<?php
/**
 * Admin screens and actions.
 *
 * @package Maintained_Log
 */

namespace Maintained_Log\Admin;

use Maintained_Log\Alerts;
use Maintained_Log\Backups;
use Maintained_Log\Cron_Status;
use Maintained_Log\Environment;
use Maintained_Log\Health_Checks;
use Maintained_Log\Inventory;
use Maintained_Log\Log;
use Maintained_Log\Performance;
use Maintained_Log\Public_Report;
use Maintained_Log\Tech_Status;
use Maintained_Log\Vulnerabilities;
use Maintained_Log\Plugin;
use Maintained_Log\Reporter;
use Maintained_Log\Rollback;
use Maintained_Log\Settings;

defined( 'ABSPATH' ) || exit;

/**
 * Log, report and settings screens.
 */
class Admin {

	const SLUG          = 'maintained-log';
	const REPORT_SLUG   = 'maintained-log-report';
	const SETTINGS_SLUG = 'maintained-log-settings';

	/**
	 * Registers hooks.
	 */
	public static function register() {
		add_action( 'admin_menu', array( __CLASS__, 'menu' ) );
		Onboarding::register();
		Maintainer_Widget::register();
		add_action( 'wp_ajax_maintained_log_fetch', array( __CLASS__, 'ajax_fetch' ) );
		add_action( 'admin_init', array( __CLASS__, 'register_settings' ) );
		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'assets' ) );
		add_action( 'admin_notices', array( __CLASS__, 'environment_notice' ) );
		add_filter( 'plugin_action_links_' . plugin_basename( MAINTAINED_LOG_FILE ), array( __CLASS__, 'action_links' ) );

		$actions = array( 'add_entry', 'run_checks', 'snapshot', 'send_report', 'export', 'verify', 'confirm_production', 'pending_alert', 'backup_confirm', 'rollback', 'regenerate_token', 'tech_refresh', 'tech_notes', 'vuln_review', 'vuln_unreview' );
		foreach ( $actions as $action ) {
			add_action( 'admin_post_maintained_log_' . $action, array( __CLASS__, 'handle_' . $action ) );
		}
	}

	/**
	 * Adds the menu pages.
	 */
	public static function menu() {
		// Only the people who maintain the site see the menu, even if the client is an administrator.
		$cap = Plugin::user_can_manage() ? Plugin::capability() : 'do_not_allow';
		add_menu_page( 'Maintained.log', 'Maintained.log', $cap, self::SLUG, array( __CLASS__, 'render_log' ), 'dashicons-clipboard', 81 );
		add_submenu_page( self::SLUG, __( 'Maintenance log', 'maintained-log' ), __( 'Log', 'maintained-log' ), $cap, self::SLUG, array( __CLASS__, 'render_log' ) );
		add_submenu_page( self::SLUG, __( 'Client report', 'maintained-log' ), __( 'Client report', 'maintained-log' ), $cap, self::REPORT_SLUG, array( __CLASS__, 'render_report' ) );
		add_submenu_page( self::SLUG, __( 'Settings', 'maintained-log' ), __( 'Settings', 'maintained-log' ), $cap, self::SETTINGS_SLUG, array( __CLASS__, 'render_settings' ) );
	}

	/**
	 * Registers the settings option.
	 */
	public static function register_settings() {
		register_setting(
			'maintained_log',
			Settings::OPTION,
			array(
				'type'              => 'array',
				'sanitize_callback' => array( Settings::class, 'sanitize' ),
			)
		);
		add_filter(
			'option_page_capability_maintained_log',
			static function ( $cap ) {
				return Plugin::user_can_manage() ? $cap : 'do_not_allow';
			}
		);
	}

	/**
	 * Enqueues admin CSS on plugin screens.
	 *
	 * @param string $hook Current screen hook.
	 */
	public static function assets( $hook ) {
		if ( false === strpos( $hook, self::SLUG ) ) {
			return;
		}
		wp_enqueue_style( 'maintained-log-admin', MAINTAINED_LOG_URL . 'admin/admin.css', array(), MAINTAINED_LOG_VERSION );
		wp_enqueue_script( 'maintained-log-admin', MAINTAINED_LOG_URL . 'admin/admin.js', array(), MAINTAINED_LOG_VERSION, true );

		if ( false !== strpos( $hook, self::SETTINGS_SLUG ) ) {
			wp_enqueue_script( 'maintained-log-fetch', MAINTAINED_LOG_URL . 'admin/fetch-now.js', array(), MAINTAINED_LOG_VERSION, true );
			wp_localize_script(
				'maintained-log-fetch',
				'maintainedLogFetch',
				array(
					'ajaxUrl' => admin_url( 'admin-ajax.php' ),
					'nonce'   => wp_create_nonce( 'maintained_log_fetch' ),
					'working' => __( 'Working… keep this page open.', 'maintained-log' ),
					'failed'  => __( 'The request failed. Check your connection and try again.', 'maintained-log' ),
				)
			);
		}
	}

	/**
	 * Settings link on the plugins screen.
	 *
	 * @param array $links Links.
	 * @return array
	 */
	public static function action_links( $links ) {
		if ( ! Plugin::user_can_manage() ) {
			return $links;
		}
		array_unshift( $links, '<a href="' . esc_url( admin_url( 'admin.php?page=' . self::SETTINGS_SLUG ) ) . '">' . esc_html__( 'Settings', 'maintained-log' ) . '</a>' );
		return $links;
	}

	/**
	 * Warns on plugin screens when client emails are blocked.
	 */
	public static function environment_notice() {
		$screen = get_current_screen();
		if ( ! $screen || false === strpos( $screen->id, self::SLUG ) || ! Plugin::user_can_manage() ) {
			return;
		}

		self::flash_notice();

		$reason = Environment::blocking_reason();
		if ( '' === $reason ) {
			return;
		}
		?>
		<div class="notice notice-warning">
			<p>
				<strong><?php esc_html_e( 'Client emails are paused.', 'maintained-log' ); ?></strong>
				<?php echo esc_html( $reason ); ?>
				<?php esc_html_e( 'The log keeps working, but reports will not be sent to clients from this copy.', 'maintained-log' ); ?>
			</p>
			<?php if ( 'production' === wp_get_environment_type() ) : ?>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
					<?php wp_nonce_field( 'maintained_log_confirm_production' ); ?>
					<input type="hidden" name="action" value="maintained_log_confirm_production">
					<p><button class="button"><?php esc_html_e( 'This is the live site now', 'maintained-log' ); ?></button></p>
				</form>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * Log screen.
	 */
	public static function render_log() {
		self::require_cap();
		Inventory::maybe_detect_external();

		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- Read-only filters.
		$type   = isset( $_GET['type'] ) ? sanitize_key( wp_unslash( $_GET['type'] ) ) : '';
		$paged  = isset( $_GET['paged'] ) ? max( 1, absint( $_GET['paged'] ) ) : 1;
		$amends = isset( $_GET['amend'] ) ? absint( $_GET['amend'] ) : 0;
		// phpcs:enable

		$per_page = 50;
		$args     = array(
			'type'     => array_key_exists( $type, Log::types() ) ? $type : '',
			'per_page' => $per_page,
			'page'     => $paged,
		);
		$entries  = Log::query( $args );
		$total    = Log::count( $args );
		$pending  = Alerts::pending_updates();
		$original = $amends ? Log::get( $amends ) : null;
		$types    = Log::types();
		$cats     = Log::categories();
		$base_url = admin_url( 'admin.php?page=' . self::SLUG );
		?>
		<div class="wrap maintained-log">
			<h1 class="wp-heading-inline">Maintained.log</h1>
			<?php self::action_button( 'run_checks', __( 'Run site checks', 'maintained-log' ), 'page-title-action' ); ?>
			<?php self::action_button( 'snapshot', __( 'Record changes now', 'maintained-log' ), 'page-title-action' ); ?>
			<?php if ( Performance::is_enabled() ) : ?>
				<a class="page-title-action" href="<?php echo esc_url( admin_url( 'admin.php?page=' . self::SETTINGS_SLUG . '#ml-fetch' ) ); ?>"><?php esc_html_e( 'Measure speed now', 'maintained-log' ); ?></a>
			<?php endif; ?>
			<hr class="wp-header-end">

			<div class="ml-cards">
				<?php $active_exposures = Vulnerabilities::is_enabled() ? Vulnerabilities::active_exposures() : array(); ?>
				<div class="ml-card <?php echo $pending ? 'ml-card--warning' : 'ml-card--ok'; ?><?php echo $active_exposures ? ' ml-card--danger' : ''; ?>">
					<div class="ml-card__value"><?php echo esc_html( count( $pending ) ); ?></div>
					<div class="ml-card__label"><?php esc_html_e( 'pending updates', 'maintained-log' ); ?></div>
					<?php if ( $active_exposures ) : ?>
						<div class="ml-card__alert">
							<a href="#ml-vulns">
								<?php
								/* translators: %d: number of components. */
								echo esc_html( sprintf( _n( '%d with known vulnerabilities', '%d with known vulnerabilities', count( $active_exposures ), 'maintained-log' ), count( $active_exposures ) ) );
								?>
							</a>
						</div>
					<?php endif; ?>
					<?php $inactive_exposures = Vulnerabilities::is_enabled() ? Vulnerabilities::inactive_exposures() : array(); ?>
					<?php if ( $inactive_exposures ) : ?>
						<div class="ml-card__note">
							<a href="#ml-vulns">
								<?php
								/* translators: %d: number of components. */
								echo esc_html( sprintf( _n( '+ %d deactivated with vulnerabilities', '+ %d deactivated with vulnerabilities', count( $inactive_exposures ), 'maintained-log' ), count( $inactive_exposures ) ) );
								?>
							</a>
						</div>
					<?php endif; ?>
					<?php if ( $pending ) : ?>
						<a href="<?php echo esc_url( admin_url( 'update-core.php' ) ); ?>"><?php esc_html_e( 'Review updates', 'maintained-log' ); ?></a>
					<?php endif; ?>
				</div>
				<?php
				$month_start = get_gmt_from_date( wp_date( 'Y-m-01 00:00:00' ) );
				$month_args  = array(
					'from'     => $month_start,
					'per_page' => 0,
				);
				$month_tasks = Log::query( array_merge( $month_args, array( 'type' => Log::TYPE_MANUAL ) ) );
				$minutes     = array_sum( wp_list_pluck( $month_tasks, 'minutes' ) );
				?>
				<?php
				$backup_days    = Backups::days_since( Backups::KIND_CHECKED );
				$backup_restore = Backups::last_confirmation( Backups::KIND_RESTORE_TEST );
				?>
				<div class="ml-card ml-card--wide <?php echo Backups::is_overdue() ? 'ml-card--warning' : 'ml-card--ok'; ?>">
					<div class="ml-card__value">
						<?php
						if ( null === $backup_days ) {
							esc_html_e( 'Not checked', 'maintained-log' );
						} elseif ( 0 === $backup_days ) {
							esc_html_e( 'Today', 'maintained-log' );
						} else {
							/* translators: %d: number of days. */
							echo esc_html( sprintf( _n( '%d day ago', '%d days ago', $backup_days, 'maintained-log' ), $backup_days ) );
						}
						?>
					</div>
					<div class="ml-card__label">
						<?php esc_html_e( 'backups last checked', 'maintained-log' ); ?>
						<?php if ( $backup_restore ) : ?>
							<br>
							<?php
							/* translators: %s: date. */
							echo esc_html( sprintf( __( 'Last restore test: %s', 'maintained-log' ), self::local_date( $backup_restore->created_at, get_option( 'date_format' ) ) ) );
							?>
						<?php endif; ?>
					</div>
					<div class="ml-card__actions">
						<?php
						self::action_button( 'backup_confirm', __( 'Checked today', 'maintained-log' ), 'button button-small', array( 'kind' => Backups::KIND_CHECKED ) );
						self::action_button( 'backup_confirm', __( 'Restore test done', 'maintained-log' ), 'button button-small', array( 'kind' => Backups::KIND_RESTORE_TEST ) );
						?>
					</div>
					<?php if ( ! Backups::has_policy() ) : ?>
						<a href="<?php echo esc_url( admin_url( 'admin.php?page=' . self::SETTINGS_SLUG . '#ml-backups' ) ); ?>"><?php esc_html_e( 'Describe your backup policy', 'maintained-log' ); ?></a>
					<?php endif; ?>
				</div>
				<div class="ml-card">
					<div class="ml-card__value"><?php echo esc_html( Log::count( array_merge( $month_args, array( 'type' => Log::TYPE_UPDATE ) ) ) ); ?></div>
					<div class="ml-card__label"><?php esc_html_e( 'changes this month', 'maintained-log' ); ?></div>
				</div>
				<div class="ml-card">
					<div class="ml-card__value"><?php echo esc_html( Reporter::format_minutes( $minutes ) ); ?></div>
					<div class="ml-card__label"><?php esc_html_e( 'logged this month', 'maintained-log' ); ?></div>
				</div>
			</div>

