<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName -- File names follow the MisticGate naming convention.
/**
 * Administration UI for MisticGate.
 *
 * @package Misticgate
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Single-site and network administration controller.
 */
final class MisticGate_Admin {
	const PAGE               = 'misticgate';
	const SITE_CAPABILITY    = 'manage_options';
	const NETWORK_CAPABILITY = 'manage_network_options';
	const SITES_PER_PAGE     = 50;

	/**
	 * Registered page hooks.
	 *
	 * @var string[]
	 */
	private static $page_hooks = array();

	/**
	 * Plugins screen and settings URLs for the redirect after activation.
	 *
	 * @var array
	 */
	private static $activation_redirect = array();

	/**
	 * Whether the protection warning was already shown in this request.
	 *
	 * @var bool
	 */
	private static $protection_notice_shown = false;

	/**
	 * Protection gap results for this request, keyed by scope.
	 *
	 * @var int[]
	 */
	private static $protection_gaps = array();

	// Hooks and menus.
	/**
	 * Registers hooks.
	 *
	 * @return void
	 */
	public static function boot() {
		add_action( 'activate_' . plugin_basename( MISTICGATE_MAIN_FILE ), array( __CLASS__, 'prepare_activation_redirect' ), 5 );
		add_action( 'admin_init', array( 'MisticGate', 'ensure_settings' ) );
		add_action( 'admin_menu', array( __CLASS__, 'register_site_page' ) );
		add_action( 'network_admin_menu', array( __CLASS__, 'register_network_page' ) );
		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'enqueue_assets' ) );
		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'prepare_session_notice' ), 20 );
		add_action( 'admin_notices', array( __CLASS__, 'show_setup_notice' ) );
		add_action( 'network_admin_notices', array( __CLASS__, 'show_setup_notice' ) );
		add_action( 'admin_notices', array( __CLASS__, 'show_protection_notice' ), 5 );
		add_action( 'network_admin_notices', array( __CLASS__, 'show_protection_notice' ), 5 );

		add_action( 'admin_post_misticgate_enable', array( __CLASS__, 'handle_enable' ) );
		add_action( 'admin_post_misticgate_disable', array( __CLASS__, 'handle_disable' ) );
		add_action( 'admin_post_misticgate_prepare_rotation', array( __CLASS__, 'handle_prepare_rotation' ) );
		add_action( 'admin_post_misticgate_activate_rotation', array( __CLASS__, 'handle_activate_rotation' ) );
		add_action( 'admin_post_misticgate_cancel_rotation', array( __CLASS__, 'handle_cancel_rotation' ) );
		add_action( 'admin_post_misticgate_exempt_roles', array( __CLASS__, 'handle_exempt_roles' ) );

		add_action( 'admin_post_misticgate_network_enable', array( __CLASS__, 'handle_network_enable' ) );
		add_action( 'admin_post_misticgate_network_disable', array( __CLASS__, 'handle_network_disable' ) );
		add_action( 'admin_post_misticgate_network_prepare_rotation', array( __CLASS__, 'handle_network_prepare_rotation' ) );
		add_action( 'admin_post_misticgate_network_activate_rotation', array( __CLASS__, 'handle_network_activate_rotation' ) );
		add_action( 'admin_post_misticgate_network_cancel_rotation', array( __CLASS__, 'handle_network_cancel_rotation' ) );
		add_action( 'admin_post_misticgate_network_exempt_roles', array( __CLASS__, 'handle_network_exempt_roles' ) );

		add_filter( 'plugin_action_links_' . plugin_basename( MISTICGATE_MAIN_FILE ), array( __CLASS__, 'add_site_action_link' ) );
		add_filter( 'network_admin_plugin_action_links', array( __CLASS__, 'add_network_action_link' ), 10, 4 );
	}

	// Initial setup: change only WordPress's successful, single-plugin activation redirect.
	/**
	 * Records that the settings screen should open after activation.
	 *
	 * @param bool $network_wide Whether the plugin is being network activated.
	 *
	 * @return void
	 */
	public static function prepare_activation_redirect( $network_wide = false ) {
		global $pagenow;

		if (
			'plugins.php' !== $pagenow ||
			! is_admin() ||
			'GET' !== self::request_method() ||
			wp_doing_ajax() ||
			wp_doing_cron() ||
			( defined( 'WP_CLI' ) && WP_CLI ) ||
			( defined( 'REST_REQUEST' ) && REST_REQUEST ) ||
			( defined( 'IFRAME_REQUEST' ) && IFRAME_REQUEST )
		) {
			return;
		}

		$plugin = plugin_basename( MISTICGATE_MAIN_FILE );
		$nonce  = isset( $_GET['_wpnonce'] ) && is_string( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
		if ( ! wp_verify_nonce( $nonce, 'activate-plugin_' . $plugin ) ) {
			return;
		}
		if (
			! isset( $_GET['action'], $_GET['plugin'] ) ||
			! is_string( $_GET['action'] ) ||
			! is_string( $_GET['plugin'] ) ||
			'activate' !== sanitize_key( wp_unslash( $_GET['action'] ) ) ||
			sanitize_text_field( wp_unslash( $_GET['plugin'] ) ) !== $plugin ||
			! current_user_can( 'activate_plugin', $plugin )
		) {
			return;
		}

		if ( $network_wide ) {
			if (
				! is_multisite() || ! is_network_admin() ||
				! is_super_admin( get_current_user_id() ) || ! current_user_can( self::NETWORK_CAPABILITY ) ||
				false !== get_network_option( get_current_network_id(), MisticGate_Network::OPTION_NAME, false )
			) {
				return;
			}
		} elseif (
			is_network_admin() || ! current_user_can( self::SITE_CAPABILITY ) ||
			false !== get_option( MisticGate::OPTION_NAME, false )
		) {
			return;
		}

		self::$activation_redirect = array(
			'plugins_url'  => $network_wide ? network_admin_url( 'plugins.php' ) : admin_url( 'plugins.php' ),
			'settings_url' => $network_wide ? self::network_page_url() : self::site_page_url(),
		);
		add_filter( 'wp_redirect', array( __CLASS__, 'filter_activation_redirect' ), 10, 2 );
	}

	/**
	 * Opens the settings screen after a single activation.
	 *
	 * @param string $location Redirect destination.
	 * @param int    $status   HTTP status code.
	 *
	 * @return string Redirect destination.
	 */
	public static function filter_activation_redirect( $location, $status ) {
		if ( empty( self::$activation_redirect ) || ! is_string( $location ) || 302 !== $status ) {
			return $location;
		}
		$base = explode( '?', $location, 2 );
		if ( self::$activation_redirect['plugins_url'] !== $base[0] ) {
			return $location;
		}

		$query = array();
		wp_parse_str( (string) wp_parse_url( $location, PHP_URL_QUERY ), $query );
		if ( ! isset( $query['activate'] ) || 'true' !== $query['activate'] ) {
			return $location;
		}
		if ( isset( $query['error'] ) || isset( $query['activate-multi'] ) ) {
			return $location;
		}

		$target                    = self::$activation_redirect['settings_url'];
		self::$activation_redirect = array();
		remove_filter( 'wp_redirect', array( __CLASS__, 'filter_activation_redirect' ), 10 );
		return $target;
	}

	// The notice reuses a request-local result; never keep an all-clear across requests.
	/**
	 * Returns a site that needs protection in the current scope.
	 *
	 * @return int Site ID, or 0 when no site needs attention.
	 */
	private static function protection_gap_site_id() {
		$network_scope = is_multisite() && is_super_admin( get_current_user_id() ) && current_user_can( self::NETWORK_CAPABILITY );
		if ( ! $network_scope && ( is_network_admin() || ! current_user_can( self::SITE_CAPABILITY ) ) ) {
			return 0;
		}

		$key = get_current_user_id() . ':' . ( $network_scope ? 'network:' . get_current_network_id() : 'site:' . get_current_blog_id() );
		if ( ! array_key_exists( $key, self::$protection_gaps ) ) {
			self::$protection_gaps[ $key ] = $network_scope
				? MisticGate_Network::first_unprotected_site_id()
				: ( MisticGate::protects_site( get_current_blog_id() ) || MisticGate_Network::protects_current_site() ? 0 : get_current_blog_id() );
		}
		return self::$protection_gaps[ $key ];
	}

	/**
	 * Registers the site settings page.
	 *
	 * @return void
	 */
	public static function register_site_page() {
		if ( ! current_user_can( self::SITE_CAPABILITY ) ) {
			return;
		}
		self::$page_hooks[] = add_menu_page(
			'MisticGate',
			'MisticGate',
			self::SITE_CAPABILITY,
			self::PAGE,
			array( __CLASS__, 'render_site_page' ),
			'dashicons-shield-alt',
			99
		);
	}

	/**
	 * Registers the network settings page.
	 *
	 * @return void
	 */
	public static function register_network_page() {
		if ( ! is_multisite() || ! is_super_admin( get_current_user_id() ) || ! current_user_can( self::NETWORK_CAPABILITY ) ) {
			return;
		}
		self::$page_hooks[] = add_menu_page(
			'MisticGate',
			'MisticGate',
			self::NETWORK_CAPABILITY,
			self::PAGE,
			array( __CLASS__, 'render_network_page' ),
			'dashicons-shield-alt',
			99
		);
	}

	/**
	 * Loads the settings page assets.
	 *
	 * @param string $hook_suffix Current admin page hook.
	 *
	 * @return void
	 */
	public static function enqueue_assets( $hook_suffix ) {
		if ( ! in_array( $hook_suffix, self::$page_hooks, true ) ) {
			return;
		}

		wp_enqueue_style( 'misticgate-admin', MISTICGATE_BASE_URL . 'inc/css/misticgate-admin.css', array(), MISTICGATE_VERSION );
		wp_enqueue_script(
			'misticgate-admin',
			MISTICGATE_BASE_URL . 'inc/js/misticgate-admin.js',
			array(),
			MISTICGATE_VERSION,
			array(
				'in_footer' => true,
				'strategy'  => 'defer',
			)
		);
		wp_localize_script(
			'misticgate-admin',
			'misticgateAdminL10n',
			array(
				'copyUrl'      => __( 'Copy URL', 'misticgate' ),
				'copied'       => __( 'Copied', 'misticgate' ),
				'copySuccess'  => __( 'URL copied. Save it as a bookmark.', 'misticgate' ),
				'copyFailed'   => __( 'Could not copy automatically. Copy the selected URL manually.', 'misticgate' ),
				'pendingLeave' => __( 'The new gate URL is not active yet. It will not work until you switch to it. Leave this page?', 'misticgate' ),
			)
		);
	}

