<?php
/** Optional per-form Turnstile. Private credentials never enter a public schema. */
if ( ! defined( 'ABSPATH' ) ) { exit; }

final class KCONV_Spam {
    const META = '_kconv_spam';
    // phpcs:ignore PluginCheck.CodeAnalysis.Offloading.OffloadedContent -- Optional Cloudflare Turnstile is an explicitly disclosed remote CAPTCHA service, disabled by default and owner-enabled per form. Its required widget/siteverify and privacy links are not remotely hosted plugin UI assets.
    const VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
    public static function boot() {
        add_action( 'kconv_admin_form_after', array( __CLASS__, 'admin_fields' ), 35 );
        add_filter( 'kconv_validate_form_save', array( __CLASS__, 'validate_save' ), 30, 3 );
        add_action( 'kconv_form_saved', array( __CLASS__, 'save' ), 30, 3 );
        add_filter( 'kconv_render_form', array( __CLASS__, 'render_form' ), 40, 3 );
        add_filter( 'kconv_submission_preflight', array( __CLASS__, 'preflight' ), 20, 4 );
    }
    public static function defaults() { return array( 'enabled' => false, 'acknowledged' => false, 'sitekey' => '', 'secret' => '' ); }
    public static function config( $form ) {
        if ( empty( $form['id'] ) ) { return self::defaults(); }
        $raw = get_post_meta( (int) $form['id'], self::META, true );
        if ( '' !== $raw && ! is_array( $raw ) ) { return new WP_Error( 'kconv_spam_config', __( 'Review the saved spam protection settings.', 'killerconversions' ) ); }
        return self::sanitize( is_array( $raw ) ? $raw : array() );
    }
    public static function sanitize( $raw ) {
        if ( ! is_array( $raw ) ) { return new WP_Error( 'kconv_spam_config', __( 'Review the spam protection settings.', 'killerconversions' ) ); }
        $config = self::defaults();
        foreach ( array( 'enabled', 'acknowledged' ) as $key ) {
            if ( isset( $raw[ $key ] ) && ! is_scalar( $raw[ $key ] ) ) { return new WP_Error( 'kconv_spam_config', __( 'Review the spam protection settings.', 'killerconversions' ) ); }
            $config[ $key ] = ! empty( $raw[ $key ] );
        }
        foreach ( array( 'sitekey', 'secret' ) as $key ) {
            if ( isset( $raw[ $key ] ) && ! is_string( $raw[ $key ] ) ) { return new WP_Error( 'kconv_spam_config', __( 'Turnstile keys must be text.', 'killerconversions' ) ); }
            $config[ $key ] = isset( $raw[ $key ] ) ? trim( $raw[ $key ] ) : '';
            if ( '' !== $config[ $key ] && ! preg_match( '/^[A-Za-z0-9_-]{10,256}$/D', $config[ $key ] ) ) { return new WP_Error( 'kconv_spam_config', __( 'Use valid Turnstile keys without spaces.', 'killerconversions' ) ); }
        }
        if ( $config['enabled'] && ( ! $config['sitekey'] || ! $config['secret'] || ! $config['acknowledged'] ) ) { return new WP_Error( 'kconv_spam_config', __( 'Add both Turnstile keys and acknowledge the external service before enabling protection.', 'killerconversions' ) ); }
        return $config;
    }
    public static function from_post( $form, $post ) {
        if ( ! isset( $post['kconv_spam'] ) || ! is_array( $post['kconv_spam'] ) ) { return new WP_Error( 'kconv_spam_config', __( 'Spam protection settings are incomplete. Reload the editor.', 'killerconversions' ) ); }
        $raw = $post['kconv_spam'];
        $stored = get_post_meta( (int) $form['id'], self::META, true );
        if ( ! empty( $raw['clear_secret'] ) ) { $raw['secret'] = ''; }
        elseif ( isset( $raw['secret'] ) && '' === $raw['secret'] && isset( $stored['secret'] ) ) { $raw['secret'] = $stored['secret']; }
        return self::sanitize( $raw );
    }
    private static function guarded( $post ) {
        if ( ! current_user_can( 'manage_options' ) ) { return false; }
        if ( ! isset( $post['kconv_spam_nonce'] ) || ! is_string( $post['kconv_spam_nonce'] ) ) { return false; }
        if ( ! wp_verify_nonce( sanitize_text_field( $post['kconv_spam_nonce'] ), 'kconv_spam_save' ) ) { return false; }
        return isset( $post['kconv_spam_complete'] ) && '1' === $post['kconv_spam_complete'];
    }
