<?php
/**
 * Explicit network-origin facts.
 *
 * @package LoggedAI
 */

namespace LoggedAI;

defined( 'ABSPATH' ) || exit;

/** Explicit network-origin facts. Site timelines remain independently scoped. */
final class NetworkActivity {
	/**
	 * Register native network activity, export and privacy navigation under their current capabilities.
	 *
	 * @return void
	 */
	public static function boot(): void {
		add_action(
			'network_admin_menu',
			static function () {
				add_menu_page( __( 'Logged.ai network activity', 'logged-ai' ), __( 'Logged.ai', 'logged-ai' ), 'manage_network_options', 'logged-ai-network', array( self::class, 'page' ), 'dashicons-list-view', 80 );
			}
		);
		add_action(
			'network_admin_menu',
			static function () {
				add_submenu_page( 'logged-ai-network', __( 'Network exports', 'logged-ai' ), __( 'Exports', 'logged-ai' ), 'logged_ai_export_network_events', 'logged-ai-network-exports', array( Exports::class, 'page_network' ) );
				add_submenu_page( 'logged-ai-network', __( 'Network privacy', 'logged-ai' ), __( 'Privacy and retention', 'logged-ai' ), 'logged_ai_manage_network_settings', 'logged-ai-network-privacy', array( NetworkPrivacy::class, 'page' ) );
			},
			20
		);
	}

	/**
	 * Buffer bounded network-origin evidence and seal all rendered reads and current network authority before output.
	 *
	 * @return void
	 */
	public static function page(): void {
		global $wpdb;
		$caller = $wpdb;
		$origin = Derived::native_context( $caller );
		$scope  = Scope::current_network();
		if ( is_wp_error( $scope ) ) {
			wp_die( esc_html__( 'Network evidence access denied.', 'logged-ai' ), '', array( 'response' => 403 ) );
		}
		$reads = array();
		$level = ob_get_level();
		// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- The native output-buffer callback must accept and discard this parameter so unsealed evidence is never flushed.
		ob_start( static fn( string $chunk ): string => '' );
		try {
			self::render_page( $scope, $reads );
			$html = ob_get_clean();
		} finally {
			while ( ob_get_level() > $level ) {
				ob_end_clean();
			}
		}
		$valid = is_string( $html ) && strlen( $html ) <= 2097152 && Derived::native_context( $caller ) === $origin;
		$valid = $valid && Store::render_groups( $scope, $reads );
		if ( ! $reads ) {
			$valid = $valid && $scope->valid_for_all( array( 'logged_ai_view_network_events' ) );
		}
		if ( ! $valid || Derived::native_context( $caller ) !== $origin ) {
			wp_die( esc_html__( 'Network evidence or access changed while rendering. Reload.', 'logged-ai' ), '', array( 'response' => 403 ) );
		}
		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Every dynamic fragment was context-escaped in render_page; only the sealed buffer is emitted, without invoking another output callback.
		echo $html; // Escaped while buffered; no native output callbacks after the seal.
	}