			<div class="ml-columns">
				<div class="ml-main">
					<?php self::render_exposures(); ?>
					<ul class="subsubsub">
						<li><a href="<?php echo esc_url( $base_url ); ?>" class="<?php echo '' === $args['type'] ? 'current' : ''; ?>"><?php esc_html_e( 'All', 'maintained-log' ); ?></a> |</li>
						<?php foreach ( $types as $slug => $label ) : ?>
							<li><a href="<?php echo esc_url( add_query_arg( 'type', $slug, $base_url ) ); ?>" class="<?php echo $slug === $args['type'] ? 'current' : ''; ?>"><?php echo esc_html( $label ); ?></a><?php echo array_key_last( $types ) === $slug ? '' : ' |'; ?></li>
						<?php endforeach; ?>
					</ul>
					<div class="ml-toolbar">
						<a class="button" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=maintained_log_export&type=' . $args['type'] ), 'maintained_log_export' ) ); ?>"><?php esc_html_e( 'Export CSV', 'maintained-log' ); ?></a>
						<?php self::action_button( 'verify', __( 'Verify integrity', 'maintained-log' ) ); ?>
					</div>

					<table class="widefat striped ml-log">
						<thead>
							<tr>
								<th class="ml-col-date"><?php esc_html_e( 'Date', 'maintained-log' ); ?></th>
								<th class="ml-col-type"><?php esc_html_e( 'Type', 'maintained-log' ); ?></th>
								<th><?php esc_html_e( 'Entry', 'maintained-log' ); ?></th>
								<th class="ml-col-who"><?php esc_html_e( 'By', 'maintained-log' ); ?></th>
							</tr>
						</thead>
						<tbody>
						<?php if ( ! $entries ) : ?>
							<tr><td colspan="4"><?php esc_html_e( 'Nothing logged yet.', 'maintained-log' ); ?></td></tr>
						<?php endif; ?>
						<?php foreach ( $entries as $entry ) : ?>
							<tr id="ml-entry-<?php echo esc_attr( $entry->id ); ?>">
								<td class="ml-col-date"><?php echo esc_html( self::local_date( $entry->created_at, get_option( 'date_format' ) . ' H:i' ) ); ?></td>
								<td class="ml-col-type">
									<span class="ml-status ml-status--<?php echo esc_attr( $entry->status ); ?>"></span>
									<?php echo esc_html( isset( $types[ $entry->type ] ) ? $types[ $entry->type ] : $entry->type ); ?>
								</td>
								<td>
									<strong><?php echo esc_html( $entry->title ); ?></strong>
									<?php if ( Log::TYPE_MANUAL === $entry->type && isset( $cats[ $entry->category ] ) ) : ?>
										<span class="ml-tag"><?php echo esc_html( $cats[ $entry->category ] ); ?></span>
									<?php endif; ?>
									<?php if ( $entry->minutes ) : ?>
										<span class="ml-tag"><?php echo esc_html( Reporter::format_minutes( $entry->minutes ) ); ?></span>
									<?php endif; ?>
									<?php if ( $entry->amends_id ) : ?>
										<span class="ml-tag ml-tag--amend">
											<?php
											/* translators: %d: entry ID. */
											echo esc_html( sprintf( __( 'corrects #%d', 'maintained-log' ), $entry->amends_id ) );
											?>
										</span>
									<?php endif; ?>
									<?php self::render_details( $entry ); ?>
									<?php self::render_security_fixes( $entry ); ?>
									<?php self::render_rollback_action( $entry ); ?>
									<?php if ( Log::TYPE_MANUAL === $entry->type ) : ?>
										<div class="row-actions"><a href="<?php echo esc_url( add_query_arg( 'amend', $entry->id, $base_url ) . '#ml-add' ); ?>"><?php esc_html_e( 'Add correction', 'maintained-log' ); ?></a></div>
									<?php endif; ?>
								</td>
								<td class="ml-col-who"><?php echo esc_html( self::author( $entry ) ); ?></td>
							</tr>
						<?php endforeach; ?>
						</tbody>
					</table>

					<?php
					$pages = (int) ceil( $total / $per_page );
					if ( $pages > 1 ) {
						echo '<div class="tablenav"><div class="tablenav-pages">';
						echo wp_kses_post(
							paginate_links(
								array(
									'base'    => add_query_arg( 'paged', '%#%' ),
									'format'  => '',
									'current' => $paged,
									'total'   => $pages,
								)
							)
						);
						echo '</div></div>';
					}
					?>
				</div>

				<div class="ml-side" id="ml-add">
					<?php $tech = Tech_Status::get(); ?>
					<div class="postbox">
						<h2 class="hndle"><?php esc_html_e( 'Technical status', 'maintained-log' ); ?></h2>
						<div class="inside">
							<ul class="ml-tech">
								<?php foreach ( $tech['items'] as $key => $item ) : ?>
									<li>
										<span class="ml-status ml-status--<?php echo esc_attr( 'ok' === $item['status'] ? 'success' : $item['status'] ); ?>"></span>
										<strong><?php echo esc_html( $item['label'] ); ?></strong><br>
										<span class="ml-muted"><?php echo esc_html( $item['detail'] ); ?></span>
										<?php if ( 'ok' !== $item['status'] ) : ?>
											<?php $note = Tech_Status::notes()[ $key ]['text'] ?? ''; ?>
											<?php if ( $note ) : ?>
												<div class="ml-tech__note"><?php echo esc_html( $note ); ?></div>
											<?php endif; ?>
											<a href="<?php echo esc_url( admin_url( 'admin.php?page=' . self::SETTINGS_SLUG . '#ml-tech-notes' ) ); ?>"><?php echo $note ? esc_html__( 'Edit note', 'maintained-log' ) : esc_html__( 'Add a note for the client', 'maintained-log' ); ?></a>
											<?php if ( 'health' === $key ) : ?>
												· <a href="<?php echo esc_url( admin_url( 'site-health.php' ) ); ?>"><?php esc_html_e( 'Site Health', 'maintained-log' ); ?></a>
											<?php endif; ?>
										<?php endif; ?>
									</li>
								<?php endforeach; ?>
							</ul>
							<?php self::action_button( 'tech_refresh', __( 'Check again', 'maintained-log' ), 'button button-small' ); ?>
						</div>
					</div>
					<div class="postbox">
						<h2 class="hndle"><?php echo $original ? esc_html__( 'Correct an entry', 'maintained-log' ) : esc_html__( 'Log a task', 'maintained-log' ); ?></h2>
						<div class="inside">
							<?php if ( $original ) : ?>
								<p class="description">
									<?php
									/* translators: 1: entry ID, 2: entry title. */
									echo esc_html( sprintf( __( 'The original entry #%1$d ("%2$s") stays in the log. This correction replaces it in client reports.', 'maintained-log' ), $original->id, $original->title ) );
									?>
								</p>
							<?php endif; ?>
							<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
								<?php wp_nonce_field( 'maintained_log_add_entry' ); ?>
								<input type="hidden" name="action" value="maintained_log_add_entry">
								<input type="hidden" name="amends_id" value="<?php echo esc_attr( $original ? $original->id : 0 ); ?>">
								<p>
									<label for="ml-title"><?php esc_html_e( 'What was done', 'maintained-log' ); ?></label>
									<input type="text" id="ml-title" name="title" class="widefat" required value="<?php echo esc_attr( $original ? $original->title : '' ); ?>" placeholder="<?php esc_attr_e( 'e.g. Tested the contact form and checkout', 'maintained-log' ); ?>">
								</p>
								<p>
									<label for="ml-category"><?php esc_html_e( 'Category', 'maintained-log' ); ?></label>
									<select id="ml-category" name="category" class="widefat">
										<?php foreach ( $cats as $slug => $label ) : ?>
											<option value="<?php echo esc_attr( $slug ); ?>" <?php selected( $original ? $original->category : 'test', $slug ); ?>><?php echo esc_html( $label ); ?></option>
										<?php endforeach; ?>
									</select>
								</p>
								<p>
									<label for="ml-notes"><?php esc_html_e( 'Details (visible to the client)', 'maintained-log' ); ?></label>
									<textarea id="ml-notes" name="notes" rows="4" class="widefat"><?php echo esc_textarea( $original && isset( $original->details['notes'] ) ? $original->details['notes'] : '' ); ?></textarea>
								</p>
								<p class="ml-inline">
									<span>
										<label for="ml-minutes"><?php esc_html_e( 'Minutes', 'maintained-log' ); ?></label>
										<input type="number" id="ml-minutes" name="minutes" min="0" step="5" class="small-text" value="<?php echo esc_attr( $original ? $original->minutes : '' ); ?>">
									</span>
									<span>
										<label for="ml-date"><?php esc_html_e( 'Date', 'maintained-log' ); ?></label>
										<input type="datetime-local" id="ml-date" name="date" value="<?php echo esc_attr( $original ? get_date_from_gmt( $original->created_at, 'Y-m-d\TH:i' ) : wp_date( 'Y-m-d\TH:i' ) ); ?>">
									</span>
								</p>
								<p>
									<label for="ml-status"><?php esc_html_e( 'Result', 'maintained-log' ); ?></label>
									<select id="ml-status" name="status" class="widefat">
										<option value="success"><?php esc_html_e( 'OK', 'maintained-log' ); ?></option>
										<option value="warning" <?php selected( $original ? $original->status : '', 'warning' ); ?>><?php esc_html_e( 'Needs attention', 'maintained-log' ); ?></option>
										<option value="error" <?php selected( $original ? $original->status : '', 'error' ); ?>><?php esc_html_e( 'Problem found', 'maintained-log' ); ?></option>
									</select>
								</p>
								<p><button class="button button-primary"><?php echo $original ? esc_html__( 'Save correction', 'maintained-log' ) : esc_html__( 'Add to log', 'maintained-log' ); ?></button></p>
							</form>
						</div>
					</div>
				</div>
			</div>
		</div>
		<?php
	}

	/**
	 * Report preview and send screen.
	 */
	public static function render_report() {
		self::require_cap();

		$period = Reporter::manual_period();
		$tz     = wp_timezone();
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- Read-only preview.
		if ( ! empty( $_GET['from'] ) ) {
			$from = \DateTimeImmutable::createFromFormat( 'Y-m-d', sanitize_text_field( wp_unslash( $_GET['from'] ) ), $tz );
			if ( $from ) {
				$period['from'] = $from->setTime( 0, 0 );
			}
		}
		if ( ! empty( $_GET['to'] ) ) {
			$to = \DateTimeImmutable::createFromFormat( 'Y-m-d', sanitize_text_field( wp_unslash( $_GET['to'] ) ), $tz );
			if ( $to ) {
				$period['to'] = $to->setTime( 0, 0 )->modify( '+1 day' );
			}
		}
		// phpcs:enable

		$report     = Reporter::build( $period['from'], $period['to'] );
		$html       = Reporter::render( $report, 'preview' );
		$recipients = Settings::get( 'report_recipients' );
		$next       = Reporter::due_period();
		$last_day   = $period['to']->format( 'H:i:s' ) === '00:00:00' ? $period['to']->modify( '-1 day' ) : $period['to'];
		?>
		<div class="wrap maintained-log">
			<h1><?php esc_html_e( 'Client report', 'maintained-log' ); ?></h1>

			<form method="get" class="ml-period">
				<input type="hidden" name="page" value="<?php echo esc_attr( self::REPORT_SLUG ); ?>">
				<label><?php esc_html_e( 'From', 'maintained-log' ); ?> <input type="date" name="from" value="<?php echo esc_attr( $period['from']->format( 'Y-m-d' ) ); ?>"></label>
				<label><?php esc_html_e( 'To', 'maintained-log' ); ?> <input type="date" name="to" value="<?php echo esc_attr( $last_day->format( 'Y-m-d' ) ); ?>"></label>
				<button class="button"><?php esc_html_e( 'Update preview', 'maintained-log' ); ?></button>
			</form>

			<p class="description">
				<?php
				$frequencies = Settings::report_frequencies();
				/* translators: %s: frequency label. */
				echo esc_html( sprintf( __( 'Automatic reports: %s.', 'maintained-log' ), $frequencies[ Settings::get( 'report_frequency' ) ] ) );
				echo ' ';
				if ( $recipients ) {
					/* translators: %s: email addresses. */
					echo esc_html( sprintf( __( 'Recipients: %s', 'maintained-log' ), $recipients ) );
				} else {
					echo '<a href="' . esc_url( admin_url( 'admin.php?page=' . self::SETTINGS_SLUG ) ) . '">' . esc_html__( 'Add client recipients in Settings.', 'maintained-log' ) . '</a>';
				}
				if ( $next ) {
					echo ' ' . esc_html__( 'A scheduled report is due and will be sent on the next cron run.', 'maintained-log' );
				}
				echo ' <a href="' . esc_url( admin_url( 'admin.php?page=' . self::SETTINGS_SLUG . '#ml-sending' ) ) . '">' . esc_html__( 'When is the automatic report sent?', 'maintained-log' ) . '</a>';
				?>
			</p>

			<?php if ( $report['public_url'] ) : ?>
				<p>
					<?php esc_html_e( 'Public link to this report:', 'maintained-log' ); ?>
					<a href="<?php echo esc_url( $report['public_url'] ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'open', 'maintained-log' ); ?></a>
					<input type="text" class="large-text code" readonly value="<?php echo esc_attr( $report['public_url'] ); ?>" data-ml-select>
				</p>
			<?php endif; ?>