	// Keep WordPress Heartbeat and its dialog behavior; replace only the protected screen's login iframe with guidance.
	/**
	 * Loads the expired-session guidance on protected screens.
	 *
	 * @return void
	 */
	public static function prepare_session_notice() {
		if ( ! is_user_logged_in() || ! ( MisticGate::protects_site( get_current_blog_id() ) || MisticGate_Network::protects_current_site() ) ) {
			return;
		}
		$priority = has_action( 'admin_print_footer_scripts', 'wp_auth_check_html' );
		if ( false === $priority ) {
			return;
		}
		remove_action( 'admin_print_footer_scripts', 'wp_auth_check_html', $priority );
		remove_action( 'wp_print_footer_scripts', 'wp_auth_check_html', $priority );
		add_action( 'admin_print_footer_scripts', array( __CLASS__, 'render_session_notice' ), $priority );
		wp_enqueue_style( 'misticgate-session', MISTICGATE_BASE_URL . 'inc/css/misticgate-session.css', array( 'wp-auth-check' ), MISTICGATE_VERSION );
		wp_enqueue_script( 'misticgate-session', MISTICGATE_BASE_URL . 'inc/js/misticgate-session.js', array( 'wp-auth-check' ), MISTICGATE_VERSION, true );
	}

	/**
	 * Outputs the expired-session guidance template.
	 *
	 * @return void
	 */
	public static function render_session_notice() {
		?>
		<div id="wp-auth-check-wrap" class="hidden fallback misticgate-session-check">
			<div id="wp-auth-check-bg"></div>
			<div id="wp-auth-check" role="dialog" aria-modal="true" aria-labelledby="misticgate-session-title" aria-describedby="misticgate-session-description">
				<button type="button" class="wp-auth-check-close button-link"><span class="screen-reader-text"><?php esc_html_e( 'Close dialog', 'misticgate' ); ?></span></button>
				<div class="wp-auth-fallback">
					<h2 id="misticgate-session-title" class="wp-auth-fallback-expired" tabindex="-1"><?php esc_html_e( 'Your session has expired', 'misticgate' ); ?></h2>
					<p id="misticgate-session-description"><?php esc_html_e( 'Open the WordPress login page from your saved MisticGate gate URL and log in again.', 'misticgate' ); ?></p>
				</div>
			</div>
		</div>
		<?php
	}

	/**
	 * Adds the Settings link on the Plugins screen.
	 *
	 * @param array $links Plugin action links.
	 *
	 * @return array Plugin action links.
	 */
	public static function add_site_action_link( $links ) {
		if ( ! current_user_can( self::SITE_CAPABILITY ) ) {
			return $links;
		}
		array_unshift( $links, '<a href="' . esc_url( self::site_page_url() ) . '">' . esc_html__( 'Settings', 'misticgate' ) . '</a>' );
		return $links;
	}

	/**
	 * Adds the Settings link on the Network Plugins screen.
	 *
	 * @param array  $actions     Plugin action links.
	 * @param string $plugin_file Plugin file.
	 * @param array  $plugin_data Plugin data.
	 * @param string $context     Plugin list context.
	 *
	 * @return array Plugin action links.
	 */
	public static function add_network_action_link( $actions, $plugin_file, $plugin_data, $context ) {
		unset( $plugin_data, $context );
		if ( is_multisite() && is_super_admin( get_current_user_id() ) && current_user_can( self::NETWORK_CAPABILITY ) && plugin_basename( MISTICGATE_MAIN_FILE ) === $plugin_file ) {
			array_unshift( $actions, '<a href="' . esc_url( self::network_page_url() ) . '">' . esc_html__( 'Settings', 'misticgate' ) . '</a>' );
		}
		return $actions;
	}

	/**
	 * Shows the notice that opens the settings while the gate is off.
	 *
	 * @return void
	 */
	public static function show_setup_notice() {
		if ( self::$protection_notice_shown || MisticGate::is_emergency_disabled() ) {
			return;
		}

		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
		if ( ! $screen ) {
			return;
		}
		if ( is_network_admin() ) {
			if ( ! is_multisite() || 'plugins-network' !== $screen->id || ! is_super_admin( get_current_user_id() ) || ! current_user_can( self::NETWORK_CAPABILITY ) ) {
				return;
			}
			$settings = MisticGate_Network::get_settings();
			$page_url = self::network_page_url();
		} else {
			if ( 'plugins' !== $screen->id || ! current_user_can( self::SITE_CAPABILITY ) || ( is_multisite() && MisticGate_Network::protects_current_site() ) ) {
				return;
			}
			$settings = MisticGate::get_settings();
			$page_url = self::site_page_url();
		}
		if ( $settings['enabled'] ) {
			return;
		}
		?>
		<div class="notice notice-info">
			<p><strong>MisticGate:</strong> <?php esc_html_e( 'Save the gate URL as a bookmark, then enable MisticGate.', 'misticgate' ); ?> <a href="<?php echo esc_url( $page_url ); ?>"><?php esc_html_e( 'Open settings', 'misticgate' ); ?></a></p>
		</div>
		<?php
	}

	/**
	 * Shows the warning for sites that no gate protects.
	 *
	 * @return void
	 */
	public static function show_protection_notice() {
		if ( self::$protection_notice_shown || ( ! current_user_can( self::SITE_CAPABILITY ) && ! current_user_can( self::NETWORK_CAPABILITY ) ) ) {
			return;
		}
		if ( MisticGate::is_emergency_disabled() ) {
			self::$protection_notice_shown = true;
			echo '<div class="notice notice-warning"><p><strong>MisticGate:</strong> ' . esc_html__( 'Protection is paused by MISTICGATE_DISABLE. Saved settings have not changed.', 'misticgate' ) . '</p></div>';
			return;
		}

		if ( is_multisite() && is_super_admin( get_current_user_id() ) && current_user_can( self::NETWORK_CAPABILITY ) ) {
			$site_id = self::protection_gap_site_id();
			if ( 0 === $site_id ) {
				return;
			}
			$message     = __( 'Some sites in this network are not protected by MisticGate.', 'misticgate' );
			$main_active = MisticGate::is_active_on_site( get_main_site_id( get_current_network_id() ) );
			$url         = $main_active ? self::network_page_url( $site_id ) : network_admin_url( 'plugins.php' );
			$link_text   = $main_active ? __( 'Review protection', 'misticgate' ) : __( 'Open network plugins', 'misticgate' );
			if ( ! $main_active ) {
				$message .= ' ' . __( 'Activate MisticGate on the main site or for the network to open network settings.', 'misticgate' );
			}
		} else {
			if ( 0 === self::protection_gap_site_id() ) {
				return;
			}
			$message   = __( 'This site\'s login page is not protected by MisticGate.', 'misticgate' );
			$url       = self::site_page_url();
			$link_text = __( 'Open settings', 'misticgate' );
		}

		self::$protection_notice_shown = true;
		echo '<div class="notice notice-warning"><p><strong>MisticGate:</strong> ' . esc_html( $message ) . ' <a href="' . esc_url( $url ) . '">' . esc_html( $link_text ) . '</a></p></div>';
	}

	/**
	 * Outputs the site settings page.
	 *
	 * @return void
	 */
	public static function render_site_page() {
		if ( ! current_user_can( self::SITE_CAPABILITY ) ) {
			wp_die( esc_html__( 'You are not allowed to manage MisticGate.', 'misticgate' ), '', array( 'response' => 403 ) );
		}

		if ( 'readme' === self::query_key( 'tab' ) ) {
			self::render_readme_page( false );
			return;
		}

		self::render_settings_page(
			'site',
			get_current_blog_id(),
			admin_url( 'admin-post.php' ),
			'',
			''
		);
	}

	/**
	 * Outputs the network settings page.
	 *
	 * @return void
	 */
	public static function render_network_page() {
		if (
			! is_multisite() ||
			! current_user_can( self::NETWORK_CAPABILITY ) ||
			! is_super_admin( get_current_user_id() )
		) {
			wp_die( esc_html__( 'You are not allowed to manage MisticGate network settings.', 'misticgate' ), '', array( 'response' => 403 ) );
		}

		MisticGate_Network::ensure_settings();

		$site_id = self::query_integer( 'site_id' );
		$site    = $site_id > 0 ? get_site( $site_id ) : null;
		if ( 0 === $site_id ) {
			if ( 'readme' === self::query_key( 'tab' ) ) {
				self::render_readme_page( true );
				return;
			}
			self::render_network_site_list();
			return;
		}
		if ( ! $site || get_current_network_id() !== (int) $site->network_id ) {
			wp_die(
				esc_html__( 'This site is no longer available in this network.', 'misticgate' ),
				'',
				array(
					'response'  => 404,
					'back_link' => true,
				)
			);
		}
		if ( ! wp_is_site_initialized( $site_id ) ) {
			wp_die(
				esc_html__( 'This site is not ready. Finish creating or restoring it in WordPress before configuring MisticGate.', 'misticgate' ),
				'',
				array(
					'response'  => 409,
					'back_link' => true,
				)
			);
		}

		$form_action = admin_url( 'admin-post.php' );
		$site_name   = (string) get_blog_option( $site_id, 'blogname', '' );
		$site_url    = get_home_url( $site_id, '/' );

		switch_to_blog( $site_id );
		try {
			MisticGate::ensure_settings();
			self::render_settings_page(
				'network',
				$site_id,
				$form_action,
				$site_name,
				$site_url
			);
		} finally {
			restore_current_blog();
		}
	}