	/**
	 * Render scoped network filters, event detail and a bounded timeline while recording reads for final sealing.
	 *
	 * @param Scope $scope Server-selected current operation scope with its required native permissions.
	 * @param array $reads Rendered source groups appended by reference for the page's final current-evidence seal.
	 *
	 * @return void
	 */
	private static function render_page( Scope $scope, array &$reads ): void {
		$request_query = \LoggedAI\AdminInput::query();
		try {
			$time = TimeDisplay::site();
		} catch ( \Throwable $error ) {
			wp_die( esc_html__( 'Site timezone context changed. Reload this view.', 'logged-ai' ), '', array( 'response' => 403 ) );
		}
		nocache_headers();
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only network navigation uses validated filters, IDs and cursors within the current authorized scope.
		$input   = $request_query;
		$cursor  = $input['cursor'] ?? '';
		$filters = Activity::input_filters( $input, array( 'page', 'event', 'event_uid', 'cursor' ) );
		if ( isset( $input['event_uid'] ) && ( ! isset( $input['event'] ) || ! is_string( $input['event_uid'] ) || ! preg_match( '/\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/D', $input['event_uid'] ) ) ) {
			wp_die( esc_html__( 'This recorded event is unavailable or no longer retained.', 'logged-ai' ), '', array( 'response' => 404 ) );
		}
		if ( is_wp_error( $filters ) || ! is_string( $cursor ) ) {
			wp_die( esc_html__( 'Invalid filter or cursor. Network scope has not changed.', 'logged-ai' ), '', array( 'response' => 400 ) ); }
		$base = add_query_arg( array_merge( array( 'page' => 'logged-ai-network' ), Activity::url_filters( $filters ), $cursor ? array( 'cursor' => $cursor ) : array() ), Scope::network_admin_url( 'admin.php' ) );
		$rows = Store::listing( $scope, $filters, $cursor, 50 );
		echo '<div class="wrap logged-ai"><h1>' . esc_html__( 'Network activity', 'logged-ai' ) . '</h1><p>' . esc_html__( 'These facts originated in this network’s administrative context. Plugin, theme and WordPress files are shared across the installation, so their effects can extend to other networks. Site activity remains in each site’s own timeline.', 'logged-ai' ) . '</p>';
		echo ( '<p>' . ( esc_html( sprintf( /* translators: 1: Value shown in this message. 2: Value shown in this message. */ __( 'Network #%1$s · Times shown in %2$s (current site setting)', 'logged-ai' ), $scope->network_id, $time->zone() ) ) ) . '</p>' );
		Activity::filter_form( $filters, true );
		if ( isset( $input['event'] ) ) {
			echo '<p><a class="button" href="' . esc_url( $base ) . '">' . esc_html__( 'Back to filtered network activity', 'logged-ai' ) . '</a></p>';
			$detail = is_string( $input['event'] ) ? Store::detail( $scope, $input['event'] ) : new \WP_Error( 'event', 'Event unavailable.' );
			if ( ! is_wp_error( $detail ) && isset( $input['event_uid'] ) && $input['event_uid'] !== ( $detail['uid'] ?? null ) ) {
				$detail = new \WP_Error( 'event', __( 'This recorded event is unavailable or no longer retained.', 'logged-ai' ) );
			}
			if ( is_wp_error( $detail ) ) {
				echo ( '<p role="alert">' . ( esc_html( PresentationTranslations::text( $detail->get_error_message() ) ) ) . '</p>' ); } else {
				$reads[] = array(
					'value'  => $detail,
					'detail' => true,
				);
				echo ( '<h2>' . ( esc_html( sprintf( /* translators: 1: Value shown in this message. */ __( 'Event #%1$s', 'logged-ai' ), $detail['id'] ) ) ) . '</h2>' . '<p>' . ( esc_html( sprintf( /* translators: 1: Value shown in this message. 2: Value shown in this message. */ __( 'Occurred: %1$s · Ingested: %2$s', 'logged-ai' ), $time->text( $detail['occurred_at'] ), $time->text( $detail['ingested_at'] ) ) ) ) . '</p>' . '<p>' . esc_html__( 'Canonical evidence below retains UTC timestamps.', 'logged-ai' ) . '</p>' . '<pre style="white-space:pre-wrap;overflow-wrap:anywhere">' . ( esc_html( wp_json_encode( $detail, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES ) ) ) . '</pre>' ); }
		}
		if ( is_wp_error( $rows ) ) {
			echo ( '<p role="alert">' . ( esc_html( PresentationTranslations::text( $rows->get_error_message() ) ) ) . '</p>' ); } else {
			$reads[] = array(
				'value'  => $rows,
				'detail' => false,
			);
			echo ( '<div style="max-width:100%;overflow:auto">' . '<table class="widefat">' . '<thead>' . '<tr>' . '<th>' . esc_html__( 'Time (selected timezone)', 'logged-ai' ) . '</th>' . '<th>' . esc_html__( 'Event', 'logged-ai' ) . '</th>' . '<th>' . esc_html__( 'Actor', 'logged-ai' ) . '</th>' . '<th>' . esc_html__( 'Outcome', 'logged-ai' ) . '</th>' . '</tr>' . '</thead>' . '<tbody>' );
			foreach ( $rows['events'] as $event ) {
				$url = add_query_arg( 'event', $event['id'], $base );
				echo ( '<tr>' . '<td>' . ( esc_html( $time->text( $event['occurred_at'] ) ) ) . '</td>' . '<td>' . '<a href="' . ( esc_url( $url ) ) . '">' . ( esc_html( $event['code'] ) ) . '</a>' . '</td>' . '<td>' . ( esc_html( ( $event['actor_id'] ? sprintf( /* translators: 1: Value shown in this message. */ __( 'User #%1$s', 'logged-ai' ), $event['actor_id'] ) : $event['actor_kind'] ) ) ) . '</td>' . '<td>' . ( esc_html( $event['outcome'] ) ) . '</td>' . '</tr>' );
			}
			echo '</tbody></table></div>';
			if ( $rows['next_cursor'] ) {
				echo '<p><a class="button" href="' . esc_url( add_query_arg( 'cursor', $rows['next_cursor'], $base ) ) . '">' . esc_html__( 'Older network activity', 'logged-ai' ) . '</a></p>'; }
			}
			if ( $scope->valid_for( 'logged_ai_export_network_events' ) ) {
				Activity::background_export_form( $filters, true ); }
			echo '</div>';
	}
}