<?php
/**
 * "Connect to WPXLab" section with the consent screen.
 *
 * @package Keepwatch
 */

namespace Keepwatch\Admin;

use Keepwatch\Cloud\Connection;
use Keepwatch\Cloud\PurchaseCode;
use Keepwatch\Distribution;

defined( 'ABSPATH' ) || exit;

/**
 * Optional. All local features work without connecting (WordPress.org trialware rule).
 * The CodeCanyon build shows no service pitch (Envato: no premium promotion in WP admin). Its main form activates
 * the site with the purchase code and the buyer's e-mail (no WPXLab account needed, ADR-0011); buyers who already
 * have an account can still connect with a connection code and add the purchase code afterwards.
 */
final class ConnectionPanel {

	public const CONNECT_ACTION    = 'keepwatch_connect';
	public const DISCONNECT_ACTION = 'keepwatch_disconnect';
	public const REDEEM_ACTION     = 'keepwatch_redeem_purchase_code';
	public const ACTIVATE_ACTION   = 'keepwatch_activate_purchase_code';
	public const INVENTORY_ACTION  = 'keepwatch_inventory_consent';
	private const NOTICE           = 'keepwatch_connection_notice';

	/**
	 * Whether this is the CodeCanyon build.
	 *
	 * @var bool
	 */
	private $codecanyon;

	/**
	 * Constructor.
	 *
	 * @param bool|null $codecanyon Build profile; null reads KEEPWATCH_DISTRIBUTION.
	 */
	public function __construct( ?bool $codecanyon = null ) {
		$this->codecanyon = null === $codecanyon ? Distribution::is_codecanyon() : $codecanyon;
	}

	/**
	 * Register admin-post handlers.
	 */
	public function register(): void {
		add_action( 'admin_post_' . self::CONNECT_ACTION, array( $this, 'connect' ) );
		add_action( 'admin_post_' . self::DISCONNECT_ACTION, array( $this, 'disconnect' ) );
		add_action( 'admin_post_' . self::INVENTORY_ACTION, array( $this, 'allow_inventory' ) );
		if ( $this->codecanyon ) {
			add_action( 'admin_post_' . self::REDEEM_ACTION, array( $this, 'redeem' ) );
			add_action( 'admin_post_' . self::ACTIVATE_ACTION, array( $this, 'activate' ) );
		}
	}

	/**
	 * Handle "Connect".
	 */
	public function connect(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'keepwatch' ), 403 );
		}
		check_admin_referer( self::CONNECT_ACTION );

		$code    = isset( $_POST['keepwatch_code'] ) ? sanitize_text_field( wp_unslash( $_POST['keepwatch_code'] ) ) : '';
		$consent = ! empty( $_POST['keepwatch_consent'] );

		$result = ( new Connection( Connection::client() ) )->connect( $code, $consent );
		$this->notice( $result['ok'] ? 'success' : 'error', $result['ok'] ? __( 'This site is now connected to WPXLab.', 'keepwatch' ) : $result['message'] );

		$this->back();
	}

	/**
	 * Handle "Disconnect".
	 */
	public function disconnect(): void {
		$this->authorize( self::DISCONNECT_ACTION );

		( new Connection( Connection::client() ) )->disconnect();
		$this->notice( 'success', __( 'Disconnected. Keepwatch no longer sends anything to WPXLab.', 'keepwatch' ) );

		$this->back();
	}

	/**
	 * Handle "Allow" for the plugin/theme list and site metrics (sites connected before consent version 2).
	 */
	public function allow_inventory(): void {
		$this->authorize( self::INVENTORY_ACTION );

		Connection::grant_inventory_consent();
		$this->notice( 'success', __( 'Thanks. The next report includes your installed plugins, themes and site metrics.', 'keepwatch' ) );

		$this->back();
	}

	/**
	 * Handle "Add purchase code" (CodeCanyon build). The code is sent only while connected (consent given).
	 */
	public function redeem(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'keepwatch' ), 403 );
		}
		check_admin_referer( self::REDEEM_ACTION );

		$code   = isset( $_POST['keepwatch_purchase_code'] ) ? sanitize_text_field( wp_unslash( $_POST['keepwatch_purchase_code'] ) ) : '';
		$result = ( new PurchaseCode( Connection::client() ) )->redeem( $code );
		$this->notice( $result['ok'] ? 'success' : 'error', $result['ok'] ? __( 'Your CodeCanyon purchase is now linked to your WPXLab account.', 'keepwatch' ) : $result['message'] );

