<?php
/**
 * Plugin Name:       Larvabot
 * Plugin URI:        https://larvabot.com/integrations/wordpress
 * Description:       Adds the Larvabot visitor snippet to every page, so your Larvabot reports show which emails, threads, directory listings and backlinks sent real visitors. No cookies.
 * Version:           1.1.0
 * Requires at least: 6.3
 * Requires PHP:      7.4
 * Author:            Larvabot
 * Author URI:        https://larvabot.com
 * License:           GPLv2 or later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain:       larvabot
 *
 * @package Larvabot
 */

// One job: put the Larvabot snippet on every front-end page. The tracking key comes from the
// Connect button (Larvabot sends it back after you pick a project) or is pasted by hand. The
// plugin itself never calls Larvabot; the snippet in visitors' browsers sends a page-view beacon.

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

define( 'LARVABOT_VERSION', '1.1.0' );
define( 'LARVABOT_SCRIPT', 'https://larvabot.com/t.js' );
define( 'LARVABOT_APP', 'https://app.larvabot.com' );

/**
 * The saved tracking key, or '' when none (or a malformed one) is saved.
 *
 * @return string
 */
function larvabot_key() {
	$key = get_option( 'larvabot_tracking_key', '' );
	return is_string( $key ) && preg_match( '/^[a-z0-9]{8,40}$/', $key ) ? $key : '';
}

/**
 * Normalizes a pasted key: accepts the key itself or the whole snippet copied from Larvabot.
 *
 * @param mixed $value Submitted value.
 * @return string
 */
function larvabot_sanitize_key( $value ) {
	$value = strtolower( trim( (string) $value ) );
	if ( preg_match( '/data-key=["\']?([a-z0-9]{8,40})/', $value, $m ) ) {
		$value = $m[1];
	}
	if ( '' !== $value && ! preg_match( '/^[a-z0-9]{8,40}$/', $value ) ) {
		add_settings_error( 'larvabot_tracking_key', 'larvabot_bad_key', __( "That doesn't look like a Larvabot tracking key. Copy it from your project's Setup page in Larvabot, or use Connect.", 'larvabot' ) );
		return larvabot_key();
	}
	if ( larvabot_key() !== $value ) {
		update_option( 'larvabot_project', '' );
	}
	return $value;
}

// ---------- front end ----------

add_action( 'wp_enqueue_scripts', 'larvabot_enqueue' );

/**
 * Adds the snippet to every front-end page once a key is saved.
 */
function larvabot_enqueue() {
	if ( ! larvabot_key() ) {
		return;
	}
	// No version: the script is served by Larvabot, so a ?ver= would only bust its cache.
	wp_enqueue_script( 'larvabot', LARVABOT_SCRIPT, array(), null, array( 'strategy' => 'defer', 'in_footer' => false ) ); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.MissingVersion
}

add_filter( 'script_loader_tag', 'larvabot_script_tag', 10, 2 );

/**
 * The snippet reads its project from data-key.
 *
 * @param string $tag    The script tag.
 * @param string $handle Script handle.
 * @return string
 */
function larvabot_script_tag( $tag, $handle ) {
	if ( 'larvabot' !== $handle ) {
		return $tag;
	}
	return preg_replace( '/<script\b/', '<script data-key="' . esc_attr( larvabot_key() ) . '"', $tag, 1 );
}

// ---------- admin ----------

add_action( 'admin_menu', 'larvabot_menu' );

/**
 * Settings → Larvabot.
 */
function larvabot_menu() {
	add_options_page( __( 'Larvabot', 'larvabot' ), __( 'Larvabot', 'larvabot' ), 'manage_options', 'larvabot', 'larvabot_settings_page' );
}

add_action( 'admin_init', 'larvabot_admin_init' );

