<?php
/**
 * Bulk editor for SEO titles, descriptions and noindex.
 *
 * @package OrbitstemSEO
 */

namespace Orbitstem\SEO\Admin;

use Orbitstem\SEO\Content\MetaRepository;
use Orbitstem\SEO\Content\SeoCsv;
use Orbitstem\SEO\Plugin;
use WP_Query;

defined( 'ABSPATH' ) || exit;

/**
 * A plain form, no JavaScript: one row per published item, saved through
 * admin-post.php. Only rows whose values changed are written, and each row
 * is checked against edit_post for the current user.
 */
class BulkEditor {

	const SLUG          = 'orbitstem-seo-bulk';
	const ACTION        = 'orbitstem_seo_bulk_save';
	const EXPORT_ACTION = 'orbitstem_seo_csv_export';
	const CSV_ACTION    = 'orbitstem_seo_csv';
	const PER_PAGE      = 20;
	const PREVIEW_ROWS  = 200;

	/**
	 * Plugin services.
	 *
	 * @var Plugin
	 */
	private $plugin;

	/**
	 * Constructor.
	 *
	 * @param Plugin $plugin Plugin services.
	 */
	public function __construct( Plugin $plugin ) {
		$this->plugin = $plugin;
	}

	/**
	 * Registers hooks.
	 */
	public function register() {
		add_action( 'admin_menu', array( $this, 'menu' ), 20 );
		add_action( 'admin_post_' . self::ACTION, array( $this, 'save' ) );
		add_action( 'admin_post_' . self::EXPORT_ACTION, array( $this, 'export' ) );
		add_action( 'admin_post_' . self::CSV_ACTION, array( $this, 'handle_csv' ) );
	}

	/**
	 * Transient holding the current user's import preview.
	 *
	 * @return string
	 */
	private static function plan_key() {
		return 'orbitstem_seo_csv_plan_' . get_current_user_id();
	}

	/**
	 * Transient holding the current user's last import, for "Undo this import".
	 *
	 * @return string
	 */
	private static function last_key() {
		return 'orbitstem_seo_csv_last_' . get_current_user_id();
	}

	/**
	 * Streams a CSV file of the filtered items (all pages).
	 */
	public function export() {
		if ( ! current_user_can( Admin::capability() ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'orbitstem-seo' ), 403 );
		}
		check_admin_referer( self::EXPORT_ACTION );
		$filters = $this->filters();
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce checked above.
		$scope = isset( $_GET['scope'] ) && 'all' === $_GET['scope'] ? 'all' : $filters['post_type'];
		$ids   = $this->plugin->csv->export_ids( $scope, $filters['missing'], $filters['s'] );

		nocache_headers();
		header( 'Content-Type: text/csv; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename="orbitstem-seo-' . sanitize_file_name( $scope ) . '-' . gmdate( 'Y-m-d' ) . '.csv"' );
		header( 'X-Content-Type-Options: nosniff' );
		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- the response body.
		$out = fopen( 'php://output', 'w' );
		$this->plugin->csv->write( $out, $ids );
		fclose( $out ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- the response body.
		exit;
	}

	/**
	 * Import steps: preview (upload), apply, cancel, undo.
	 */
	public function handle_csv() {
		if ( ! current_user_can( Admin::capability() ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'orbitstem-seo' ), 403 );
		}
		// A body larger than post_max_size arrives empty, nonce included: say why instead of "link expired".
		if ( empty( $_POST ) && ! empty( $_SERVER['CONTENT_LENGTH'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nothing is changed; only a message is shown.
			RedirectsPage::notice( 'error', self::too_big_message() );
			wp_safe_redirect( admin_url( 'admin.php?page=' . self::SLUG ) );
			exit;
		}
		check_admin_referer( self::CSV_ACTION );
		$task = isset( $_POST['task'] ) ? sanitize_key( wp_unslash( $_POST['task'] ) ) : '';
		$args = array( 'page' => self::SLUG );