			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="ml-send">
				<?php wp_nonce_field( 'maintained_log_send_report' ); ?>
				<input type="hidden" name="action" value="maintained_log_send_report">
				<input type="hidden" name="from" value="<?php echo esc_attr( $period['from']->format( 'Y-m-d H:i:s' ) ); ?>">
				<input type="hidden" name="to" value="<?php echo esc_attr( $period['to']->format( 'Y-m-d H:i:s' ) ); ?>">
				<button class="button" name="mode" value="test"><?php esc_html_e( 'Send a test to me', 'maintained-log' ); ?></button>
				<button class="button button-primary" name="mode" value="client" <?php disabled( ! $recipients || ! Environment::can_email_clients() ); ?>><?php esc_html_e( 'Send to client', 'maintained-log' ); ?></button>
			</form>

			<?php if ( $report['last_check'] && ! $report['last_check_ok'] ) : ?>
				<div class="notice notice-warning inline">
					<p><?php esc_html_e( 'The latest site check failed. The client will only see those pages as "under review", without technical details. Fix them and run the checks again before sending, so the report shows the final result.', 'maintained-log' ); ?></p>
				</div>
			<?php endif; ?>

			<iframe class="ml-preview" title="<?php esc_attr_e( 'Report preview', 'maintained-log' ); ?>" sandbox="" srcdoc="<?php echo htmlspecialchars( $html, ENT_QUOTES, 'UTF-8', true ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- esc_attr() does not double-encode, which would unescape the report markup inside srcdoc. ?>"></iframe>
		</div>
		<?php
	}

	/**
	 * Settings screen.
	 */
	public static function render_settings() {
		self::require_cap();
		$s = Settings::all();
		?>
		<div class="wrap maintained-log">
			<h1 class="wp-heading-inline"><?php esc_html_e( 'Maintained.log settings', 'maintained-log' ); ?></h1>
			<a class="page-title-action" href="<?php echo esc_url( Onboarding::url( 'brand' ) ); ?>"><?php esc_html_e( 'Open the setup assistant', 'maintained-log' ); ?></a>
			<hr class="wp-header-end">
			<?php self::render_fetch_now(); ?>
			<?php self::render_tech_notes(); ?>
			<form method="post" action="options.php">
				<?php settings_fields( 'maintained_log' ); ?>

				<h2><?php esc_html_e( 'Client report', 'maintained-log' ); ?></h2>
				<?php self::render_sending_conditions(); ?>
				<table class="form-table" role="presentation">
					<?php
					self::field_select( 'report_frequency', __( 'Send automatically', 'maintained-log' ), Settings::report_frequencies(), $s );
					self::field_text( 'client_name', __( 'Client name', 'maintained-log' ), $s, __( 'The person who receives the report, e.g. "Ana" or "Ana García". Used in the greeting of the report ({client_name}).', 'maintained-log' ) );
					self::field_text( 'report_recipients', __( 'Client emails', 'maintained-log' ), $s, __( 'Separate several addresses with commas.', 'maintained-log' ) );
					self::field_text( 'report_from_name', __( 'From name', 'maintained-log' ), $s, __( 'Defaults to the agency name.', 'maintained-log' ) );
					self::field_text( 'report_from_email', __( 'From email', 'maintained-log' ), $s, __( 'Use an address on a domain your mail server is allowed to send for, or leave empty to use the WordPress default.', 'maintained-log' ), 'email' );
					self::field_text( 'report_subject', __( 'Subject', 'maintained-log' ), $s );
					self::field_textarea( 'report_intro', __( 'Introduction', 'maintained-log' ), $s );
					self::field_textarea( 'report_outro', __( 'Closing', 'maintained-log' ), $s );
					?>
					<tr>
						<th scope="row"><?php esc_html_e( 'Placeholders', 'maintained-log' ); ?></th>
						<td><code>{client_name}</code> <code>{site_name}</code> <code>{site_url}</code> <code>{agency_name}</code> <code>{period_start}</code> <code>{period_end}</code> <code>{updates_count}</code> <code>{checks_count}</code> <code>{tasks_count}</code> <code>{hours}</code></td>
					</tr>
					<tr>
						<th scope="row"><?php esc_html_e( 'Sections', 'maintained-log' ); ?></th>
						<td>
							<?php
							self::checkbox( 'report_show_updates', __( 'Updates', 'maintained-log' ), $s );
							self::checkbox( 'report_show_checks', __( 'Site checks', 'maintained-log' ), $s );
							self::checkbox( 'report_show_tasks', __( 'Logged tasks', 'maintained-log' ), $s );
							self::checkbox( 'report_show_time', __( 'Time dedicated', 'maintained-log' ), $s );
							self::checkbox( 'report_show_backups', __( 'Backup policy and last check', 'maintained-log' ), $s );
							self::checkbox( 'report_show_perf', __( 'Speed (when the performance module is enabled)', 'maintained-log' ), $s );
							self::checkbox( 'report_show_vulns', __( 'Security updates explained (when the vulnerability module is enabled)', 'maintained-log' ), $s );
							self::checkbox( 'report_show_tech', __( 'Technical status (HTTPS certificate, PHP, WordPress version, Site Health)', 'maintained-log' ), $s );
							self::checkbox( 'report_send_if_empty', __( 'Send even if nothing changed (shows the site was watched)', 'maintained-log' ), $s );
							?>
						</td>
					</tr>
				</table>

				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'If a check is failing', 'maintained-log' ); ?></th>
						<td>
							<?php self::checkbox( 'report_hold', __( 'Hold the scheduled report until the site checks pass', 'maintained-log' ), $s ); ?>
							<p class="description"><?php esc_html_e( 'Right before each scheduled report the site is checked again. If something fails, you get an email and the report waits; it goes out as soon as the checks pass, or after the maximum below, showing those pages as "under review".', 'maintained-log' ); ?></p>
						</td>
					</tr>
					<?php self::field_text( 'report_hold_days', __( 'Hold for at most (days)', 'maintained-log' ), $s, '', 'number' ); ?>
				</table>

				<?php self::render_cron(); ?>

				<h2><?php esc_html_e( 'Client visibility', 'maintained-log' ); ?></h2>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'Who maintains this site', 'maintained-log' ); ?></th>
						<td>
							<?php
							$maintainers = Settings::maintainers();
							foreach ( Settings::maintainer_candidates() as $user ) :
								?>
								<label class="ml-checkbox">
									<input type="checkbox" name="<?php echo esc_attr( Settings::OPTION . '[maintainers][]' ); ?>" value="<?php echo esc_attr( $user->ID ); ?>" <?php checked( in_array( (int) $user->ID, $maintainers, true ) ); ?>>
									<?php echo esc_html( $user->display_name . ' (' . $user->user_email . ')' ); ?>
								</label>
							<?php endforeach; ?>
							<p class="description"><?php esc_html_e( 'Only these users see the Maintained.log menu and the "Maintenance: your pending tasks" summary on the dashboard. Leave your client unchecked even if they are an administrator. If nobody is checked, every administrator sees them. If you uncheck yourself, you will lose access when you save.', 'maintained-log' ); ?></p>
						</td>
					</tr>
					<tr>
						<th scope="row"><?php esc_html_e( 'Dashboard', 'maintained-log' ); ?></th>
						<td><?php self::checkbox( 'dashboard_widget', __( 'Show a "Website maintenance" box at the top of the WordPress dashboard for every user', 'maintained-log' ), $s ); ?></td>
					</tr>
					<tr>
						<th scope="row"><?php esc_html_e( 'Public link', 'maintained-log' ); ?></th>
						<td>
							<?php self::checkbox( 'public_report_enabled', __( 'Publish reports at a secret link that can be opened in a browser and saved as PDF', 'maintained-log' ), $s ); ?>
							<p class="description"><?php esc_html_e( 'The link is added to the report email and the dashboard box. Anyone who has it can see the report, which lists installed plugins and versions; you can regenerate it at any time to invalidate old links.', 'maintained-log' ); ?></p>
						</td>
					</tr>
				</table>

				<h2><?php esc_html_e( 'Branding', 'maintained-log' ); ?></h2>
				<table class="form-table" role="presentation">
					<?php
					self::field_text( 'agency_name', __( 'Agency name', 'maintained-log' ), $s );
					self::field_text( 'agency_url', __( 'Agency website', 'maintained-log' ), $s, '', 'url' );
					self::field_text( 'logo_url', __( 'Logo URL', 'maintained-log' ), $s, __( 'Shown on the report header. A white or transparent logo works best.', 'maintained-log' ), 'url' );
					self::field_text( 'brand_color', __( 'Brand color', 'maintained-log' ), $s, '', 'color' );
					?>
				</table>

				<h2><?php esc_html_e( 'Administrator alerts', 'maintained-log' ); ?></h2>
				<table class="form-table" role="presentation">
					<?php
					self::field_text( 'admin_recipients', __( 'Administrator emails', 'maintained-log' ), $s, __( 'Receive pending-update reminders and failed-check alerts. Also used as Reply-To on client reports.', 'maintained-log' ) );
					self::field_select( 'pending_alert', __( 'Remind about pending updates', 'maintained-log' ), Settings::alert_frequencies(), $s );
					?>
					<tr>
						<th scope="row"><?php esc_html_e( 'Failures', 'maintained-log' ); ?></th>
						<td>
							<?php self::checkbox( 'alert_on_failure', __( 'Email me immediately when a site check fails', 'maintained-log' ), $s ); ?>
							<?php self::checkbox( 'tech_alert', __( 'Email me when the technical status needs attention (expiring certificate, unsupported PHP…)', 'maintained-log' ), $s ); ?>
						</td>
					</tr>
				</table>

				<h2><?php esc_html_e( 'Site checks', 'maintained-log' ); ?></h2>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'Automation', 'maintained-log' ); ?></th>
						<td><?php self::checkbox( 'checks_after_update', __( 'Run checks automatically after every update', 'maintained-log' ), $s ); ?></td>
					</tr>
					<?php
					self::field_textarea(
						'check_urls',
						__( 'Pages to check', 'maintained-log' ),
						$s,
						__( 'One URL per line. Optionally add "| text" to require that text on the page, e.g. https://example.com/contact/ | Send message', 'maintained-log' )
					);
					self::field_text( 'check_timeout', __( 'Timeout (seconds)', 'maintained-log' ), $s, '', 'number' );
					self::field_text( 'check_slow_ms', __( 'Slow response threshold (ms)', 'maintained-log' ), $s, '', 'number' );
					?>
				</table>

				<h2 id="ml-vulnerabilities"><?php esc_html_e( 'Vulnerabilities (Wordfence Intelligence)', 'maintained-log' ); ?></h2>
				<p class="description">
					<?php esc_html_e( 'Optional. Downloads the Wordfence Intelligence vulnerability database once a day to detect which updates fixed known security vulnerabilities, explain them in the client report, and alert you about vulnerable software. No information about this site is sent to Wordfence.', 'maintained-log' ); ?>
					<a href="https://www.wordfence.com/threat-intel/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Get a free API key in your Wordfence account (Integrations)', 'maintained-log' ); ?></a>
				</p>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'Module', 'maintained-log' ); ?></th>
						<td><?php self::checkbox( 'vuln_enabled', __( 'Check updates and installed software against known vulnerabilities', 'maintained-log' ), $s ); ?></td>
					</tr>
					<?php self::field_text( 'vuln_api_key', __( 'Wordfence Intelligence API key', 'maintained-log' ), $s ); ?>
					<tr>
						<th scope="row"><?php esc_html_e( 'Alerts', 'maintained-log' ); ?></th>
						<td><?php self::checkbox( 'vuln_alert', __( 'Email me when installed software has a known vulnerability', 'maintained-log' ), $s ); ?></td>
					</tr>
					<tr>
						<th scope="row"><?php esc_html_e( 'Status', 'maintained-log' ); ?></th>
						<td><?php self::render_vuln_status(); ?></td>
					</tr>
				</table>

				<h2 id="ml-performance"><?php esc_html_e( 'Speed (Google PageSpeed Insights)', 'maintained-log' ); ?></h2>
				<p class="description">
					<?php esc_html_e( 'Optional. Measures the pages below with Google PageSpeed Insights and adds a rating (Excellent, Good or Could be improved), its trend and a plain-language list of improvements to the client report. The page URLs are sent to Google.', 'maintained-log' ); ?>
					<a href="https://developers.google.com/speed/docs/insights/v5/get-started#APIKey" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Get a free API key', 'maintained-log' ); ?></a>
				</p>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'Module', 'maintained-log' ); ?></th>
						<td><?php self::checkbox( 'perf_enabled', __( 'Measure speed with Google PageSpeed Insights', 'maintained-log' ), $s ); ?></td>
					</tr>
					<?php
					self::field_text( 'perf_api_key', __( 'Google API key', 'maintained-log' ), $s, __( 'Required: without a key Google rejects most requests.', 'maintained-log' ) );
					self::field_textarea( 'perf_urls', __( 'Pages to measure', 'maintained-log' ), $s, __( 'One URL per line. Each page takes about 30 seconds per device, so keep the list short.', 'maintained-log' ) );
					?>
					<tr>
						<th scope="row"><?php esc_html_e( 'Devices', 'maintained-log' ); ?></th>
						<td>
							<?php foreach ( Performance::strategies() as $value => $text ) : ?>
								<label class="ml-checkbox">
									<input type="checkbox" name="<?php echo esc_attr( Settings::OPTION . '[perf_strategies][]' ); ?>" value="<?php echo esc_attr( $value ); ?>" <?php checked( in_array( $value, (array) $s['perf_strategies'], true ) ); ?>>
									<?php echo esc_html( $text ); ?>
								</label>
							<?php endforeach; ?>
						</td>
					</tr>
					<?php self::field_select( 'perf_frequency', __( 'Measure', 'maintained-log' ), Performance::frequencies(), $s ); ?>
					<tr>
						<th scope="row"><?php esc_html_e( 'Alerts', 'maintained-log' ); ?></th>
						<td><?php self::checkbox( 'perf_alert', __( 'Email me when a page drops to a lower rating', 'maintained-log' ), $s ); ?></td>
					</tr>
				</table>

