<?php
/**
 * Server and configuration basics.
 *
 * @package Keepwatch
 */

namespace Keepwatch\Checks;

defined( 'ABSPATH' ) || exit;

/**
 * PHP version, HTTPS, visible errors, memory limit and the built-in file editor.
 * Read-only: Keepwatch never changes wp-config.php (CLAUDE.md rule 2).
 */
final class EnvironmentCheck implements Check {

	/** PHP versions below this no longer receive security fixes (as of 2026). */
	public const PHP_RECOMMENDED = '8.2';

	/**
	 * {@inheritDoc}
	 */
	public function group(): string {
		return 'environment';
	}

	/**
	 * {@inheritDoc}
	 */
	public function run(): array {
		return self::evaluate(
			array(
				'php'            => PHP_VERSION,
				'https'          => 0 === strpos( (string) home_url(), 'https://' ),
				'display_errors' => defined( 'WP_DEBUG' ) && WP_DEBUG && ( ! defined( 'WP_DEBUG_DISPLAY' ) || WP_DEBUG_DISPLAY ),
				'memory_bytes'   => (int) wp_convert_hr_to_bytes( defined( 'WP_MEMORY_LIMIT' ) ? (string) WP_MEMORY_LIMIT : '40M' ),
				'file_edit'      => ! ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT ),
				'production'     => 'production' === wp_get_environment_type(),
			)
		);
	}

	/**
	 * Pure evaluation.
	 *
	 * @param array{php: string, https: bool, display_errors: bool, memory_bytes: int, file_edit: bool, production: bool} $env Environment facts.
	 * @return Result[]
	 */
	public static function evaluate( array $env ): array {
		$results = array();

		if ( version_compare( $env['php'], self::PHP_RECOMMENDED, '<' ) ) {
			$results[] = new Result(
				'environment.php',
				Result::RECOMMENDED,
				/* translators: %s: PHP version */
				sprintf( __( 'PHP %s is out of security support', 'keepwatch' ), $env['php'] ),
				/* translators: %s: recommended PHP version */
				sprintf( __( 'Ask your host to switch to PHP %s or newer. It is faster and still receives security fixes.', 'keepwatch' ), self::PHP_RECOMMENDED )
			);
		} else {
			/* translators: %s: PHP version */
			$results[] = new Result( 'environment.php', Result::GOOD, sprintf( __( 'PHP %s is supported', 'keepwatch' ), $env['php'] ) );
		}

		$results[] = $env['https']
			? new Result( 'environment.https', Result::GOOD, __( 'The site uses HTTPS', 'keepwatch' ) )
			: new Result(
				'environment.https',
				$env['production'] ? Result::CRITICAL : Result::RECOMMENDED,
				__( 'The site does not use HTTPS', 'keepwatch' ),
				__( 'Without HTTPS, logins and forms are sent unencrypted and browsers mark the site as "Not secure".', 'keepwatch' ),
				admin_url( 'options-general.php' ),
				__( 'General settings', 'keepwatch' )
			);

		if ( $env['display_errors'] && $env['production'] ) {
			$results[] = new Result(
				'environment.display_errors',
				Result::CRITICAL,
				__( 'PHP errors are shown to visitors', 'keepwatch' ),
				__( 'WP_DEBUG and WP_DEBUG_DISPLAY are on in production. Error messages can reveal file paths to visitors. Ask your developer to turn WP_DEBUG_DISPLAY off in wp-config.php.', 'keepwatch' )
			);
		}

		if ( $env['memory_bytes'] > 0 && $env['memory_bytes'] < 128 * 1024 * 1024 ) {
			$results[] = new Result(
				'environment.memory',
				Result::RECOMMENDED,
				/* translators: %s: memory limit, e.g. 64 MB */
				sprintf( __( 'WordPress memory limit is %s', 'keepwatch' ), size_format( $env['memory_bytes'] ) ),
				__( 'Page builders and stores often need at least 128 MB. Low limits cause "Allowed memory size exhausted" errors.', 'keepwatch' )
			);
		}

		if ( $env['file_edit'] ) {
			$results[] = new Result(
				'environment.file_edit',
				Result::RECOMMENDED,
				__( 'The built-in file editor is enabled', 'keepwatch' ),
				__( 'If an admin account is compromised, the editor lets an attacker change PHP files. Setting DISALLOW_FILE_EDIT in wp-config.php turns it off.', 'keepwatch' )
			);
		}

		return $results;
	}
}