<?php
/**
 * Location meta box for post types served to a map.
 *
 * @package Mapsemble
 */

namespace Mapsemble\Admin;

use Mapsemble\Api\Client;
use Mapsemble\Capabilities;
use Mapsemble\Geo\CoordinateInput;
use Mapsemble\Geo\Coordinates;
use Mapsemble\MapConfig;
use Mapsemble\MapConfigRepository;
use Mapsemble\Rest\GeocodeController;

/**
 * Lat/lng meta box and its save handler.
 */
class MetaBox {

	private const NONCE_ACTION = 'mapsemble_location';
	private const NONCE_FIELD  = 'mapsemble_location_nonce';

	/**
	 * Per-user, per-post error left by a save for the next screen to show;
	 * the post id is appended after the user id.
	 */
	private const ERROR_TRANSIENT = 'mapsemble_location_error_';

	private const SCRIPT_HANDLE = 'mapsemble-location-box';

	/**
	 * Config repository.
	 *
	 * @var MapConfigRepository
	 */
	private MapConfigRepository $repository;

	/**
	 * Coordinate storage.
	 *
	 * @var Coordinates
	 */
	private Coordinates $coordinates;

	/**
	 * API client, asked only whether the site is connected.
	 *
	 * @var Client
	 */
	private Client $api;

	/**
	 * Constructor.
	 *
	 * @param MapConfigRepository $repository  Config repository.
	 * @param Coordinates         $coordinates Coordinate storage.
	 * @param Client|null         $api         API client; a fresh one when
	 *                                         omitted, as it only reads the
	 *                                         saved credentials.
	 */
	public function __construct( MapConfigRepository $repository, Coordinates $coordinates, ?Client $api = null ) {
		$this->repository  = $repository;
		$this->coordinates = $coordinates;
		$this->api         = $api ?? new Client();
	}

	/**
	 * Hooks the meta box and save handler.
	 */
	public function register(): void {
		add_action( 'add_meta_boxes', array( $this, 'add_boxes' ) );
		add_action( 'save_post', array( $this, 'save' ), 10, 2 );
		add_action( 'admin_notices', array( $this, 'notice' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue' ) );
	}

	/**
	 * What went wrong, by CoordinateInput error code. The script receives
	 * the same strings, so the browser and the server say the same thing —
	 * on blur before any save as much as after one, so none claims a save.
	 *
	 * @return array<string, string>
	 */
	private function messages(): array {
		return array(
			'half'       => __( 'Enter both latitude and longitude — until this is fixed, the stored location stays as it was.', 'mapsemble' ),
			'not_number' => __( 'Latitude and longitude must be numbers, like 51.9244 — until this is fixed, the stored location stays as it was.', 'mapsemble' ),
			'lat_range'  => __( 'Latitude must be between -90 and 90 — until this is fixed, the stored location stays as it was.', 'mapsemble' ),
			'lng_range'  => __( 'Longitude must be between -180 and 180 — until this is fixed, the stored location stays as it was.', 'mapsemble' ),
		);
	}

	/**
	 * The address search's words: its own, plus the endpoint's error
	 * messages keyed by REST error code (GeocodeController is their one
	 * source). `found` holds a %s, or %1$s, for the map link's text.
	 *
	 * @return array<string, string>
	 */
	private function search_messages(): array {
		return array_merge(
			array(
				'empty'     => __( 'Type an address first.', 'mapsemble' ),
				'searching' => __( 'Searching…', 'mapsemble' ),
				/* translators: %s: link text, "check it on OpenStreetMap". Write it as %s or %1$s. */
				'found'     => __( 'Found — %s', 'mapsemble' ),
				'check'     => __( 'check it on OpenStreetMap', 'mapsemble' ),
				'kept'      => __( 'Found, but the coordinates were edited during the search, so they were left as typed.', 'mapsemble' ),
				'retrySoon' => (string) GeocodeController::RETRY_SOON,
			),
			GeocodeController::messages()
		);
	}

	/**
	 * Whether the current admin screen edits a post the box is on.
	 */
	private function on_box_screen(): bool {
		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
		return null !== $screen
			&& 'post' === $screen->base
			&& in_array( $screen->post_type, $this->metabox_post_types(), true );
	}

	/**
	 * The error transient key for the current user and a post.
	 *
	 * @param int $post_id Post ID.
	 */
	private function error_key( int $post_id ): string {
		return self::ERROR_TRANSIENT . get_current_user_id() . '_' . $post_id;
	}

