<?php
/**
 * Admin settings screen and sanitization.
 *
 * @package Krawlup_Analytics
 */

defined( 'ABSPATH' ) || exit;

/**
 * Class Krawlup_Admin
 */
class Krawlup_Admin {

	/**
	 * Register admin hooks.
	 */
	public function init() {
		add_action( 'admin_menu', array( $this, 'add_settings_page' ) );
		add_action( 'admin_init', array( $this, 'register_settings' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_assets' ) );
	}

	/**
	 * Add menu item under WordPress Settings.
	 */
	public function add_settings_page() {
		add_options_page(
			__( 'Krawlup Analytics', 'krawlup' ),
			__( 'Krawlup Analytics', 'krawlup' ),
			'manage_options',
			'krawlup',
			array( $this, 'render_settings_page' )
		);
	}

	/**
	 * Enqueue admin stylesheet on Krawlup settings page only.
	 *
	 * @param string $hook_suffix Current admin page hook.
	 */
	public function enqueue_assets( $hook_suffix ) {
		if ( 'settings_page_krawlup' !== $hook_suffix ) {
			return;
		}

		wp_enqueue_style(
			'krawlup-admin-css',
			KRAWLUP_PLUGIN_URL . 'assets/css/admin.css',
			array(),
			KRAWLUP_VERSION
		);
	}

	/**
	 * Register settings with validation and sanitization.
	 */
	public function register_settings() {
		register_setting(
			'krawlup_settings_group',
			'krawlup_site_token',
			array(
				'type'              => 'string',
				'sanitize_callback' => array( $this, 'sanitize_site_token' ),
				'default'           => '',
			)
		);

		register_setting(
			'krawlup_settings_group',
			'krawlup_custom_domain',
			array(
				'type'              => 'string',
				'sanitize_callback' => array( $this, 'sanitize_custom_domain' ),
				'default'           => KRAWLUP_DEFAULT_ENDPOINT,
			)
		);

		register_setting(
			'krawlup_settings_group',
			'krawlup_track_admin',
			array(
				'type'              => 'string',
				'sanitize_callback' => array( $this, 'sanitize_checkbox' ),
				'default'           => '0',
			)
		);

		register_setting(
			'krawlup_settings_group',
			'krawlup_track_woocommerce',
			array(
				'type'              => 'string',
				'sanitize_callback' => array( $this, 'sanitize_checkbox' ),
				'default'           => '1',
			)
		);
	}

	/**
	 * Sanitize and validate Krawlup site token (8-64 hex chars).
	 *
	 * @param string $token Raw token.
	 * @return string Sanitized token.
	 */
	public function sanitize_site_token( $token ) {
		$clean = strtolower( trim( sanitize_text_field( $token ) ) );
		if ( empty( $clean ) ) {
			return '';
		}

		if ( ! preg_match( '/^[0-9a-f]{8,64}$/', $clean ) ) {
			add_settings_error(
				'krawlup_site_token',
				'invalid_token',
				__( 'Invalid Site Token format. The Krawlup token should be an 8–64 character hexadecimal string.', 'krawlup' ),
				'error'
			);
			return get_option( 'krawlup_site_token', '' );
		}

		return $clean;
	}

	/**
	 * Sanitize custom endpoint domain.
	 *
	 * @param string $domain Raw URL or domain.
	 * @return string Sanitized URL.
	 */
	public function sanitize_custom_domain( $domain ) {
		$clean = trim( sanitize_text_field( $domain ) );
		if ( empty( $clean ) ) {
			return KRAWLUP_DEFAULT_ENDPOINT;
		}

		// https:// is mandatory: this URL becomes every visitor's script src.
		// Plain HTTP is rewritten (browsers block it on secure sites as mixed
		// content, silently stopping tracking), and anything that does not
		// survive sanitization as https falls back to the default endpoint
		// rather than landing as a broken or exotic-scheme URL.
		if ( preg_match( '#^http://#i', $clean ) ) {
			$clean = 'https://' . substr( $clean, 7 );
			add_settings_error(
				'krawlup_custom_domain',
				'insecure_endpoint',
				__( 'Custom endpoints must use HTTPS — the http:// URL was rewritten to https://. Browsers block plain-HTTP scripts on secure sites (mixed content), which would silently stop tracking.', 'krawlup' ),
				'warning'
			);
		} elseif ( ! preg_match( '#^https://#i', $clean ) ) {
			$clean = 'https://' . $clean;
		}

		$sanitized = esc_url_raw( rtrim( $clean, '/' ) );
		if ( empty( $sanitized ) || ! preg_match( '#^https://#i', $sanitized ) ) {
			return KRAWLUP_DEFAULT_ENDPOINT;
		}
		return $sanitized;
	}

	/**
	 * Sanitize boolean checkbox fields.
	 *
	 * @param mixed $value Input value.
	 * @return string '1' or '0'.
	 */
	public function sanitize_checkbox( $value ) {
		return ! empty( $value ) ? '1' : '0';
	}

	/**
	 * Render settings page template.
	 */
	public function render_settings_page() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'krawlup' ) );
		}

