<?php

defined( 'ABSPATH' ) || exit;
final class MyDriveCloud_Access {
    const PAGE = 'mydrivecloud-access';

    const REGISTRATION_TOKEN = 'mydrivecloud_registration_token';

    const REGISTRATION_STATUS = 'mydrivecloud_registration_status';

    public static function register() {
        add_action( 'admin_post_mydrivecloud_access_action', array(__CLASS__, 'handle_action') );
        add_action( 'template_redirect', array(__CLASS__, 'registration_page'), 0 );
        add_filter(
            'authenticate',
            array(__CLASS__, 'block_unapproved_login'),
            45,
            3
        );
    }

    private static function registration_token() {
        $token = (string) get_option( self::REGISTRATION_TOKEN, '' );
        if ( strlen( $token ) < 24 ) {
            $token = wp_generate_password( 40, false, false );
            update_option( self::REGISTRATION_TOKEN, $token, false );
        }
        return $token;
    }

    public static function registration_url() {
        return add_query_arg( array(
            'mydrivecloud_register' => '1',
            'key'                   => self::registration_token(),
        ), home_url( '/' ) );
    }

    private static function registration_status( $user_id ) {
        return sanitize_key( (string) get_user_meta( (int) $user_id, self::REGISTRATION_STATUS, true ) );
    }

    public static function block_unapproved_login( $user, $username = '', $password = '' ) {
        if ( !$user instanceof WP_User ) {
            return $user;
        }
        $status = self::registration_status( $user->ID );
        if ( 'pending' === $status ) {
            return new WP_Error('mydrivecloud_registration_pending', __( 'Your account is awaiting administrator approval.', 'mydrivecloud' ));
        }
        if ( 'rejected' === $status ) {
            return new WP_Error('mydrivecloud_registration_rejected', __( 'Your portal access request was not approved.', 'mydrivecloud' ));
        }
        if ( 'suspended' === $status ) {
            return new WP_Error('mydrivecloud_account_suspended', __( 'Your portal access has been suspended by an administrator.', 'mydrivecloud' ));
        }
        return $user;
    }

    private static function require_admin() {
        if ( !MyDriveCloud_Roles::user_can( 'manage_access' ) ) {
            wp_die( esc_html__( 'You do not have permission to manage access.', 'mydrivecloud' ), '', array(
                'response' => 403,
            ) );
        }
    }

    private static function redirect( $tab = 'clients', $message = '' ) {
        $url = add_query_arg( array(
            'page' => self::PAGE,
            'tab'  => sanitize_key( $tab ),
        ), admin_url( 'admin.php' ) );
        if ( $message ) {
            $url = add_query_arg( 'mydrivecloud_notice', rawurlencode( $message ), $url );
        }
        wp_safe_redirect( $url );
        exit;
    }

    public static function handle_action() {
        self::require_admin();
        check_admin_referer( 'mydrivecloud_access_action' );
        global $wpdb;
        $action = ( isset( $_POST['access_action'] ) ? sanitize_key( wp_unslash( $_POST['access_action'] ) ) : '' );
        $now = current_time( 'mysql', true );
        if ( 'toggle_client' === $action ) {
            $user_id = ( isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0 );
            $user = get_userdata( $user_id );
            if ( !$user ) {
                self::redirect( 'clients', __( 'The user was not found.', 'mydrivecloud' ) );
            }
            if ( user_can( $user, 'mydrivecloud_manage_all' ) ) {
                self::redirect( 'clients', __( 'MyDriveCloud administrator access cannot be disabled here.', 'mydrivecloud' ) );
            }
            $enabled = !empty( $_POST['enabled'] );
            // A per-user false value overrides roles such as Subscriber that normally include portal access.
            $user->add_cap( 'mydrivecloud_access', $enabled );
            MyDriveCloud_DB::audit( ( $enabled ? 'client_access_enabled' : 'client_access_disabled' ), null, array(
                'client_id' => $user_id,
            ) );
            self::redirect( 'clients', __( 'Client access was updated.', 'mydrivecloud' ) );
        }
        if ( 'set_client_role' === $action ) {
            $user_id = ( isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0 );
            $role = ( isset( $_POST['mydrivecloud_role'] ) ? sanitize_key( wp_unslash( $_POST['mydrivecloud_role'] ) ) : 'client' );
            $user = get_userdata( $user_id );
            if ( !$user || !MyDriveCloud_Roles::get( $role ) ) {
                self::redirect( 'clients', __( 'The selected role is invalid.', 'mydrivecloud' ) );
            }
            $selected_role = MyDriveCloud_Roles::get( $role );
            if ( $user_id === get_current_user_id() && empty( $selected_role['permissions']['manage_access'] ) ) {
                self::redirect( 'clients', __( 'You cannot remove your own MyDriveCloud administration permission.', 'mydrivecloud' ) );
            }
            MyDriveCloud_Roles::assign( $user_id, $role );
            MyDriveCloud_DB::audit( 'client_role_changed', null, array(
                'client_id' => $user_id,
                'role'      => $role,
            ) );
            self::redirect( 'clients', __( 'The user role was updated.', 'mydrivecloud' ) );
        }
        if ( 'save_client_quota' === $action ) {
            $user_id = ( isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0 );
            $user = get_userdata( $user_id );
            if ( !$user ) {
                self::redirect( 'clients', __( 'The client account was not found.', 'mydrivecloud' ) );
            }
            $unlimited = !empty( $_POST['quota_unlimited'] );
            $quota_input = ( isset( $_POST['quota_gb'] ) ? sanitize_text_field( wp_unslash( $_POST['quota_gb'] ) ) : '' );
            $quota = MyDriveCloud_Settings::validate_quota_gb( $quota_input );
            if ( is_wp_error( $quota ) ) {
                self::redirect( 'clients', $quota->get_error_message() );
            }
            update_user_meta( $user_id, MyDriveCloud_Settings::USER_QUOTA_META, $quota );
            update_user_meta( $user_id, MyDriveCloud_Settings::USER_UNLIMITED_META, ( $unlimited ? '1' : '0' ) );
            MyDriveCloud_DB::audit( 'client_storage_quota_updated', null, array(
                'client_id' => $user_id,
                'quota_gb'  => $quota,
                'unlimited' => $unlimited,
            ) );
            self::redirect( 'clients', __( 'The client storage limit was updated.', 'mydrivecloud' ) );
        }
        if ( 'send_registration_link' === $action ) {
            $email = ( isset( $_POST['invite_email'] ) ? sanitize_email( wp_unslash( $_POST['invite_email'] ) ) : '' );
            if ( !is_email( $email ) ) {
                self::redirect( 'clients', __( 'Enter a valid e-mail address.', 'mydrivecloud' ) );
            }
            $brand = MyDriveCloud_Settings::brand_name();
            /* translators: %s: portal brand name. */
            $subject = sprintf( __( 'Your registration invitation to %s', 'mydrivecloud' ), $brand );
            /* translators: 1: portal brand name, 2: private registration URL. */
            $message = sprintf( __( 'You have been invited to create a client account in %1$s.