		$this->back();
	}

	/**
	 * Handle "Activate" (CodeCanyon build): purchase code + e-mail, no WPXLab account needed.
	 */
	public function activate(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'keepwatch' ), 403 );
		}
		check_admin_referer( self::ACTIVATE_ACTION );

		$code    = isset( $_POST['keepwatch_purchase_code'] ) ? sanitize_text_field( wp_unslash( $_POST['keepwatch_purchase_code'] ) ) : '';
		$email   = isset( $_POST['keepwatch_email'] ) ? sanitize_email( wp_unslash( $_POST['keepwatch_email'] ) ) : '';
		$consent = ! empty( $_POST['keepwatch_consent'] );

		$result = ( new PurchaseCode( Connection::client() ) )->activate( $code, $email, $consent );
		$this->notice( $result['ok'] ? 'success' : 'error', $result['ok'] ? __( 'Keepwatch is activated and this site is now connected to WPXLab.', 'keepwatch' ) : $result['message'] );

		$this->back();
	}

	/**
	 * Render the "WPXLab cloud" tab.
	 */
	public function render(): void {
		$state  = Connection::state();
		$notice = get_transient( self::NOTICE . '_' . get_current_user_id() );
		delete_transient( self::NOTICE . '_' . get_current_user_id() );

		if ( is_array( $notice ) && isset( $notice['type'], $notice['message'] ) ) {
			printf(
				'<div class="notice notice-%1$s inline kw-notice"><p>%2$s</p></div>',
				'success' === $notice['type'] ? 'success' : 'error',
				esc_html( (string) $notice['message'] )
			);
		}

		if ( $state['connected'] ) {
			echo '<section class="kw-card kw-connected"><div class="kw-connected-head"><span class="kw-shortcut-icon is-good" aria-hidden="true">&#10003;</span><div>';
			echo '<h2>' . esc_html__( 'Connected to WPXLab', 'keepwatch' ) . '</h2>';
			printf(
				'<p class="kw-muted">%s</p>',
				esc_html(
					sprintf(
						/* translators: 1: site name, 2: date */
						__( 'Connected as %1$s since %2$s.', 'keepwatch' ),
						'' !== $state['name'] ? $state['name'] : (string) wp_parse_url( home_url(), PHP_URL_HOST ),
						wp_date( get_option( 'date_format' ), $state['connected_at'] )
					)
				)
			);
			echo '</div></div><ul class="kw-list">';
			foreach ( $this->sent_items() as $item ) {
				echo '<li>' . esc_html( $item ) . '</li>';
			}
			echo '</ul><div class="kw-actions">';
			printf(
				'<a class="button button-primary" href="%1$s" target="_blank" rel="noopener">%2$s</a>',
				esc_url( 'https://wpxlab.com/dashboard/keepwatch/sites' ),
				esc_html__( 'Open WPXLab dashboard', 'keepwatch' )
			);
			$this->form( self::DISCONNECT_ACTION, '', __( 'Disconnect', 'keepwatch' ) );
			echo '</div></section>';
			if ( ! Connection::inventory_allowed() ) {
				// Sites connected before this data type existed: nothing extra is sent until an admin agrees here.
				echo '<section class="kw-card"><h2>' . esc_html__( 'New: component list and site metrics', 'keepwatch' ) . '</h2>';
				echo '<p class="kw-muted">' . esc_html( self::inventory_item() ) . '</p>';
				$this->form( self::INVENTORY_ACTION, '', __( 'Allow sending', 'keepwatch' ) );
				echo '</section>';
			}
			if ( $this->codecanyon ) {
				$this->render_account_suggestion();
				$this->render_purchase_code();
			}
			return;
		}

		echo '<div class="kw-cloud">';

		if ( $this->codecanyon ) {
			$this->render_activation();
			// Buyers who already have a WPXLab account connect with a connection code instead.
			echo '<details class="kw-card kw-existing-account"><summary>' . esc_html__( 'Already have a WPXLab account? Connect with a connection code', 'keepwatch' ) . '</summary>';
			$this->render_steps();
		} else {
			$this->render_pitch();
		}

		printf(
			'<form method="post" action="%1$s" class="kw-card kw-connect"><input type="hidden" name="action" value="%2$s">',
			esc_url( admin_url( 'admin-post.php' ) ),
			esc_attr( self::CONNECT_ACTION )
		);
		wp_nonce_field( self::CONNECT_ACTION );

		echo '<p class="kw-field"><label for="keepwatch-code">' . esc_html__( 'Connection code', 'keepwatch' ) . '</label>';
		echo '<input type="text" class="kw-code-input code" id="keepwatch-code" name="keepwatch_code" autocomplete="off" spellcheck="false" placeholder="XXXX-XXXX-XXXX-XXXX-XXXX-XXXX" required></p>';