	// Settings screens.
	/**
	 * Outputs the site list on the network settings page.
	 *
	 * @return void
	 */
	private static function render_network_site_list() {
		$paged            = max( 1, self::query_integer( 'paged' ) );
		$network_id       = get_current_network_id();
		$offset           = ( $paged - 1 ) * self::SITES_PER_PAGE;
		$sites            = get_sites(
			array(
				'network_id' => $network_id,
				'number'     => self::SITES_PER_PAGE,
				'offset'     => $offset,
				'orderby'    => 'id',
				'order'      => 'ASC',
			)
		);
		$total            = (int) get_sites(
			array(
				'network_id' => $network_id,
				'count'      => true,
			)
		);
		$network_settings = MisticGate_Network::get_settings();
		$form_action      = admin_url( 'admin-post.php' );
		$network_message  = self::query_key( 'misticgate_network_message' );
		?>
		<div class="wrap misticgate-wrap">
			<div class="misticgate-shell misticgate-shell-wide">
				<header class="misticgate-header">
					<div>
						<p class="misticgate-kicker">MisticGate™ 1.0.0</p>
						<h1><?php esc_html_e( 'Network gate', 'misticgate' ); ?></h1>
						<p><?php esc_html_e( 'Manage the network gate and site gates.', 'misticgate' ); ?></p>
					</div>
				</header>

				<?php self::render_tabs( 'settings', self::network_page_url() ); ?>

				<?php self::render_network_gate( $network_settings, $form_action, $network_message ); ?>

				<section class="misticgate-card">
					<div class="misticgate-card-body">
						<div class="misticgate-section-heading">
							<h2><?php esc_html_e( 'Site gates', 'misticgate' ); ?></h2>
							<p>
							<?php
							if ( ! MisticGate::is_emergency_disabled() && MisticGate_Network::is_network_active() && $network_settings['enabled'] && $network_settings['protect_all_sites'] ) {
								esc_html_e( 'Add a site gate only when a separate bookmark is needed.', 'misticgate' );
							} else {
								esc_html_e( 'Enable a site gate for each site that is not protected by the network gate.', 'misticgate' );
							}
							?>
						</p>
						</div>
						<table class="widefat striped misticgate-sites-table">
							<thead><tr><th scope="col"><?php esc_html_e( 'Site', 'misticgate' ); ?></th><th scope="col"><?php esc_html_e( 'Protection', 'misticgate' ); ?></th><th scope="col" class="misticgate-sites-action"><?php esc_html_e( 'Action', 'misticgate' ); ?></th></tr></thead>
							<tbody>
							<?php if ( empty( $sites ) ) : ?>
								<tr><td colspan="3"><?php esc_html_e( 'No sites found.', 'misticgate' ); ?></td></tr>
							<?php else : ?>
								<?php foreach ( $sites as $network_site ) : ?>
									<?php
									$network_site_id   = (int) $network_site->blog_id;
									$site_ready        = wp_is_site_initialized( $network_site_id );
									$site_name         = $site_ready ? (string) get_blog_option( $network_site_id, 'blogname', '' ) : '';
									$home_url          = $site_ready ? get_home_url( $network_site_id, '/' ) : $network_site->domain . $network_site->path;
									$network_protected = $site_ready && MisticGate_Network::protects_site( $network_site_id, $network_settings );
									$site_enabled      = $site_ready && MisticGate::protects_site( $network_site_id );
									if ( ! $site_ready ) {
										$status = __( 'Site not ready', 'misticgate' );
									} elseif ( MisticGate::is_emergency_disabled() ) {
										$status = __( 'Protection paused', 'misticgate' );
									} elseif ( $network_protected ) {
										$status = $site_enabled ? __( 'Network + site gate', 'misticgate' ) : __( 'Network gate', 'misticgate' );
									} else {
										$status = $site_enabled ? __( 'Site gate', 'misticgate' ) : __( 'Not protected', 'misticgate' );
									}
									?>
									<tr>
										<td><strong><?php echo esc_html( '' !== $site_name ? $site_name : $home_url ); ?></strong><br><span class="misticgate-site-url"><?php echo esc_html( $home_url ); ?></span></td>
										<td><span class="misticgate-table-status <?php echo ( $network_protected || $site_enabled ) ? 'is-enabled' : ''; ?>"><?php echo esc_html( $status ); ?></span></td>
										<td class="misticgate-sites-action"><a class="button" href="<?php echo esc_url( self::network_page_url( $network_site_id ) ); ?>"><?php esc_html_e( 'Settings', 'misticgate' ); ?></a></td>
									</tr>
								<?php endforeach; ?>
							<?php endif; ?>
							</tbody>
						</table>

						<?php
						$total_pages = (int) ceil( $total / self::SITES_PER_PAGE );
						if ( $total_pages > 1 ) {
							echo '<div class="tablenav"><div class="tablenav-pages">';
							echo wp_kses_post(
								paginate_links(
									array(
										'base'      => add_query_arg( 'paged', '%#%', self::network_page_url() ),
										'format'    => '',
										'current'   => $paged,
										'total'     => $total_pages,
										'prev_text' => __( 'Previous', 'misticgate' ),
										'next_text' => __( 'Next', 'misticgate' ),
									)
								)
							);
							echo '</div></div>';
						}
						?>
					</div>
				</section>

				<?php if ( 'https' !== wp_parse_url( MisticGate_Network::login_url(), PHP_URL_SCHEME ) ) : ?>
					<p class="misticgate-warning"><span class="dashicons dashicons-warning" aria-hidden="true"></span><?php esc_html_e( 'HTTPS is not enabled. Use HTTPS before enabling MisticGate on a public site.', 'misticgate' ); ?></p>
				<?php endif; ?>

				<p class="misticgate-live" role="status" aria-live="polite"></p>
			</div>
		</div>
		<?php
	}

	/**
	 * Outputs the Settings and Readme tabs.
	 *
	 * @param string $current  Current tab: 'settings' or 'readme'.
	 * @param string $page_url Settings page URL.
	 *
	 * @return void
	 */
	private static function render_tabs( $current, $page_url ) {
		?>
		<nav class="nav-tab-wrapper misticgate-tabs">
			<a href="<?php echo esc_url( $page_url ); ?>" class="nav-tab<?php echo 'settings' === $current ? ' nav-tab-active" aria-current="page' : ''; ?>"><?php esc_html_e( 'Settings', 'misticgate' ); ?></a>
			<a href="<?php echo esc_url( add_query_arg( 'tab', 'readme', $page_url ) ); ?>" class="nav-tab<?php echo 'readme' === $current ? ' nav-tab-active" aria-current="page' : ''; ?>"><?php esc_html_e( 'Readme', 'misticgate' ); ?></a>
		</nav>
		<?php
	}

	/**
	 * Outputs the Readme tab.
	 *
	 * @param bool $network Whether the page is the network settings page.
	 *
	 * @return void
	 */
	private static function render_readme_page( $network ) {
		?>
		<div class="wrap misticgate-wrap">
			<div class="misticgate-shell<?php echo $network ? ' misticgate-shell-wide' : ''; ?>">
				<header class="misticgate-header">
					<div>
						<p class="misticgate-kicker">MisticGate™ 1.0.0</p>
						<h1><?php esc_html_e( 'Readme', 'misticgate' ); ?></h1>
					</div>
				</header>

				<?php self::render_tabs( 'readme', $network ? self::network_page_url() : self::site_page_url() ); ?>

				<section class="misticgate-card misticgate-readme">
					<div class="misticgate-card-body">
						<h2><?php esc_html_e( 'Keep the standard login URL', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'MisticGate protects the standard WordPress login URL without changing it. Do not combine it with plugins or server rules that change or hide the login URL. MisticGate cannot protect a changed login URL, and the combination can lock you out.', 'misticgate' ); ?></p>

						<h2><?php esc_html_e( 'If you cannot log in', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'If you lost the gate URL, your bookmark stopped working after a domain or path change, or MisticGate cannot read its settings from the database, the recovery steps are the same.', 'misticgate' ); ?></p>
						<ol>
							<li>
							<?php
							printf(
								/* translators: %s: PHP code to add to wp-config.php. */
								esc_html__( 'Add %s to wp-config.php.', 'misticgate' ),
								'<code>' . esc_html( "define( 'MISTICGATE_DISABLE', true );" ) . '</code>'
							);
							?>
							</li>
							<li><?php esc_html_e( 'Log in from the standard login page.', 'misticgate' ); ?></li>
							<li><?php esc_html_e( 'Open the MisticGate settings, copy the gate URL or change it, and save it as a bookmark.', 'misticgate' ); ?></li>
							<li><?php esc_html_e( 'Remove the line from wp-config.php to turn protection back on.', 'misticgate' ); ?></li>
						</ol>
						<p><strong><?php esc_html_e( 'You cannot open this page while you are locked out. Write these steps down somewhere you can find them.', 'misticgate' ); ?></strong></p>

						<h2><?php esc_html_e( 'When your session expires', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'Keep the page open so you do not lose unsaved work. Open your gate bookmark in a new tab, log in there, then return to the original tab.', 'misticgate' ); ?></p>

						<h2><?php esc_html_e( 'Changing the gate URL', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'Save the new URL as a bookmark before you switch. The current URL keeps working until you switch, and stops working after that.', 'misticgate' ); ?></p>

						<h2><?php esc_html_e( 'Keep the gate URL private', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'Anyone with the gate URL can reach the login page. Do not share it, post it, or show it in screenshots. It can also appear in browser history and in server, CDN, or firewall access logs.', 'misticgate' ); ?></p>

						<h2><?php esc_html_e( 'Deactivating and deleting', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'Deactivating MisticGate keeps its settings. Deleting it removes all of its settings, including the gate URL. If you install it again, set up the gate again with a new URL.', 'misticgate' ); ?></p>

						<h2><?php esc_html_e( 'Recommended setup', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'MisticGate is the first layer, not the only one. Combine it with:', 'misticgate' ); ?></p>
						<ul>
							<li><?php esc_html_e( 'Two-factor authentication (2FA) from a security or 2FA plugin, especially for administrators.', 'misticgate' ); ?></li>
							<li><?php esc_html_e( 'A login challenge, such as a math question or CAPTCHA, from a security plugin.', 'misticgate' ); ?></li>
							<li><?php esc_html_e( 'HTTPS and strong, unique passwords.', 'misticgate' ); ?></li>
							<li><?php esc_html_e( 'Updates for WordPress, themes, and plugins.', 'misticgate' ); ?></li>
						</ul>