    public static function validate_save( $errors, $form, $post ) {
        if ( ! isset( $post['kconv_spam_present'] ) ) { return $errors; }
        if ( ! self::guarded( $post ) ) { $errors->add( 'kconv_spam_incomplete', __( 'Spam protection settings are incomplete or expired. Reload the editor before saving. Existing settings have not changed.', 'killerconversions' ) ); return $errors; }
        $config = self::from_post( $form, $post );
        if ( is_wp_error( $config ) ) { $errors->add( $config->get_error_code(), $config->get_error_message() ); }
        return $errors;
    }
    public static function save( $id, $form, $post ) {
        if ( ! isset( $post['kconv_spam_present'] ) || ! self::guarded( $post ) ) { return; }
        $config = self::from_post( $form, $post );
        if ( ! is_wp_error( $config ) ) { update_post_meta( $id, self::META, wp_slash( $config ) ); }
    }
    public static function admin_fields( $form ) {
        if ( ! current_user_can( 'manage_options' ) ) { return; }
        $config = self::config( $form );
        $invalid = is_wp_error( $config );
        if ( $invalid ) { $config = self::defaults(); }
        wp_enqueue_style( 'kconv-spam', KCONV_URL . 'assets/spam.css', array(), KCONV_VERSION );
        wp_enqueue_script( 'kconv-spam-admin', KCONV_URL . 'assets/spam-admin.js', array( 'kconv-workspace' , 'wp-i18n' ), KCONV_VERSION, true ); wp_set_script_translations( 'kconv-spam-admin', 'killerconversions', KCONV_DIR . 'languages' );
        echo '<section class="kconv-panel kconv-spam-settings" id="kconv-spam-settings" data-kconv-section="settings"><h2>' . esc_html__( 'Spam protection', 'killerconversions' ) . '</h2><p>' . esc_html__( 'Built-in validation, a honeypot and rate limits remain active. Add Cloudflare Turnstile when your form needs another layer.', 'killerconversions' ) . '</p>';
        if ( $invalid ) { echo '<p class="notice notice-error inline">' . esc_html__( 'The saved Turnstile configuration needs attention. Protected submissions are blocked until you correct it or save protection as disabled.', 'killerconversions' ) . '</p>'; }
        wp_nonce_field( 'kconv_spam_save', 'kconv_spam_nonce' );
        echo '<input type="hidden" name="kconv_spam_present" value="1">';
        echo '<label class="kconv-spam-toggle"><input type="checkbox" name="kconv_spam[enabled]" value="1"' . checked( $config['enabled'], true, false ) . '> ' . esc_html__( 'Protect this form with Cloudflare Turnstile', 'killerconversions' ) . '</label><p class="kconv-spam-config-state" role="status" data-kconv-spam-state></p>';
        echo '<div class="kconv-spam-key-grid"><label>' . esc_html__( 'Public site key', 'killerconversions' ) . '<input type="text" name="kconv_spam[sitekey]" value="' . esc_attr( $config['sitekey'] ) . '" maxlength="256" autocomplete="off" spellcheck="false"></label><label>' . esc_html__( 'New secret key', 'killerconversions' ) . '<input type="password" name="kconv_spam[secret]" value="" maxlength="256" autocomplete="new-password" data-kconv-secret-saved="' . ( $config['secret'] ? '1' : '0' ) . '"><small>' . esc_html( $config['secret'] ? __( 'Secret saved. Leave blank to keep it.', 'killerconversions' ) : __( 'No secret saved.', 'killerconversions' ) ) . '</small></label></div>';
        echo '<p><label><input type="checkbox" name="kconv_spam[clear_secret]" value="1"> ' . esc_html__( 'Remove the saved secret (disable protection first)', 'killerconversions' ) . '</label></p>';
        echo '<p class="description">' . esc_html__( 'Create a Managed Turnstile widget for this website hostname:', 'killerconversions' ) . ' <code>' . esc_html( wp_parse_url( home_url(), PHP_URL_HOST ) ) . '</code>. ' . esc_html__( 'Preview never loads Turnstile. Test the published form after saving.', 'killerconversions' ) . '</p>';
        // phpcs:ignore PluginCheck.CodeAnalysis.Offloading.OffloadedContent -- Optional Cloudflare Turnstile is an explicitly disclosed remote CAPTCHA service, disabled by default and owner-enabled per form. Its required widget/siteverify and privacy links are not remotely hosted plugin UI assets.