		// Consent screen (CLAUDE.md rule 7): what, where, how often, plus terms and privacy links.
		echo '<div class="kw-consent"><p><strong>' . esc_html__( 'What will be sent', 'keepwatch' ) . '</strong></p><ul class="kw-list">';
		foreach ( $this->sent_items() as $item ) {
			echo '<li>' . esc_html( $item ) . '</li>';
		}
		echo '</ul>';
		printf(
			'<label class="kw-consent-check"><input type="checkbox" name="keepwatch_consent" value="1" required> <span>%1$s <a href="%2$s" target="_blank" rel="noopener">%3$s</a> · <a href="%4$s" target="_blank" rel="noopener">%5$s</a></span></label></div>',
			esc_html__( 'I agree to send this data to WPXLab.', 'keepwatch' ),
			esc_url( 'https://wpxlab.com/terms' ),
			esc_html__( 'Terms of service', 'keepwatch' ),
			esc_url( 'https://wpxlab.com/privacy' ),
			esc_html__( 'Privacy policy', 'keepwatch' )
		);

		submit_button( __( 'Connect to WPXLab', 'keepwatch' ), $this->codecanyon ? 'secondary' : 'primary large', 'submit', false );
		echo '</form>';
		if ( $this->codecanyon ) {
			echo '</details>';
		}
		echo '</div>';
	}

	/**
	 * CodeCanyon activation: purchase code + e-mail + consent (rule 7). Local features never depend on it (rule 11).
	 */
	private function render_activation(): void {
		printf(
			'<form method="post" action="%1$s" class="kw-card kw-connect kw-activate"><input type="hidden" name="action" value="%2$s">',
			esc_url( admin_url( 'admin-post.php' ) ),
			esc_attr( self::ACTIVATE_ACTION )
		);
		wp_nonce_field( self::ACTIVATE_ACTION );
		echo '<h2>' . esc_html__( 'Activate with your purchase code', 'keepwatch' ) . '</h2>';
		echo '<p class="kw-muted">' . esc_html__( 'All Keepwatch features on this site work without activation. Activating connects this site to WPXLab for outside uptime checks, history and e-mail alerts. No WPXLab account is needed: one is created for your e-mail if you do not have one yet.', 'keepwatch' ) . '</p>';

		echo '<p class="kw-field"><label for="keepwatch-activate-code">' . esc_html__( 'Purchase code', 'keepwatch' ) . '</label>';
		echo '<input type="text" class="kw-code-input code" id="keepwatch-activate-code" name="keepwatch_purchase_code" autocomplete="off" spellcheck="false" maxlength="64" placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" required></p>';
		echo '<p class="kw-muted">' . esc_html__( 'Find it under CodeCanyon → Downloads → Keepwatch → License certificate & purchase code.', 'keepwatch' ) . '</p>';
		echo '<p class="kw-field"><label for="keepwatch-activate-email">' . esc_html__( 'E-mail address', 'keepwatch' ) . '</label>';
		echo '<input type="email" class="regular-text" id="keepwatch-activate-email" name="keepwatch_email" autocomplete="email" maxlength="191" required></p>';
		echo '<p class="kw-muted">' . esc_html__( 'Alerts and your WPXLab sign-in go to this address. Use the e-mail of your Envato account if you can.', 'keepwatch' ) . '</p>';

		echo '<div class="kw-consent"><p><strong>' . esc_html__( 'What will be sent', 'keepwatch' ) . '</strong></p><ul class="kw-list">';
		echo '<li>' . esc_html__( 'Once: the purchase code and the e-mail address above, so WPXLab can check the code with Envato and open your account.', 'keepwatch' ) . '</li>';
		foreach ( $this->sent_items() as $item ) {
			echo '<li>' . esc_html( $item ) . '</li>';
		}
		echo '</ul>';
		printf(
			'<label class="kw-consent-check"><input type="checkbox" name="keepwatch_consent" value="1" required> <span>%1$s <a href="%2$s" target="_blank" rel="noopener">%3$s</a> · <a href="%4$s" target="_blank" rel="noopener">%5$s</a></span></label></div>',
			esc_html__( 'I agree to send this data to WPXLab.', 'keepwatch' ),
			esc_url( 'https://wpxlab.com/terms' ),
			esc_html__( 'Terms of service', 'keepwatch' ),
			esc_url( 'https://wpxlab.com/privacy' ),
			esc_html__( 'Privacy policy', 'keepwatch' )
		);

		submit_button( __( 'Activate', 'keepwatch' ), 'primary large', 'submit', false );
		echo '</form>';
	}