/**
 * Registers the setting and finishes a Connect round trip.
 */
function larvabot_admin_init() {
	register_setting(
		'larvabot',
		'larvabot_tracking_key',
		array(
			'type'              => 'string',
			'sanitize_callback' => 'larvabot_sanitize_key',
			'default'           => '',
		)
	);

	// Back from Larvabot's Connect page with the chosen project's key. The state proves this admin
	// started the connection here (it's kept per user for 30 minutes), so a crafted link can't set it.
	// phpcs:disable WordPress.Security.NonceVerification.Recommended -- the one-time state below is the nonce.
	if ( ! isset( $_GET['page'], $_GET['larvabot_key'], $_GET['larvabot_state'] ) || 'larvabot' !== $_GET['page'] ) {
		return;
	}
	if ( ! current_user_can( 'manage_options' ) ) {
		return;
	}
	$state    = sanitize_text_field( wp_unslash( $_GET['larvabot_state'] ) );
	$key      = sanitize_text_field( wp_unslash( $_GET['larvabot_key'] ) );
	$project  = isset( $_GET['larvabot_project'] ) ? sanitize_text_field( wp_unslash( $_GET['larvabot_project'] ) ) : '';
	$expected = get_transient( 'larvabot_state_' . get_current_user_id() );
	// phpcs:enable
	$result = 'failed';
	if ( is_string( $expected ) && '' !== $expected && hash_equals( $expected, $state ) && preg_match( '/^[a-z0-9]{8,40}$/', $key ) ) {
		delete_transient( 'larvabot_state_' . get_current_user_id() );
		update_option( 'larvabot_tracking_key', $key );
		update_option( 'larvabot_project', $project );
		$result = 'connected';
	}
	wp_safe_redirect( admin_url( 'options-general.php?page=larvabot&larvabot=' . $result ) );
	exit;
}

/**
 * The Connect URL, with a fresh one-time state for this admin.
 *
 * @return string
 */
function larvabot_connect_url() {
	$state = wp_generate_password( 32, false );
	set_transient( 'larvabot_state_' . get_current_user_id(), $state, 30 * MINUTE_IN_SECONDS );
	return add_query_arg(
		array(
			'site'   => rawurlencode( home_url( '/' ) ),
			'return' => rawurlencode( admin_url( 'options-general.php?page=larvabot' ) ),
			'state'  => $state,
		),
		LARVABOT_APP . '/connect/wordpress'
	);
}

add_action( 'admin_enqueue_scripts', 'larvabot_admin_assets' );

/**
 * Larvabot's own look, on its settings screen only.
 *
 * @param string $hook Current admin page.
 */
function larvabot_admin_assets( $hook ) {
	if ( 'settings_page_larvabot' === $hook ) {
		wp_enqueue_style( 'larvabot-admin', plugins_url( 'assets/admin.css', __FILE__ ), array(), LARVABOT_VERSION );
	}
}

add_action( 'admin_post_larvabot_disconnect', 'larvabot_disconnect' );

/**
 * Disconnect: removes the key, so the snippet leaves every page.
 */
function larvabot_disconnect() {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'Sorry, you are not allowed to do that.', 'larvabot' ), 403 );
	}
	check_admin_referer( 'larvabot_disconnect' );
	delete_option( 'larvabot_tracking_key' );
	delete_option( 'larvabot_project' );
	wp_safe_redirect( admin_url( 'options-general.php?page=larvabot&larvabot=disconnected' ) );
	exit;
}