				<h2 id="ml-backups"><?php esc_html_e( 'Backups', 'maintained-log' ); ?></h2>
				<p class="description"><?php esc_html_e( 'WordPress cannot see backups made by your hosting provider. Describe them here so they appear in client reports, and confirm periodically that they exist.', 'maintained-log' ); ?></p>
				<table class="form-table" role="presentation">
					<?php
					self::field_text( 'backup_provider', __( 'Managed by', 'maintained-log' ), $s, __( 'e.g. "the hosting provider" or "Hostinger". Leave empty if you do not want to mention backups.', 'maintained-log' ) );
					self::field_select( 'backup_frequency', __( 'Frequency', 'maintained-log' ), Backups::frequencies(), $s );
					self::field_text( 'backup_retention', __( 'Kept for (days)', 'maintained-log' ), $s, __( '0 if unknown.', 'maintained-log' ), 'number' );
					self::field_select( 'backup_reminder', __( 'Remind me to check them', 'maintained-log' ), Backups::reminder_intervals(), $s );
					?>
				</table>

				<h2><?php esc_html_e( 'Previous versions', 'maintained-log' ); ?></h2>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'Rollback', 'maintained-log' ); ?></th>
						<td>
							<?php self::checkbox( 'rollback_enabled', __( 'Keep a copy of each plugin and theme before updating it, so it can be restored with one click', 'maintained-log' ), $s ); ?>
							<p class="description"><?php esc_html_e( 'Copies are stored in the uploads folder. Premium plugins are included, so you can go back even if the old version cannot be downloaded again.', 'maintained-log' ); ?></p>
						</td>
					</tr>
					<?php self::field_text( 'rollback_keep', __( 'Versions to keep per plugin or theme', 'maintained-log' ), $s, '', 'number' ); ?>
				</table>

				<h2><?php esc_html_e( 'Data', 'maintained-log' ); ?></h2>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'Uninstall', 'maintained-log' ); ?></th>
						<td><?php self::checkbox( 'delete_on_uninstall', __( 'Delete the whole log and settings when the plugin is deleted', 'maintained-log' ), $s ); ?></td>
					</tr>
				</table>

				<?php submit_button(); ?>
			</form>

			<?php if ( Public_Report::is_enabled() ) : ?>
				<hr>
				<h2><?php esc_html_e( 'Public link', 'maintained-log' ); ?></h2>
				<p>
					<?php esc_html_e( 'Link to the latest report:', 'maintained-log' ); ?>
					<input type="text" class="large-text code" readonly value="<?php echo esc_attr( Public_Report::url() ); ?>" data-ml-select>
				</p>
				<p>
					<?php
					self::action_button(
						'regenerate_token',
						__( 'Regenerate link', 'maintained-log' ),
						'button',
						array(),
						__( 'Links already shared with the client will stop working. Continue?', 'maintained-log' )
					);
					?>
				</p>
			<?php endif; ?>

			<hr>
			<h2><?php esc_html_e( 'Test the alerts', 'maintained-log' ); ?></h2>
			<p><?php self::action_button( 'pending_alert', __( 'Send pending-updates reminder now', 'maintained-log' ) ); ?></p>
		</div>
		<?php
	}

	/**
	 * Adds a manual entry.
	 */
	public static function handle_add_entry() {
		self::verify( 'maintained_log_add_entry' );

		// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified above.
		$title = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
		if ( '' === $title ) {
			self::redirect( self::SLUG, 'error', __( 'Please describe what was done.', 'maintained-log' ) );
		}

		$category = isset( $_POST['category'] ) ? sanitize_key( wp_unslash( $_POST['category'] ) ) : 'other';
		$status   = isset( $_POST['status'] ) ? sanitize_key( wp_unslash( $_POST['status'] ) ) : 'success';
		$date     = isset( $_POST['date'] ) ? sanitize_text_field( wp_unslash( $_POST['date'] ) ) : '';
		$amends   = isset( $_POST['amends_id'] ) ? absint( $_POST['amends_id'] ) : 0;
		$entry    = array(
			'type'      => Log::TYPE_MANUAL,
			'category'  => array_key_exists( $category, Log::categories() ) ? $category : 'other',
			'status'    => in_array( $status, array( 'success', 'warning', 'error' ), true ) ? $status : 'success',
			'title'     => $title,
			'details'   => array( 'notes' => isset( $_POST['notes'] ) ? sanitize_textarea_field( wp_unslash( $_POST['notes'] ) ) : '' ),
			'minutes'   => isset( $_POST['minutes'] ) ? absint( $_POST['minutes'] ) : 0,
			'amends_id' => ( $amends && Log::get( $amends ) ) ? $amends : 0,
			'source'    => Log::SOURCE_MANUAL,
		);
		// phpcs:enable

		$parsed = $date ? \DateTimeImmutable::createFromFormat( 'Y-m-d\TH:i', $date, wp_timezone() ) : false;
		if ( $parsed && $parsed->getTimestamp() <= time() + MINUTE_IN_SECONDS ) {
			$entry['created_at'] = gmdate( 'Y-m-d H:i:s', $parsed->getTimestamp() );
			if ( $parsed->getTimestamp() < time() - HOUR_IN_SECONDS ) {
				// Back-dated entries are allowed (work is often logged later) but marked as such.
				$entry['details']['logged_at'] = current_time( 'mysql', true );
			}
		}

		Log::add( $entry )
			? self::redirect( self::SLUG, 'success', __( 'Added to the log.', 'maintained-log' ) )
			: self::redirect( self::SLUG, 'error', __( 'The entry could not be saved.', 'maintained-log' ) );
	}

	/**
	 * Runs site checks on demand.
	 */
	public static function handle_run_checks() {
		self::verify( 'maintained_log_run_checks' );
		$run = Health_Checks::run( 'manual' );
		$run['ok']
			? self::redirect( self::SLUG, 'success', __( 'All site checks passed.', 'maintained-log' ) )
			: self::redirect( self::SLUG, 'error', __( 'Some site checks failed. See the log for details.', 'maintained-log' ) );
	}

	/**
	 * Records inventory changes on demand.
	 */
	public static function handle_snapshot() {
		self::verify( 'maintained_log_snapshot' );
		$changes = Inventory::detect_changes( Log::SOURCE_EXTERNAL );
		/* translators: %d: number of changes. */
		self::redirect( self::SLUG, 'success', sprintf( _n( '%d change recorded.', '%d changes recorded.', count( $changes ), 'maintained-log' ), count( $changes ) ) );
	}

	/**
	 * Sends the report to the client or as a test.
	 */
	public static function handle_send_report() {
		self::verify( 'maintained_log_send_report' );

		$tz = wp_timezone();
		// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified above.
		$from = isset( $_POST['from'] ) ? \DateTimeImmutable::createFromFormat( 'Y-m-d H:i:s', sanitize_text_field( wp_unslash( $_POST['from'] ) ), $tz ) : false;
		$to   = isset( $_POST['to'] ) ? \DateTimeImmutable::createFromFormat( 'Y-m-d H:i:s', sanitize_text_field( wp_unslash( $_POST['to'] ) ), $tz ) : false;
		$mode = isset( $_POST['mode'] ) ? sanitize_key( wp_unslash( $_POST['mode'] ) ) : 'test';
		// phpcs:enable

		if ( ! $from || ! $to ) {
			$period = Reporter::manual_period();
			$from   = $period['from'];
			$to     = $period['to'];
		}

		$report = Reporter::build( $from, $to );
		$result = 'client' === $mode ? Reporter::send( $report ) : Reporter::send( $report, wp_get_current_user()->user_email );

		if ( is_wp_error( $result ) ) {
			self::redirect( self::REPORT_SLUG, 'error', $result->get_error_message() );
		}

		if ( 'client' === $mode ) {
			$stored = get_option( Reporter::LAST_PERIOD_OPTION );
			if ( ! $stored || $to->format( 'Y-m-d H:i:s' ) > $stored ) {
				update_option( Reporter::LAST_PERIOD_OPTION, $to->format( 'Y-m-d H:i:s' ), false );
			}
		}

		self::redirect(
			self::REPORT_SLUG,
			'success',
			'client' === $mode ? __( 'Report sent to the client and recorded in the log.', 'maintained-log' ) : __( 'Test report sent to your email.', 'maintained-log' )
		);
	}

	/**
	 * Streams the log as CSV.
	 */
	public static function handle_export() {
		if ( ! Plugin::user_can_manage() || ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_GET['_wpnonce'] ) ), 'maintained_log_export' ) ) {
			wp_die( esc_html__( 'You are not allowed to do this.', 'maintained-log' ), 403 );
		}

		$type    = isset( $_GET['type'] ) ? sanitize_key( wp_unslash( $_GET['type'] ) ) : '';
		$entries = Log::query(
			array(
				'type'     => $type,
				'per_page' => 0,
				'order'    => 'ASC',
			)
		);

		nocache_headers();
		header( 'Content-Type: text/csv; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename=maintained-log-' . gmdate( 'Y-m-d' ) . '.csv' );

		$out = fopen( 'php://output', 'w' );
		fwrite( $out, "\xEF\xBB\xBF" ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- UTF-8 BOM for Excel.
		fputcsv( $out, array( 'id', 'date_utc', 'type', 'category', 'status', 'title', 'source', 'user', 'minutes', 'amends_id', 'details', 'hash' ) );
		foreach ( $entries as $entry ) {
			fputcsv(
				$out,
				array_map(
					array( __CLASS__, 'csv_safe' ),
					array( $entry->id, $entry->created_at, $entry->type, $entry->category, $entry->status, $entry->title, $entry->source, self::author( $entry ), $entry->minutes, $entry->amends_id, wp_json_encode( $entry->details ), $entry->hash )
				)
			);
		}
		fclose( $out ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
		exit;
	}

	/**
	 * Verifies the hash chain.
	 */
	public static function handle_verify() {
		self::verify( 'maintained_log_verify' );
		$result = Log::verify_chain();
		if ( $result['ok'] ) {
			/* translators: %d: number of entries. */
			self::redirect( self::SLUG, 'success', sprintf( __( 'Integrity verified: %d entries, none altered or deleted.', 'maintained-log' ), $result['checked'] ) );
		}
		/* translators: %d: entry ID. */
		self::redirect( self::SLUG, 'error', sprintf( __( 'The log was altered outside Maintained.log at or before entry #%d.', 'maintained-log' ), $result['broken_at'] ) );
	}

	/**
	 * Confirms that the current URL is the live site.
	 */
	public static function handle_confirm_production() {
		self::verify( 'maintained_log_confirm_production' );
		Environment::confirm_production();
		Log::add(
			array(
				'type'   => Log::TYPE_SYSTEM,
				/* translators: %s: site URL. */
				'title'  => sprintf( __( 'Live site URL confirmed: %s', 'maintained-log' ), home_url() ),
				'source' => Log::SOURCE_MANUAL,
			)
		);
		self::redirect( self::SLUG, 'success', __( 'Client emails are enabled for this URL.', 'maintained-log' ) );
	}

	/**
	 * Sends the pending-updates reminder now.
	 */
	public static function handle_pending_alert() {
		self::verify( 'maintained_log_pending_alert' );
		Alerts::maybe_send_pending_updates_alert( true )
			? self::redirect( self::SETTINGS_SLUG, 'success', __( 'Reminder sent.', 'maintained-log' ) )
			: self::redirect( self::SETTINGS_SLUG, 'info', __( 'No reminder sent: there are no pending updates or no administrator email is set.', 'maintained-log' ) );
	}

