theme'] ) ) : ?>
                            <?php
                            /* translators: %d is the number of theme files compared against the previous scan instead of a published hash. */
                            printf( esc_html__( 'Themes stay on the snapshot comparison — %d file(s) here.', 'guardforge' ), (int) $guardforge_scopes['theme'] );
                            ?>
                        <?php endif; ?>
                        <?php if ( $guardforge_queued ) : ?>
                            <?php
                            /* translators: %s is a comma-separated list of plugin folder names. */
                            printf( esc_html__( 'Still waiting for a reference, and queued for the next scan: %s.', 'guardforge' ), '<code>' . esc_html( implode( ', ', array_map( 'strval', $guardforge_queued ) ) ) . '</code>' );
                            ?>
                        <?php endif; ?>
                    </p>
                <?php endif; ?>
            <?php endif; ?>
        </div>

        <?php if ( $guardforge_flagged ) : ?>
        <div class="gf-table-wrap">
            <table class="gf-table">
                <thead><tr>
                    <th><?php esc_html_e( 'File', 'guardforge' ); ?></th>
                    <th><?php esc_html_e( 'Verdict', 'guardforge' ); ?></th>
                    <th><?php esc_html_e( 'Scope', 'guardforge' ); ?></th>
                    <th></th>
                </tr></thead>
                <tbody>
                <?php foreach ( $guardforge_flagged as $guardforge_row ) :
                    $guardforge_path  = (string) ( $guardforge_row['path'] ?? '' );
                    $guardforge_verd  = (string) ( $guardforge_row['class'] ?? '' );
                    $guardforge_scope = (string) ( $guardforge_row['scope'] ?? '' );
                    ?>
                    <tr>
                        <td class="gf-mono" style="word-break:break-all"><?php echo esc_html( $guardforge_path ); ?></td>
                        <td style="<?php echo 'unexpected' === $guardforge_verd ? 'color:var(--status-error);font-weight:600' : ''; ?>">
                            <?php echo esc_html( $guardforge_class_label[ $guardforge_verd ] ?? $guardforge_verd ); ?>
                        </td>
                        <td><?php echo esc_html( $guardforge_scope ); ?></td>
                        <td style="white-space:nowrap">
                            <?php if ( class_exists( 'GUARDFORGE_Core_Restore' ) && 'core' === $guardforge_scope && ( 'modified' === $guardforge_verd || 'missing' === $guardforge_verd ) ) : ?>
                                <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="margin:0">
                                    <?php wp_nonce_field( GUARDFORGE_Core_Restore::ACTION ); ?>
                                    <input type="hidden" name="action" value="<?php echo esc_attr( GUARDFORGE_Core_Restore::ACTION ); ?>" />
                                    <input type="hidden" name="file" value="<?php echo esc_attr( $guardforge_path ); ?>" />
                                    <button type="submit" class="button button-small"><?php esc_html_e( 'Restore from wordpress.org', 'guardforge' ); ?></button>
                                </form>
                            <?php elseif ( 'core' === $guardforge_scope && ( 'modified' === $guardforge_verd || 'missing' === $guardforge_verd ) ) : ?>
                                <span style="font-size:11px;color:var(--text-muted)">
                                    <?php
                                    printf(
                                        /* translators: %s is a link to the WordPress Updates screen. */
                                        esc_html__( 'Put core files back by re-installing WordPress from %s.', 'guardforge' ),
                                        '<a href="' . esc_url( admin_url( 'update-core.php' ) ) . '">' . esc_html__( 'Dashboard → Updates', 'guardforge' ) . '</a>'
                                    );
                                    ?>
                                </span>
                            <?php elseif ( 'plugin' === $guardforge_scope ) : ?>
                                <span style="font-size:11px;color:var(--text-muted)">
                                    <?php
                                    printf(
                                        /* translators: %s is a link to the Plugins screen. */
                                        esc_html__( 'Reinstall it from %s — one file put back on its own can leave a half-updated plugin.', 'guardforge' ),
                                        '<a href="' . esc_url( admin_url( 'plugins.php' ) ) . '">' . esc_html__( 'Plugins', 'guardforge' ) . '</a>'
                                    );
                                    ?>
                                </span>
                            <?php endif; ?>
                        </td>
                    </tr>
                <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php if ( $guardforge_total > $guardforge_shown ) : ?>
            <div style="padding:10px 14px;font-size:11px;color:var(--text-muted);border-top:1px solid #F4F4F5">
                <?php
                /* translators: 1: number of files listed here, 2: total number of files the checksums flagged. */
                printf( esc_html__( 'Showing the %1$d most serious of %2$d.', 'guardforge' ), (int) $guardforge_shown, (int) $guardforge_total );
                ?>
            </div>
        <?php endif; ?>
        <?php elseif ( $guardforge_summary ) : ?>
            <div style="padding:0 18px 16px;font-size:12px;color:var(--text-muted)">
                <?php esc_html_e( 'Nothing was flagged: every file that could be checked matched what wordpress.org published.', 'guardforge' ); ?>
            </div>
        <?php endif; ?>
    </div>