Open the registration link:
%2$s

After registration, the account must be approved by an administrator.', 'mydrivecloud' ), $brand, self::registration_url() );
            if ( !wp_mail( $email, $subject, $message ) ) {
                self::redirect( 'clients', __( 'The message could not be sent. Check the site e-mail configuration.', 'mydrivecloud' ) );
            }
            MyDriveCloud_DB::audit( 'registration_invitation_sent', null, array(
                'email' => $email,
            ) );
            self::redirect( 'clients', __( 'The registration invitation was sent.', 'mydrivecloud' ) );
        }
        if ( 'regenerate_registration_link' === $action ) {
            update_option( self::REGISTRATION_TOKEN, wp_generate_password( 40, false, false ), false );
            MyDriveCloud_DB::audit( 'registration_link_regenerated' );
            self::redirect( 'clients', __( 'A new link was generated. The previous link is no longer valid.', 'mydrivecloud' ) );
        }
        if ( in_array( $action, array('approve_registration', 'reject_registration'), true ) ) {
            $user_id = ( isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0 );
            $user = get_userdata( $user_id );
            if ( !$user || !in_array( self::registration_status( $user_id ), array('pending', 'rejected'), true ) ) {
                self::redirect( 'clients', __( 'The registration request was not found.', 'mydrivecloud' ) );
            }
            if ( 'approve_registration' === $action ) {
                MyDriveCloud_Roles::assign( $user_id, 'client' );
                delete_user_meta( $user_id, self::REGISTRATION_STATUS );
                $user->add_cap( 'mydrivecloud_access', true );
                /* translators: %s: portal brand name. */
                $approved_subject = sprintf( __( 'Your %s account was approved', 'mydrivecloud' ), MyDriveCloud_Settings::brand_name() );
                /* translators: %s: portal sign-in URL. */
                $approved_message = sprintf( __( 'Your account was approved. You can sign in here:
%s', 'mydrivecloud' ), MyDriveCloud_Settings::return_url() );
                wp_mail( $user->user_email, $approved_subject, $approved_message );
                MyDriveCloud_DB::audit( 'registration_approved', null, array(
                    'client_id' => $user_id,
                ) );
                self::redirect( 'clients', __( 'The client was approved and can now access the portal.', 'mydrivecloud' ) );
            }
            update_user_meta( $user_id, self::REGISTRATION_STATUS, 'rejected' );
            $user->add_cap( 'mydrivecloud_access', false );
            WP_Session_Tokens::get_instance( $user_id )->destroy_all();
            /* translators: %s: portal brand name. */
            $rejected_subject = sprintf( __( '%s access request', 'mydrivecloud' ), MyDriveCloud_Settings::brand_name() );
            wp_mail( $user->user_email, $rejected_subject, __( 'Your portal access request was not approved. Contact the site administrator for details.', 'mydrivecloud' ) );
            MyDriveCloud_DB::audit( 'registration_rejected', null, array(
                'client_id' => $user_id,
            ) );
            self::redirect( 'clients', __( 'The client request was rejected.', 'mydrivecloud' ) );
        }
        if ( 'delete_rejected_registration' === $action ) {
            $user_id = ( isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0 );
            $user = get_userdata( $user_id );
            if ( !$user || 'rejected' !== self::registration_status( $user_id ) ) {
                self::redirect( 'clients', __( 'The rejected account was not found.', 'mydrivecloud' ) );
            }
            if ( $user_id === get_current_user_id() || user_can( $user, 'mydrivecloud_manage_all' ) ) {
                self::redirect( 'clients', __( 'This account cannot be deleted here.', 'mydrivecloud' ) );
            }
            $wpdb->delete( MyDriveCloud_DB::table( 'group_members' ), array(
                'user_id' => $user_id,
            ), array('%d') );
            $wpdb->delete( MyDriveCloud_DB::table( 'access' ), array(
                'subject_type' => 'user',
                'subject_id'   => $user_id,
            ), array('%s', '%d') );
            MyDriveCloud_DB::audit( 'rejected_registration_deleted', null, array(
                'client_id' => $user_id,
                'email'     => $user->user_email,
            ) );
            require_once ABSPATH . 'wp-admin/includes/user.php';
            if ( !wp_delete_user( $user_id ) ) {
                self::redirect( 'clients', __( 'The rejected account could not be deleted.', 'mydrivecloud' ) );
            }
            self::redirect( 'clients', __( 'The rejected account was permanently deleted.', 'mydrivecloud' ) );
        }
        if ( in_array( $action, array('suspend_client', 'reactivate_client'), true ) ) {
            $user_id = ( isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0 );
            $user = get_userdata( $user_id );
            if ( !$user ) {
                self::redirect( 'clients', __( 'The client account was not found.', 'mydrivecloud' ) );
            }
            if ( $user_id === get_current_user_id() || user_can( $user, 'mydrivecloud_manage_all' ) ) {
                self::redirect( 'clients', __( 'Administrator accounts cannot be suspended here.', 'mydrivecloud' ) );
            }
            if ( in_array( self::registration_status( $user_id ), array('pending', 'rejected'), true ) ) {
                self::redirect( 'clients', __( 'Approve or reject this registration request first.', 'mydrivecloud' ) );
            }
            if ( 'suspend_client' === $action ) {
                update_user_meta( $user_id, self::REGISTRATION_STATUS, 'suspended' );
                $user->add_cap( 'mydrivecloud_access', false );
                WP_Session_Tokens::get_instance( $user_id )->destroy_all();
                MyDriveCloud_DB::audit( 'client_suspended', null, array(
                    'client_id' => $user_id,
                ) );
                self::redirect( 'clients', __( 'The client was suspended and all active sessions were revoked.', 'mydrivecloud' ) );
            }
            delete_user_meta( $user_id, self::REGISTRATION_STATUS );
            $user->add_cap( 'mydrivecloud_access', true );
            MyDriveCloud_DB::audit( 'client_reactivated', null, array(
                'client_id' => $user_id,
            ) );
            self::redirect( 'clients', __( 'The client was reactivated.', 'mydrivecloud' ) );
        }
        if ( 'delete_client' === $action ) {
            $user_id = ( isset( $_POST['user_id'] ) ? absint( $_POST['user_id'] ) : 0 );
            $user = get_userdata( $user_id );
            if ( !$user ) {
                self::redirect( 'clients', __( 'The client account was not found.', 'mydrivecloud' ) );
            }
            if ( $user_id === get_current_user_id() || user_can( $user, 'mydrivecloud_manage_all' ) ) {
                self::redirect( 'clients', __( 'Administrator accounts cannot be deleted here.', 'mydrivecloud' ) );
            }
            $new_owner = get_current_user_id();
            $wpdb->update(
                MyDriveCloud_DB::table( 'items' ),
                array(
                    'owner_id' => $new_owner,
                ),
                array(
                    'owner_id' => $user_id,
                ),
                array('%d'),
                array('%d')
            );
            $wpdb->update(
                MyDriveCloud_DB::table( 'shares' ),
                array(
                    'created_by' => $new_owner,
                ),
                array(
                    'created_by' => $user_id,
                ),
                array('%d'),
                array('%d')
            );
            $wpdb->update(
                MyDriveCloud_DB::table( 'groups' ),
                array(
                    'created_by' => $new_owner,
                ),
                array(
                    'created_by' => $user_id,
                ),
                array('%d'),
                array('%d')
            );
            $wpdb->update(
                MyDriveCloud_DB::table( 'access' ),
                array(
                    'created_by' => $new_owner,
                ),
                array(
                    'created_by' => $user_id,
                ),
                array('%d'),
                array('%d')
            );
            $wpdb->delete( MyDriveCloud_DB::table( 'group_members' ), array(
                'user_id' => $user_id,
            ), array('%d') );
            $wpdb->delete( MyDriveCloud_DB::table( 'access' ), array(
                'subject_type' => 'user',
                'subject_id'   => $user_id,
            ), array('%s', '%d') );
            $wpdb->delete( MyDriveCloud_DB::table( 'shares' ), array(
                'user_id' => $user_id,
            ), array('%d') );
            MyDriveCloud_DB::audit( 'client_deleted', null, array(
