<?php
/**
 * Vulnerabilities.
 *
 * One screen, two feeds. Which one is behind it is decided by whether the
 * add-on's class is on disk and switched on — pro_feature_available, whose
 * floor is class_exists — and never by asking the licence what the reader
 * bought: from 1.2.1 this screen has real content in the free package, so a
 * licence check here would be a paywall over shipped code (wp.org Guideline 5,
 * and the rejection of 2026-08-03 behind it).
 *
 * The free half says out loud that it is late. A reader who cannot tell a
 * seven-day-old advisory from a live one will believe a clean screen on the
 * day an exploit is published, so the delay is a line at the top and a column
 * in the table, not a footnote.
 */
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

$guardforge_pro_feed = GUARDFORGE_Pro_Bridge::feature_available( 'vuln_db', 'GUARDFORGE_Vuln_Db' );

/*
 * Neither feed on disk. The wp.org build carries no advisory source at all:
 * the only one this plugin ever had is a request to an Avakode server, and
 * that build makes none, so GUARDFORGE_Vuln_Feed is not in it. Say so and
 * stop — everything below this point reads one feed or the other, so
 * continuing would be a fatal, and a "Fetch now" button here would be a
 * control with nothing behind it.
 */
if ( ! $guardforge_pro_feed && ! class_exists( 'GUARDFORGE_Vuln_Feed' ) ) {
    GUARDFORGE_Admin::instance()->render_addon_screen(
        __( 'Vulnerability database', 'guardforge' ),
        __( 'The advisory database is served by GuardForge Pro, a separate add-on. This build carries no advisory source of its own, so there is nothing to list here. File integrity, the audit log and brute-force protection are unaffected.', 'guardforge' ),
        'vuln_db'
    );
    return;
}

// True only for an older add-on that hangs no filter and has no daily event to
// ride on; the refresh card below then asks for a newer add-on.
$guardforge_addon_outdated = false;

if ( $guardforge_pro_feed ) {
    $guardforge_db         = GUARDFORGE_Vuln_Db::instance();
    // The two feeds share a table and each owns a `source`; the count belongs
    // to whichever one is talking. See GUARDFORGE_Vuln_Db::record_count.
    $guardforge_total      = $guardforge_db->record_count();
    // The same never_fetched/stale/failed/clean contract the free feed below
    // uses — see both classes' state. This screen still shows whatever the
    // mirror currently holds (below, with the freshness notice this drives);
    // it is the hardening-score row (register_score_item) that refuses to
    // grade the site on anything short of 'clean'.
    $guardforge_state      = GUARDFORGE_Vuln_Db::state();
    $guardforge_hits       = $guardforge_db->find_matches();
    $guardforge_last_fetch = (string) $guardforge_state['fetched_at'];
    $guardforge_delay_days = 0;
    $guardforge_action     = 'guardforge_vulndb_refresh';
    // The licensed feed carries its own consent: the owner bought and
    // activated a key for it.
    $guardforge_needs_consent = false;
    // Does the add-on keep the database up to date on its own schedule? A
    // current add-on hangs the filter at load and answers it with true while its
    // licence is active and its own switch is on, and leaves false otherwise, so
    // a switched-off add-on takes the daily line off the screen. Asked through the
    // filter and not through GUARDFORGE_Vuln_Feed::pro_updates_feed, which says
    // the same thing: that class is not in the wp.org build, and this is the
    // branch that runs there.
    if ( has_filter( 'guardforge/pro_updates_vuln_db' ) ) {
        $guardforge_daily = (bool) apply_filters( 'guardforge/pro_updates_vuln_db', false );
    } else {
        // An add-on from before the filter (1.2.x) hangs nothing and has no switch
        // or event of its own: it downloads on this plugin's daily event, for as
        // long as that event is on the schedule, and not at all without it. So
        // the schedule is the answer. The event is named as a string, because
        // GUARDFORGE_Vuln_Feed::CRON_HOOK is not in the wp.org build either;
        // class-vuln-db-refresh-note-test.php holds the two names together.
        $guardforge_daily          = (bool) wp_next_scheduled( 'guardforge_vulndb_cron' );
        $guardforge_addon_outdated = ! $guardforge_daily;
    }
} else {
    $guardforge_feed       = GUARDFORGE_Vuln_Feed::instance();
    // find_matches, not refresh_matches: rendering a screen is a GET, and
    // a GET has no business writing an option. The stored match set is
    // refreshed where it can actually change — when a pull lands.
    $guardforge_hits       = $guardforge_feed->find_matches();
    $guardforge_state      = GUARDFORGE_Vuln_Feed::state();
    $guardforge_total      = (int) $guardforge_state['records'];
    $guardforge_last_fetch = (string) $guardforge_state['fetched_at'];
    $guardforge_delay_days = (int) $guardforge_state['delay_days'];
    $guardforge_action     = 'guardforge_vulndb_free_refresh';
    // No switch, no button: the free feed is the one download that reaches an
    // Avakode server, and nothing here may start it before the owner has said
    // yes on the Settings screen.
    $guardforge_needs_consent = ! GUARDFORGE_Vuln_Feed::consent_given();
    // With the download switched on this plugin's own daily event is on the
    // schedule; with it off the button is not drawn at all, so nothing below
    // reads the answer.
    $guardforge_daily = true;
}
/* translators: %1$d is total advisory records, %2$d is records affecting this site. */
$guardforge_subtitle = sprintf( __( '%1$d records · %2$d affecting this site', 'guardforge' ), (int) $guardforge_total, (int) count( $guardforge_hits ) );
?>
<div class="wrap">
    <?php GUARDFORGE_Admin_Header::render( __( 'Vulnerabilities', 'guardforge' ), $guardforge_subtitle ); ?>