						<?php if ( $network ) : ?>
							<h2><?php esc_html_e( 'Multisite', 'misticgate' ); ?></h2>
							<ul>
								<li><?php esc_html_e( 'The network setting for logged-in users applies to every site that the network gate protects. It lists only the roles registered on the main site.', 'misticgate' ); ?></li>
								<li><?php esc_html_e( 'A site with a mapped domain may need its own site gate, because gate cookies do not reach other domains.', 'misticgate' ); ?></li>
							</ul>
						<?php endif; ?>
					</div>
				</section>
			</div>
		</div>
		<?php
	}

	/**
	 * Outputs the network gate section.
	 *
	 * @param array  $settings    Network settings.
	 * @param string $form_action Form action URL.
	 * @param string $message     Message key.
	 *
	 * @return void
	 */
	private static function render_network_gate( $settings, $form_action, $message ) {
		$current_url    = MisticGate_Network::gate_url( $settings['secret'] );
		$pending_url    = MisticGate_Network::gate_url( $settings['pending_secret'] );
		$network_active = MisticGate_Network::is_network_active();
		$settings_id    = MisticGate::settings_fingerprint( $settings );
		$status_enabled = MisticGate_Network::protects_site( get_main_site_id( get_current_network_id() ) );
		$status_text    = $status_enabled
			? ( $settings['protect_all_sites'] ? __( 'Protecting all login pages', 'misticgate' ) : __( 'Protecting main login page', 'misticgate' ) )
			: __( 'Disabled', 'misticgate' );

		if ( MisticGate::is_emergency_disabled() ) {
			$status_text = __( 'Protection paused', 'misticgate' );
		} elseif ( $settings['enabled'] && $settings['protect_all_sites'] && ! $network_active ) {
			$status_text    = __( 'Network activation required', 'misticgate' );
			$status_enabled = false;
		}

		self::render_network_message( $message );
		?>
		<section class="misticgate-card misticgate-network-card">
			<div class="misticgate-card-body">
				<div class="misticgate-network-heading">
					<div>
						<h2><?php esc_html_e( 'Network gate URL', 'misticgate' ); ?></h2>
						<p><?php esc_html_e( 'This URL opens the WordPress login page.', 'misticgate' ); ?></p>
					</div>
					<span class="misticgate-status <?php echo $status_enabled ? 'is-enabled' : 'is-disabled'; ?>">
						<span aria-hidden="true"></span><?php echo esc_html( $status_text ); ?>
					</span>
				</div>

				<?php if ( ! $network_active ) : ?>
					<p class="misticgate-warning"><?php esc_html_e( 'Activate MisticGate for the network to protect login pages on all sites.', 'misticgate' ); ?></p>
				<?php endif; ?>

				<?php if ( ! MisticGate::is_valid_secret( $settings['secret'] ) ) : ?>
					<p class="misticgate-warning"><span class="dashicons dashicons-warning" aria-hidden="true"></span><?php esc_html_e( 'Could not create a secure gate URL. Reload the page and try again.', 'misticgate' ); ?></p>
				<?php elseif ( ! $settings['enabled'] ) : ?>
					<p><?php esc_html_e( 'Copy this URL and save it as a bookmark.', 'misticgate' ); ?></p>
					<?php self::render_url_row( 'misticgate-network-current-url', $current_url, __( 'Copy URL', 'misticgate' ) ); ?>
					<form class="misticgate-confirm-form" method="post" action="<?php echo esc_url( $form_action ); ?>">
						<input type="hidden" name="action" value="misticgate_network_enable">
						<?php
						wp_nonce_field( 'misticgate_network_enable' );
						self::render_settings_id( $settings_id );
						?>
						<?php if ( ! $network_active && $settings['protect_all_sites'] ) : ?>
							<input type="hidden" name="protect_all_sites" value="1">
						<?php endif; ?>
						<label class="misticgate-check"><input type="checkbox" name="protect_all_sites" value="1"<?php checked( $settings['protect_all_sites'] ); ?><?php disabled( ! $network_active ); ?>><span><?php esc_html_e( 'Protect login pages on all sites', 'misticgate' ); ?></span></label>
						<label class="misticgate-check"><input type="checkbox" name="bookmark_confirmed" value="1" data-misticgate-confirm><span><?php esc_html_e( 'I saved this URL as a bookmark', 'misticgate' ); ?></span></label>
						<button type="submit" class="button button-primary" data-misticgate-submit><?php esc_html_e( 'Enable network gate', 'misticgate' ); ?></button>
					</form>
				<?php else : ?>
					<?php self::render_url_row( 'misticgate-network-current-url', $current_url, __( 'Copy URL', 'misticgate' ) ); ?>

					<?php if ( ! MisticGate::is_valid_secret( $settings['pending_secret'] ) ) : ?>
						<div class="misticgate-actions">
							<?php self::network_action_form( 'misticgate_network_prepare_rotation', 'misticgate_network_prepare_rotation', __( 'Change URL', 'misticgate' ), 'button button-secondary', $form_action, $settings_id ); ?>
							<form method="post" action="<?php echo esc_url( $form_action ); ?>">
								<input type="hidden" name="action" value="misticgate_network_disable">
								<?php
								wp_nonce_field( 'misticgate_network_disable' );
								self::render_settings_id( $settings_id );
								?>
								<button type="submit" class="button button-secondary button-link-delete" data-misticgate-confirm-message="<?php echo esc_attr__( 'Disable the network gate? Login-page protection from this gate will end. Site gates will not change.', 'misticgate' ); ?>"><?php esc_html_e( 'Disable network gate', 'misticgate' ); ?></button>
							</form>
						</div>
					<?php endif; ?>
				<?php endif; ?>
			</div>
		</section>

		<?php if ( $settings['enabled'] && MisticGate::is_valid_secret( $settings['pending_secret'] ) ) : ?>
			<section class="misticgate-card misticgate-card-pending">
				<div class="misticgate-card-body">
					<h2><?php esc_html_e( 'New network gate URL', 'misticgate' ); ?></h2>
					<p><?php esc_html_e( 'Save the new URL as a bookmark. The current URL will keep working until you switch.', 'misticgate' ); ?></p>
					<?php self::render_url_row( 'misticgate-network-pending-url', $pending_url, __( 'Copy new URL', 'misticgate' ) ); ?>

					<form class="misticgate-confirm-form" method="post" action="<?php echo esc_url( $form_action ); ?>">
						<input type="hidden" name="action" value="misticgate_network_activate_rotation">
						<input type="hidden" name="pending_id" value="<?php echo esc_attr( MisticGate::secret_fingerprint( $settings['pending_secret'] ) ); ?>">
						<?php
						wp_nonce_field( 'misticgate_network_activate_rotation' );
						self::render_settings_id( $settings_id );
						?>
						<label class="misticgate-check"><input type="checkbox" name="bookmark_confirmed" value="1" data-misticgate-confirm><span><?php esc_html_e( 'I saved the new URL as a bookmark', 'misticgate' ); ?></span></label>
						<button type="submit" class="button button-primary" data-misticgate-submit><?php esc_html_e( 'Switch to new URL', 'misticgate' ); ?></button>
					</form>

					<form class="misticgate-cancel-form" method="post" action="<?php echo esc_url( $form_action ); ?>">
						<input type="hidden" name="action" value="misticgate_network_cancel_rotation">
						<input type="hidden" name="pending_id" value="<?php echo esc_attr( MisticGate::secret_fingerprint( $settings['pending_secret'] ) ); ?>">
						<?php
						wp_nonce_field( 'misticgate_network_cancel_rotation' );
						self::render_settings_id( $settings_id );
						?>
						<button type="submit" class="button-link"><?php esc_html_e( 'Cancel', 'misticgate' ); ?></button>
					</form>
				</div>
			</section>
		<?php endif; ?>
		<?php
		if ( $settings['enabled'] ) {
			self::render_exempt_roles( $settings, 'misticgate_network_exempt_roles', $form_action, $settings_id, '', 0, false );
		}
	}

	/**
	 * Outputs the settings for a site gate.
	 *
	 * @param string $context     Settings context: 'site' or 'network'.
	 * @param int    $site_id     Site ID.
	 * @param string $form_action Form action URL.
	 * @param string $site_name   Site name.
	 * @param string $site_url    Site URL.
	 *
	 * @return void
	 */
	private static function render_settings_page( $context, $site_id, $form_action, $site_name, $site_url ) {
		$settings          = MisticGate::get_settings();
		$settings_id       = MisticGate::settings_fingerprint( $settings );
		$site_enabled      = MisticGate::protects_site( $site_id );
		$current_url       = MisticGate::gate_url( $settings['secret'] );
		$pending_url       = MisticGate::gate_url( $settings['pending_secret'] );
		$message           = self::query_key( 'misticgate_message' );
		$network_protected = is_multisite() && MisticGate_Network::protects_current_site();
		$status_enabled    = $site_enabled || $network_protected;
		$status_text       = $site_enabled
			? ( $network_protected ? __( 'Network + site gate', 'misticgate' ) : __( 'Site gate', 'misticgate' ) )
			: ( $network_protected ? __( 'Network gate', 'misticgate' ) : __( 'Not protected', 'misticgate' ) );
		if ( MisticGate::is_emergency_disabled() ) {
			$status_text = __( 'Protection paused', 'misticgate' );
		}
		?>
		<div class="wrap misticgate-wrap">
			<div class="misticgate-shell">
				<?php if ( 'network' === $context ) : ?>
					<p class="misticgate-back"><a href="<?php echo esc_url( self::network_page_url() ); ?>">&larr; <?php esc_html_e( 'Back to site list', 'misticgate' ); ?></a></p>
				<?php endif; ?>
				<header class="misticgate-header">
					<div>
						<p class="misticgate-kicker">MisticGate™ 1.0.0</p>
						<h1><?php esc_html_e( 'Site gate', 'misticgate' ); ?></h1>
						<?php if ( 'network' === $context ) : ?>
							<p><strong><?php echo esc_html( '' !== $site_name ? $site_name : $site_url ); ?></strong><br><span class="misticgate-site-url"><?php echo esc_html( $site_url ); ?></span></p>
						<?php endif; ?>
						<p><?php esc_html_e( 'This URL opens this site\'s login page.', 'misticgate' ); ?></p>
					</div>
					<span class="misticgate-status <?php echo $status_enabled ? 'is-enabled' : 'is-disabled'; ?>">
						<span aria-hidden="true"></span><?php echo esc_html( $status_text ); ?>
					</span>
				</header>