                'client_id'            => $user_id,
                'email'                => $user->user_email,
                'files_transferred_to' => $new_owner,
            ) );
            require_once ABSPATH . 'wp-admin/includes/user.php';
            if ( !wp_delete_user( $user_id ) ) {
                self::redirect( 'clients', __( 'The client account could not be deleted.', 'mydrivecloud' ) );
            }
            self::redirect( 'clients', __( 'The client account was permanently deleted. Its regular files were transferred to your account.', 'mydrivecloud' ) );
        }
        if ( 'create_role' === $action ) {
            $name = ( isset( $_POST['name'] ) ? sanitize_text_field( wp_unslash( $_POST['name'] ) ) : '' );
            $description = ( isset( $_POST['description'] ) ? sanitize_textarea_field( wp_unslash( $_POST['description'] ) ) : '' );
            $permissions = ( isset( $_POST['permissions'] ) ? (array) wp_unslash( $_POST['permissions'] ) : array() );
            $result = MyDriveCloud_Roles::create( $name, $description, $permissions );
            if ( is_wp_error( $result ) ) {
                self::redirect( 'roles', $result->get_error_message() );
            }
            MyDriveCloud_DB::audit( 'role_created', null, array(
                'role' => $result,
            ) );
            self::redirect( 'roles', __( 'The custom role was created.', 'mydrivecloud' ) );
        }
        if ( 'delete_role' === $action ) {
            $role = ( isset( $_POST['mydrivecloud_role'] ) ? sanitize_key( wp_unslash( $_POST['mydrivecloud_role'] ) ) : '' );
            if ( MyDriveCloud_Roles::current_role_slug() === $role ) {
                self::redirect( 'roles', __( 'You cannot delete the role assigned to your own account.', 'mydrivecloud' ) );
            }
            if ( !MyDriveCloud_Roles::delete( $role ) ) {
                self::redirect( 'roles', __( 'The role cannot be deleted.', 'mydrivecloud' ) );
            }
            MyDriveCloud_DB::audit( 'role_deleted', null, array(
                'role' => $role,
            ) );
            self::redirect( 'roles', __( 'The role was deleted. Its users were assigned the Client role.', 'mydrivecloud' ) );
        }
        if ( 'create_group' === $action ) {
            $name = ( isset( $_POST['name'] ) ? sanitize_text_field( wp_unslash( $_POST['name'] ) ) : '' );
            $description = ( isset( $_POST['description'] ) ? sanitize_textarea_field( wp_unslash( $_POST['description'] ) ) : '' );
            if ( !$name ) {
                self::redirect( 'groups', __( 'Enter a name for the group.', 'mydrivecloud' ) );
            }
            $created = $wpdb->insert( MyDriveCloud_DB::table( 'groups' ), array(
                'name'        => $name,
                'description' => $description,
                'created_by'  => get_current_user_id(),
                'created_at'  => $now,
            ), array(
                '%s',
                '%s',
                '%d',
                '%s'
            ) );
            self::redirect( 'groups', ( false === $created ? __( 'The group already exists or could not be created.', 'mydrivecloud' ) : __( 'The group was created.', 'mydrivecloud' ) ) );
        }
        if ( 'save_members' === $action ) {
            $group_id = ( isset( $_POST['group_id'] ) ? absint( $_POST['group_id'] ) : 0 );
            $group = $wpdb->get_var( $wpdb->prepare( 'SELECT id FROM %i WHERE id=%d', MyDriveCloud_DB::table( 'groups' ), $group_id ) );
            if ( !$group ) {
                self::redirect( 'groups', __( 'The group was not found.', 'mydrivecloud' ) );
            }
            $members = ( isset( $_POST['members'] ) ? array_unique( array_map( 'absint', (array) wp_unslash( $_POST['members'] ) ) ) : array() );
            $wpdb->delete( MyDriveCloud_DB::table( 'group_members' ), array(
                'group_id' => $group_id,
            ), array('%d') );
            foreach ( $members as $user_id ) {
                if ( $user_id && get_userdata( $user_id ) ) {
                    $wpdb->insert( MyDriveCloud_DB::table( 'group_members' ), array(
                        'group_id'   => $group_id,
                        'user_id'    => $user_id,
                        'created_at' => $now,
                    ), array('%d', '%d', '%s') );
                }
            }
            MyDriveCloud_DB::audit( 'group_members_updated', null, array(
                'group_id' => $group_id,
                'members'  => $members,
            ) );
            self::redirect( 'groups', __( 'Group members were updated.', 'mydrivecloud' ) );
        }
        if ( 'delete_group' === $action ) {
            $group_id = ( isset( $_POST['group_id'] ) ? absint( $_POST['group_id'] ) : 0 );
            $wpdb->delete( MyDriveCloud_DB::table( 'access' ), array(
                'subject_type' => 'group',
                'subject_id'   => $group_id,
            ), array('%s', '%d') );
            $wpdb->delete( MyDriveCloud_DB::table( 'group_members' ), array(
                'group_id' => $group_id,
            ), array('%d') );
            $wpdb->delete( MyDriveCloud_DB::table( 'groups' ), array(
                'id' => $group_id,
            ), array('%d') );
            MyDriveCloud_DB::audit( 'group_deleted', null, array(
                'group_id' => $group_id,
            ) );
            self::redirect( 'groups', __( 'The group and its permissions were removed.', 'mydrivecloud' ) );
        }
        if ( 'grant' === $action ) {
            $item_id = ( isset( $_POST['item_id'] ) ? absint( $_POST['item_id'] ) : 0 );
            $subject_type = ( isset( $_POST['subject_type'] ) && 'group' === sanitize_key( wp_unslash( $_POST['subject_type'] ) ) ? 'group' : 'user' );
            $subject_id = ( isset( $_POST['subject_id'] ) ? absint( $_POST['subject_id'] ) : 0 );
            $item = MyDriveCloud_Permissions::get_item( $item_id );
            if ( !$item || !$subject_id ) {
                self::redirect( 'permissions', __( 'Choose a valid file or folder and recipient.', 'mydrivecloud' ) );
            }
            $valid_subject = ( 'user' === $subject_type ? get_userdata( $subject_id ) : $wpdb->get_var( $wpdb->prepare( 'SELECT id FROM %i WHERE id=%d', MyDriveCloud_DB::table( 'groups' ), $subject_id ) ) );
            if ( !$valid_subject ) {
                self::redirect( 'permissions', __( 'The recipient is invalid.', 'mydrivecloud' ) );
            }
            $expires = ( isset( $_POST['expires_at'] ) ? sanitize_text_field( wp_unslash( $_POST['expires_at'] ) ) : '' );
            if ( $expires ) {
                $expires_timestamp = strtotime( $expires );
                if ( false === $expires_timestamp || $expires_timestamp <= time() ) {
                    self::redirect( 'permissions', __( 'The expiration date must be in the future.', 'mydrivecloud' ) );
                }
                $expires = gmdate( 'Y-m-d H:i:s', $expires_timestamp );
            } else {
                $expires = null;
            }
            $data = array(
                'item_id'      => $item_id,
                'subject_type' => $subject_type,
                'subject_id'   => $subject_id,
                'can_preview'  => ( !empty( $_POST['can_preview'] ) ? 1 : 0 ),
                'can_download' => ( !empty( $_POST['can_download'] ) ? 1 : 0 ),
                'expires_at'   => $expires,
                'created_by'   => get_current_user_id(),
                'created_at'   => $now,
            );
            $wpdb->replace( MyDriveCloud_DB::table( 'access' ), $data, array(
                '%d',
                '%s',
                '%d',
                '%d',
                '%d',
                '%s',
                '%d',
                '%s'
            ) );
            MyDriveCloud_DB::audit( 'access_granted', $item_id, array(
                'subject_type' => $subject_type,
                'subject_id'   => $subject_id,
                'preview'      => $data['can_preview'],
                'download'     => $data['can_download'],
                'expires_at'   => $expires,
            ) );
            self::redirect( 'permissions', __( 'The permission was saved.', 'mydrivecloud' ) );
        }
        if ( 'revoke' === $action ) {
            $grant_id = ( isset( $_POST['grant_id'] ) ? absint( $_POST['grant_id'] ) : 0 );
            $grant = $wpdb->get_row( $wpdb->prepare( 'SELECT * FROM %i WHERE id=%d', MyDriveCloud_DB::table( 'access' ), $grant_id ) );
            if ( $grant ) {
                $wpdb->delete( MyDriveCloud_DB::table( 'access' ), array(
                    'id' => $grant_id,
                ), array('%d') );
                MyDriveCloud_DB::audit( 'access_revoked', $grant->item_id, array(
                    'grant_id' => $grant_id,
                ) );
            }
            self::redirect( 'permissions', __( 'The permission was removed.', 'mydrivecloud' ) );
        }
        self::redirect( 'clients', __( 'The action is invalid.', 'mydrivecloud' ) );
    }