/**
 * The settings page.
 */
function larvabot_settings_page() {
	if ( ! current_user_can( 'manage_options' ) ) {
		return;
	}
	$key     = larvabot_key();
	$project = (string) get_option( 'larvabot_project', '' );
	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only.
	$result  = isset( $_GET['larvabot'] ) ? sanitize_key( wp_unslash( $_GET['larvabot'] ) ) : '';
	$notices = array(
		'connected'    => array( 'ok', __( 'Connected. The Larvabot snippet is now on every page of your site.', 'larvabot' ) ),
		'disconnected' => array( 'info', __( 'Disconnected. The snippet has been removed from your site.', 'larvabot' ) ),
		'failed'       => array( 'bad', __( "That connection expired or didn't start here. Click Connect to Larvabot again.", 'larvabot' ) ),
	);
	$assets  = plugins_url( 'assets/', __FILE__ );
	?>
	<div class="wrap lb-wrap">
		<h1 class="screen-reader-text"><?php esc_html_e( 'Larvabot', 'larvabot' ); ?></h1>
		<?php // WordPress moves notices to just after the first .wrap h1; this empty one keeps them above our layout. ?>
		<hr class="wp-header-end" />

		<header class="lb-brand">
			<img src="<?php echo esc_url( $assets . 'larvabot-mark.svg' ); ?>" width="34" height="34" alt="" />
			<span class="lb-word">larvabot</span>
			<a class="lb-link" href="<?php echo esc_url( LARVABOT_APP ); ?>" target="_blank" rel="noopener"><?php esc_html_e( 'Open Larvabot', 'larvabot' ); ?> ↗</a>
		</header>

		<?php if ( isset( $notices[ $result ] ) ) : ?>
			<div class="lb-alert lb-alert-<?php echo esc_attr( $notices[ $result ][0] ); ?>" role="status"><?php echo esc_html( $notices[ $result ][1] ); ?></div>
		<?php endif; ?>
		<?php foreach ( get_settings_errors( 'larvabot_tracking_key' ) as $error ) : ?>
			<div class="lb-alert lb-alert-<?php echo 'error' === $error['type'] ? 'bad' : 'ok'; ?>" role="status"><?php echo esc_html( $error['message'] ); ?></div>
		<?php endforeach; ?>

		<section class="lb-card lb-hero">
			<div class="lb-hero-text">
				<?php if ( $key ) : ?>
					<span class="lb-pill lb-pill-ok"><span class="lb-dot"></span><?php esc_html_e( 'Connected', 'larvabot' ); ?></span>
					<h2>
						<?php
						if ( $project ) {
							/* translators: %s: Larvabot project name. */
							printf( esc_html__( 'Tracking visits for %s', 'larvabot' ), '<span class="lb-hl">' . esc_html( $project ) . '</span>' );
						} else {
							esc_html_e( 'Tracking visits on every page', 'larvabot' );
						}
						?>
					</h2>
					<p><?php esc_html_e( "The snippet is on every page of your site. If you use a caching plugin, clear its cache once, then click Check now on the project's Setup page in Larvabot.", 'larvabot' ); ?></p>
					<div class="lb-actions">
						<a class="lb-btn lb-btn-ink" href="<?php echo esc_url( LARVABOT_APP ); ?>" target="_blank" rel="noopener"><?php esc_html_e( 'See your reports', 'larvabot' ); ?></a>
						<a class="lb-btn lb-btn-ghost" href="<?php echo esc_url( larvabot_connect_url() ); ?>"><?php esc_html_e( 'Switch project', 'larvabot' ); ?></a>
						<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" onsubmit="return confirm('<?php echo esc_js( __( 'Disconnect Larvabot? The snippet will be removed from your site and visits stop being counted.', 'larvabot' ) ); ?>');">
							<input type="hidden" name="action" value="larvabot_disconnect" />
							<?php wp_nonce_field( 'larvabot_disconnect' ); ?>
							<button type="submit" class="lb-btn lb-btn-danger"><?php esc_html_e( 'Disconnect', 'larvabot' ); ?></button>
						</form>
					</div>
				<?php else : ?>
					<span class="lb-pill"><span class="lb-dot"></span><?php esc_html_e( 'Not connected', 'larvabot' ); ?></span>
					<h2><?php esc_html_e( 'See which emails and posts send you visitors', 'larvabot' ); ?></h2>
					<p><?php esc_html_e( 'Connect your Larvabot project and the visitor snippet goes on every page. Your reports then show which emails, threads, directory listings and backlinks sent real visitors.', 'larvabot' ); ?></p>
					<div class="lb-actions">
						<a class="lb-btn lb-btn-leaf" href="<?php echo esc_url( larvabot_connect_url() ); ?>"><?php esc_html_e( 'Connect to Larvabot', 'larvabot' ); ?></a>
						<a class="lb-btn lb-btn-ghost" href="https://larvabot.com" target="_blank" rel="noopener"><?php esc_html_e( 'No account? Start free', 'larvabot' ); ?></a>
					</div>
				<?php endif; ?>
			</div>
			<img class="lb-mascot" src="<?php echo esc_url( $assets . 'larvabot.svg' ); ?>" width="220" height="128" alt="" />
		</section>