    <?php if ( $guardforge_findings ) : ?>
    <div class="gf-card" style="margin-bottom:24px">
        <div class="gf-card-head"><span class="dashicons dashicons-warning"></span><h3><?php esc_html_e( 'What changed in the last scan', 'guardforge' ); ?></h3></div>
        <div class="gf-table-wrap">
            <table class="gf-table">
                <thead><tr>
                    <th><?php esc_html_e( 'File', 'guardforge' ); ?></th>
                    <th><?php esc_html_e( 'Change', 'guardforge' ); ?></th>
                    <th></th>
                </tr></thead>
                <tbody>
                <?php foreach ( $guardforge_findings as $guardforge_relative => $guardforge_event ) : ?>
                    <tr>
                        <td class="gf-mono" style="word-break:break-all"><?php echo esc_html( $guardforge_relative ); ?></td>
                        <td><?php
                            echo $guardforge_event['change'] === 'removed'
                                ? esc_html__( 'Removed', 'guardforge' )
                                : esc_html__( 'Modified', 'guardforge' );
                        ?></td>
                        <td style="white-space:nowrap"><?php if ( $guardforge_explainer ) { $guardforge_explainer->render_control( 'integrity', $guardforge_event ); } ?></td>
                    </tr>
                    <?php if ( $guardforge_explainer ) { $guardforge_explainer->render_explanation_row( $guardforge_event, 3 ); } ?>
                <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php
        $guardforge_listed  = count( $guardforge_findings );
        $guardforge_flagged = (int) ( $guardforge_summary['changed'] ?? 0 ) + (int) ( $guardforge_summary['removed'] ?? 0 );
        if ( $guardforge_flagged > $guardforge_listed ) : ?>
            <div style="padding:10px 14px;font-size:11px;color:var(--text-muted);border-top:1px solid #F4F4F5">
                <?php
                /* translators: 1: number of files listed here, 2: total number of files the scan flagged. */
                printf( esc_html__( 'Showing %1$d of %2$d flagged files.', 'guardforge' ), (int) $guardforge_listed, (int) $guardforge_flagged );
                ?>
            </div>
        <?php endif; ?>
        <?php // Text, never a disabled control: the batch is not on this disk,
              // so there is nothing here to switch on. ?>
        <?php if ( ! GUARDFORGE_Pro_Bridge::feature_available( 'ai_threat', 'GUARDFORGE_Ai_Threat' ) ) : ?>
            <div style="padding:10px 14px;font-size:12px;color:var(--text-muted);border-top:1px solid #F4F4F5">
                <?php esc_html_e( 'GuardForge Pro reads every event automatically, once an hour, instead of one at a time.', 'guardforge' ); ?>
                <?php GUARDFORGE_Pro_Bridge::feature_notice( 'ai_threat' ); ?>
            </div>
        <?php elseif ( class_exists( 'GUARDFORGE_Ai_Threat' ) ) : ?>
            <?php // The add-on draws its own opt-in: the batch is metered and must be asked for. ?>
            <?php GUARDFORGE_Ai_Threat::instance()->render_settings_card(); ?>
        <?php endif; ?>
    </div>
    <?php endif; ?>

    <div class="gf-card" style="margin-bottom:24px">
        <div class="gf-card-head"><span class="dashicons dashicons-update"></span><h3><?php esc_html_e( 'Manual scan', 'guardforge' ); ?></h3></div>
        <div style="padding:16px 18px;display:flex;gap:14px;align-items:center;flex-wrap:wrap">
            <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
                <?php wp_nonce_field( 'guardforge_run_integrity' ); ?>
                <input type="hidden" name="action" value="guardforge_run_integrity" />
                <button type="submit" class="button button-primary gf-btn-primary"><?php esc_html_e( 'Run scan now', 'guardforge' ); ?></button>
            </form>
            <span style="font-size:12px;color:var(--text-muted)">
                <?php esc_html_e( 'First run builds the baseline. Subsequent runs compare against the previous snapshot.', 'guardforge' ); ?>
            </span>
        </div>
    </div>

    <div class="gf-card">
        <div class="gf-card-head"><span class="dashicons dashicons-media-code"></span><h3><?php esc_html_e( 'Last verified files', 'guardforge' ); ?></h3></div>
        <div class="gf-table-wrap">
        <?php if ( empty( $guardforge_rows ) ) : ?>
            <div style="padding:28px;text-align:center;color:var(--text-muted)"><?php esc_html_e( 'No data yet. Run the scan above to create a baseline.', 'guardforge' ); ?></div>
        <?php else : ?>
            <table class="gf-table">
                <thead><tr>
                    <th><?php esc_html_e( 'File', 'guardforge' ); ?></th>
                    <th><?php esc_html_e( 'Scope', 'guardforge' ); ?></th>
                    <th><?php esc_html_e( 'SHA-256', 'guardforge' ); ?></th>
                    <th><?php esc_html_e( 'Verified', 'guardforge' ); ?></th>
                </tr></thead>
                <tbody>
                <?php foreach ( $guardforge_rows as $guardforge_file_row ) : ?>
                    <tr>
                        <td class="gf-mono" style="word-break:break-all"><?php echo esc_html( str_replace( ABSPATH, '', $guardforge_file_row->file_path ) ); ?></td>
                        <td><?php echo esc_html( $guardforge_file_row->scope ); ?></td>
                        <td class="gf-mono" style="color:var(--text-muted)"><?php echo esc_html( substr( $guardforge_file_row->file_hash, 0, 20 ) ) . '…'; ?></td>
                        <td style="white-space:nowrap;color:var(--text-muted)"><?php echo esc_html( $guardforge_file_row->scanned_at ); ?></td>
                    </tr>
                <?php endforeach; ?>
                </tbody>
            </table>
            <?php if ( $guardforge_file_total > 200 ) : ?>
                <div style="padding:10px 14px;font-size:11px;color:var(--text-muted);border-top:1px solid #F4F4F5">
                    <?php
                    /* translators: %d is the total number of tracked files. */
                    printf( esc_html__( 'Showing first 200 of %d files.', 'guardforge' ), (int) $guardforge_file_total );
                    ?>
                </div>
            <?php endif; ?>
        <?php endif; ?>
        </div>
    </div>
</div>