    private static function action_fields( $action ) {
        wp_nonce_field( 'mydrivecloud_access_action' );
        echo '<input type="hidden" name="action" value="mydrivecloud_access_action"><input type="hidden" name="access_action" value="' . esc_attr( $action ) . '">';
    }

    private static function users() {
        $users = get_users( array(
            'orderby' => 'display_name',
            'order'   => 'ASC',
            'number'  => 500,
        ) );
        usort( $users, static function ( $a, $b ) {
            $a_admin = 'administrator' === MyDriveCloud_Roles::current_role_slug( $a->ID ) || user_can( $a, 'mydrivecloud_manage_all' );
            $b_admin = 'administrator' === MyDriveCloud_Roles::current_role_slug( $b->ID ) || user_can( $b, 'mydrivecloud_manage_all' );
            if ( $a_admin !== $b_admin ) {
                return ( $a_admin ? -1 : 1 );
            }
            $a_pending = 'pending' === self::registration_status( $a->ID );
            $b_pending = 'pending' === self::registration_status( $b->ID );
            return ( $a_pending === $b_pending ? strcasecmp( $a->display_name, $b->display_name ) : (( $a_pending ? -1 : 1 )) );
        } );
        return $users;
    }

    public static function registration_page() {
        if ( !isset( $_GET['mydrivecloud_register'] ) ) {
            return;
        }
        $provided = ( isset( $_REQUEST['key'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['key'] ) ) : '' );
        if ( !$provided || !hash_equals( self::registration_token(), $provided ) ) {
            status_header( 404 );
            nocache_headers();
            exit;
        }
        if ( is_user_logged_in() ) {
            wp_safe_redirect( home_url( '/' ) );
            exit;
        }
        $error = '';
        $success = false;
        if ( 'POST' === strtoupper( ( isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '' ) ) ) {
            $nonce = ( isset( $_POST['_mydrivecloud_register_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_mydrivecloud_register_nonce'] ) ) : '' );
            $username = ( isset( $_POST['user_login'] ) ? sanitize_user( wp_unslash( $_POST['user_login'] ), true ) : '' );
            $email = ( isset( $_POST['user_email'] ) ? sanitize_email( wp_unslash( $_POST['user_email'] ) ) : '' );
            $first_name = ( isset( $_POST['first_name'] ) ? sanitize_text_field( wp_unslash( $_POST['first_name'] ) ) : '' );
            $last_name = ( isset( $_POST['last_name'] ) ? sanitize_text_field( wp_unslash( $_POST['last_name'] ) ) : '' );
            $password = ( isset( $_POST['user_password'] ) ? (string) wp_unslash( $_POST['user_password'] ) : '' );
            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Passwords must remain byte-for-byte unchanged.
            $confirm = ( isset( $_POST['password_confirm'] ) ? (string) wp_unslash( $_POST['password_confirm'] ) : '' );
            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Compared directly with the password.
            $honeypot = ( isset( $_POST['company_website'] ) ? trim( (string) wp_unslash( $_POST['company_website'] ) ) : '' );
            if ( !wp_verify_nonce( $nonce, 'mydrivecloud_register' ) || $honeypot ) {
                $error = __( 'The form session expired. Reload the page and try again.', 'mydrivecloud' );
            } elseif ( strlen( $username ) < 3 || !validate_username( $username ) ) {
                $error = __( 'Choose a valid username with at least 3 characters.', 'mydrivecloud' );
            } elseif ( !is_email( $email ) ) {
                $error = __( 'Enter a valid e-mail address.', 'mydrivecloud' );
            } elseif ( username_exists( $username ) || email_exists( $email ) ) {
                $error = __( 'This username or e-mail address is already in use.', 'mydrivecloud' );
            } elseif ( strlen( $password ) < 10 ) {
                $error = __( 'The password must contain at least 10 characters.', 'mydrivecloud' );
            } elseif ( !hash_equals( $password, $confirm ) ) {
                $error = __( 'The passwords do not match.', 'mydrivecloud' );
            } else {
                $user_id = wp_insert_user( array(
                    'user_login'   => $username,
                    'user_email'   => $email,
                    'user_pass'    => $password,
                    'first_name'   => $first_name,
                    'last_name'    => $last_name,
                    'display_name' => ( trim( $first_name . ' ' . $last_name ) ?: $username ),
                    'role'         => 'subscriber',
                ) );
                if ( is_wp_error( $user_id ) ) {
                    $error = wp_strip_all_tags( $user_id->get_error_message() );
                } else {
                    MyDriveCloud_Roles::assign( $user_id, 'client' );
                    update_user_meta( $user_id, self::REGISTRATION_STATUS, 'pending' );
                    $new_user = get_userdata( $user_id );
                    if ( $new_user ) {
                        $new_user->add_cap( 'mydrivecloud_access', false );
                    }
                    $admin_url = add_query_arg( array(
                        'page' => self::PAGE,
                        'tab'  => 'clients',
                    ), admin_url( 'admin.php' ) );
                    /* translators: %s: portal brand name. */
                    $admin_subject = sprintf( __( 'New client awaiting approval — %s', 'mydrivecloud' ), MyDriveCloud_Settings::brand_name() );
                    $admin_message = sprintf(
                        /* translators: 1: client display name, 2: client email, 3: admin management URL. */
                        __( '%1$s (%2$s) registered and is awaiting approval.

Manage the request:
%3$s', 'mydrivecloud' ),
                        ( $new_user ? $new_user->display_name : $username ),
                        $email,
                        $admin_url
                    );
                    wp_mail( get_option( 'admin_email' ), $admin_subject, $admin_message );
                    MyDriveCloud_DB::audit( 'registration_submitted', null, array(
                        'client_id' => $user_id,
                    ) );
                    $success = true;
                }
            }
        }
        $brand = MyDriveCloud_Settings::brand_name();
        $logo = MyDriveCloud_Settings::brand_icon_url();
        wp_enqueue_style(
            'mydrivecloud-registration',
            MYDRIVECLOUD_URL . 'assets/css/mydrivecloud-admin.css',
            array(),
            MYDRIVECLOUD_VERSION
        );
        status_header( ( $success ? 201 : 200 ) );
        nocache_headers();
        ?><!doctype html>
		<html <?php 
        language_attributes();
        ?>>
		<head>
			<meta charset="<?php 
        bloginfo( 'charset' );
        ?>">
			<meta name="viewport" content="width=device-width,initial-scale=1">
			<meta name="robots" content="noindex,nofollow">
			<title><?php 
        /* translators: %s: portal brand name. */
        echo esc_html( sprintf( __( 'Register — %s', 'mydrivecloud' ), $brand ) );
        ?></title>
			<?php 
        wp_head();
        ?>
			
		</head>
		<body class="mydrivecloud-registration-page"><main class="mydrivecloud-registration-card">
			<div class="mydrivecloud-registration-brand"><?php 
        if ( $logo ) {
            ?><img src="<?php 
            echo esc_url( $logo );
            ?>" alt=""><?php 
        }
        ?><span><?php 
        echo esc_html( $brand );
        ?></span></div>
			<?php 
        if ( $success ) {
            ?>
				<section class="mydrivecloud-registration-success"><b>✓</b><h1><?php 
            esc_html_e( 'Request submitted', 'mydrivecloud' );
            ?></h1><p><?php 
            esc_html_e( 'Your account was created and is awaiting administrator approval. You will receive an e-mail after it is approved.', 'mydrivecloud' );
            ?></p></section>
			<?php 
        } else {
            ?>
				<h1><?php 
            esc_html_e( 'Create your client account', 'mydrivecloud' );
            ?></h1>
				<p class="mydrivecloud-registration-intro"><?php 
            esc_html_e( 'Complete the form below. Portal access will become active after administrator approval.', 'mydrivecloud' );
            ?></p>
				<?php 
            if ( $error ) {
                ?><p class="mydrivecloud-registration-error" role="alert"><?php 
                echo esc_html( $error );
                ?></p><?php 
            }
            ?>
				<form class="mydrivecloud-registration-form" method="post" action="<?php 
            echo esc_url( self::registration_url() );
            ?>">
					<?php 
            wp_nonce_field( 'mydrivecloud_register', '_mydrivecloud_register_nonce' );
            ?>
					<input type="hidden" name="key" value="<?php 
            echo esc_attr( $provided );
            ?>">
					<label class="mydrivecloud-registration-hp" aria-hidden="true">Website<input name="company_website" tabindex="-1" autocomplete="off"></label>
					<div class="mydrivecloud-registration-row"><label><?php 
            esc_html_e( 'First name', 'mydrivecloud' );
            ?><input name="first_name" autocomplete="given-name" required maxlength="60"></label><label><?php 
            esc_html_e( 'Last name', 'mydrivecloud' );
            ?><input name="last_name" autocomplete="family-name" required maxlength="60"></label></div>
					<label><?php 
            esc_html_e( 'Username', 'mydrivecloud' );
            ?><input name="user_login" autocomplete="username" required minlength="3" maxlength="60"></label>
					<label><?php 
            esc_html_e( 'E-mail', 'mydrivecloud' );
            ?><input name="user_email" type="email" autocomplete="email" required></label>
					<div class="mydrivecloud-registration-row"><label><?php 
            esc_html_e( 'Password', 'mydrivecloud' );
            ?><input name="user_password" type="password" autocomplete="new-password" required minlength="10"></label><label><?php 
            esc_html_e( 'Confirm password', 'mydrivecloud' );
            ?><input name="password_confirm" type="password" autocomplete="new-password" required minlength="10"></label></div>
					<button type="submit"><?php 
            esc_html_e( 'Submit registration request', 'mydrivecloud' );
            ?></button>
				</form>
			<?php 
        }
        ?>
		</main><?php 
        wp_footer();
        ?></body></html><?php 
        exit;
    }