				<?php if ( 'site' === $context ) : ?>
					<?php self::render_tabs( 'settings', self::site_page_url() ); ?>
				<?php endif; ?>

				<?php self::render_message( $message ); ?>
				<?php if ( ! MisticGate::is_active_on_site( $site_id ) ) : ?>
					<div class="misticgate-notice is-info" role="status"><?php esc_html_e( 'MisticGate is not active on this site. Activate it to apply these settings.', 'misticgate' ); ?></div>
				<?php endif; ?>
				<?php if ( $network_protected ) : ?>
					<div class="misticgate-notice is-info" role="status"><?php esc_html_e( 'This site\'s login page is protected by the network gate. Add a site gate only if you need a separate bookmark for this site.', 'misticgate' ); ?></div>
				<?php endif; ?>

				<?php if ( ! MisticGate::is_valid_secret( $settings['secret'] ) ) : ?>
					<section class="misticgate-card"><div class="misticgate-card-body"><h2><?php esc_html_e( 'Could not create a secure gate URL', 'misticgate' ); ?></h2><p><?php esc_html_e( 'The site gate is still disabled. Reload the page and try again.', 'misticgate' ); ?></p></div></section>
				<?php elseif ( ! $settings['enabled'] ) : ?>
					<?php self::render_initial_setup( $current_url, $context, $site_id, $form_action, $settings_id ); ?>
				<?php else : ?>
					<?php self::render_active_settings( $current_url, $pending_url, $settings['pending_secret'], $context, $site_id, $form_action, $settings_id ); ?>
					<?php self::render_exempt_roles( $settings, 'misticgate_exempt_roles', $form_action, $settings_id, $context, $site_id, $network_protected ); ?>
				<?php endif; ?>

				<?php if ( 'https' !== wp_parse_url( wp_login_url(), PHP_URL_SCHEME ) ) : ?>
					<p class="misticgate-warning"><span class="dashicons dashicons-warning" aria-hidden="true"></span><?php esc_html_e( 'HTTPS is not enabled. Use HTTPS before enabling MisticGate on a public site.', 'misticgate' ); ?></p>
				<?php endif; ?>

				<p class="misticgate-live" role="status" aria-live="polite"></p>
			</div>
		</div>
		<?php
	}

	/**
	 * Outputs the first-time setup steps.
	 *
	 * @param string $url         Gate URL.
	 * @param string $context     Settings context: 'site' or 'network'.
	 * @param int    $site_id     Site ID.
	 * @param string $form_action Form action URL.
	 * @param string $settings_id Settings fingerprint.
	 *
	 * @return void
	 */
	private static function render_initial_setup( $url, $context, $site_id, $form_action, $settings_id ) {
		?>
		<section class="misticgate-card misticgate-card-primary">
			<div class="misticgate-card-body">
				<h2><?php esc_html_e( 'Set up site gate', 'misticgate' ); ?></h2>
				<p><?php esc_html_e( 'Copy this URL and save it as a bookmark.', 'misticgate' ); ?></p>
				<?php self::render_url_row( 'misticgate-current-url', $url, __( 'Copy URL', 'misticgate' ) ); ?>

				<form class="misticgate-confirm-form" method="post" action="<?php echo esc_url( $form_action ); ?>">
					<input type="hidden" name="action" value="misticgate_enable">
					<?php self::render_context_fields( $context, $site_id, $settings_id ); ?>
					<?php wp_nonce_field( 'misticgate_enable' ); ?>
					<label class="misticgate-check"><input type="checkbox" name="bookmark_confirmed" value="1" data-misticgate-confirm><span><?php esc_html_e( 'I saved this URL as a bookmark', 'misticgate' ); ?></span></label>
					<button type="submit" class="button button-primary button-hero" data-misticgate-submit><?php esc_html_e( 'Enable site gate', 'misticgate' ); ?></button>
				</form>
			</div>
		</section>
		<?php
	}

	/**
	 * Outputs the settings of a configured gate.
	 *
	 * @param string $current_url    Current gate URL.
	 * @param string $pending_url    Prepared replacement URL.
	 * @param string $pending_secret Prepared replacement secret.
	 * @param string $context        Settings context: 'site' or 'network'.
	 * @param int    $site_id        Site ID.
	 * @param string $form_action    Form action URL.
	 * @param string $settings_id    Settings fingerprint.
	 *
	 * @return void
	 */
	private static function render_active_settings( $current_url, $pending_url, $pending_secret, $context, $site_id, $form_action, $settings_id ) {
		?>
		<section class="misticgate-card">
			<div class="misticgate-card-body">
				<h2><?php esc_html_e( 'Site gate URL', 'misticgate' ); ?></h2>
				<p><?php esc_html_e( 'Use this bookmark to open this site\'s login page.', 'misticgate' ); ?></p>
				<?php self::render_url_row( 'misticgate-current-url', $current_url, __( 'Copy URL', 'misticgate' ) ); ?>

				<?php if ( ! MisticGate::is_valid_secret( $pending_secret ) ) : ?>
					<div class="misticgate-actions">
						<?php self::action_form( 'misticgate_prepare_rotation', 'misticgate_prepare_rotation', __( 'Change URL', 'misticgate' ), 'button button-secondary', $context, $site_id, $form_action, $settings_id ); ?>
						<form method="post" action="<?php echo esc_url( $form_action ); ?>">
							<input type="hidden" name="action" value="misticgate_disable">
							<?php self::render_context_fields( $context, $site_id, $settings_id ); ?>
							<?php wp_nonce_field( 'misticgate_disable' ); ?>
							<button type="submit" class="button button-secondary button-link-delete" data-misticgate-confirm-message="<?php echo esc_attr__( 'Disable this site gate? This bookmark will stop working. Network protection will not change.', 'misticgate' ); ?>"><?php esc_html_e( 'Disable site gate', 'misticgate' ); ?></button>
						</form>
					</div>
				<?php endif; ?>
			</div>
		</section>

		<?php if ( MisticGate::is_valid_secret( $pending_secret ) ) : ?>
			<section class="misticgate-card misticgate-card-pending">
				<div class="misticgate-card-body">
					<h2><?php esc_html_e( 'New site gate URL', 'misticgate' ); ?></h2>
					<p><?php esc_html_e( 'Save the new URL as a bookmark. The current URL will keep working until you switch.', 'misticgate' ); ?></p>
					<?php self::render_url_row( 'misticgate-pending-url', $pending_url, __( 'Copy new URL', 'misticgate' ) ); ?>

					<form class="misticgate-confirm-form" method="post" action="<?php echo esc_url( $form_action ); ?>">
						<input type="hidden" name="action" value="misticgate_activate_rotation">
						<input type="hidden" name="pending_id" value="<?php echo esc_attr( MisticGate::secret_fingerprint( $pending_secret ) ); ?>">
						<?php self::render_context_fields( $context, $site_id, $settings_id ); ?>
						<?php wp_nonce_field( 'misticgate_activate_rotation' ); ?>
						<label class="misticgate-check"><input type="checkbox" name="bookmark_confirmed" value="1" data-misticgate-confirm><span><?php esc_html_e( 'I saved the new URL as a bookmark', 'misticgate' ); ?></span></label>
						<button type="submit" class="button button-primary" data-misticgate-submit><?php esc_html_e( 'Switch to new URL', 'misticgate' ); ?></button>
					</form>

					<form class="misticgate-cancel-form" method="post" action="<?php echo esc_url( $form_action ); ?>">
						<input type="hidden" name="action" value="misticgate_cancel_rotation">
						<input type="hidden" name="pending_id" value="<?php echo esc_attr( MisticGate::secret_fingerprint( $pending_secret ) ); ?>">
						<?php self::render_context_fields( $context, $site_id, $settings_id ); ?>
						<?php wp_nonce_field( 'misticgate_cancel_rotation' ); ?>
						<button type="submit" class="button-link"><?php esc_html_e( 'Cancel', 'misticgate' ); ?></button>
					</form>
				</div>
			</section>
		<?php endif; ?>
		<?php
	}

	/**
	 * Outputs the settings for logged-in users.
	 *
	 * @param array  $settings           Normalized settings.
	 * @param string $action             Action name.
	 * @param string $form_action        Form action URL.
	 * @param string $settings_id        Settings fingerprint.
	 * @param string $context            Settings context: 'site', 'network', or an empty string for the network gate.
	 * @param int    $site_id            Site ID.
	 * @param bool   $managed_by_network Whether the network gate setting applies instead.
	 *
	 * @return void
	 */
	private static function render_exempt_roles( $settings, $action, $form_action, $settings_id, $context, $site_id, $managed_by_network ) {
		$roles = self::exemptible_roles();
		?>
		<section class="misticgate-card">
			<div class="misticgate-card-body">
				<h2><?php esc_html_e( 'Logged-in users', 'misticgate' ); ?></h2>
				<p><?php esc_html_e( 'Logged-in administrators can open the login page without the gate. Other logged-in users must pass the gate unless you allow their role.', 'misticgate' ); ?></p>
				<?php if ( $managed_by_network ) : ?>
					<div class="misticgate-notice is-info" role="status"><?php esc_html_e( 'The network gate setting for logged-in users applies to this site.', 'misticgate' ); ?></div>
				<?php else : ?>
					<?php if ( '' === $context ) : ?>
						<p><?php esc_html_e( 'This setting applies to every site that the network gate protects.', 'misticgate' ); ?></p>
					<?php endif; ?>
					<?php if ( empty( $roles ) ) : ?>
						<p><?php esc_html_e( 'No other roles are available.', 'misticgate' ); ?></p>
					<?php else : ?>
						<form class="misticgate-confirm-form" method="post" action="<?php echo esc_url( $form_action ); ?>">
							<input type="hidden" name="action" value="<?php echo esc_attr( $action ); ?>">
							<?php
							if ( '' === $context ) {
								self::render_settings_id( $settings_id );
							} else {
								self::render_context_fields( $context, $site_id, $settings_id );
							}
							wp_nonce_field( $action );
							?>
							<fieldset class="misticgate-roles">
								<legend class="screen-reader-text"><?php esc_html_e( 'Roles allowed without the gate', 'misticgate' ); ?></legend>
								<?php foreach ( $roles as $role => $role_name ) : ?>
									<label class="misticgate-check"><input type="checkbox" name="exempt_roles[]" value="<?php echo esc_attr( $role ); ?>"<?php checked( in_array( $role, $settings['exempt_roles'], true ) ); ?>><span><?php echo esc_html( $role_name ); ?></span></label>
								<?php endforeach; ?>
							</fieldset>
							<button type="submit" class="button button-secondary"><?php esc_html_e( 'Save', 'misticgate' ); ?></button>
						</form>
					<?php endif; ?>
				<?php endif; ?>
				<p class="misticgate-footnote"><?php esc_html_e( 'When a session expires, every user must pass the gate again.', 'misticgate' ); ?></p>
			</div>
		</section>
		<?php
	}