	/**
	 * After a code activation that opened a new account: suggest signing in for more (CodeCanyon build).
	 */
	private function render_account_suggestion(): void {
		$purchase = PurchaseCode::state();
		if ( null === $purchase || ! $purchase['account_created'] ) {
			return;
		}

		echo '<section class="kw-card kw-account-suggestion"><h2>' . esc_html__( 'Your WPXLab account is ready', 'keepwatch' ) . '</h2>';
		echo '<p class="kw-muted">' . esc_html__( 'We opened a WPXLab account for the e-mail you entered. Set a password and sign in to see the check history, choose who gets alerts and manage your purchase.', 'keepwatch' ) . '</p>';
		echo '<div class="kw-actions">';
		printf(
			'<a class="button button-primary" href="%1$s" target="_blank" rel="noopener">%2$s</a> ',
			esc_url( 'https://wpxlab.com/forgot-password' ),
			esc_html__( 'Set a password', 'keepwatch' )
		);
		printf(
			'<a class="button" href="%1$s" target="_blank" rel="noopener">%2$s</a>',
			esc_url( 'https://wpxlab.com/login' ),
			esc_html__( 'Sign in', 'keepwatch' )
		);
		echo '</div></section>';
	}

	/**
	 * Service pitch (WordPress.org build).
	 */
	private function render_pitch(): void {
		echo '<section class="kw-card kw-cloud-pitch"><h2>' . esc_html__( 'Watch all your sites from one place', 'keepwatch' ) . '</h2>';
		echo '<p class="kw-muted">' . esc_html__( 'Keepwatch works fully on this site without an account. Connecting adds outside uptime checks, history and alerts for all your sites in one place at wpxlab.com.', 'keepwatch' ) . '</p>';
		echo '<ul class="kw-benefits">';
		$benefits = array(
			__( 'History of every check, not just the current state', 'keepwatch' ),
			__( 'Email alerts when a site breaks or stops reporting', 'keepwatch' ),
			__( 'All your sites on one dashboard', 'keepwatch' ),
		);
		foreach ( $benefits as $benefit ) {
			echo '<li>' . esc_html( $benefit ) . '</li>';
		}
		echo '</ul>';
		$this->render_steps();
		echo '</section>';
	}

	/**
	 * How to connect.
	 */
	private function render_steps(): void {
		echo '<ol class="kw-steps">';
		$steps = array(
			__( 'Create a code at wpxlab.com → Dashboard → Keepwatch → Add a site.', 'keepwatch' ),
			__( 'Paste the code here and review what will be sent.', 'keepwatch' ),
			__( 'Accept and connect. The first report arrives within an hour.', 'keepwatch' ),
		);
		foreach ( $steps as $step ) {
			echo '<li>' . esc_html( $step ) . '</li>';
		}
		echo '</ol>';
	}

	/**
	 * Optional purchase code (CodeCanyon build, connected sites only).
	 */
	private function render_purchase_code(): void {
		$purchase = PurchaseCode::state();

		echo '<section class="kw-card kw-purchase-code"><h2>' . esc_html__( 'CodeCanyon purchase code', 'keepwatch' ) . '</h2>';
		if ( null !== $purchase ) {
			$item = '' !== $purchase['item'] ? $purchase['item'] : 'Keepwatch';
			printf(
				'<p class="kw-muted">%s</p>',
				esc_html(
					sprintf(
						/* translators: 1: CodeCanyon item name, 2: last four characters of the purchase code */
						__( 'Linked to your WPXLab account: %1$s (code ending in %2$s).', 'keepwatch' ),
						$item,
						$purchase['code_last4']
					)
				)
			);
			$until = '' !== $purchase['supported_until'] ? strtotime( $purchase['supported_until'] ) : false;
			if ( false !== $until ) {
				printf(
					'<p class="kw-muted">%s</p>',
					esc_html(
						sprintf(
							/* translators: %s: date */
							__( 'Support until %s.', 'keepwatch' ),
							wp_date( get_option( 'date_format' ), $until )
						)
					)
				);
			}
		}