    <?php GUARDFORGE_Admin::render_feed_refreshed_notice(); // The notice a "Fetch now" press leaves behind; Settings prints the same one. ?>

    <?php if ( ! $guardforge_pro_feed ) : ?>
        <div class="gf-notice">
            <strong><?php
                printf(
                    /* translators: %d is the number of days the free feed lags behind. */
                    esc_html__( 'This feed is delayed %d days. GuardForge Pro reads the same advisories in real time.', 'guardforge' ),
                    (int) ( $guardforge_delay_days > 0 ? $guardforge_delay_days : GUARDFORGE_Vuln_Feed::DELAY_DAYS_DEFAULT )
                );
            ?></strong>
            <p><?php esc_html_e( 'Every advisory below is public and matched against what is installed here. The publication date of each one is in the table, so you can see how old the news is.', 'guardforge' ); ?></p>
        </div>
        <?php GUARDFORGE_Pro_Bridge::feature_notice( 'vuln_db' ); ?>
    <?php endif; ?>

    <?php if ( $guardforge_state['status'] === 'failed' ) : ?>
        <div class="gf-notice gf-notice-warn"><?php
            printf(
                /* translators: 1: error message from the last fetch, 2: date and time of the last successful fetch. */
                esc_html__( 'The last check did not bring anything back: %1$s The records below are from %2$s.', 'guardforge' ),
                esc_html( $guardforge_state['error'] ),
                esc_html( $guardforge_last_fetch !== '' ? $guardforge_last_fetch : __( 'never', 'guardforge' ) )
            );
        ?></div>
    <?php elseif ( $guardforge_state['status'] === 'never_fetched' ) : ?>
        <div class="gf-notice gf-notice-warn"><?php
            echo esc_html(
                $guardforge_needs_consent
                    ? __( 'This feed has never been downloaded, because the download is switched off. Nothing below can be trusted as a clean result until it has run — turn it on under Settings → Vulnerability database.', 'guardforge' )
                    : __( 'This feed has not completed a first fetch yet. Nothing below can be trusted as a clean result until it has — use "Fetch now" below.', 'guardforge' )
            );
        ?></div>
    <?php elseif ( $guardforge_state['status'] === 'stale' ) : ?>
        <div class="gf-notice gf-notice-warn"><?php
            printf(
                /* translators: %s is the date and time of the last successful fetch. */
                esc_html__( 'The last successful fetch was on %s — longer ago than the daily check is supposed to allow. The records below may not be current.', 'guardforge' ),
                esc_html( $guardforge_last_fetch !== '' ? $guardforge_last_fetch : __( 'never', 'guardforge' ) )
            );
        ?></div>
    <?php endif; ?>

    <div class="gf-stats">
        <div class="gf-stat"><div class="gf-stat-val"><?php echo (int) count( $guardforge_hits ); ?></div><div class="gf-stat-lbl"><?php esc_html_e( 'Open hits', 'guardforge' ); ?></div></div>
        <div class="gf-stat"><div class="gf-stat-val"><?php echo (int) $guardforge_total; ?></div><div class="gf-stat-lbl"><?php esc_html_e( 'Advisory records', 'guardforge' ); ?></div></div>
        <div class="gf-stat"><div class="gf-stat-val" style="font-size:15px;padding-top:9px"><?php echo $guardforge_last_fetch ? esc_html( $guardforge_last_fetch ) : '—'; ?></div><div class="gf-stat-lbl"><?php esc_html_e( 'Last fetch', 'guardforge' ); ?></div></div>
        <?php if ( ! $guardforge_pro_feed ) : ?>
            <div class="gf-stat"><div class="gf-stat-val" style="font-size:15px;padding-top:9px"><?php echo $guardforge_state['generated_at'] ? esc_html( $guardforge_state['generated_at'] ) : '—'; ?></div><div class="gf-stat-lbl"><?php esc_html_e( 'Feed generated', 'guardforge' ); ?></div></div>
        <?php endif; ?>
    </div>