	/**
	 * Enqueues the box's script on the post edit screens it appears on.
	 *
	 * @param string $hook_suffix Current admin page.
	 */
	public function enqueue( string $hook_suffix ): void {
		if ( ! in_array( $hook_suffix, array( 'post.php', 'post-new.php' ), true ) || ! $this->on_box_screen() ) {
			return;
		}
		$screen = get_current_screen();
		// Only the block editor has a notices store to report a save to.
		// apiFetch, for the address search, works in either editor and
		// brings the REST nonce with it.
		$deps = null !== $screen && $screen->is_block_editor()
			? array( 'wp-api-fetch', 'wp-data', 'wp-notices', 'wp-editor' )
			: array( 'wp-api-fetch' );
		wp_enqueue_script(
			self::SCRIPT_HANDLE,
			plugins_url( 'assets/js/location-box.js', MAPSEMBLE_PLUGIN_FILE ),
			$deps,
			MAPSEMBLE_VERSION,
			true
		);
		wp_localize_script(
			self::SCRIPT_HANDLE,
			'mapsembleLocationBox',
			array(
				'messages' => $this->messages(),
				'search'   => $this->search_messages(),
			)
		);
	}

	/**
	 * Classic editor: says why the last save left the location as it was.
	 *
	 * The block editor saves meta boxes in a request of their own and never
	 * reloads, so its script reports the error at save time instead; the
	 * message is still consumed here, or it would linger for the next visit.
	 */
	public function notice(): void {
		if ( ! $this->on_box_screen() ) {
			return;
		}
		$post = get_post();
		if ( ! $post instanceof \WP_Post ) {
			return;
		}
		$key     = $this->error_key( (int) $post->ID );
		$message = get_transient( $key );
		if ( false === $message ) {
			return;
		}
		delete_transient( $key );
		$screen = get_current_screen();
		if ( ! is_string( $message ) || ( null !== $screen && $screen->is_block_editor() ) ) {
			return;
		}
		printf( '<div class="notice notice-error is-dismissible"><p>%s</p></div>', esc_html( $message ) );
	}

	/**
	 * Post types whose configs use the built-in meta box.
	 *
	 * Hosted maps are excluded: their locations live in Mapsemble and are
	 * edited there, so a latitude field on this site's posts would collect
	 * values nothing ever reads.
	 *
	 * @return string[]
	 */
	private function metabox_post_types(): array {
		$types = array();
		foreach ( $this->repository->all() as $config ) {
			if ( ! $config->is_hosted() && MapConfig::SOURCE_METABOX === $config->location_source ) {
				$types[ $config->post_type ] = true;
			}
		}
		return array_keys( $types );
	}

	/**
	 * Registers the meta box on the relevant post types.
	 */
	public function add_boxes(): void {
		foreach ( $this->metabox_post_types() as $post_type ) {
			add_meta_box(
				'mapsemble_location',
				__( 'Map location', 'mapsemble' ),
				array( $this, 'render' ),
				$post_type,
				'side'
			);
		}
	}

	/**
	 * Renders the meta box fields.
	 *
	 * Plain text fields: type=number drops a comma decimal in an en-US
	 * browser, and inputmode="decimal" gets iOS's keypad, which has no minus
	 * key. The message line is a polite live region that stays in the
	 * accessibility tree, empty while there is nothing to say.
	 *
	 * The address search above them has no name, so it never posts: it only
	 * fills the two fields, which save as if typed.
	 *
	 * @param \WP_Post $post The post being edited.
	 */
	public function render( \WP_Post $post ): void {
		$coords = $this->coordinates->get( (int) $post->ID );
		$hidden = '1' === get_post_meta( (int) $post->ID, Coordinates::META_HIDDEN, true );
		wp_nonce_field( self::NONCE_ACTION, self::NONCE_FIELD );
		$this->render_search();
		?>
		<p>
			<label for="mapsemble-lat"><?php esc_html_e( 'Latitude', 'mapsemble' ); ?></label><br />
			<input type="text" autocomplete="off" spellcheck="false" id="mapsemble-lat"
				name="mapsemble_lat" class="widefat" aria-describedby="mapsemble-location-error"
				value="<?php echo esc_attr( null !== $coords ? (string) $coords['lat'] : '' ); ?>" />
		</p>
		<p>
			<label for="mapsemble-lng"><?php esc_html_e( 'Longitude', 'mapsemble' ); ?></label><br />
			<input type="text" autocomplete="off" spellcheck="false" id="mapsemble-lng"
				name="mapsemble_lng" class="widefat" aria-describedby="mapsemble-location-error"
				value="<?php echo esc_attr( null !== $coords ? (string) $coords['lng'] : '' ); ?>" />
		</p>
		<p id="mapsemble-location-error" class="mapsemble-location-error" aria-live="polite" style="color: #d63638; margin: 0;"></p>
		<p>
			<label for="mapsemble-hidden">
				<input type="checkbox" id="mapsemble-hidden" name="mapsemble_hidden" value="1" <?php checked( $hidden ); ?> />
				<?php esc_html_e( 'Hide from maps', 'mapsemble' ); ?>
			</label>
		</p>
		<p class="description">
			<?php esc_html_e( 'Leave both fields empty to keep this item off the map.', 'mapsemble' ); ?>
		</p>
		<?php
	}