    private static function groups() {
        global $wpdb;
        return $wpdb->get_results( $wpdb->prepare( 'SELECT g.*,COUNT(m.user_id) AS member_count FROM %i g LEFT JOIN %i m ON m.group_id=g.id GROUP BY g.id ORDER BY g.name ASC', MyDriveCloud_DB::table( 'groups' ), MyDriveCloud_DB::table( 'group_members' ) ) );
    }

    private static function item_path( $item ) {
        $parts = array($item->name);
        $seen = array(
            (int) $item->id => true,
        );
        while ( $item->parent_id && !isset( $seen[(int) $item->parent_id] ) ) {
            $seen[(int) $item->parent_id] = true;
            $item = MyDriveCloud_Permissions::get_item( $item->parent_id );
            if ( !$item ) {
                break;
            }
            array_unshift( $parts, $item->name );
        }
        return implode( ' / ', $parts );
    }

    private static function view_as_items( $type, $id ) {
        global $wpdb;
        $rows = $wpdb->get_results( $wpdb->prepare( 'SELECT * FROM %i WHERE trashed_at IS NULL ORDER BY type DESC,name ASC LIMIT 1000', MyDriveCloud_DB::table( 'items' ) ) );
        return array_values( array_filter( $rows, static function ( $item ) use($type, $id) {
            return ( 'group' === $type ? MyDriveCloud_Permissions::group_can_view( $item, $id ) : MyDriveCloud_Permissions::can_view( $item, $id ) );
        } ) );
    }

    public static function page() {
        self::require_admin();
        global $wpdb;
        $tab = ( isset( $_GET['tab'] ) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : 'clients' );
        if ( !in_array( $tab, array(
            'clients',
            'roles',
            'groups',
            'permissions'
        ), true ) ) {
            $tab = 'clients';
        }
        $users = self::users();
        $groups = self::groups();
        $roles = MyDriveCloud_Roles::all_roles();
        $view_type = ( isset( $_GET['view_type'] ) && 'group' === sanitize_key( wp_unslash( $_GET['view_type'] ) ) ? 'group' : 'user' );
        $view_id = ( isset( $_GET['view_id'] ) ? absint( $_GET['view_id'] ) : 0 );
        $notice = ( isset( $_GET['mydrivecloud_notice'] ) ? sanitize_text_field( rawurldecode( wp_unslash( $_GET['mydrivecloud_notice'] ) ) ) : '' );
        ?>
		<div class="wrap mydrivecloud-access-admin">
			<h1><?php 
        esc_html_e( 'MyDriveCloud — Clients & Access', 'mydrivecloud' );
        ?></h1>
			<?php 
        MyDriveCloud_Settings::tabs( 'access' );
        ?>
			<p class="description"><?php 
        esc_html_e( 'Manage clients, groups, private folders, and preview/download permissions.', 'mydrivecloud' );
        ?></p>
			<?php 
        if ( $notice ) {
            ?><div class="notice notice-info is-dismissible"><p><?php 
            echo esc_html( $notice );
            ?></p></div><?php 
        }
        ?>
			<nav class="nav-tab-wrapper">
				<?php 
        foreach ( array(
            'clients'     => __( 'Clients', 'mydrivecloud' ),
            'roles'       => __( 'Roles', 'mydrivecloud' ),
            'groups'      => __( 'Groups', 'mydrivecloud' ),
            'permissions' => __( 'Permissions', 'mydrivecloud' ),
        ) as $key => $label ) {
            ?>
				<a class="nav-tab <?php 
            echo ( $tab === $key ? 'nav-tab-active' : '' );
            ?>" href="<?php 
            echo esc_url( add_query_arg( array(
                'page' => self::PAGE,
                'tab'  => $key,
            ), admin_url( 'admin.php' ) ) );
            ?>"><?php 
            echo esc_html( $label );
            ?></a>
				<?php 
        }
        ?>
			</nav>