    <div class="gf-card" style="margin-bottom:20px;">
        <div class="gf-card-head"><h3><?php esc_html_e( 'Refresh feed', 'guardforge' ); ?></h3></div>
        <div style="padding:16px 18px;">
            <?php if ( $guardforge_needs_consent ) : ?>
                <p class="description" style="margin:0;">
                    <?php esc_html_e( 'This download is switched off. GuardForge contacts no external server for advisories until you turn it on under Settings → Vulnerability database, where the exact address and what the request carries are spelled out.', 'guardforge' ); ?>
                </p>
                <p style="margin-top:10px;">
                    <a class="button" href="<?php echo esc_url( admin_url( 'admin.php?page=guardforge#gf-card-vulndb' ) ); ?>"><?php esc_html_e( 'Open Settings', 'guardforge' ); ?></a>
                </p>
            <?php else : ?>
                <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
                    <?php wp_nonce_field( $guardforge_action ); ?>
                    <input type="hidden" name="action" value="<?php echo esc_attr( $guardforge_action ); ?>" />
                    <button type="submit" class="button button-primary gf-btn-primary"><?php esc_html_e( 'Fetch now', 'guardforge' ); ?></button>
                </form>
                <p class="description" style="margin-top:8px;"><?php
                    if ( $guardforge_daily ) {
                        $guardforge_daily_line = __( 'Runs automatically every day. Manual fetch here for immediate update.', 'guardforge' );
                    } elseif ( $guardforge_addon_outdated ) {
                        $guardforge_daily_line = __( 'Automatic daily updates need a newer GuardForge Pro (update it under Plugins); until then the database changes only when you press Fetch now.', 'guardforge' );
                    } else {
                        $guardforge_daily_line = __( 'Automatic daily updates are switched off in GuardForge Pro (Daily database update, below); the database changes only when you press Fetch now.', 'guardforge' );
                    }
                    echo esc_html( $guardforge_daily_line );
                ?></p>
            <?php endif; ?>
        </div>
    </div>

    <?php
    /**
 * Where the add-on prints what it does with these rows — the "patch by
 * update" rule's state and its last actions. Nothing on a free-only site,
 * because the rule is not installed there.
 *
 * @param array $hits The advisories affecting this site.
 */
    do_action( 'guardforge/vulndb_screen', $guardforge_hits );
    ?>

    <div class="gf-card">
        <div class="gf-card-head"><h3><?php esc_html_e( 'Affecting this site', 'guardforge' ); ?></h3></div>
        <div class="gf-table-wrap">
            <?php if ( empty( $guardforge_hits ) ) : ?>
                <div style="padding:28px;text-align:center;color:var(--text-muted);"><?php esc_html_e( 'No open vulnerabilities for your installed plugins or themes. Nice.', 'guardforge' ); ?></div>
            <?php else : ?>
                <table class="gf-table">
                    <thead><tr>
                        <th><?php esc_html_e( 'Slug', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'Type', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'Version', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'Affected', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'Fixed in', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'Severity', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'CVE', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'Published', 'guardforge' ); ?></th>
                        <th><?php esc_html_e( 'Summary', 'guardforge' ); ?></th>
                    </tr></thead>
                    <tbody>
                    <?php foreach ( $guardforge_hits as $guardforge_hit ) :
                        $guardforge_color = $guardforge_hit['severity'] === 'critical' ? 'var(--status-error)' : ( $guardforge_hit['severity'] === 'high' ? '#92400E' : 'var(--text-secondary)' );
                    ?>
                        <tr>
                            <td><strong><?php echo esc_html( $guardforge_hit['slug'] ); ?></strong></td>
                            <td><?php echo esc_html( $guardforge_hit['type'] ); ?></td>
                            <td class="gf-mono"><?php echo esc_html( $guardforge_hit['version'] ); ?></td>
                            <td class="gf-mono"><?php echo esc_html( $guardforge_hit['affected_range'] ); ?></td>
                            <td class="gf-mono"><?php echo esc_html( ! empty( $guardforge_hit['patched_in'] ) ? $guardforge_hit['patched_in'] : '—' ); ?></td>
                            <td><strong style="color:<?php echo esc_attr( $guardforge_color ); ?>"><?php echo esc_html( strtoupper( $guardforge_hit['severity'] ) ); ?></strong></td>
                            <td class="gf-mono"><?php echo esc_html( ! empty( $guardforge_hit['cve'] ) ? $guardforge_hit['cve'] : '—' ); ?></td>
                            <td class="gf-mono"><?php echo esc_html( ! empty( $guardforge_hit['published_at'] ) ? substr( (string) $guardforge_hit['published_at'], 0, 10 ) : '—' ); ?></td>
                            <td style="max-width:340px;"><?php echo esc_html( ! empty( $guardforge_hit['summary'] ) ? $guardforge_hit['summary'] : '—' ); ?></td>
                        </tr>
                    <?php endforeach; ?>
                    </tbody>
                </table>
            <?php endif; ?>
        </div>
    </div>

    <?php
    // A slot for the add-on at the foot of the screen; this package prints nothing there.
    do_action( 'guardforge/admin_screen_bottom', 'vulndb' );
    ?>
</div>