	/**
	 * "Get the data now" box: runs the vulnerability sync or a speed round
	 * right away, driven step by step from the browser.
	 */
	private static function render_fetch_now() {
		$vuln_state = Vulnerabilities::sync_state();
		$perf_last  = Performance::measurements( null, null, 1 );
		$boxes      = array(
			array(
				'what'    => 'vuln',
				'title'   => __( 'Vulnerabilities (Wordfence)', 'maintained-log' ),
				'text'    => __( 'Downloads the vulnerability database now and checks this site\'s updates and installed software against it. Usually takes less than a minute.', 'maintained-log' ),
				'button'  => __( 'Get vulnerabilities now', 'maintained-log' ),
				'enabled' => Vulnerabilities::is_enabled(),
				/* translators: %s: time since. */
				'last'    => $vuln_state['last_success'] ? sprintf( __( 'Last update: %s ago.', 'maintained-log' ), human_time_diff( $vuln_state['last_success'] ) ) : __( 'Never downloaded.', 'maintained-log' ),
			),
			array(
				'what'    => 'perf',
				'title'   => __( 'Speed (Google PageSpeed Insights)', 'maintained-log' ),
				'text'    => __( 'Measures every configured page and device now. Each measurement takes about 30 seconds.', 'maintained-log' ),
				'button'  => __( 'Measure speed now', 'maintained-log' ),
				'enabled' => Performance::is_enabled(),
				/* translators: %s: time since. */
				'last'    => $perf_last ? sprintf( __( 'Last measurement: %s ago.', 'maintained-log' ), human_time_diff( strtotime( $perf_last[0]->created_at . ' UTC' ) ) ) : __( 'Never measured.', 'maintained-log' ),
			),
		);
		?>
		<div class="ml-fetch" id="ml-fetch">
			<h2><?php esc_html_e( 'Get the data now', 'maintained-log' ); ?></h2>
			<p class="description"><?php esc_html_e( 'This normally happens on its own in the background. Use these buttons to get fresh data right now; the results are saved in the log and used in the next client report.', 'maintained-log' ); ?></p>
			<div class="ml-fetch__boxes">
				<?php foreach ( $boxes as $box ) : ?>
					<div class="ml-fetch__box" data-what="<?php echo esc_attr( $box['what'] ); ?>">
						<h3><?php echo esc_html( $box['title'] ); ?></h3>
						<p><?php echo esc_html( $box['text'] ); ?></p>
						<p class="ml-muted ml-fetch__last"><?php echo esc_html( $box['last'] ); ?></p>
						<?php if ( $box['enabled'] ) : ?>
							<button type="button" class="button button-primary ml-fetch__run"><?php echo esc_html( $box['button'] ); ?></button>
						<?php else : ?>
							<button type="button" class="button" disabled><?php echo esc_html( $box['button'] ); ?></button>
							<p class="ml-muted"><?php esc_html_e( 'Enable the module and add its key below first.', 'maintained-log' ); ?></p>
						<?php endif; ?>
						<div class="ml-fetch__progress" hidden><span></span></div>
						<div class="ml-fetch__status" aria-live="polite"></div>
					</div>
				<?php endforeach; ?>
			</div>
		</div>
		<?php
	}

	/**
	 * Installed software with known vulnerabilities, with what to do and a
	 * "mark as reviewed" option for each one.
	 */
	private static function render_exposures() {
		if ( ! Vulnerabilities::is_enabled() ) {
			return;
		}
		$exposures = Vulnerabilities::exposures();
		if ( ! $exposures ) {
			return;
		}
		$labels = array(
			'active'    => __( 'Needs attention', 'maintained-log' ),
			'inactive'  => __( 'Deactivated', 'maintained-log' ),
			'uncertain' => __( 'Possible match with another edition', 'maintained-log' ),
			'reviewed'  => __( 'Reviewed', 'maintained-log' ),
		);
		?>
		<div class="ml-vulns" id="ml-vulns">
			<h2><?php esc_html_e( 'Software with known vulnerabilities', 'maintained-log' ); ?></h2>
			<?php foreach ( $exposures as $exposure ) : ?>
				<?php $severity = Vulnerabilities::severity( $exposure['vulns'][0] ); ?>
				<div class="ml-vulns__item ml-vulns__item--<?php echo esc_attr( $exposure['state'] ); ?>">
					<div class="ml-vulns__head">
						<strong><?php echo esc_html( $exposure['name'] . ' ' . $exposure['version'] ); ?></strong>
						<span class="ml-tag ml-vulns__state"><?php echo esc_html( $labels[ $exposure['state'] ] ); ?></span>
						<?php if ( in_array( $exposure['state'], array( 'active', 'inactive' ), true ) ) : ?>
							<span class="ml-tag ml-tag--security" style="background:<?php echo esc_attr( $severity['color'] ); ?>;"><?php echo esc_html( $severity['label'] ); ?></span>
						<?php endif; ?>
					</div>
					<?php if ( 'reviewed' === $exposure['state'] ) : ?>
						<p class="ml-muted">
							<?php
							$who = $exposure['review']['user_id'] ? get_userdata( $exposure['review']['user_id'] ) : false;
							/* translators: 1: user, 2: date. */
							echo esc_html( sprintf( __( 'Marked as reviewed by %1$s on %2$s.', 'maintained-log' ), $who ? $who->display_name : '—', self::local_date( $exposure['review']['at'], get_option( 'date_format' ) ) ) );
							?>
							<?php if ( '' !== $exposure['review']['note'] ) : ?>
								<br><em><?php echo esc_html( $exposure['review']['note'] ); ?></em>
							<?php endif; ?>
						</p>
						<?php self::action_button( 'vuln_unreview', __( 'Mark as pending again', 'maintained-log' ), 'button button-small', array( 'key' => $exposure['review_key'] ) ); ?>
					<?php else : ?>
						<p><?php echo esc_html( Vulnerabilities::advice( $exposure ) ); ?></p>
						<details>
							<summary>
								<?php
								/* translators: %d: number of vulnerabilities. */
								echo esc_html( sprintf( _n( 'See the %d vulnerability', 'See the %d vulnerabilities', count( $exposure['vulns'] ), 'maintained-log' ), count( $exposure['vulns'] ) ) );
								?>
							</summary>
							<ul class="ml-details">
								<?php foreach ( $exposure['vulns'] as $vuln ) : ?>
									<li>
										<?php echo esc_html( $vuln['title'] ); ?>
										<span class="ml-muted"><?php echo esc_html( trim( $vuln['cve'] . ( $vuln['fixed'] ? ' · ' . sprintf( /* translators: %s: version. */ __( 'fixed in %s', 'maintained-log' ), implode( ', ', $vuln['fixed'] ) ) : '' ), ' ·' ) ); ?></span>
										<?php if ( $vuln['mismatch'] ) : ?>
											<span class="ml-tag"><?php esc_html_e( 'other edition?', 'maintained-log' ); ?></span>
										<?php endif; ?>
										<?php if ( $vuln['reviewed'] ) : ?>
											<span class="ml-tag"><?php esc_html_e( 'reviewed', 'maintained-log' ); ?></span>
										<?php endif; ?>
									</li>
								<?php endforeach; ?>
							</ul>
						</details>
						<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="ml-vulns__review">
							<?php wp_nonce_field( 'maintained_log_vuln_review' ); ?>
							<input type="hidden" name="action" value="maintained_log_vuln_review">
							<input type="hidden" name="key" value="<?php echo esc_attr( $exposure['review_key'] ); ?>">
							<input type="text" name="note" class="regular-text" placeholder="<?php esc_attr_e( 'Why it is fine (optional), e.g. it is the free edition', 'maintained-log' ); ?>">
							<button class="button"><?php esc_html_e( 'Mark as reviewed', 'maintained-log' ); ?></button>
						</form>
					<?php endif; ?>
				</div>
			<?php endforeach; ?>
			<p class="ml-muted"><?php esc_html_e( 'A review applies to these vulnerabilities and this version only: a new vulnerability or a different version will need attention again.', 'maintained-log' ); ?></p>
		</div>
		<?php
	}

	/**
	 * Marks the vulnerabilities of a component as reviewed.
	 */
	public static function handle_vuln_review() {
		self::verify( 'maintained_log_vuln_review' );
		// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified above.
		$key  = isset( $_POST['key'] ) ? sanitize_text_field( wp_unslash( $_POST['key'] ) ) : '';
		$note = isset( $_POST['note'] ) ? sanitize_textarea_field( wp_unslash( $_POST['note'] ) ) : '';
		// phpcs:enable
		Vulnerabilities::mark_reviewed( $key, $note )
			? self::redirect( self::SLUG, 'success', __( 'Marked as reviewed. It will not count as pending unless a new vulnerability appears or the version changes.', 'maintained-log' ) )
			: self::redirect( self::SLUG, 'error', __( 'That component is no longer affected.', 'maintained-log' ) );
	}

	/**
	 * Undoes a vulnerability review.
	 */
	public static function handle_vuln_unreview() {
		self::verify( 'maintained_log_vuln_unreview' );
		$key = isset( $_POST['key'] ) ? sanitize_text_field( wp_unslash( $_POST['key'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Verified above.
		Vulnerabilities::unmark_reviewed( $key );
		self::redirect( self::SLUG, 'success', __( 'Marked as pending again.', 'maintained-log' ) );
	}

	/**
	 * Notes for technical status items that are not green.
	 */
	private static function render_tech_notes() {
		$items   = Tech_Status::get()['items'];
		$notes   = Tech_Status::notes();
		$pending = array_filter(
			$items,
			static function ( $item ) {
				return 'ok' !== $item['status'];
			}
		);
		$hidden  = array_diff_key( $notes, $pending );
		?>
		<div class="ml-fetch ml-tech-notes" id="ml-tech-notes">
			<h2><?php esc_html_e( 'Technical status notes', 'maintained-log' ); ?></h2>
			<p class="description"><?php esc_html_e( 'When a point of the technical status is not green, the report shows it as "under review". If there is a reason it cannot be solved for now (for example, PHP cannot be upgraded because a plugin is not compatible yet), explain it here: the note appears in every report from now on, while the point stays that way.', 'maintained-log' ); ?></p>
			<?php if ( ! $pending ) : ?>
				<p><strong><?php esc_html_e( 'Everything is green right now: no note is needed.', 'maintained-log' ); ?></strong></p>
			<?php else : ?>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
					<?php wp_nonce_field( 'maintained_log_tech_notes' ); ?>
					<input type="hidden" name="action" value="maintained_log_tech_notes">
					<?php foreach ( $pending as $key => $item ) : ?>
						<div class="ml-tech-notes__item">
							<label for="ml-note-<?php echo esc_attr( $key ); ?>">
								<span class="ml-status ml-status--<?php echo esc_attr( $item['status'] ); ?>"></span>
								<strong><?php echo esc_html( $item['label'] ); ?></strong>
								<span class="ml-muted"><?php echo esc_html( $item['detail'] ); ?></span>
							</label>
							<?php if ( 'health' === $key ) : ?>
								<?php self::render_health_issues( $item ); ?>
							<?php endif; ?>
							<textarea id="ml-note-<?php echo esc_attr( $key ); ?>" name="notes[<?php echo esc_attr( $key ); ?>]" rows="2" class="large-text" placeholder="<?php esc_attr_e( 'e.g. The PHP version cannot be upgraded yet because the booking plugin is not compatible. We will do it as soon as it is updated.', 'maintained-log' ); ?>"><?php echo esc_textarea( isset( $notes[ $key ]['text'] ) ? $notes[ $key ]['text'] : '' ); ?></textarea>
							<?php if ( ! empty( $notes[ $key ]['updated_at'] ) ) : ?>
								<p class="ml-muted">
									<?php
									/* translators: %s: date. */
									echo esc_html( sprintf( __( 'Saved on %s. Shown in the reports as "Known situation".', 'maintained-log' ), self::local_date( $notes[ $key ]['updated_at'], get_option( 'date_format' ) ) ) );
									?>
								</p>
							<?php else : ?>
								<p class="ml-muted"><?php esc_html_e( 'Without a note, the report shows this point as "under review".', 'maintained-log' ); ?></p>
							<?php endif; ?>
						</div>
					<?php endforeach; ?>
					<p><button class="button button-primary"><?php esc_html_e( 'Save notes', 'maintained-log' ); ?></button> <span class="ml-muted"><?php esc_html_e( 'Leave a note empty to remove it.', 'maintained-log' ); ?></span></p>
				</form>
			<?php endif; ?>
			<?php if ( $hidden ) : ?>
				<p class="ml-muted">
					<?php
					echo esc_html(
						sprintf(
							/* translators: %s: comma-separated item names. */
							__( 'Saved notes not shown because the point is green again: %s. They will reappear if it stops being green.', 'maintained-log' ),
							implode(
								', ',
								array_map(
									static function ( $key ) use ( $items ) {
										return isset( $items[ $key ] ) ? $items[ $key ]['label'] : $key;
									},
									array_keys( $hidden )
								)
							)
						)
					);
					?>
				</p>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * Summary of what WordPress Site Health reports, so it can be understood
	 * (and explained in a note) without leaving the plugin.
	 *
	 * @param array $item Technical status item.
	 */
	private static function render_health_issues( array $item ) {
		$issues = isset( $item['issues'] ) ? $item['issues'] : array();
		?>
		<div class="ml-health">
			<?php if ( $issues ) : ?>
				<p class="ml-health__intro"><?php esc_html_e( 'This is what Site Health reports right now:', 'maintained-log' ); ?></p>
				<ul>
					<?php foreach ( $issues as $issue ) : ?>
						<li class="ml-health__issue ml-health__issue--<?php echo esc_attr( $issue['status'] ); ?>">
							<span class="ml-tag"><?php echo 'critical' === $issue['status'] ? esc_html__( 'Critical', 'maintained-log' ) : esc_html__( 'Recommended', 'maintained-log' ); ?></span>
							<strong><?php echo esc_html( $issue['label'] ); ?></strong>
							<?php if ( '' !== $issue['description'] ) : ?>
								<br><span class="ml-muted"><?php echo esc_html( $issue['description'] ); ?></span>
							<?php endif; ?>
						</li>
					<?php endforeach; ?>
				</ul>
			<?php else : ?>
				<p class="ml-muted"><?php esc_html_e( 'The detail of the issues is not available yet: click "Check again" in the log, or open Site Health.', 'maintained-log' ); ?></p>
			<?php endif; ?>
			<p>
				<a href="<?php echo esc_url( admin_url( 'site-health.php' ) ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Open Tools → Site Health', 'maintained-log' ); ?> ↗</a>
				<span class="ml-muted"><?php esc_html_e( 'Only the critical issues turn this point yellow; recommendations are improvements.', 'maintained-log' ); ?></span>
			</p>
		</div>
		<?php
	}