			<?php 
        if ( 'clients' === $tab ) {
            ?>
			<section class="mwa-invite-panel">
				<div class="mwa-invite-copy"><span><?php 
            esc_html_e( 'CLIENT REGISTRATION', 'mydrivecloud' );
            ?></span><h2><?php 
            esc_html_e( 'Invite clients securely', 'mydrivecloud' );
            ?></h2><p><?php 
            esc_html_e( 'The Register page is private and can only be accessed through this link. Every new account remains blocked until an administrator approves it.', 'mydrivecloud' );
            ?></p></div>
				<div class="mwa-link-row"><input id="mwa-registration-url" class="large-text code" type="text" readonly value="<?php 
            echo esc_attr( self::registration_url() );
            ?>"><button class="button button-primary" type="button" data-copy-registration><?php 
            esc_html_e( 'Copy link', 'mydrivecloud' );
            ?></button></div>
				<div class="mwa-invite-actions">
					<form method="post" action="<?php 
            echo esc_url( admin_url( 'admin-post.php' ) );
            ?>"><?php 
            self::action_fields( 'send_registration_link' );
            ?><label><span><?php 
            esc_html_e( 'Send invitation by e-mail', 'mydrivecloud' );
            ?></span><input type="email" name="invite_email" required placeholder="client@example.com"></label><button class="button button-primary"><?php 
            esc_html_e( 'Send invitation', 'mydrivecloud' );
            ?></button></form>
					<form method="post" action="<?php 
            echo esc_url( admin_url( 'admin-post.php' ) );
            ?>" onsubmit="return confirm('Generate a new link? The current link will stop working.');"><?php 
            self::action_fields( 'regenerate_registration_link' );
            ?><button class="button"><?php 
            esc_html_e( 'Generate new link', 'mydrivecloud' );
            ?></button></form>
				</div>
			</section>
			<div class="mwa-toolbar"><form method="get"><input type="hidden" name="page" value="<?php 
            echo esc_attr( self::PAGE );
            ?>"><input type="hidden" name="tab" value="clients"><label><?php 
            esc_html_e( 'View as', 'mydrivecloud' );
            ?> <select name="view_type"><option value="user" <?php 
            selected( $view_type, 'user' );
            ?>><?php 
            esc_html_e( 'User', 'mydrivecloud' );
            ?></option><option value="group" <?php 
            selected( $view_type, 'group' );
            ?>><?php 
            esc_html_e( 'Group', 'mydrivecloud' );
            ?></option></select></label><select name="view_id"><?php 
            $choices = ( 'group' === $view_type ? $groups : $users );
            foreach ( $choices as $choice ) {
                $id = ( 'group' === $view_type ? $choice->id : $choice->ID );
                ?><option value="<?php 
                echo esc_attr( $id );
                ?>" <?php 
                selected( $view_id, $id );
                ?>><?php 
                echo esc_html( $choice->name ?? $choice->display_name );
                ?></option><?php 
            }
            ?></select><button class="button button-primary"><?php 
            esc_html_e( 'View as', 'mydrivecloud' );
            ?></button></form></div>
			<?php 
            if ( $view_id ) {
                self::render_view_as( $view_type, $view_id );
            }
            ?>
			<div class="mwa-grid"><?php 
            foreach ( $users as $user ) {
                $role_slug = MyDriveCloud_Roles::current_role_slug( $user->ID );
                $role_data = MyDriveCloud_Roles::get( $role_slug );
                $has_access = MyDriveCloud_Roles::user_can( 'access_portal', $user->ID );
                $vault = false;
                $registration_status = self::registration_status( $user->ID );
                $quota_settings = MyDriveCloud_Settings::user_quota_settings( $user->ID );
                ?>
			<article class="mwa-card <?php 
                echo ( 'pending' === $registration_status ? 'is-pending' : '' );
                ?>">
				<div class="mwa-person"><?php 
                echo get_avatar( $user->ID, 48 );
                ?><div><strong><?php 
                echo esc_html( $user->display_name );
                ?></strong><small><?php 
                echo esc_html( $user->user_email );
                ?></small></div></div>
				<p><?php 
                if ( 'pending' === $registration_status ) {
                    ?><span class="mwa-badge pending"><?php 
                    esc_html_e( 'Awaiting approval', 'mydrivecloud' );
                    ?></span><?php 
                } elseif ( 'rejected' === $registration_status ) {
                    ?><span class="mwa-badge rejected"><?php 
                    esc_html_e( 'Rejected', 'mydrivecloud' );
                    ?></span><?php 
                } elseif ( 'suspended' === $registration_status ) {
                    ?><span class="mwa-badge suspended"><?php 
                    esc_html_e( 'Suspended', 'mydrivecloud' );
                    ?></span><?php 
                } else {
                    ?><span class="mwa-badge <?php 
                    echo ( $has_access ? 'ok' : '' );
                    ?>"><?php 
                    echo ( $has_access ? esc_html__( 'Portal active', 'mydrivecloud' ) : esc_html__( 'No access', 'mydrivecloud' ) );
                    ?></span><?php 
                }
                ?> <span class="mwa-badge <?php 
                echo ( 'administrator' === $role_slug ? 'admin' : '' );
                ?>"><?php 
                echo esc_html( ( $role_data ? $role_data['name'] : __( 'No role', 'mydrivecloud' ) ) );
                ?></span>
				<?php 
                ?>
				</p>
				<form class="mwa-quota-form" method="post" action="<?php 
                echo esc_url( admin_url( 'admin-post.php' ) );
                ?>">
					<?php 
                self::action_fields( 'save_client_quota' );
                ?><input type="hidden" name="user_id" value="<?php 
                echo esc_attr( $user->ID );
                ?>">
					<div class="mwa-quota-heading"><strong><?php 
                esc_html_e( 'Storage limit', 'mydrivecloud' );
                ?></strong><span><?php 
                echo ( $quota_settings['unlimited'] ? esc_html__( 'Unlimited', 'mydrivecloud' ) : esc_html( $quota_settings['gb'] . ' GB' ) );
                ?></span></div>
					<div class="mwa-quota-controls"><label><span><?php 
                esc_html_e( 'Limit (GB)', 'mydrivecloud' );
                ?></span><input type="number" name="quota_gb" min="0.01" max="<?php 
                echo esc_attr( MyDriveCloud_Settings::maximum_quota_gb() );
                ?>" step="0.01" required value="<?php 
                echo esc_attr( $quota_settings['gb'] );
                ?>"></label><label class="mwa-unlimited"><input type="checkbox" name="quota_unlimited" value="1" <?php 
                checked( $quota_settings['unlimited'] );
                ?>> <?php 
                esc_html_e( 'Unlimited', 'mydrivecloud' );
                ?></label><button class="button button-primary"><?php 
                esc_html_e( 'Save', 'mydrivecloud' );
                ?></button></div>
					<small><?php 
                esc_html_e( 'This exact limit appears in the client portal and is enforced for new uploads.', 'mydrivecloud' );
                ?></small>
				</form>
				<?php 
                if ( in_array( $registration_status, array('pending', 'rejected'), true ) ) {
                    ?>
					<div class="mwa-approval-actions">
						<form method="post" action="<?php 
                    echo esc_url( admin_url( 'admin-post.php' ) );
                    ?>"><?php 
                    self::action_fields( 'approve_registration' );
                    ?><input type="hidden" name="user_id" value="<?php 
                    echo esc_attr( $user->ID );
                    ?>"><button class="button button-primary"><?php 
                    esc_html_e( 'Approve client', 'mydrivecloud' );
                    ?></button></form>
						<?php 
                    if ( 'pending' === $registration_status ) {
                        ?><form method="post" action="<?php 
                        echo esc_url( admin_url( 'admin-post.php' ) );
                        ?>" onsubmit="return confirm('Reject this registration request?');"><?php 
                        self::action_fields( 'reject_registration' );
                        ?><input type="hidden" name="user_id" value="<?php 
                        echo esc_attr( $user->ID );
                        ?>"><button class="button button-link-delete"><?php 
                        esc_html_e( 'Reject', 'mydrivecloud' );
                        ?></button></form><?php 
                    } else {
                        ?><form method="post" action="<?php 
                        echo esc_url( admin_url( 'admin-post.php' ) );
                        ?>" onsubmit="return confirm('Permanently delete this rejected account? This action cannot be undone.');"><?php 
                        self::action_fields( 'delete_rejected_registration' );
                        ?><input type="hidden" name="user_id" value="<?php 
                        echo esc_attr( $user->ID );
                        ?>"><button class="button mwa-delete-client"><?php 
                        esc_html_e( 'Delete permanently', 'mydrivecloud' );
                        ?></button></form><?php 
                    }
                    ?>
					</div>
				<?php 
                } else {
                    ?>
					<form class="mwa-role-form" method="post" action="<?php 
                    echo esc_url( admin_url( 'admin-post.php' ) );
                    ?>"><?php 
                    self::action_fields( 'set_client_role' );
                    ?><input type="hidden" name="user_id" value="<?php 
                    echo esc_attr( $user->ID );
                    ?>"><label><?php 
                    esc_html_e( 'MyDriveCloud role', 'mydrivecloud' );
                    ?><select name="mydrivecloud_role" <?php 
                    disabled( $user->ID === get_current_user_id() );
                    ?>><?php 
                    if ( !$role_slug ) {
                        ?><option value="" selected disabled><?php 
                        esc_html_e( 'Choose a role…', 'mydrivecloud' );
                        ?></option><?php 
                    }
                    foreach ( $roles as $slug => $available_role ) {
                        ?><option value="<?php 
                        echo esc_attr( $slug );
                        ?>" <?php 
                        selected( $role_slug, $slug );
                        ?>><?php 
                        echo esc_html( $available_role['name'] );
                        ?></option><?php 
                    }
                    ?></select></label><?php 
                    if ( $user->ID === get_current_user_id() ) {
                        ?><small><?php 
                        esc_html_e( 'Your account is protected against accidental demotion.', 'mydrivecloud' );
                        ?></small><?php 
                    } else {
                        ?><button class="button button-primary"><?php 
                        esc_html_e( 'Save role', 'mydrivecloud' );
                        ?></button><?php 
                    }
                    ?></form>
					<div class="mwa-actions"><a class="button" href="<?php 
                    echo esc_url( add_query_arg( array(
                        'page'      => self::PAGE,
                        'tab'       => 'clients',
                        'view_type' => 'user',
                        'view_id'   => $user->ID,
                    ), admin_url( 'admin.php' ) ) );
                    ?>"><?php 
                    esc_html_e( 'View as', 'mydrivecloud' );
                    ?></a><?php 
                    if ( $user->ID !== get_current_user_id() && 'administrator' !== $role_slug ) {
                        ?><form method="post" action="<?php 
                        echo esc_url( admin_url( 'admin-post.php' ) );
                        ?>"><?php 
                        self::action_fields( ( 'suspended' === $registration_status ? 'reactivate_client' : 'suspend_client' ) );
                        ?><input type="hidden" name="user_id" value="<?php 
                        echo esc_attr( $user->ID );
                        ?>"><button class="button"><?php 
                        echo ( 'suspended' === $registration_status ? esc_html__( 'Reactivate', 'mydrivecloud' ) : esc_html__( 'Suspend access', 'mydrivecloud' ) );
                        ?></button></form><form method="post" action="<?php 
                        echo esc_url( admin_url( 'admin-post.php' ) );
                        ?>" onsubmit="return confirm('Permanently delete this client account? Regular files will be transferred to your account. This action cannot be undone.');"><?php 
                        self::action_fields( 'delete_client' );
                        ?><input type="hidden" name="user_id" value="<?php 
                        echo esc_attr( $user->ID );
                        ?>"><button class="button mwa-delete-client"><?php 
                        esc_html_e( 'Delete permanently', 'mydrivecloud' );
                        ?></button></form><?php 
                    }
                    ?></div>
				<?php 
                }
                ?>
			</article>
			<?php 
            }
            ?></div>