		$token             = get_option( 'krawlup_site_token', '' );
		$custom_domain     = get_option( 'krawlup_custom_domain', KRAWLUP_DEFAULT_ENDPOINT );
		$track_admin       = get_option( 'krawlup_track_admin', '0' );
		$track_woocommerce = get_option( 'krawlup_track_woocommerce', '1' );
		$has_wc            = class_exists( 'WooCommerce' );
		$is_connected      = ! empty( $token );
		?>
		<div class="wrap krawlup-admin-wrap">
			<div class="krawlup-header">
				<div class="krawlup-branding">
					<div class="krawlup-logo-mark">K</div>
					<div>
						<h1><?php esc_html_e( 'Krawlup Analytics', 'krawlup' ); ?></h1>
						<p class="krawlup-subtitle"><?php esc_html_e( 'Agent-native growth intelligence, cookieless analytics & automated revenue attribution.', 'krawlup' ); ?></p>
					</div>
				</div>
				<div class="krawlup-status-badge <?php echo $is_connected ? 'is-connected' : 'is-pending'; ?>">
					<span class="status-dot"></span>
					<?php echo $is_connected ? esc_html__( 'Active & Tracking', 'krawlup' ) : esc_html__( 'Token Required', 'krawlup' ); ?>
				</div>
			</div>

			<?php settings_errors(); ?>

			<form method="post" action="options.php" class="krawlup-card">
				<?php
				settings_fields( 'krawlup_settings_group' );
				?>

				<div class="krawlup-section">
					<label for="krawlup_site_token" class="krawlup-label">
						<?php esc_html_e( 'Site Analytics Token', 'krawlup' ); ?>
						<span class="krawlup-required">*</span>
					</label>
					<p class="description">
						<?php
						printf(
							/* translators: %s: URL to Krawlup dashboard */
							esc_html__( 'Find your unique tracking token in your %s under Tracking Tag.', 'krawlup' ),
							'<a href="' . esc_url( 'https://krawlup.com/dashboard' ) . '" target="_blank" rel="noopener noreferrer">' . esc_html__( 'Krawlup Dashboard', 'krawlup' ) . ' &nearr;</a>'
						);
						?>
					</p>
					<input
						type="text"
						id="krawlup_site_token"
						name="krawlup_site_token"
						value="<?php echo esc_attr( $token ); ?>"
						class="regular-text code krawlup-input"
						placeholder="e.g. 7c0e6417726a422a94f6f3693f1ef1e8"
						autocomplete="off"
						spellcheck="false"
					/>
				</div>

				<div class="krawlup-section">
					<h3 class="krawlup-heading"><?php esc_html_e( 'Tracking Preferences', 'krawlup' ); ?></h3>

					<label class="krawlup-checkbox-row">
						<input
							type="checkbox"
							name="krawlup_track_admin"
							value="1"
							<?php checked( '1', $track_admin ); ?>
						/>
						<div>
							<strong><?php esc_html_e( 'Track Admin & Editor Visits', 'krawlup' ); ?></strong>
							<p class="description"><?php esc_html_e( 'When unchecked (recommended), visits from logged-in administrators, editors, and post authors are excluded from analytics to keep your metrics organic.', 'krawlup' ); ?></p>
						</div>
					</label>

					<label class="krawlup-checkbox-row <?php echo ! $has_wc ? 'is-disabled' : ''; ?>">
						<input
							type="checkbox"
							name="krawlup_track_woocommerce"
							value="1"
							<?php checked( '1', $track_woocommerce ); ?>
							<?php disabled( ! $has_wc ); ?>
						/>
						<div>
							<strong><?php esc_html_e( 'Auto-Track WooCommerce Orders (Revenue Attribution)', 'krawlup' ); ?></strong>
							<p class="description">
								<?php
								if ( $has_wc ) {
									esc_html_e( 'Automatically attributes completed purchases to the visitor referrer and channel. Includes order total and currency with idempotency protection against page refreshes.', 'krawlup' );
								} else {
									esc_html_e( 'WooCommerce is not currently active on this WordPress site.', 'krawlup' );
								}
								?>
							</p>
						</div>
					</label>
				</div>

				<div class="krawlup-section">
					<h3 class="krawlup-heading"><?php esc_html_e( 'Advanced / Custom Domain', 'krawlup' ); ?></h3>
					<label for="krawlup_custom_domain" class="krawlup-label">
						<?php esc_html_e( 'Tracking Endpoint URL', 'krawlup' ); ?>
					</label>
					<p class="description">
						<?php esc_html_e( 'Default is https://krawlup.com. Only change this if you are proxying the tracking script through a custom domain.', 'krawlup' ); ?>
					</p>
					<input
						type="url"
						id="krawlup_custom_domain"
						name="krawlup_custom_domain"
						value="<?php echo esc_attr( $custom_domain ); ?>"
						class="regular-text krawlup-input"
						placeholder="https://krawlup.com"
					/>
				</div>

				<div class="krawlup-actions">
					<?php submit_button( __( 'Save Changes', 'krawlup' ), 'primary krawlup-submit-btn', 'submit', false ); ?>
				</div>
			</form>
		</div>
		<?php
	}
}