	/**
	 * Saves the technical status notes.
	 */
	public static function handle_tech_notes() {
		self::verify( 'maintained_log_tech_notes' );
		$notes   = isset( $_POST['notes'] ) && is_array( $_POST['notes'] ) ? wp_unslash( $_POST['notes'] ) : array(); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verified above; sanitized in save_note().
		$items   = Tech_Status::get()['items'];
		$changed = 0;
		foreach ( $notes as $key => $text ) {
			$key = sanitize_key( $key );
			if ( isset( $items[ $key ] ) && Tech_Status::save_note( $key, (string) $text ) ) {
				++$changed;
			}
		}
		self::redirect(
			self::SETTINGS_SLUG,
			'success',
			$changed ? __( 'Notes saved. They will appear in the next client report.', 'maintained-log' ) : __( 'No changes.', 'maintained-log' )
		);
	}

	/**
	 * One step of a "get the data now" run.
	 */
	public static function ajax_fetch() {
		check_ajax_referer( 'maintained_log_fetch' );
		if ( ! Plugin::user_can_manage() ) {
			wp_send_json_error( array( 'message' => __( 'You are not allowed to do this.', 'maintained-log' ) ), 403 );
		}

		$what = isset( $_POST['what'] ) ? sanitize_key( wp_unslash( $_POST['what'] ) ) : '';
		$op   = isset( $_POST['op'] ) ? sanitize_key( wp_unslash( $_POST['op'] ) ) : 'step';

		if ( 'vuln' === $what ) {
			self::ajax_vuln_step( $op );
		}
		if ( 'perf' === $what ) {
			self::ajax_perf_step( $op );
		}
		wp_send_json_error( array( 'message' => __( 'Invalid request.', 'maintained-log' ) ), 400 );
	}

	/**
	 * Vulnerability sync, one step per request.
	 *
	 * @param string $op start or step.
	 */
	private static function ajax_vuln_step( $op ) {
		if ( 'start' === $op ) {
			$started = Vulnerabilities::start();
			// A sync already running (e.g. started by cron) is simply continued from here.
			if ( is_wp_error( $started ) && 'running' !== $started->get_error_code() ) {
				wp_send_json_error( array( 'message' => $started->get_error_message() ) );
			}
			wp_clear_scheduled_hook( Vulnerabilities::TICK_HOOK );
			wp_send_json_success(
				array(
					'done'     => false,
					'progress' => 2,
					'message'  => __( 'Downloading the vulnerability database…', 'maintained-log' ),
				)
			);
		}

		Vulnerabilities::tick();
		wp_clear_scheduled_hook( Vulnerabilities::TICK_HOOK );
		$state = Vulnerabilities::sync_state();

		if ( 'idle' !== $state['state'] ) {
			wp_send_json_success(
				array(
					'done'     => false,
					'progress' => Vulnerabilities::progress(),
					'message'  => 'parse' === $state['state'] ? __( 'Checking the vulnerabilities against this site…', 'maintained-log' ) : __( 'Downloading the vulnerability database…', 'maintained-log' ),
				)
			);
		}
		if ( $state['last_error'] ) {
			wp_send_json_error( array( 'message' => $state['last_error'] ) );
		}

		$all       = Vulnerabilities::exposures();
		$exposures = Vulnerabilities::active_exposures();
		$uncertain = count(
			array_filter(
				$all,
				static function ( $exposure ) {
					return 'uncertain' === $exposure['state'];
				}
			)
		);
		// Counted once per vulnerability, as in the report.
		$fixed_ids = array();
		foreach ( Log::query(
			array(
				'type'     => Log::TYPE_UPDATE,
				'from'     => gmdate( 'Y-m-d H:i:s', time() - 31 * DAY_IN_SECONDS ),
				'per_page' => 0,
			)
		) as $entry ) {
			foreach ( Vulnerabilities::fixed_by_entry( $entry ) as $vuln ) {
				$fixed_ids[ $vuln['id'] ] = true;
			}
		}
		$fixed    = count( $fixed_ids );
		$lines    = array(
			/* translators: 1: vulnerabilities checked, 2: relevant to this site. */
			sprintf( __( '%1$s vulnerabilities checked; %2$s concern software on this site.', 'maintained-log' ), number_format_i18n( isset( $state['total'] ) ? $state['total'] : 0 ), number_format_i18n( isset( $state['indexed'] ) ? $state['indexed'] : 0 ) ),
			/* translators: %d: number of vulnerabilities. */
			sprintf( _n( 'Updates of the last month fixed %d known vulnerability.', 'Updates of the last month fixed %d known vulnerabilities.', $fixed, 'maintained-log' ), $fixed ),
			$exposures
				/* translators: %d: number of components. */
				? sprintf( _n( 'Warning: %d installed component has known vulnerabilities. See the log.', 'Warning: %d installed components have known vulnerabilities. See the log.', count( $exposures ), 'maintained-log' ), count( $exposures ) )
				: __( 'No installed software has known vulnerabilities.', 'maintained-log' ),
		);
		$inactive = count( wp_list_filter( $all, array( 'state' => 'inactive' ) ) );
		if ( $inactive ) {
			/* translators: %d: number of components. */
			$lines[] = sprintf( _n( 'Also %d deactivated plugin or theme has known vulnerabilities: delete it if it is not used.', 'Also %d deactivated plugins or themes have known vulnerabilities: delete them if they are not used.', $inactive, 'maintained-log' ), $inactive );
		}
		if ( $uncertain ) {
			/* translators: %d: number of components. */
			$lines[] = sprintf( _n( '%d possible match with another edition (e.g. Premium) to check.', '%d possible matches with another edition (e.g. Premium) to check.', $uncertain, 'maintained-log' ), $uncertain );
		}
		wp_send_json_success(
			array(
				'done'     => true,
				'progress' => 100,
				'warning'  => (bool) $exposures,
				'lines'    => $lines,
				/* translators: %s: time since. */
				'last'     => sprintf( __( 'Last update: %s ago.', 'maintained-log' ), human_time_diff( time() - 1 ) ),
			)
		);
	}

	/**
	 * Speed round, one measurement per request.
	 *
	 * @param string $op start or step.
	 */
	private static function ajax_perf_step( $op ) {
		if ( 'start' === $op ) {
			if ( ! Performance::queue_round() ) {
				wp_send_json_error( array( 'message' => __( 'Enable the speed module, add a Google API key and choose at least one device in the settings.', 'maintained-log' ) ) );
			}
			wp_clear_scheduled_hook( Performance::TICK_HOOK );
			$total = count( (array) get_option( Performance::QUEUE_OPTION, array() ) );
			set_transient(
				'maintained_log_perf_run_' . get_current_user_id(),
				array(
					'total' => $total,
					'lines' => array(),
				),
				HOUR_IN_SECONDS
			);
			wp_send_json_success(
				array(
					'done'     => false,
					'progress' => 2,
					/* translators: %d: number of measurements. */
					'message'  => sprintf( _n( '%d measurement to do…', '%d measurements to do…', $total, 'maintained-log' ), $total ),
				)
			);
		}

		$run  = get_transient( 'maintained_log_perf_run_' . get_current_user_id() );
		$run  = is_array( $run ) ? $run : array(
			'total' => 1,
			'lines' => array(),
		);
		$item = Performance::tick( false );

		if ( $item ) {
			$label = Performance::url_label( $item['url'] ) . ' · ' . Performance::strategy_label( $item['strategy'] );
			if ( is_wp_error( $item['result'] ) ) {
				$run['lines'][] = $label . ': ' . $item['result']->get_error_message();
			} else {
				$rating         = Performance::rating( $item['result']['score'] );
				$run['lines'][] = sprintf( '%s: %s (%d/100)', $label, $rating['label'], $item['result']['score'] );
			}
			set_transient( 'maintained_log_perf_run_' . get_current_user_id(), $run, HOUR_IN_SECONDS );
		}

		$remaining = $item ? $item['remaining'] : 0;
		if ( $remaining > 0 ) {
			wp_send_json_success(
				array(
					'done'     => false,
					'progress' => (int) floor( 100 * ( $run['total'] - $remaining ) / max( 1, $run['total'] ) ),
					/* translators: %d: measurements left. */
					'message'  => sprintf( _n( 'Measuring… %d left.', 'Measuring… %d left.', $remaining, 'maintained-log' ), $remaining ),
					'lines'    => $run['lines'],
				)
			);
		}

		delete_transient( 'maintained_log_perf_run_' . get_current_user_id() );
		wp_send_json_success(
			array(
				'done'     => true,
				'progress' => 100,
				'lines'    => $run['lines'],
				/* translators: %s: time since. */
				'last'     => sprintf( __( 'Last measurement: %s ago.', 'maintained-log' ), human_time_diff( time() - 1 ) ),
			)
		);
	}

	/**
	 * Sync status line for the settings screen.
	 */
	private static function render_vuln_status() {
		$state = Vulnerabilities::sync_state();
		if ( 'idle' !== $state['state'] ) {
			echo '<p>' . esc_html__( 'Updating vulnerability data…', 'maintained-log' ) . '</p>';
		} elseif ( $state['last_success'] ) {
			echo '<p>';
			/* translators: 1: time since, 2: records read, 3: records relevant to this site. */
			echo esc_html( sprintf( __( 'Last update %1$s ago: %2$s vulnerabilities checked, %3$s concern software on this site (installed now or in the past).', 'maintained-log' ), human_time_diff( $state['last_success'] ), number_format_i18n( isset( $state['total'] ) ? $state['total'] : 0 ), number_format_i18n( isset( $state['indexed'] ) ? $state['indexed'] : 0 ) ) );
			echo '</p>';
		} else {
			echo '<p>' . esc_html__( 'Not downloaded yet.', 'maintained-log' ) . '</p>';
		}
		if ( $state['last_error'] ) {
			/* translators: %s: error message. */
			echo '<p class="ml-error">' . esc_html( sprintf( __( 'Last error: %s', 'maintained-log' ), $state['last_error'] ) ) . '</p>';
		}
	}

	/**
	 * Security badge and explanation on update entries that fixed vulnerabilities.
	 *
	 * @param object $entry Entry.
	 */
	private static function render_security_fixes( $entry ) {
		if ( Log::TYPE_UPDATE !== $entry->type || ! Settings::get( 'vuln_enabled' ) ) {
			return;
		}
		$fixed = Vulnerabilities::fixed_by_entry( $entry );
		if ( ! $fixed ) {
			return;
		}
		$severity = Vulnerabilities::severity( $fixed[0] );
		echo '<div class="ml-security">';
		printf(
			'<span class="ml-tag ml-tag--security" style="background:%1$s;">%2$s</span> ',
			esc_attr( $severity['color'] ),
			/* translators: %d: number of vulnerabilities. */
			esc_html( sprintf( _n( 'Fixed %d vulnerability', 'Fixed %d vulnerabilities', count( $fixed ), 'maintained-log' ), count( $fixed ) ) . ' · ' . $severity['label'] )
		);
		echo '<ul class="ml-details">';
		foreach ( array_slice( $fixed, 0, 3 ) as $vuln ) {
			printf( '<li>%s <span class="ml-muted">%s</span></li>', esc_html( $vuln['title'] ), esc_html( $vuln['cve'] ) );
		}
		echo '</ul></div>';
	}

	/**
	 * Replaces the public report token.
	 */
	public static function handle_regenerate_token() {
		self::verify( 'maintained_log_regenerate_token' );
		Public_Report::regenerate();
		Log::add(
			array(
				'type'   => Log::TYPE_SYSTEM,
				'title'  => __( 'Public report link regenerated: previous links no longer work', 'maintained-log' ),
				'source' => Log::SOURCE_MANUAL,
			)
		);
		self::redirect( self::SETTINGS_SLUG, 'success', __( 'New link created. Previous links no longer work.', 'maintained-log' ) );
	}

	/**
	 * Recomputes the technical status.
	 */
	public static function handle_tech_refresh() {
		self::verify( 'maintained_log_tech_refresh' );
		Tech_Status::refresh();
		self::redirect( self::SLUG, 'success', __( 'Technical status updated.', 'maintained-log' ) );
	}