			<?php 
        } elseif ( 'roles' === $tab ) {
            self::render_roles( $roles );
            ?>

			<?php 
        } elseif ( 'groups' === $tab ) {
            ?>
			<div class="mwa-columns"><section class="mwa-panel"><h2><?php 
            esc_html_e( 'New group', 'mydrivecloud' );
            ?></h2><form method="post" action="<?php 
            echo esc_url( admin_url( 'admin-post.php' ) );
            ?>"><?php 
            self::action_fields( 'create_group' );
            ?><label><?php 
            esc_html_e( 'Name', 'mydrivecloud' );
            ?><input class="regular-text" name="name" required maxlength="190"></label><label><?php 
            esc_html_e( 'Description', 'mydrivecloud' );
            ?><textarea name="description" rows="3"></textarea></label><button class="button button-primary"><?php 
            esc_html_e( 'Create group', 'mydrivecloud' );
            ?></button></form></section><section class="mwa-panel"><h2><?php 
            esc_html_e( 'Groups', 'mydrivecloud' );
            ?></h2><?php 
            foreach ( $groups as $group ) {
                $member_ids = array_map( 'intval', $wpdb->get_col( $wpdb->prepare( 'SELECT user_id FROM %i WHERE group_id=%d', MyDriveCloud_DB::table( 'group_members' ), $group->id ) ) );
                /* translators: %d: number of users assigned to the group. */
                $member_count_label = sprintf( _n(
                    '%d member',
                    '%d members',
                    $group->member_count,
                    'mydrivecloud'
                ), $group->member_count );
                ?><details class="mwa-group"><summary><strong><?php 
                echo esc_html( $group->name );
                ?></strong><span><?php 
                echo esc_html( $member_count_label );
                ?></span></summary><p><?php 
                echo esc_html( $group->description );
                ?></p><form method="post" action="<?php 
                echo esc_url( admin_url( 'admin-post.php' ) );
                ?>"><?php 
                self::action_fields( 'save_members' );
                ?><input type="hidden" name="group_id" value="<?php 
                echo esc_attr( $group->id );
                ?>"><div class="mwa-members"><?php 
                foreach ( $users as $user ) {
                    ?><label><input type="checkbox" name="members[]" value="<?php 
                    echo esc_attr( $user->ID );
                    ?>" <?php 
                    checked( in_array( (int) $user->ID, $member_ids, true ) );
                    ?>> <?php 
                    echo esc_html( $user->display_name );
                    ?></label><?php 
                }
                ?></div><button class="button button-primary"><?php 
                esc_html_e( 'Save members', 'mydrivecloud' );
                ?></button> <a class="button" href="<?php 
                echo esc_url( add_query_arg( array(
                    'page'      => self::PAGE,
                    'tab'       => 'clients',
                    'view_type' => 'group',
                    'view_id'   => $group->id,
                ), admin_url( 'admin.php' ) ) );
                ?>"><?php 
                esc_html_e( 'View as group', 'mydrivecloud' );
                ?></a></form><form class="mwa-delete-form" method="post" action="<?php 
                echo esc_url( admin_url( 'admin-post.php' ) );
                ?>" onsubmit="return confirm('Delete the group and its permissions?');"><?php 
                self::action_fields( 'delete_group' );
                ?><input type="hidden" name="group_id" value="<?php 
                echo esc_attr( $group->id );
                ?>"><button class="button button-link-delete"><?php 
                esc_html_e( 'Delete group', 'mydrivecloud' );
                ?></button></form></details><?php 
            }
            if ( !$groups ) {
                ?><p><?php 
                esc_html_e( 'There are no groups yet.', 'mydrivecloud' );
                ?></p><?php 
            }
            ?></section></div>

			<?php 
        } else {
            self::render_permissions( $users, $groups );
        }
        ?>
		</div>
		
		
		
		<?php 
    }

    private static function render_view_as( $type, $id ) {
        global $wpdb;
        if ( 'group' === $type ) {
            $subject = $wpdb->get_row( $wpdb->prepare( 'SELECT * FROM %i WHERE id=%d', MyDriveCloud_DB::table( 'groups' ), $id ) );
            $name = ( $subject ? $subject->name : __( 'Unknown group', 'mydrivecloud' ) );
            $vault = false;
        } else {
            $subject = get_userdata( $id );
            $name = ( $subject ? $subject->display_name : __( 'Unknown user', 'mydrivecloud' ) );
            $vault = false;
        }
        $items = ( $subject ? self::view_as_items( $type, $id ) : array() );
        ?><section class="mwa-view"><h2><?php 
        /* translators: %s: selected user or group name. */
        echo esc_html( sprintf( __( 'View as: %s', 'mydrivecloud' ), $name ) );
        ?> <span class="mwa-badge"><?php 
        esc_html_e( 'Read-only', 'mydrivecloud' );
        ?></span></h2><p><?php 
        esc_html_e( 'This is an access simulation. It does not change the administrator’s identity or allow actions on files.', 'mydrivecloud' );
        ?></p><?php 
        ?><table class="widefat striped"><thead><tr><th><?php 
        esc_html_e( 'Element', 'mydrivecloud' );
        ?></th><th><?php 
        esc_html_e( 'Type', 'mydrivecloud' );
        ?></th><th><?php 
        esc_html_e( 'Owner', 'mydrivecloud' );
        ?></th><th><?php 
        esc_html_e( 'Preview', 'mydrivecloud' );
        ?></th><th><?php 
        esc_html_e( 'Download', 'mydrivecloud' );
        ?></th></tr></thead><tbody><?php 
        foreach ( $items as $item ) {
            $owner = get_userdata( $item->owner_id );
            ?><tr><td><?php 
            echo esc_html( self::item_path( $item ) );
            ?></td><td><?php 
            echo esc_html( ( 'folder' === $item->type ? __( 'Folder', 'mydrivecloud' ) : __( 'File', 'mydrivecloud' ) ) );
            ?></td><td><?php 
            echo esc_html( ( $owner ? $owner->display_name : '—' ) );
            ?></td><td><?php 
            echo ( MyDriveCloud_Permissions::can_preview( $item, ( 'user' === $type ? $id : null ), ( 'group' === $type ? $id : null ) ) ? '✓' : '—' );
            ?></td><td><?php 
            echo ( MyDriveCloud_Permissions::can_download( $item, ( 'user' === $type ? $id : null ), ( 'group' === $type ? $id : null ) ) ? '✓' : '—' );
            ?></td></tr><?php 
        }
        if ( !$items ) {
            ?><tr><td colspan="5"><?php 
            esc_html_e( 'There are no visible files for this selection.', 'mydrivecloud' );
            ?></td></tr><?php 
        }
        ?></tbody></table></section><?php 
    }