        echo '<details class="kconv-spam-disclosure" open><summary>' . esc_html__( 'External service and privacy', 'killerconversions' ) . '</summary><p>' . esc_html__( 'When enabled, published forms load a security widget from challenges.cloudflare.com. Cloudflare processes the visitor’s IP address, browser/device signals, site key and page origin to distinguish people from bots. On submission, this server sends the challenge token and secret key to Cloudflare’s Siteverify service over HTTPS. KillerConversions does not send form answers or files to Turnstile.', 'killerconversions' ) . '</p><p>' . esc_html__( 'Disable protection and save to stop future Turnstile loading and verification. Remove the saved secret to delete it from this form’s settings. Update your website privacy notice for this optional service.', 'killerconversions' ) . '</p><p><a href="https://www.cloudflare.com/turnstile-privacy-policy/" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Cloudflare Turnstile privacy', 'killerconversions' ) . '</a> · <a href="https://www.cloudflare.com/website-terms/" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Cloudflare terms', 'killerconversions' ) . '</a></p></details>';
        echo '<label class="kconv-spam-ack"><input type="checkbox" name="kconv_spam[acknowledged]" value="1"' . checked( $config['acknowledged'], true, false ) . '> ' . esc_html__( 'I understand this optional service, the data sent and how to disable it.', 'killerconversions' ) . '</label><input type="hidden" name="kconv_spam_complete" value="1"></section>';
    }
    public static function action( $form ) { return 'kconv_form_' . (int) $form['id']; }
    public static function render_form( $html, $form, $instance ) {
        if ( ! empty( $form['_kconv_preview'] ) ) { return $html; }
        $config = self::config( $form );
        if ( ! is_wp_error( $config ) && ! $config['enabled'] ) { return $html; }
        wp_enqueue_style( 'kconv-spam', KCONV_URL . 'assets/spam.css', array(), KCONV_VERSION );
        $message = __( 'Security verification is unavailable. Please try again later or contact the website owner.', 'killerconversions' );
        $box = '<div class="kconv-spam"';
        if ( ! is_wp_error( $config ) ) {
            wp_enqueue_script( 'kconv-spam', KCONV_URL . 'assets/spam.js', array( 'kconv-forms' , 'wp-i18n' ), KCONV_VERSION, true ); wp_set_script_translations( 'kconv-spam', 'killerconversions', KCONV_DIR . 'languages' );
            $box .= ' data-kconv-turnstile="1" data-sitekey="' . esc_attr( $config['sitekey'] ) . '" data-action="' . esc_attr( self::action( $form ) ) . '"';
            $message = __( 'Loading security verification…', 'killerconversions' );
        }
        // phpcs:ignore PluginCheck.CodeAnalysis.Offloading.OffloadedContent -- Optional Cloudflare Turnstile is an explicitly disclosed remote CAPTCHA service, disabled by default and owner-enabled per form. Its required widget/siteverify and privacy links are not remotely hosted plugin UI assets.
        $box .= '><div class="kconv-spam-widget"></div><p class="kconv-spam-status" role="status" aria-live="polite">' . esc_html( $message ) . '</p><button type="button" class="kconv-spam-retry" hidden>' . esc_html__( 'Retry security check', 'killerconversions' ) . '</button><p class="kconv-spam-privacy">' . esc_html__( 'Protected by Cloudflare Turnstile.', 'killerconversions' ) . ' <a href="https://www.cloudflare.com/turnstile-privacy-policy/" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Privacy', 'killerconversions' ) . '</a></p><noscript><p>' . esc_html__( 'Enable JavaScript to complete this form’s security check. Your answers will not be submitted without verification.', 'killerconversions' ) . '</p></noscript></div>';
        return str_replace( '<button type="submit" class="kconv-submit">', $box . '<button type="submit" class="kconv-submit">', $html );
    }
    public static function preflight( $result, $data, $form, $request ) {
        if ( is_wp_error( $result ) ) { return $result; }
        $config = self::config( $form );
        if ( ! is_wp_error( $config ) && ! $config['enabled'] ) { return $result; }
        if ( is_wp_error( $config ) ) { return self::unavailable(); }
        $token = isset( $data['turnstile_token'] ) ? $data['turnstile_token'] : '';
        if ( ! is_string( $token ) || ! preg_match( '/^[\x21-\x7e]{1,2048}$/D', $token ) ) { return self::challenge_error(); }
        $response = wp_remote_post( self::VERIFY_URL, array( 'timeout' => 10, 'redirection' => 0, 'limit_response_size' => 16384, 'sslverify' => true, 'headers' => array( 'Accept' => 'application/json' ), 'body' => array( 'secret' => $config['secret'], 'response' => $token ) ) );
        if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) { return self::unavailable(); }
        $verified = json_decode( wp_remote_retrieve_body( $response ), true, 12 );
        if ( ! is_array( $verified ) || ! isset( $verified['success'] ) || ! is_bool( $verified['success'] ) ) { return self::unavailable(); }
        if ( ! $verified['success'] ) {
            $codes = isset( $verified['error-codes'] ) && is_array( $verified['error-codes'] ) ? array_filter( $verified['error-codes'], 'is_string' ) : array();
            return array_intersect( $codes, array( 'missing-input-secret', 'invalid-input-secret', 'internal-error' ) ) ? self::unavailable() : self::challenge_error();
        }
        $hostname = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );
        if ( ! isset( $verified['hostname'], $verified['action'] ) || ! is_string( $verified['hostname'] ) || ! is_string( $verified['action'] ) || strtolower( $verified['hostname'] ) !== $hostname || $verified['action'] !== self::action( $form ) ) { return self::challenge_error(); }
        return $result;
    }
    private static function unavailable() { return new WP_Error( 'kconv_spam_unavailable', __( 'Security verification is unavailable. Your message has not been saved. Please try again later or contact the website owner.', 'killerconversions' ), array( 'status' => 503 ) ); }
    private static function challenge_error() { return new WP_Error( 'kconv_spam_challenge', __( 'Complete a fresh security check and try again. Your message has not been saved.', 'killerconversions' ), array( 'status' => 422 ) ); }
}