	/**
	 * Logs a backup check or restore test.
	 */
	public static function handle_backup_confirm() {
		self::verify( 'maintained_log_backup_confirm' );
		$kind = isset( $_POST['kind'] ) ? sanitize_key( wp_unslash( $_POST['kind'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Verified above.
		Backups::confirm( $kind )
			? self::redirect( self::SLUG, 'success', __( 'Recorded in the log. It will appear in the next client report.', 'maintained-log' ) )
			: self::redirect( self::SLUG, 'error', __( 'The confirmation could not be saved.', 'maintained-log' ) );
	}

	/**
	 * Reinstalls a previous version of a plugin or theme.
	 */
	public static function handle_rollback() {
		self::verify( 'maintained_log_rollback' );

		if ( ! current_user_can( 'update_plugins' ) || ! current_user_can( 'update_themes' ) ) {
			self::redirect( self::SLUG, 'error', __( 'You are not allowed to change plugins or themes.', 'maintained-log' ) );
		}

		// phpcs:disable WordPress.Security.NonceVerification.Missing -- Verified above.
		$component = isset( $_POST['component'] ) ? sanitize_key( wp_unslash( $_POST['component'] ) ) : '';
		$key       = isset( $_POST['key'] ) ? sanitize_text_field( wp_unslash( $_POST['key'] ) ) : '';
		$version   = isset( $_POST['version'] ) ? sanitize_text_field( wp_unslash( $_POST['version'] ) ) : '';
		// phpcs:enable

		if ( ! in_array( $component, array( 'plugin', 'theme' ), true ) || validate_file( $key ) ) {
			self::redirect( self::SLUG, 'error', __( 'Invalid request.', 'maintained-log' ) );
		}

		$result = Rollback::restore( $component, $key, $version );
		if ( is_wp_error( $result ) ) {
			self::redirect( self::SLUG, 'error', $result->get_error_message() );
		}

		// The version change itself is logged by the inventory diff; verify the site right away.
		if ( Settings::get( 'checks_after_update' ) ) {
			wp_schedule_single_event( time(), Plugin::POST_UPDATE_HOOK );
		}

		/* translators: %s: version. */
		self::redirect( self::SLUG, 'success', sprintf( __( 'Version %s restored. Site checks will run in a moment.', 'maintained-log' ), $version ) );
	}

	/**
	 * Restore button for update entries whose previous version is archived.
	 *
	 * @param object $entry Entry.
	 */
	private static function render_rollback_action( $entry ) {
		$d = $entry->details;
		if ( Log::TYPE_UPDATE !== $entry->type || empty( $d['kind'] ) || ! in_array( $d['kind'], array( 'updated', 'downgraded' ), true ) ) {
			return;
		}
		if ( empty( $d['component'] ) || ! in_array( $d['component'], array( 'plugin', 'theme' ), true ) || ! Rollback::has( $d['component'], $d['key'], $d['from'] ) ) {
			return;
		}
		if ( ! current_user_can( 'update_plugins' ) || ! current_user_can( 'update_themes' ) ) {
			return;
		}

		echo '<div class="ml-rollback">';
		self::action_button(
			'rollback',
			/* translators: %s: version. */
			sprintf( __( 'Restore version %s', 'maintained-log' ), $d['from'] ),
			'button button-small',
			array(
				'component' => $d['component'],
				'key'       => $d['key'],
				'version'   => $d['from'],
			),
			/* translators: 1: component name, 2: version. */
			sprintf( __( 'Reinstall %1$s %2$s? The current version will be kept so you can switch back.', 'maintained-log' ), $d['name'], $d['from'] )
		);
		echo '</div>';
	}

	/**
	 * Renders structured details of an entry.
	 *
	 * @param object $entry Entry.
	 */
	private static function render_details( $entry ) {
		$d = $entry->details;

		if ( Log::TYPE_CHECK === $entry->type && ! empty( $d['items'] ) ) {
			echo '<ul class="ml-details">';
			foreach ( $d['items'] as $item ) {
				printf(
					'<li><span class="ml-status ml-status--%1$s"></span>%2$s: <span class="ml-muted">%3$s</span></li>',
					esc_attr( 'ok' === $item['status'] ? 'success' : $item['status'] ),
					esc_html( $item['label'] ),
					esc_html( $item['detail'] )
				);
			}
			echo '</ul>';
			return;
		}

		if ( Log::TYPE_CHECK === $entry->type && ! empty( $d['results'] ) ) {
			echo '<ul class="ml-details">';
			foreach ( $d['results'] as $r ) {
				printf(
					'<li><span class="ml-status ml-status--%1$s"></span>%2$s <span class="ml-muted">%3$s</span> %4$s</li>',
					esc_attr( $r['status'] ),
					esc_html( $r['url'] ),
					esc_html( $r['code'] ? $r['code'] . ' · ' . $r['ms'] . ' ms' : '' ),
					esc_html( $r['message'] )
				);
			}
			echo '</ul>';
			return;
		}

		if ( Log::TYPE_PERFORMANCE === $entry->type && isset( $d['score'] ) ) {
			$parts = array();
			if ( isset( $d['metrics']['lcp'] ) ) {
				$parts[] = 'LCP ' . number_format_i18n( $d['metrics']['lcp'] / 1000, 1 ) . ' s';
			}
			if ( isset( $d['metrics']['tbt'] ) ) {
				$parts[] = 'TBT ' . number_format_i18n( $d['metrics']['tbt'] ) . ' ms';
			}
			if ( isset( $d['metrics']['cls'] ) ) {
				$parts[] = 'CLS ' . number_format_i18n( $d['metrics']['cls'], 2 );
			}
			if ( ! empty( $d['field']['category'] ) ) {
				/* translators: %s: FAST, AVERAGE or SLOW. */
				$parts[] = sprintf( __( 'real visitors: %s', 'maintained-log' ), $d['field']['category'] );
			}
			echo '<div class="ml-muted">' . esc_html( implode( ' · ', $parts ) ) . '</div>';
			$texts = Performance::theme_texts();
			if ( ! empty( $d['themes'] ) ) {
				echo '<ul class="ml-details">';
				foreach ( array_slice( $d['themes'], 0, 3 ) as $theme ) {
					if ( isset( $texts[ $theme ] ) ) {
						echo '<li>' . esc_html( $texts[ $theme ] ) . '</li>';
					}
				}
				echo '</ul>';
			}
			return;
		}

		if ( Log::TYPE_ALERT === $entry->type && ! empty( $d['vulnerability'] ) ) {
			echo '<ul class="ml-details">';
			foreach ( (array) $d['titles'] as $title ) {
				echo '<li>' . esc_html( $title ) . '</li>';
			}
			echo '</ul>';
			if ( ! empty( $d['advice'] ) ) {
				echo '<div class="ml-muted">' . esc_html( $d['advice'] ) . '</div>';
			}
			return;
		}

		if ( Log::TYPE_ALERT === $entry->type && ! empty( $d['pending'] ) ) {
			echo '<ul class="ml-details">';
			foreach ( $d['pending'] as $p ) {
				printf( '<li>%s: %s → %s</li>', esc_html( $p['name'] ), esc_html( $p['from'] ), esc_html( $p['to'] ) );
			}
			echo '</ul>';
			return;
		}

		if ( ! empty( $d['notes'] ) ) {
			echo '<div class="ml-notes">' . wp_kses_post( nl2br( esc_html( $d['notes'] ) ) ) . '</div>';
		}
		if ( ! empty( $d['logged_at'] ) ) {
			/* translators: %s: date. */
			echo '<div class="ml-muted">' . esc_html( sprintf( __( 'Logged on %s', 'maintained-log' ), self::local_date( $d['logged_at'], get_option( 'date_format' ) . ' H:i' ) ) ) . '</div>';
		}
	}

	/**
	 * Who made an entry.
	 *
	 * @param object $entry Entry.
	 * @return string
	 */
	private static function author( $entry ) {
		$sources = array(
			Log::SOURCE_AUTO     => __( 'Auto-update', 'maintained-log' ),
			Log::SOURCE_CLI      => 'WP-CLI',
			Log::SOURCE_EXTERNAL => __( 'Detected', 'maintained-log' ),
			Log::SOURCE_SYSTEM   => 'Maintained.log',
		);

		$user = $entry->user_id ? get_userdata( $entry->user_id ) : false;
		if ( $user ) {
			$name = $user->display_name;
			return isset( $sources[ $entry->source ] ) ? $name . ' (' . $sources[ $entry->source ] . ')' : $name;
		}
		return isset( $sources[ $entry->source ] ) ? $sources[ $entry->source ] : '—';
	}

	/**
	 * Prevents CSV formula injection when opened in a spreadsheet.
	 *
	 * @param mixed $value Cell.
	 * @return string
	 */
	private static function csv_safe( $value ) {
		$value = (string) $value;
		return ( '' !== $value && in_array( $value[0], array( '=', '+', '-', '@', "\t", "\r" ), true ) ) ? "'" . $value : $value;
	}

	/**
	 * A one-button form posting to admin-post.php.
	 *
	 * @param string $action  Action suffix.
	 * @param string $label   Button label.
	 * @param string $class   Extra class.
	 * @param array  $fields  Extra hidden fields.
	 * @param string $confirm Confirmation question, if any.
	 */
	private static function action_button( $action, $label, $class = 'button', array $fields = array(), $confirm = '' ) {
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="ml-action-form"<?php echo $confirm ? ' data-ml-confirm="' . esc_attr( $confirm ) . '"' : ''; ?>>
			<?php wp_nonce_field( 'maintained_log_' . $action ); ?>
			<input type="hidden" name="action" value="maintained_log_<?php echo esc_attr( $action ); ?>">
			<?php foreach ( $fields as $name => $value ) : ?>
				<input type="hidden" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>">
			<?php endforeach; ?>
			<button class="<?php echo esc_attr( $class ); ?>"><?php echo esc_html( $label ); ?></button>
		</form>
		<?php
	}

	/**
	 * Text-like input row.
	 *
	 * @param string $key   Setting key.
	 * @param string $label Label.
	 * @param array  $s     Settings.
	 * @param string $help  Help text.
	 * @param string $type  Input type.
	 */
	private static function field_text( $key, $label, array $s, $help = '', $type = 'text' ) {
		$id    = 'ml-' . $key;
		$class = in_array( $type, array( 'number', 'color' ), true ) ? 'small-text' : 'regular-text';
		?>
		<tr>
			<th scope="row"><label for="<?php echo esc_attr( $id ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<input type="<?php echo esc_attr( $type ); ?>" id="<?php echo esc_attr( $id ); ?>" name="<?php echo esc_attr( Settings::OPTION . '[' . $key . ']' ); ?>" value="<?php echo esc_attr( $s[ $key ] ); ?>" class="<?php echo esc_attr( $class ); ?>">
				<?php if ( $help ) : ?>
					<p class="description"><?php echo esc_html( $help ); ?></p>
				<?php endif; ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Textarea row.
	 *
	 * @param string $key   Setting key.
	 * @param string $label Label.
	 * @param array  $s     Settings.
	 * @param string $help  Help text.
	 */
	private static function field_textarea( $key, $label, array $s, $help = '' ) {
		$id = 'ml-' . $key;
		?>
		<tr>
			<th scope="row"><label for="<?php echo esc_attr( $id ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<textarea id="<?php echo esc_attr( $id ); ?>" name="<?php echo esc_attr( Settings::OPTION . '[' . $key . ']' ); ?>" rows="5" class="large-text"><?php echo esc_textarea( $s[ $key ] ); ?></textarea>
				<?php if ( $help ) : ?>
					<p class="description"><?php echo esc_html( $help ); ?></p>
				<?php endif; ?>
			</td>
		</tr>
		<?php
	}

	/**
	 * Select row.
	 *
	 * @param string $key     Setting key.
	 * @param string $label   Label.
	 * @param array  $choices Value => label.
	 * @param array  $s       Settings.
	 */
	private static function field_select( $key, $label, array $choices, array $s ) {
		$id = 'ml-' . $key;
		?>
		<tr>
			<th scope="row"><label for="<?php echo esc_attr( $id ); ?>"><?php echo esc_html( $label ); ?></label></th>
			<td>
				<select id="<?php echo esc_attr( $id ); ?>" name="<?php echo esc_attr( Settings::OPTION . '[' . $key . ']' ); ?>">
					<?php foreach ( $choices as $value => $text ) : ?>
						<option value="<?php echo esc_attr( $value ); ?>" <?php selected( $s[ $key ], $value ); ?>><?php echo esc_html( $text ); ?></option>
					<?php endforeach; ?>
				</select>
			</td>
		</tr>
		<?php
	}

	/**
	 * Checkbox line.
	 *
	 * @param string $key   Setting key.
	 * @param string $label Label.
	 * @param array  $s     Settings.
	 */
	private static function checkbox( $key, $label, array $s ) {
		?>
		<label class="ml-checkbox">
			<input type="checkbox" name="<?php echo esc_attr( Settings::OPTION . '[' . $key . ']' ); ?>" value="1" <?php checked( ! empty( $s[ $key ] ) ); ?>>
			<?php echo esc_html( $label ); ?>
		</label>
		<?php
	}