    private static function render_roles( $roles ) {
        $labels = MyDriveCloud_Roles::permission_labels();
        $user_ids = get_users( array(
            'fields' => 'ids',
        ) );
        ?>
		<div class="mwa-columns mwa-roles-layout">
			<section class="mwa-panel">
				<h2><?php 
        esc_html_e( 'Create a new role', 'mydrivecloud' );
        ?></h2>
				<p><?php 
        esc_html_e( 'Choose exactly what a user assigned this role can do.', 'mydrivecloud' );
        ?></p>
				<form method="post" action="<?php 
        echo esc_url( admin_url( 'admin-post.php' ) );
        ?>">
					<?php 
        self::action_fields( 'create_role' );
        ?>
					<label><?php 
        esc_html_e( 'Role name', 'mydrivecloud' );
        ?><input class="regular-text" name="name" required maxlength="80" placeholder="Example: Accountant, Contributor, Manager"></label>
					<label><?php 
        esc_html_e( 'Description', 'mydrivecloud' );
        ?><textarea name="description" rows="3" maxlength="300"></textarea></label>
					<fieldset class="mwa-role-permissions"><legend><?php 
        esc_html_e( 'Permissions', 'mydrivecloud' );
        ?></legend><?php 
        foreach ( $labels as $key => $label ) {
            ?><label><input type="checkbox" name="permissions[<?php 
            echo esc_attr( $key );
            ?>]" value="1"> <?php 
            echo esc_html( $label );
            ?></label><?php 
        }
        ?></fieldset>
					<button class="button button-primary"><?php 
        esc_html_e( 'Create role', 'mydrivecloud' );
        ?></button>
				</form>
			</section>
			<section class="mwa-panel"><h2><?php 
        esc_html_e( 'Available roles', 'mydrivecloud' );
        ?></h2><div class="mwa-role-list">
				<?php 
        foreach ( $roles as $slug => $role ) {
            $count = 0;
            foreach ( $user_ids as $user_id ) {
                if ( MyDriveCloud_Roles::current_role_slug( $user_id ) === $slug ) {
                    $count++;
                }
            }
            ?>
				<?php 
            /* translators: %d: number of users assigned to the role. */
            $assigned_label = sprintf( _n(
                '%d assigned user',
                '%d assigned users',
                $count,
                'mydrivecloud'
            ), $count );
            ?>
				<article class="mwa-role-card"><div class="mwa-role-title"><div><h3><?php 
            echo esc_html( $role['name'] );
            ?></h3><p><?php 
            echo esc_html( $role['description'] );
            ?></p></div><?php 
            if ( !empty( $role['built_in'] ) ) {
                ?><span class="mwa-badge admin"><?php 
                esc_html_e( 'Protected', 'mydrivecloud' );
                ?></span><?php 
            }
            ?></div><ul><?php 
            foreach ( $labels as $key => $label ) {
                if ( !empty( $role['permissions'][$key] ) ) {
                    ?><li>✓ <?php 
                    echo esc_html( $label );
                    ?></li><?php 
                }
            }
            ?></ul><small><?php 
            echo esc_html( $assigned_label );
            ?></small><?php 
            if ( empty( $role['built_in'] ) ) {
                ?><form method="post" action="<?php 
                echo esc_url( admin_url( 'admin-post.php' ) );
                ?>" onsubmit="return confirm('Delete this role? Its users will be assigned the Client role.');"><?php 
                self::action_fields( 'delete_role' );
                ?><input type="hidden" name="mydrivecloud_role" value="<?php 
                echo esc_attr( $slug );
                ?>"><button class="button button-link-delete"><?php 
                esc_html_e( 'Delete role', 'mydrivecloud' );
                ?></button></form><?php 
            }
            ?></article>
				<?php 
        }
        ?>
			</div></section>
		</div>
		<?php 
    }

    private static function render_permissions( $users, $groups ) {
        global $wpdb;
        $items = $wpdb->get_results( $wpdb->prepare( 'SELECT i.*,u.display_name AS owner_name FROM %i i LEFT JOIN %i u ON u.ID=i.owner_id WHERE i.trashed_at IS NULL ORDER BY i.type DESC,i.name ASC LIMIT 1000', MyDriveCloud_DB::table( 'items' ), $wpdb->users ) );
        $grants = $wpdb->get_results( $wpdb->prepare(
            'SELECT a.*,i.name AS item_name,u.display_name AS user_name,g.name AS group_name FROM %i a LEFT JOIN %i i ON i.id=a.item_id LEFT JOIN %i u ON a.subject_type="user" AND u.ID=a.subject_id LEFT JOIN %i g ON a.subject_type="group" AND g.id=a.subject_id ORDER BY a.created_at DESC',
            MyDriveCloud_DB::table( 'access' ),
            MyDriveCloud_DB::table( 'items' ),
            $wpdb->users,
            MyDriveCloud_DB::table( 'groups' )
        ) );
        ?><div class="mwa-columns"><section class="mwa-panel"><h2><?php 
        esc_html_e( 'Assign files or folders', 'mydrivecloud' );
        ?></h2><p><?php 
        esc_html_e( 'An assigned folder provides inherited access to its contents. Unassigned items remain private to the owner and administrator.', 'mydrivecloud' );
        ?></p><form class="mwa-permission-form" method="post" action="<?php 
        echo esc_url( admin_url( 'admin-post.php' ) );
        ?>"><?php 
        self::action_fields( 'grant' );
        ?><label class="wide"><?php 
        esc_html_e( 'File or folder', 'mydrivecloud' );
        ?><select name="item_id" required><option value=""><?php 
        esc_html_e( 'Choose…', 'mydrivecloud' );
        ?></option><?php 
        foreach ( $items as $item ) {
            ?><option value="<?php 
            echo esc_attr( $item->id );
            ?>"><?php 
            echo esc_html( (( 'folder' === $item->type ? '📁 ' : '📄 ' )) . self::item_path( $item ) . ' — ' . $item->owner_name );
            ?></option><?php 
        }
        ?></select></label><label><?php 
        esc_html_e( 'Assign to', 'mydrivecloud' );
        ?><select name="subject_type"><option value="user"><?php 
        esc_html_e( 'User', 'mydrivecloud' );
        ?></option><option value="group"><?php 
        esc_html_e( 'Group', 'mydrivecloud' );
        ?></option></select></label><label><?php 
        esc_html_e( 'Recipient', 'mydrivecloud' );
        ?><select name="subject_id" data-subject-options="user" required><?php 
        foreach ( $users as $user ) {
            ?><option value="<?php 
            echo esc_attr( $user->ID );
            ?>"><?php 
            echo esc_html( $user->display_name );
            ?></option><?php 
        }
        ?></select><select name="subject_id" data-subject-options="group" disabled hidden required><?php 
        foreach ( $groups as $group ) {
            ?><option value="<?php 
            echo esc_attr( $group->id );
            ?>"><?php 
            echo esc_html( $group->name );
            ?></option><?php 
        }
        ?></select></label><div class="wide mwa-checks"><label><input type="checkbox" name="can_preview" value="1" checked> <?php 
        esc_html_e( 'Allow preview', 'mydrivecloud' );
        ?></label><label><input type="checkbox" name="can_download" value="1" checked> <?php 
        esc_html_e( 'Allow download', 'mydrivecloud' );
        ?></label></div><label class="wide"><?php 
        esc_html_e( 'Expires (optional)', 'mydrivecloud' );
        ?><input type="datetime-local" name="expires_at"></label><button class="button button-primary wide"><?php 
        esc_html_e( 'Save access', 'mydrivecloud' );
        ?></button></form></section><section class="mwa-panel"><h2><?php 
        esc_html_e( 'Active permissions', 'mydrivecloud' );
        ?></h2><table class="widefat striped"><thead><tr><th><?php 
        esc_html_e( 'Element', 'mydrivecloud' );
        ?></th><th><?php 
        esc_html_e( 'Recipient', 'mydrivecloud' );
        ?></th><th><?php 
        esc_html_e( 'Permissions', 'mydrivecloud' );
        ?></th><th></th></tr></thead><tbody><?php 
        foreach ( $grants as $grant ) {
            ?><tr><td><?php 
            echo esc_html( ( $grant->item_name ?: '—' ) );
            ?></td><td><?php 
            echo esc_html( ( 'group' === $grant->subject_type ? '👥 ' . $grant->group_name : '👤 ' . $grant->user_name ) );
            ?></td><td><?php 
            echo ( $grant->can_preview ? 'Preview ' : '' );
            echo ( $grant->can_download ? 'Download' : '' );
            echo ( $grant->expires_at ? '<br><small>' . esc_html( $grant->expires_at ) . '</small>' : '' );
            ?></td><td><form method="post" action="<?php 
            echo esc_url( admin_url( 'admin-post.php' ) );
            ?>" onsubmit="return confirm('Remove this permission?');"><?php 
            self::action_fields( 'revoke' );
            ?><input type="hidden" name="grant_id" value="<?php 
            echo esc_attr( $grant->id );
            ?>"><button class="button button-link-delete"><?php 
            esc_html_e( 'Revoke', 'mydrivecloud' );
            ?></button></form></td></tr><?php 
        }
        if ( !$grants ) {
            ?><tr><td colspan="4"><?php 
            esc_html_e( 'No permissions have been assigned.', 'mydrivecloud' );
            ?></td></tr><?php 
        }
        ?></tbody></table></section></div><?php 
    }

}