	/**
	 * The address search, or on a site not connected yet, word of it.
	 *
	 * The hint links to the settings only for someone who may open them.
	 */
	private function render_search(): void {
		if ( ! $this->api->has_credentials() ) {
			$hint = __( 'Connect Mapsemble to search by address.', 'mapsemble' );
			if ( current_user_can( Capabilities::MANAGE ) ) {
				printf( '<p class="description"><a href="%s">%s</a></p>', esc_url( SettingsPage::url() ), esc_html( $hint ) );
			} else {
				printf( '<p class="description">%s</p>', esc_html( $hint ) );
			}
			return;
		}
		?>
		<p>
			<label for="mapsemble-address"><?php esc_html_e( 'Find an address', 'mapsemble' ); ?></label><br />
			<input type="search" id="mapsemble-address" class="widefat" autocomplete="off"
				maxlength="<?php echo esc_attr( (string) GeocodeController::MAX_LENGTH ); ?>"
				placeholder="<?php esc_attr_e( 'Street, city', 'mapsemble' ); ?>" />
			<button type="button" class="button" id="mapsemble-address-find"><?php esc_html_e( 'Find', 'mapsemble' ); ?></button>
			<span id="mapsemble-address-status" class="description" aria-live="polite"></span>
		</p>
		<?php
	}

	/**
	 * Saves the meta box values.
	 *
	 * @param int      $post_id Post ID.
	 * @param \WP_Post $post    The post being saved.
	 */
	public function save( int $post_id, \WP_Post $post ): void {
		if ( ! isset( $_POST[ self::NONCE_FIELD ] ) ) {
			return;
		}
		if ( ! wp_verify_nonce(
			sanitize_text_field( wp_unslash( $_POST[ self::NONCE_FIELD ] ) ),
			self::NONCE_ACTION
		) ) {
			return;
		}
		if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || wp_is_post_revision( $post_id ) ) {
			return;
		}
		if ( ! current_user_can( 'edit_post', $post_id ) ) {
			return;
		}
		if ( ! in_array( $post->post_type, $this->metabox_post_types(), true ) ) {
			return;
		}

		$lat    = $this->posted( 'mapsemble_lat' );
		$lng    = $this->posted( 'mapsemble_lng' );
		$parsed = null !== $lat && null !== $lng
			? CoordinateInput::parse( $lat, $lng )
			: array(
				// A forged array is no number either.
				'status' => 'invalid',
				'error'  => 'not_number',
			);
		if ( 'invalid' === $parsed['status'] ) {
			// A typo must never cost the location that was already there.
			set_transient( $this->error_key( $post_id ), $this->messages()[ $parsed['error'] ], MINUTE_IN_SECONDS );
		} else {
			delete_transient( $this->error_key( $post_id ) );
			$this->coordinates->write(
				$post_id,
				'valid' === $parsed['status']
					? array(
						'lat' => $parsed['lat'],
						'lng' => $parsed['lng'],
					)
					: null
			);
		}
		$this->coordinates->set_hidden( $post_id, ! empty( $_POST['mapsemble_hidden'] ) );
	}

	/**
	 * A submitted coordinate field, unslashed but otherwise as typed.
	 *
	 * Deliberately not sanitize_text_field(): it rewrites input ("5%201"
	 * becomes "51", "<5>" becomes ""), which would save numbers nobody
	 * typed and disagree with the script. CoordinateInput is the validator
	 * and only ever yields floats, so nothing raw reaches the database.
	 *
	 * @param string $key Field name.
	 * @return string|null Null when the field is not a string (an array, say).
	 */
	private function posted( string $key ): ?string {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- save() verified the nonce.
		if ( ! isset( $_POST[ $key ] ) ) {
			return '';
		}
		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce verified in save(); CoordinateInput::parse() validates and yields only floats.
		$raw = wp_unslash( $_POST[ $key ] );
		return is_string( $raw ) ? $raw : null;
	}
}