	/**
	 * Returns the roles that an administrator can allow without the gate.
	 *
	 * @return string[] Translated role names, keyed by role.
	 */
	private static function exemptible_roles() {
		$roles = array();
		foreach ( wp_roles()->roles as $role => $details ) {
			if ( empty( $details['capabilities'][ MisticGate::EXEMPT_CAPABILITY ] ) ) {
				$roles[ $role ] = translate_user_role( $details['name'] );
			}
		}
		return $roles;
	}

	/**
	 * Outputs a gate URL row with its copy button.
	 *
	 * @param string $id    Field ID.
	 * @param string $url   Gate URL.
	 * @param string $label Field label.
	 *
	 * @return void
	 */
	private static function render_url_row( $id, $url, $label ) {
		?>
		<div class="misticgate-url-row">
			<label class="screen-reader-text" for="<?php echo esc_attr( $id ); ?>"><?php esc_html_e( 'Gate URL', 'misticgate' ); ?></label>
			<input type="text" id="<?php echo esc_attr( $id ); ?>" class="misticgate-url" value="<?php echo esc_attr( $url ); ?>" readonly dir="ltr" spellcheck="false" autocomplete="off">
			<button type="button" class="button button-primary misticgate-copy" data-misticgate-copy="<?php echo esc_attr( $id ); ?>" data-label="<?php echo esc_attr( $label ); ?>"><span class="dashicons dashicons-admin-page" aria-hidden="true"></span><span><?php echo esc_html( $label ); ?></span></button>
		</div>
		<?php
	}

	/**
	 * Outputs a settings action form.
	 *
	 * @param string $action       Action name.
	 * @param string $nonce        Nonce action.
	 * @param string $label        Button label.
	 * @param string $button_class Button class.
	 * @param string $context      Settings context: 'site' or 'network'.
	 * @param int    $site_id      Site ID.
	 * @param string $form_action  Form action URL.
	 * @param string $settings_id  Settings fingerprint.
	 *
	 * @return void
	 */
	private static function action_form( $action, $nonce, $label, $button_class, $context, $site_id, $form_action, $settings_id ) {
		?>
		<form method="post" action="<?php echo esc_url( $form_action ); ?>">
			<input type="hidden" name="action" value="<?php echo esc_attr( $action ); ?>">
			<?php self::render_context_fields( $context, $site_id, $settings_id ); ?>
			<?php wp_nonce_field( $nonce ); ?>
			<button type="submit" class="<?php echo esc_attr( $button_class ); ?>"><?php echo esc_html( $label ); ?></button>
		</form>
		<?php
	}

	/**
	 * Outputs a network gate action form.
	 *
	 * @param string $action       Action name.
	 * @param string $nonce        Nonce action.
	 * @param string $label        Button label.
	 * @param string $button_class Button class.
	 * @param string $form_action  Form action URL.
	 * @param string $settings_id  Settings fingerprint.
	 *
	 * @return void
	 */
	private static function network_action_form( $action, $nonce, $label, $button_class, $form_action, $settings_id ) {
		?>
		<form method="post" action="<?php echo esc_url( $form_action ); ?>">
			<input type="hidden" name="action" value="<?php echo esc_attr( $action ); ?>">
			<?php
			wp_nonce_field( $nonce );
			self::render_settings_id( $settings_id );
			?>
			<button type="submit" class="<?php echo esc_attr( $button_class ); ?>"><?php echo esc_html( $label ); ?></button>
		</form>
		<?php
	}

	/**
	 * Outputs the hidden fields that identify the settings target.
	 *
	 * @param string $context     Settings context: 'site' or 'network'.
	 * @param int    $site_id     Site ID.
	 * @param string $settings_id Settings fingerprint.
	 *
	 * @return void
	 */
	private static function render_context_fields( $context, $site_id, $settings_id ) {
		?>
		<input type="hidden" name="misticgate_context" value="<?php echo esc_attr( $context ); ?>">
		<input type="hidden" name="site_id" value="<?php echo esc_attr( (string) $site_id ); ?>">
		<?php self::render_settings_id( $settings_id ); ?>
		<?php
	}

	/**
	 * Outputs the hidden settings fingerprint field.
	 *
	 * @param string $settings_id Settings fingerprint.
	 *
	 * @return void
	 */
	private static function render_settings_id( $settings_id ) {
		echo '<input type="hidden" name="settings_id" value="' . esc_attr( $settings_id ) . '">';
	}

	// Notices.
	/**
	 * Outputs a site settings message.
	 *
	 * @param string $message Message key.
	 *
	 * @return void
	 */
	private static function render_message( $message ) {
		$messages = array(
			'enabled'           => array( 'success', __( 'Site gate enabled.', 'misticgate' ) ),
			'disabled'          => array( 'info', __( 'Site gate disabled. Network protection was not changed.', 'misticgate' ) ),
			'pending'           => array( 'info', __( 'New URL created. The current URL still works until you switch.', 'misticgate' ) ),
			'rotated'           => array( 'success', __( 'New URL enabled. The previous URL no longer works.', 'misticgate' ) ),
			'cancelled'         => array( 'info', __( 'URL change cancelled.', 'misticgate' ) ),
			'exemptions_saved'  => array( 'success', __( 'Setting for logged-in users saved.', 'misticgate' ) ),
			'bookmark_required' => array( 'error', __( 'Confirm that you saved the URL as a bookmark.', 'misticgate' ) ),
			'invalid_request'   => array( 'error', __( 'Could not complete the action. Reload the page and try again.', 'misticgate' ) ),
			'generation_failed' => array( 'error', __( 'Could not create a secure URL. No settings were changed.', 'misticgate' ) ),
			'save_failed'       => array( 'error', __( 'Could not save the settings. Another change may have been made. Reload the page and try again.', 'misticgate' ) ),
		);

		if ( ! isset( $messages[ $message ] ) ) {
			return;
		}

		list( $type, $text ) = $messages[ $message ];
		echo '<div class="misticgate-notice is-' . esc_attr( $type ) . '" role="status">' . esc_html( $text ) . '</div>';
	}

	/**
	 * Outputs a network settings message.
	 *
	 * @param string $message Message key.
	 *
	 * @return void
	 */
	private static function render_network_message( $message ) {
		$messages = array(
			'enabled'           => array( 'success', __( 'Network gate enabled.', 'misticgate' ) ),
			'disabled'          => array( 'info', __( 'Network gate disabled. Site gates were not changed.', 'misticgate' ) ),
			'pending'           => array( 'info', __( 'New network gate URL created. The current URL still works until you switch.', 'misticgate' ) ),
			'rotated'           => array( 'success', __( 'New network gate URL enabled. The previous URL no longer works.', 'misticgate' ) ),
			'cancelled'         => array( 'info', __( 'URL change cancelled.', 'misticgate' ) ),
			'exemptions_saved'  => array( 'success', __( 'Setting for logged-in users saved.', 'misticgate' ) ),
			'bookmark_required' => array( 'error', __( 'Confirm that you saved the URL as a bookmark.', 'misticgate' ) ),
			'invalid_request'   => array( 'error', __( 'Could not complete the action. Reload the page and try again.', 'misticgate' ) ),
			'generation_failed' => array( 'error', __( 'Could not create a secure URL. No settings were changed.', 'misticgate' ) ),
			'save_failed'       => array( 'error', __( 'Could not save the network gate settings. Another change may have been made. Reload the page and try again.', 'misticgate' ) ),
		);

		if ( ! isset( $messages[ $message ] ) ) {
			return;
		}

		list( $type, $text ) = $messages[ $message ];
		echo '<div class="misticgate-notice is-' . esc_attr( $type ) . '" role="status">' . esc_html( $text ) . '</div>';
	}

	// Site actions.
	/**
	 * Enables a site gate.
	 *
	 * @return void
	 */
	public static function handle_enable() {
		$request  = self::prepare_action( 'misticgate_enable' );
		$message  = 'invalid_request';
		$switched = self::begin_target_site( $request );

		try {
			if ( ! $request['bookmark_confirmed'] ) {
				$message = 'bookmark_required';
			} else {
				$settings = MisticGate::get_settings();
				$expected = $settings;
				self::require_current_settings( $expected, $request );
				if ( ! MisticGate::is_valid_secret( $settings['secret'] ) ) {
					$message = 'generation_failed';
				} else {
					$settings['enabled']    = true;
					$settings['generation'] = MisticGate::next_generation( $settings['generation'] );
					$settings['updated_at'] = time();
					if ( self::save_settings( $settings, $expected ) ) {
						MisticGate::invalidate_tickets();
						self::clear_browser_access_if_local( $request );
						$message = 'enabled';
					} else {
						$message = 'save_failed';
					}
				}
			}
		} finally {
			self::end_target_site( $switched );
		}

		self::redirect_with_message( $message, $request );
	}

	/**
	 * Disables a site gate.
	 *
	 * @return void
	 */
	public static function handle_disable() {
		$request  = self::prepare_action( 'misticgate_disable' );
		$message  = 'save_failed';
		$switched = self::begin_target_site( $request );

		try {
			$settings = MisticGate::get_settings();
			$expected = $settings;
			self::require_current_settings( $expected, $request );
			$settings['enabled']        = false;
			$settings['pending_secret'] = '';
			$settings['generation']     = MisticGate::next_generation( $settings['generation'] );
			$settings['updated_at']     = time();
			if ( self::save_settings( $settings, $expected ) ) {
				MisticGate::invalidate_tickets();
				self::clear_browser_access_if_local( $request );
				$message = 'disabled';
			}
		} finally {
			self::end_target_site( $switched );
		}