		<div class="lb-grid">
			<div class="lb-card lb-mini"><b><?php esc_html_e( 'No cookies', 'larvabot' ); ?></b><span><?php esc_html_e( 'Nothing stored in the browser, and Larvabot keeps no IP addresses.', 'larvabot' ); ?></span></div>
			<div class="lb-card lb-mini"><b><?php esc_html_e( 'Under 1 KB', 'larvabot' ); ?></b><span><?php esc_html_e( 'Loads with defer, so it never slows your pages down.', 'larvabot' ); ?></span></div>
			<div class="lb-card lb-mini"><b><?php esc_html_e( 'One job', 'larvabot' ); ?></b><span><?php esc_html_e( 'Adds the snippet. Disconnect or deactivate and it is gone.', 'larvabot' ); ?></span></div>
		</div>

		<details class="lb-card lb-manual">
			<summary><?php esc_html_e( 'Paste a tracking key instead', 'larvabot' ); ?></summary>
			<form method="post" action="options.php">
				<?php settings_fields( 'larvabot' ); ?>
				<label for="larvabot_tracking_key"><?php esc_html_e( 'Tracking key', 'larvabot' ); ?></label>
				<div class="lb-row">
					<input name="larvabot_tracking_key" id="larvabot_tracking_key" type="text" class="lb-input" value="<?php echo esc_attr( $key ); ?>" autocomplete="off" spellcheck="false" placeholder="<?php esc_attr_e( 'Key or the whole snippet', 'larvabot' ); ?>" />
					<button type="submit" class="lb-btn lb-btn-ink"><?php esc_html_e( 'Save', 'larvabot' ); ?></button>
				</div>
				<p class="lb-help"><?php esc_html_e( 'In Larvabot: your project → Setup → Tracking. Paste the key or the whole snippet.', 'larvabot' ); ?></p>
			</form>
		</details>
	</div>
	<?php
}

add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), 'larvabot_action_links' );

/**
 * A Settings link on the Plugins screen.
 *
 * @param string[] $links Existing links.
 * @return string[]
 */
function larvabot_action_links( $links ) {
	array_unshift( $links, '<a href="' . esc_url( admin_url( 'options-general.php?page=larvabot' ) ) . '">' . esc_html__( 'Settings', 'larvabot' ) . '</a>' );
	return $links;
}

add_action( 'admin_notices', 'larvabot_setup_notice' );

/**
 * Until connected, a reminder on the Plugins screen only.
 */
function larvabot_setup_notice() {
	$screen = get_current_screen();
	if ( larvabot_key() || ! $screen || 'plugins' !== $screen->id || ! current_user_can( 'manage_options' ) ) {
		return;
	}
	printf(
		'<div class="notice notice-info"><p>%s <a href="%s">%s</a></p></div>',
		esc_html__( 'Larvabot is installed. Connect it to your project to start seeing which emails and posts send you visitors.', 'larvabot' ),
		esc_url( admin_url( 'options-general.php?page=larvabot' ) ),
		esc_html__( 'Connect now', 'larvabot' )
	);
}