	/**
	 * Explains when the automatic report is sent, with this site's current state.
	 */
	private static function render_sending_conditions() {
		$s         = Settings::all();
		$frequency = $s['report_frequency'];
		$names     = Settings::report_frequencies();
		$next      = Reporter::next_send_date();
		$cron      = Cron_Status::state();
		$held      = get_option( Reporter::HELD_SINCE_OPTION );
		$rows      = array();

		if ( 'never' === $frequency ) {
			$rows[] = array( 'info', __( 'Automatic sending is off', 'maintained-log' ), __( 'Reports are only sent when you send them from the "Client report" screen. Everything below applies only to automatic sending.', 'maintained-log' ) );
		} else {
			$rows[] = array(
				'ok',
				/* translators: %s: frequency, e.g. "Quarterly". */
				sprintf( __( 'Frequency: %s', 'maintained-log' ), $names[ $frequency ] ),
				$next
					/* translators: %s: date. */
					? sprintf( __( 'Next report: %s, with everything since the previous one. It goes out on the first cron run of that day.', 'maintained-log' ), $next->getTimestamp() <= time() ? __( 'now (it is due)', 'maintained-log' ) : wp_date( get_option( 'date_format' ), $next->getTimestamp() ) )
					: '',
			);
		}

		$rows[] = '' !== $s['report_recipients']
			? array( 'ok', __( 'There is a client email', 'maintained-log' ), $s['report_recipients'] )
			: array( 'error', __( 'There is no client email', 'maintained-log' ), __( 'Nothing is sent: the period is closed without sending and starts again with the next one. Add the email below.', 'maintained-log' ) );

		$reason = Environment::blocking_reason();
		$rows[] = '' === $reason
			? array( 'ok', __( 'This is the live site', 'maintained-log' ), __( 'On a staging copy, or if the site address changes, client emails are blocked and recorded in the log, so a copy never writes to your client.', 'maintained-log' ) )
			: array( 'error', __( 'Client emails are blocked here', 'maintained-log' ), $reason );

		$rows[] = $s['report_send_if_empty']
			? array( 'ok', __( 'Sent even in a quiet period', 'maintained-log' ), __( 'If nothing was done in the period, the report still goes out to show that the site was watched.', 'maintained-log' ) )
			: array( 'info', __( 'Quiet periods are skipped', 'maintained-log' ), __( 'If nothing was done in the period, no report is sent. Turn on "Send even if nothing changed" below to send it anyway.', 'maintained-log' ) );

		if ( $held ) {
			$rows[] = array(
				'error',
				__( 'The report is on hold now', 'maintained-log' ),
				/* translators: %s: time since. */
				sprintf( __( 'A site check failed before sending, %s ago. It goes out when the checks pass or when the maximum days below are reached.', 'maintained-log' ), human_time_diff( (int) $held ) ),
			);
		} elseif ( $s['report_hold'] ) {
			$rows[] = array(
				'ok',
				__( 'Checked right before sending', 'maintained-log' ),
				/* translators: %d: number of days. */
				sprintf( _n( 'If a page fails, the report waits and you get an email. It goes out as soon as the checks pass, or after %d day showing those pages as "under review".', 'If a page fails, the report waits and you get an email. It goes out as soon as the checks pass, or after %d days showing those pages as "under review".', (int) $s['report_hold_days'], 'maintained-log' ), (int) $s['report_hold_days'] ),
			);
		} else {
			$rows[] = array( 'info', __( 'Checked right before sending, without waiting', 'maintained-log' ), __( 'If a page fails, the report goes out on time showing it as "under review". Turn on "Hold the scheduled report" below to wait until it is fixed.', 'maintained-log' ) );
		}

		$cron_rows = array(
			Cron_Status::REAL    => array( 'ok', __( 'A real cron job runs the tasks', 'maintained-log' ), __( 'Reports and alerts go out on time, whether or not the site has visits.', 'maintained-log' ) ),
			Cron_Status::VISITS  => array( 'warning', __( 'Tasks depend on visits', 'maintained-log' ), __( 'WordPress only runs scheduled tasks when someone visits the site. With few visits, the report can arrive hours late. Set up a real cron job (see below).', 'maintained-log' ) ),
			Cron_Status::STOPPED => array( 'error', __( 'Scheduled tasks are not running', 'maintained-log' ), __( 'WP-Cron is disabled in wp-config.php and no cron job has called it recently: no report or alert will be sent until you set one up (see below).', 'maintained-log' ) ),
			Cron_Status::UNKNOWN => array( 'info', __( 'Waiting for the first run of the scheduled tasks', 'maintained-log' ), __( 'Come back later to see whether they run on their own. Setting up a real cron job (see below) makes sending reliable.', 'maintained-log' ) ),
		);
		$rows[]    = $cron_rows[ $cron['mode'] ];

		$rows[] = array( 'info', __( 'If the email fails, it is retried', 'maintained-log' ), __( 'If the server cannot send it, it is tried again on the next run and the period is not closed. An SMTP plugin avoids most failures and reports ending up in spam.', 'maintained-log' ) );
		$rows[] = array( 'info', __( 'Nothing is repeated', 'maintained-log' ), __( 'If you send a report by hand in the middle of a period, the next automatic one starts where it ended. The first automatic report never covers time before the plugin was installed.', 'maintained-log' ) );

		$icons = array(
			'ok'      => 'dashicons-yes-alt',
			'info'    => 'dashicons-info-outline',
			'warning' => 'dashicons-warning',
			'error'   => 'dashicons-dismiss',
		);
		?>
		<div class="ml-conditions" id="ml-sending">
			<h3><?php esc_html_e( 'When is the automatic report sent?', 'maintained-log' ); ?></h3>
			<p class="description"><?php esc_html_e( 'On the date of each period, provided the conditions below are met. This is how they stand on this site right now:', 'maintained-log' ); ?></p>
			<ul>
				<?php foreach ( $rows as $row ) : ?>
					<li class="ml-conditions__item is-<?php echo esc_attr( $row[0] ); ?>">
						<span class="dashicons <?php echo esc_attr( $icons[ $row[0] ] ); ?>" aria-hidden="true"></span>
						<div>
							<strong><?php echo esc_html( $row[1] ); ?></strong>
							<?php if ( '' !== $row[2] ) : ?>
								<p><?php echo esc_html( $row[2] ); ?></p>
							<?php endif; ?>
						</div>
					</li>
				<?php endforeach; ?>
			</ul>
		</div>
		<?php
	}

	/**
	 * Instructions to trigger WP-Cron from the hosting.
	 */
	private static function render_cron() {
		$state  = Cron_Status::state();
		$texts  = array(
			Cron_Status::REAL    => array( 'ok', __( 'Working: a real cron job is calling WordPress.', 'maintained-log' ) ),
			Cron_Status::VISITS  => array( 'warning', __( 'Not set up: scheduled tasks run only when someone visits the site.', 'maintained-log' ) ),
			Cron_Status::STOPPED => array( 'error', __( 'Stopped: WP-Cron is disabled in wp-config.php and nothing is calling it.', 'maintained-log' ) ),
			Cron_Status::UNKNOWN => array( 'info', __( 'No run recorded yet.', 'maintained-log' ) ),
		);
		$status = $texts[ $state['mode'] ];
		?>
		<div class="ml-cron" id="ml-cron">
			<h2><?php esc_html_e( 'Reliable sending: real cron job', 'maintained-log' ); ?></h2>
			<p><?php esc_html_e( 'WordPress does not have a clock of its own: it runs scheduled tasks (client reports, alerts, checks, vulnerability and speed data) when someone visits the site. On sites with few visits they can run hours late. A cron job in your hosting calls WordPress every few minutes, so everything runs on time.', 'maintained-log' ); ?></p>

			<p class="ml-cron__status is-<?php echo esc_attr( $status[0] ); ?>">
				<strong><?php esc_html_e( 'Status on this site:', 'maintained-log' ); ?></strong>
				<?php echo esc_html( $status[1] ); ?>
				<?php if ( $state['last_run'] ) : ?>
					<span class="ml-muted">
						<?php
						/* translators: %s: time since. */
						echo esc_html( sprintf( __( 'Last run: %s ago.', 'maintained-log' ), human_time_diff( $state['last_run'] ) ) );
						?>
					</span>
				<?php endif; ?>
			</p>

			<h3><?php esc_html_e( 'How to set it up', 'maintained-log' ); ?></h3>
			<ol class="ml-cron__steps">
				<li>
					<?php esc_html_e( 'In your hosting panel, open the cron jobs section: "Cron Jobs" in cPanel and in Hostinger (hPanel → Advanced), "Scheduled Tasks" in Plesk. In other panels look for "cron" or "scheduled tasks".', 'maintained-log' ); ?>
				</li>
				<li>
					<?php
					/* translators: %d: minutes. */
					echo esc_html( sprintf( __( 'Create a new task that runs every %d minutes. If the panel asks for the schedule as text, use:', 'maintained-log' ), Cron_Status::INTERVAL ) );
					?>
					<input type="text" class="regular-text code ml-cron__code" readonly value="<?php echo esc_attr( Cron_Status::schedule() ); ?>" data-ml-select>
				</li>
				<li>
					<?php esc_html_e( 'Paste this command (it is already adapted to this site):', 'maintained-log' ); ?>
					<input type="text" class="large-text code ml-cron__code" readonly value="<?php echo esc_attr( Cron_Status::commands()['wget'] ); ?>" data-ml-select>
					<details>
						<summary><?php esc_html_e( 'If your hosting does not have wget', 'maintained-log' ); ?></summary>
						<p><?php esc_html_e( 'With curl:', 'maintained-log' ); ?></p>
						<input type="text" class="large-text code ml-cron__code" readonly value="<?php echo esc_attr( Cron_Status::commands()['curl'] ); ?>" data-ml-select>
						<p><?php esc_html_e( 'Running PHP directly (some panels require the full path to PHP, e.g. /usr/local/bin/php; ask your hosting):', 'maintained-log' ); ?></p>
						<input type="text" class="large-text code ml-cron__code" readonly value="<?php echo esc_attr( Cron_Status::commands()['php'] ); ?>" data-ml-select>
					</details>
				</li>
				<li>
					<?php esc_html_e( 'Save the task and come back here in about 20 minutes: the status above should say "Working".', 'maintained-log' ); ?>
				</li>
				<li>
					<?php esc_html_e( 'Optional, only once it says "Working": stop WordPress from also running the tasks on visits, which makes pages a little faster. Add this line to wp-config.php, above "That\'s all, stop editing!":', 'maintained-log' ); ?>
					<input type="text" class="regular-text code ml-cron__code" readonly value="define( 'DISABLE_WP_CRON', true );" data-ml-select>
					<p class="ml-muted"><?php esc_html_e( 'Do not add it before the cron job works: with that line and no cron job, nothing scheduled runs at all.', 'maintained-log' ); ?></p>
					<?php if ( $state['disabled'] ) : ?>
						<p class="ml-muted"><?php esc_html_e( 'This line is already in this site\'s wp-config.php.', 'maintained-log' ); ?></p>
					<?php endif; ?>
				</li>
			</ol>
			<p class="ml-muted"><?php esc_html_e( 'Some security plugins or firewalls block requests to wp-cron.php. If the status does not change, check them or use the PHP command.', 'maintained-log' ); ?></p>
		</div>
		<?php
	}

	/**
	 * Formats a GMT MySQL date in the site timezone and language
	 * (get_date_from_gmt() would leave month names in English).
	 *
	 * @param string $gmt    Date in GMT, Y-m-d H:i:s.
	 * @param string $format Date format.
	 * @return string
	 */
	private static function local_date( $gmt, $format ) {
		return (string) wp_date( $format, strtotime( $gmt . ' UTC' ) );
	}

	/**
	 * Dies unless the user can manage the log.
	 */
	private static function require_cap() {
		if ( ! Plugin::user_can_manage() ) {
			wp_die( esc_html__( 'You are not allowed to access this page.', 'maintained-log' ), 403 );
		}
	}

	/**
	 * Checks capability and nonce for a POST action.
	 *
	 * @param string $action Nonce action.
	 */
	private static function verify( $action ) {
		self::require_cap();
		check_admin_referer( $action );
	}

	/**
	 * Stores a one-time notice and redirects to a plugin screen.
	 *
	 * @param string $page    Page slug.
	 * @param string $type    success|error|warning|info.
	 * @param string $message Message.
	 */
	private static function redirect( $page, $type, $message ) {
		set_transient(
			'maintained_log_notice_' . get_current_user_id(),
			array(
				'type'    => $type,
				'message' => $message,
			),
			MINUTE_IN_SECONDS
		);
		wp_safe_redirect( admin_url( 'admin.php?page=' . $page ) );
		exit;
	}

	/**
	 * Prints and clears the one-time notice.
	 */
	private static function flash_notice() {
		$key    = 'maintained_log_notice_' . get_current_user_id();
		$notice = get_transient( $key );
		if ( ! $notice ) {
			return;
		}
		delete_transient( $key );
		printf(
			'<div class="notice notice-%1$s is-dismissible"><p>%2$s</p></div>',
			esc_attr( $notice['type'] ),
			esc_html( $notice['message'] )
		);
	}
}