		self::redirect_with_message( $message, $request );
	}

	/**
	 * Prepares a replacement site gate URL.
	 *
	 * @return void
	 */
	public static function handle_prepare_rotation() {
		$request  = self::prepare_action( 'misticgate_prepare_rotation' );
		$message  = 'invalid_request';
		$switched = self::begin_target_site( $request );

		try {
			$settings = MisticGate::get_settings();
			$expected = $settings;
			self::require_current_settings( $expected, $request );
			if ( $settings['enabled'] ) {
				if ( ! MisticGate::is_valid_secret( $settings['pending_secret'] ) ) {
					try {
						$settings['pending_secret'] = MisticGate_Token::generate_secret();
					} catch ( Exception $exception ) {
						$settings['pending_secret'] = '';
						$message                    = 'generation_failed';
					}

					if ( MisticGate::is_valid_secret( $settings['pending_secret'] ) ) {
						$settings['updated_at'] = time();
						$message                = self::save_settings( $settings, $expected ) ? 'pending' : 'save_failed';
					}
				} else {
					$message = 'pending';
				}
			}
		} finally {
			self::end_target_site( $switched );
		}

		self::redirect_with_message( $message, $request );
	}

	/**
	 * Switches a site gate to the prepared URL.
	 *
	 * @return void
	 */
	public static function handle_activate_rotation() {
		$request  = self::prepare_action( 'misticgate_activate_rotation' );
		$message  = 'invalid_request';
		$switched = self::begin_target_site( $request );

		try {
			$settings = MisticGate::get_settings();
			$expected = $settings;
			self::require_current_settings( $expected, $request );
			if ( ! $request['bookmark_confirmed'] ) {
				$message = 'bookmark_required';
			} elseif (
				$settings['enabled'] &&
				MisticGate::is_valid_secret( $settings['pending_secret'] ) &&
				hash_equals( MisticGate::secret_fingerprint( $settings['pending_secret'] ), $request['pending_id'] )
			) {
				$settings['secret']         = $settings['pending_secret'];
				$settings['pending_secret'] = '';
				$settings['generation']     = MisticGate::next_generation( $settings['generation'] );
				$settings['updated_at']     = time();
				if ( self::save_settings( $settings, $expected ) ) {
					MisticGate::invalidate_tickets();
					self::clear_browser_access_if_local( $request );
					$message = 'rotated';
				} else {
					$message = 'save_failed';
				}
			}
		} finally {
			self::end_target_site( $switched );
		}

		self::redirect_with_message( $message, $request );
	}

	/**
	 * Discards a prepared site gate URL.
	 *
	 * @return void
	 */
	public static function handle_cancel_rotation() {
		$request  = self::prepare_action( 'misticgate_cancel_rotation' );
		$message  = 'invalid_request';
		$switched = self::begin_target_site( $request );

		try {
			$settings = MisticGate::get_settings();
			$expected = $settings;
			self::require_current_settings( $expected, $request );
			if (
				MisticGate::is_valid_secret( $settings['pending_secret'] ) &&
				hash_equals( MisticGate::secret_fingerprint( $settings['pending_secret'] ), $request['pending_id'] )
			) {
				$settings['pending_secret'] = '';
				$settings['updated_at']     = time();
				$message                    = self::save_settings( $settings, $expected ) ? 'cancelled' : 'save_failed';
			}
		} finally {
			self::end_target_site( $switched );
		}

		self::redirect_with_message( $message, $request );
	}

	/**
	 * Saves the roles that can open a site login page without the gate.
	 *
	 * @return void
	 */
	public static function handle_exempt_roles() {
		$request  = self::prepare_action( 'misticgate_exempt_roles' );
		$message  = 'invalid_request';
		$switched = self::begin_target_site( $request );

		try {
			$settings = MisticGate::get_settings();
			$expected = $settings;
			self::require_current_settings( $expected, $request );
			if ( $settings['enabled'] ) {
				$settings['exempt_roles'] = self::allowed_exempt_roles( $request['exempt_roles'] );
				if ( $settings['exempt_roles'] === $expected['exempt_roles'] ) {
					$message = 'exemptions_saved';
				} else {
					$settings['updated_at'] = time();
					$message                = self::save_settings( $settings, $expected ) ? 'exemptions_saved' : 'save_failed';
				}
			}
		} finally {
			self::end_target_site( $switched );
		}

		self::redirect_with_message( $message, $request );
	}

	// Network actions.
	/**
	 * Enables the network gate.
	 *
	 * @return void
	 */
	public static function handle_network_enable() {
		$request = self::prepare_network_action( 'misticgate_network_enable' );
		$message = 'invalid_request';

		MisticGate_Network::ensure_settings();
		if ( ! $request['bookmark_confirmed'] ) {
			$message = 'bookmark_required';
		} else {
			$settings = MisticGate_Network::get_settings();
			$expected = $settings;
			self::require_current_settings( $expected, $request );
			if ( ! MisticGate::is_valid_secret( $settings['secret'] ) ) {
				$message = 'generation_failed';
			} else {
				$settings['enabled']           = true;
				$settings['protect_all_sites'] = $request['protect_all_sites'];
				$settings['generation']        = MisticGate::next_generation( $settings['generation'] );
				$settings['updated_at']        = time();
				if ( self::save_network_settings( $settings, $expected ) ) {
					MisticGate_Network::invalidate_tickets();
					MisticGate_Network::clear_access_cookies();
					$message = 'enabled';
				} else {
					$message = 'save_failed';
				}
			}
		}

		self::redirect_network_message( $message );
	}

	/**
	 * Disables the network gate.
	 *
	 * @return void
	 */
	public static function handle_network_disable() {
		$request = self::prepare_network_action( 'misticgate_network_disable' );
		MisticGate_Network::ensure_settings();

		$settings = MisticGate_Network::get_settings();
		$expected = $settings;
		self::require_current_settings( $expected, $request );
		$settings['enabled']        = false;
		$settings['pending_secret'] = '';
		$settings['generation']     = MisticGate::next_generation( $settings['generation'] );
		$settings['updated_at']     = time();
		$message                    = 'save_failed';

		if ( self::save_network_settings( $settings, $expected ) ) {
			MisticGate_Network::invalidate_tickets();
			MisticGate_Network::clear_access_cookies();
			$message = 'disabled';
		}

		self::redirect_network_message( $message );
	}

	/**
	 * Prepares a replacement network gate URL.
	 *
	 * @return void
	 */
	public static function handle_network_prepare_rotation() {
		$request = self::prepare_network_action( 'misticgate_network_prepare_rotation' );
		MisticGate_Network::ensure_settings();

		$settings = MisticGate_Network::get_settings();
		$expected = $settings;
		self::require_current_settings( $expected, $request );
		$message = 'invalid_request';
		if ( $settings['enabled'] ) {
			if ( ! MisticGate::is_valid_secret( $settings['pending_secret'] ) ) {
				try {
					$settings['pending_secret'] = MisticGate_Token::generate_secret();
				} catch ( Exception $exception ) {
					$settings['pending_secret'] = '';
					$message                    = 'generation_failed';
				}

				if ( MisticGate::is_valid_secret( $settings['pending_secret'] ) ) {
					$settings['updated_at'] = time();
					$message                = self::save_network_settings( $settings, $expected ) ? 'pending' : 'save_failed';
				}
			} else {
				$message = 'pending';
			}
		}

		self::redirect_network_message( $message );
	}

	/**
	 * Switches the network gate to the prepared URL.
	 *
	 * @return void
	 */
	public static function handle_network_activate_rotation() {
		$request = self::prepare_network_action( 'misticgate_network_activate_rotation' );
		MisticGate_Network::ensure_settings();

		$settings = MisticGate_Network::get_settings();
		$expected = $settings;
		self::require_current_settings( $expected, $request );
		$message = 'invalid_request';
		if ( ! $request['bookmark_confirmed'] ) {
			$message = 'bookmark_required';
		} elseif (
			$settings['enabled'] &&
			MisticGate::is_valid_secret( $settings['pending_secret'] ) &&
			hash_equals( MisticGate::secret_fingerprint( $settings['pending_secret'] ), $request['pending_id'] )
		) {
			$settings['secret']         = $settings['pending_secret'];
			$settings['pending_secret'] = '';
			$settings['generation']     = MisticGate::next_generation( $settings['generation'] );
			$settings['updated_at']     = time();
			if ( self::save_network_settings( $settings, $expected ) ) {
				MisticGate_Network::invalidate_tickets();
				MisticGate_Network::clear_access_cookies();
				$message = 'rotated';
			} else {
				$message = 'save_failed';
			}
		}

		self::redirect_network_message( $message );
	}

	/**
	 * Discards a prepared network gate URL.
	 *
	 * @return void
	 */
	public static function handle_network_cancel_rotation() {
		$request = self::prepare_network_action( 'misticgate_network_cancel_rotation' );
		MisticGate_Network::ensure_settings();

		$settings = MisticGate_Network::get_settings();
		$expected = $settings;
		self::require_current_settings( $expected, $request );
		$message = 'invalid_request';
		if (
			MisticGate::is_valid_secret( $settings['pending_secret'] ) &&
			hash_equals( MisticGate::secret_fingerprint( $settings['pending_secret'] ), $request['pending_id'] )
		) {
			$settings['pending_secret'] = '';
			$settings['updated_at']     = time();
			$message                    = self::save_network_settings( $settings, $expected ) ? 'cancelled' : 'save_failed';
		}

		self::redirect_network_message( $message );
	}

	/**
	 * Saves the roles that can open login pages protected by the network gate without the gate.
	 *
	 * @return void
	 */
	public static function handle_network_exempt_roles() {
		$request = self::prepare_network_action( 'misticgate_network_exempt_roles' );
		MisticGate_Network::ensure_settings();