		if ( null !== $purchase ) {
			echo '</section>';
			return;
		}

		printf(
			'<form method="post" action="%1$s"><input type="hidden" name="action" value="%2$s">',
			esc_url( admin_url( 'admin-post.php' ) ),
			esc_attr( self::REDEEM_ACTION )
		);
		wp_nonce_field( self::REDEEM_ACTION );
		echo '<p class="kw-field"><label for="keepwatch-purchase-code">' . esc_html__( 'Purchase code (optional)', 'keepwatch' ) . '</label>';
		echo '<input type="text" class="kw-code-input code" id="keepwatch-purchase-code" name="keepwatch_purchase_code" autocomplete="off" spellcheck="false" maxlength="64" placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" required></p>';
		echo '<p class="kw-muted">' . esc_html__( 'Find it under CodeCanyon → Downloads → Keepwatch → License certificate & purchase code. WPXLab checks the code with Envato and links it to the account this site is connected to. Keepwatch works the same on this site without it.', 'keepwatch' ) . '</p>';
		submit_button( __( 'Add purchase code', 'keepwatch' ), 'secondary', 'submit', false );
		echo '</form></section>';
	}

	/**
	 * What is sent (consent screen and connected view).
	 *
	 * @return string[]
	 */
	private function sent_items(): array {
		return array(
			__( 'Now: this site\'s address, an anonymous installation id, a public key, and the WordPress, PHP and Keepwatch versions.', 'keepwatch' ),
			__( 'Then hourly (WP-Cron, never during page loads): the outcome of each check (its id, status and short headline, e.g. "2 plugins have updates") and the WordPress, PHP, Keepwatch and WooCommerce versions. Check descriptions, user names, file paths, e-mails and IP addresses are not sent.', 'keepwatch' ),
			__( 'For the last 7 days: plugin, theme and WordPress updates (name and version numbers) and when PHP fatal errors started, with only the plugin or theme they came from. Error messages and file paths are not sent.', 'keepwatch' ),
			__( 'If WooCommerce is active: only totals (for example orders per hour). Never customer names, e-mails or addresses.', 'keepwatch' ),
			self::inventory_item(),
			__( 'From WPXLab: only signed settings for this site (how often to report and which of the data above to include). WPXLab cannot run code, change files or read your database.', 'keepwatch' ),
			__( 'Where: WPXLab (wpxlab.com), servers in the EU.', 'keepwatch' ),
			__( 'You can disconnect at any time with one click; sending stops immediately.', 'keepwatch' ),
		);
	}

	/**
	 * Consent text for keepwatch-report.v2 additions.
	 */
	private static function inventory_item(): string {
		return __( 'Installed plugins and themes (name, version, active, available update) and site metrics (memory limit, autoloaded options size, database size, overdue scheduled tasks), so updates and limits can be tracked across your sites.', 'keepwatch' );
	}

	/**
	 * Small single-button form.
	 *
	 * @param string $action Action.
	 * @param string $intro  Intro text.
	 * @param string $label  Button label.
	 */
	private function form( string $action, string $intro, string $label ): void {
		printf(
			'<form method="post" action="%1$s"><input type="hidden" name="action" value="%2$s">',
			esc_url( admin_url( 'admin-post.php' ) ),
			esc_attr( $action )
		);
		wp_nonce_field( $action );
		if ( '' !== $intro ) {
			echo '<p>' . esc_html( $intro ) . '</p>';
		}
		submit_button( $label, 'secondary', 'submit', false );
		echo '</form>';
	}

	/**
	 * Capability + nonce.
	 *
	 * @param string $action Nonce action.
	 */
	private function authorize( string $action ): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'keepwatch' ), 403 );
		}
		check_admin_referer( $action );
	}

	/**
	 * One-time notice for the current user.
	 *
	 * @param string $type    success|error.
	 * @param string $message Message.
	 */
	private function notice( string $type, string $message ): void {
		set_transient(
			self::NOTICE . '_' . get_current_user_id(),
			array(
				'type'    => $type,
				'message' => $message,
			),
			60
		);
	}

	/**
	 * Back to the dashboard section.
	 */
	private function back(): void {
		wp_safe_redirect( Menu::tab_url( 'cloud' ) );
		exit;
	}
}