		$settings = MisticGate_Network::get_settings();
		$expected = $settings;
		self::require_current_settings( $expected, $request );
		$message = 'invalid_request';
		if ( $settings['enabled'] ) {
			$settings['exempt_roles'] = self::allowed_exempt_roles( $request['exempt_roles'] );
			if ( $settings['exempt_roles'] === $expected['exempt_roles'] ) {
				$message = 'exemptions_saved';
			} else {
				$settings['updated_at'] = time();
				$message                = self::save_network_settings( $settings, $expected ) ? 'exemptions_saved' : 'save_failed';
			}
		}

		self::redirect_network_message( $message );
	}

	// Request validation and persistence.
	/**
	 * Validates a network settings request.
	 *
	 * @param string $nonce_action Nonce action.
	 *
	 * @return array Request data.
	 */
	private static function prepare_network_action( $nonce_action ) {
		if ( 'POST' !== self::request_method() ) {
			wp_die( esc_html__( 'A POST request is required.', 'misticgate' ), '', array( 'response' => 405 ) );
		}

		if (
			! is_multisite() ||
			! current_user_can( self::NETWORK_CAPABILITY ) ||
			! is_super_admin( get_current_user_id() )
		) {
			wp_die( esc_html__( 'You are not allowed to manage MisticGate network settings.', 'misticgate' ), '', array( 'response' => 403 ) );
		}

		check_admin_referer( $nonce_action );

		$protect_all_sites = isset( $_POST['protect_all_sites'] ) && '1' === sanitize_text_field( wp_unslash( $_POST['protect_all_sites'] ) );
		if ( $protect_all_sites && 'misticgate_network_enable' === $nonce_action && ! MisticGate_Network::is_network_active() ) {
			wp_die(
				esc_html__( 'Activate MisticGate for the network to protect login pages on all sites.', 'misticgate' ),
				'',
				array(
					'response'  => 409,
					'back_link' => true,
				)
			);
		}

		return array(
			'bookmark_confirmed' => isset( $_POST['bookmark_confirmed'] ) && '1' === sanitize_text_field( wp_unslash( $_POST['bookmark_confirmed'] ) ),
			'protect_all_sites'  => $protect_all_sites,
			'settings_id'        => isset( $_POST['settings_id'] ) ? sanitize_text_field( wp_unslash( $_POST['settings_id'] ) ) : '',
			'pending_id'         => isset( $_POST['pending_id'] ) ? sanitize_text_field( wp_unslash( $_POST['pending_id'] ) ) : '',
			'exempt_roles'       => self::posted_roles(),
		);
	}

	/**
	 * Saves network settings through the network controller.
	 *
	 * @param array $settings New settings.
	 * @param array $expected Normalized settings the caller started from.
	 *
	 * @return bool Whether the settings were saved.
	 */
	private static function save_network_settings( $settings, $expected ) {
		return MisticGate_Network::save_settings( $settings, $expected );
	}

	/**
	 * Returns to the network settings page with a message, then exits.
	 *
	 * @param string $message Message key.
	 *
	 * @return void
	 */
	private static function redirect_network_message( $message ) {
		$url = add_query_arg( 'misticgate_network_message', sanitize_key( $message ), self::network_page_url() );
		wp_safe_redirect( $url, 302, 'WordPress' );
		exit;
	}

	/**
	 * Validates a site settings request.
	 *
	 * @param string $nonce_action Nonce action.
	 *
	 * @return array Request data.
	 */
	private static function prepare_action( $nonce_action ) {
		if ( 'POST' !== self::request_method() ) {
			wp_die( esc_html__( 'A POST request is required.', 'misticgate' ), '', array( 'response' => 405 ) );
		}

		check_admin_referer( $nonce_action );

		$context            = isset( $_POST['misticgate_context'] )
			? sanitize_key( sanitize_text_field( wp_unslash( $_POST['misticgate_context'] ) ) )
			: 'site';
		$site_id            = isset( $_POST['site_id'] )
			? absint( sanitize_text_field( wp_unslash( $_POST['site_id'] ) ) )
			: 0;
		$bookmark_confirmed = isset( $_POST['bookmark_confirmed'] ) && '1' === sanitize_text_field( wp_unslash( $_POST['bookmark_confirmed'] ) );
		$pending_id         = isset( $_POST['pending_id'] )
			? sanitize_text_field( wp_unslash( $_POST['pending_id'] ) )
			: '';

		if ( 'network' === $context ) {
			$site = is_multisite() && $site_id > 0 ? get_site( $site_id ) : null;
			if ( ! is_super_admin( get_current_user_id() ) || ! current_user_can( self::NETWORK_CAPABILITY ) || ! $site || get_current_network_id() !== (int) $site->network_id ) {
				wp_die( esc_html__( 'You are not allowed to manage MisticGate network settings.', 'misticgate' ), '', array( 'response' => 403 ) );
			}
			if ( ! wp_is_site_initialized( $site_id ) ) {
				wp_die(
					esc_html__( 'This site is not ready. Finish creating or restoring it in WordPress before configuring MisticGate.', 'misticgate' ),
					'',
					array(
						'response'  => 409,
						'back_link' => true,
					)
				);
			}
		} else {
			$context = 'site';
			$site_id = get_current_blog_id();
			if ( ! current_user_can( self::SITE_CAPABILITY ) ) {
				wp_die( esc_html__( 'You are not allowed to manage MisticGate.', 'misticgate' ), '', array( 'response' => 403 ) );
			}
		}

		return array(
			'context'            => $context,
			'site_id'            => $site_id,
			'bookmark_confirmed' => $bookmark_confirmed,
			'pending_id'         => $pending_id,
			'settings_id'        => isset( $_POST['settings_id'] ) ? sanitize_text_field( wp_unslash( $_POST['settings_id'] ) ) : '',
			'exempt_roles'       => self::posted_roles(),
		);
	}

	/**
	 * Returns the posted role names.
	 *
	 * @return string[] Role names.
	 */
	private static function posted_roles() {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Called only after check_admin_referer() during request preparation.
		if ( ! isset( $_POST['exempt_roles'] ) || ! is_array( $_POST['exempt_roles'] ) ) {
			return array();
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Called only after check_admin_referer() during request preparation.
		return MisticGate::normalize_roles( map_deep( wp_unslash( $_POST['exempt_roles'] ), 'sanitize_text_field' ) );
	}

	/**
	 * Keeps only roles that an administrator can allow on the current site.
	 *
	 * @param string[] $roles Requested role names.
	 *
	 * @return string[] Allowed role names.
	 */
	private static function allowed_exempt_roles( $roles ) {
		return MisticGate::normalize_roles( array_intersect( $roles, array_keys( self::exemptible_roles() ) ) );
	}

	/**
	 * Switches to the site that a request targets.
	 *
	 * @param array $request Request data.
	 *
	 * @return bool Whether the site was switched.
	 */
	private static function begin_target_site( $request ) {
		$switched = 'network' === $request['context'] && get_current_blog_id() !== (int) $request['site_id'];
		if ( $switched ) {
			switch_to_blog( (int) $request['site_id'] );
		}
		MisticGate::ensure_settings();
		return $switched;
	}

	/**
	 * Restores the original site.
	 *
	 * @param bool $switched Whether the site was switched.
	 *
	 * @return void
	 */
	private static function end_target_site( $switched ) {
		if ( $switched ) {
			restore_current_blog();
		}
	}

	/**
	 * Deletes gate cookies when the request targets the current site.
	 *
	 * @param array $request Request data.
	 *
	 * @return void
	 */
	private static function clear_browser_access_if_local( $request ) {
		if ( 'site' === $request['context'] ) {
			MisticGate::clear_access_cookies();
		}
	}

	/**
	 * Stops when the settings changed after the screen was loaded.
	 *
	 * @param array $settings Normalized settings.
	 * @param array $request  Request data.
	 *
	 * @return void
	 */
	private static function require_current_settings( $settings, $request ) {
		if ( ! hash_equals( MisticGate::settings_fingerprint( $settings ), $request['settings_id'] ) ) {
			wp_die(
				esc_html__( 'The settings changed. Return to MisticGate settings and reload the page.', 'misticgate' ),
				'',
				array(
					'response'  => 409,
					'back_link' => true,
				)
			);
		}
	}

	/**
	 * Saves site settings through the runtime controller.
	 *
	 * @param array $settings New settings.
	 * @param array $expected Normalized settings the caller started from.
	 *
	 * @return bool Whether the settings were saved.
	 */
	private static function save_settings( $settings, $expected ) {
		return MisticGate::save_settings( $settings, $expected );
	}

	/**
	 * Returns the request method.
	 *
	 * @return string Uppercase request method, or an empty string.
	 */
	private static function request_method() {
		if ( ! isset( $_SERVER['REQUEST_METHOD'] ) || ! is_string( $_SERVER['REQUEST_METHOD'] ) ) {
			return '';
		}

		return strtoupper( sanitize_key( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) );
	}

	/**
	 * Returns a query string value as an integer.
	 *
	 * @param string $key Query key.
	 *
	 * @return int Value, or 0 when absent.
	 */
	private static function query_integer( $key ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only network page selection.
		if ( ! isset( $_GET[ $key ] ) ) {
			return 0;
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only network page selection.
		return absint( sanitize_text_field( wp_unslash( $_GET[ $key ] ) ) );
	}

	/**
	 * Returns a query string value as a key.
	 *
	 * @param string $key Query key.
	 *
	 * @return string Value, or an empty string.
	 */
	private static function query_key( $key ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only fixed notice key.
		if ( ! isset( $_GET[ $key ] ) ) {
			return '';
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only fixed notice key.
		return sanitize_key( sanitize_text_field( wp_unslash( $_GET[ $key ] ) ) );
	}

	// URLs.
	/**
	 * Returns the site settings page URL.
	 *
	 * @return string Page URL.
	 */
	private static function site_page_url() {
		return admin_url( 'admin.php?page=' . self::PAGE );
	}

	/**
	 * Returns the network settings page URL.
	 *
	 * @param int $site_id Site ID to select, or 0.
	 *
	 * @return string Page URL.
	 */
	private static function network_page_url( $site_id = 0 ) {
		$url = network_admin_url( 'admin.php?page=' . self::PAGE );
		return $site_id > 0 ? add_query_arg( 'site_id', (int) $site_id, $url ) : $url;
	}

	/**
	 * Returns to the settings page with a message, then exits.
	 *
	 * @param string $message Message key.
	 * @param array  $request Request data.
	 *
	 * @return void
	 */
	private static function redirect_with_message( $message, $request ) {
		$page_url = 'network' === $request['context']
			? self::network_page_url( (int) $request['site_id'] )
			: self::site_page_url();
		wp_safe_redirect( add_query_arg( 'misticgate_message', sanitize_key( $message ), $page_url ), 302, 'WordPress' );
		exit;
	}
}