		if ( 'preview' === $task ) {
			$text = $this->uploaded_text();
			$plan = is_wp_error( $text ) ? $text : $this->plugin->csv->parse( $text );
			if ( is_wp_error( $plan ) ) {
				RedirectsPage::notice( 'error', $plan->get_error_message() );
			} else {
				$plan = $this->plugin->csv->plan( $plan );
				$name = isset( $_FILES['csv_file']['name'] ) ? sanitize_file_name( wp_unslash( $_FILES['csv_file']['name'] ) ) : '';
				set_transient( self::plan_key(), $plan + array( 'file' => $name ), HOUR_IN_SECONDS );
				$args['csv'] = 'preview';
			}
		} elseif ( 'apply' === $task ) {
			$plan = get_transient( self::plan_key() );
			delete_transient( self::plan_key() );
			if ( ! is_array( $plan ) ) {
				RedirectsPage::notice( 'error', __( 'The preview expired. Upload the file again.', 'orbitstem-seo' ) );
			} else {
				$result = $this->plugin->csv->import( $plan['changes'] );
				set_transient( self::last_key(), $result + array( 'time' => time() ), DAY_IN_SECONDS );
				$args['csv'] = 'done';
			}
		} elseif ( 'cancel' === $task ) {
			delete_transient( self::plan_key() );
		} elseif ( 'undo' === $task ) {
			$last = get_transient( self::last_key() );
			if ( is_array( $last ) && ! empty( $last['change_ids'] ) ) {
				$undone  = 0;
				$refused = 0;
				foreach ( array_reverse( $last['change_ids'] ) as $change_id ) {
					if ( true === $this->plugin->repair->rollback( $change_id ) ) {
						++$undone;
					} else {
						++$refused;
					}
				}
				delete_transient( self::last_key() );
				RedirectsPage::notice(
					$refused ? 'error' : 'success',
					/* translators: 1: posts restored, 2: posts left as they are */
					sprintf( __( 'Import undone. Restored: %1$d. Left as they are because they were changed again after the import: %2$d (see Repair > History).', 'orbitstem-seo' ), $undone, $refused )
				);
			}
		}
		wp_safe_redirect( add_query_arg( $args, admin_url( 'admin.php' ) ) );
		exit;
	}

	/**
	 * Message for a file over the server's upload limit.
	 *
	 * @return string
	 */
	private static function too_big_message() {
		/* translators: %s: maximum upload size, e.g. "8 MB" */
		return sprintf( __( 'The file is larger than this server accepts (%s). Split it into smaller files.', 'orbitstem-seo' ), size_format( wp_max_upload_size() ) );
	}

	/**
	 * Contents of the uploaded CSV file.
	 *
	 * @return string|\WP_Error
	 */
	private function uploaded_text() {
		// phpcs:disable WordPress.Security.NonceVerification.Missing -- called from handle_csv() after check_admin_referer().
		// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- a temporary file path from PHP, checked with is_uploaded_file().
		$file = isset( $_FILES['csv_file'] ) && is_array( $_FILES['csv_file'] ) ? $_FILES['csv_file'] : null;
		$tmp  = $file && isset( $file['tmp_name'] ) ? (string) $file['tmp_name'] : '';
		$name = $file && isset( $file['name'] ) ? sanitize_file_name( wp_unslash( (string) $file['name'] ) ) : '';
		// phpcs:enable
		if ( $file && isset( $file['error'] ) && in_array( (int) $file['error'], array( UPLOAD_ERR_INI_SIZE, UPLOAD_ERR_FORM_SIZE ), true ) ) {
			return new \WP_Error( 'size', self::too_big_message() );
		}
		if ( ! $file || ! empty( $file['error'] ) || '' === $tmp || ! is_uploaded_file( $tmp ) ) {
			return new \WP_Error( 'upload', __( 'Choose a CSV file to upload.', 'orbitstem-seo' ) );
		}
		if ( ! preg_match( '/\.(csv|txt)$/i', $name ) ) {
			return new \WP_Error( 'type', __( 'Upload a .csv file.', 'orbitstem-seo' ) );
		}
		if ( filesize( $tmp ) > \Orbitstem\SEO\Content\SeoCsv::MAX_BYTES ) {
			return new \WP_Error( 'size', __( 'The file is larger than 4 MB. Split it into smaller files.', 'orbitstem-seo' ) );
		}
		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- local uploaded file.
		$text = file_get_contents( $tmp );
		return false === $text ? new \WP_Error( 'read', __( 'The file could not be read.', 'orbitstem-seo' ) ) : $text;
	}

	/**
	 * Adds the submenu page.
	 */
	public function menu() {
		add_submenu_page( Admin::SLUG, __( 'Bulk Editor', 'orbitstem-seo' ), __( 'Bulk Editor', 'orbitstem-seo' ), Admin::capability(), self::SLUG, array( $this, 'render' ) );
	}

	/**
	 * Current filters from the query string.
	 *
	 * @return array{post_type:string,missing:string,s:string,paged:int}
	 */
	private function filters() {
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- read-only list filters.
		$types = array_keys( $this->plugin->types->post_types() );
		// Not "post_type": admin.php treats that argument specially and fails with "Cannot load".
		$post_type = isset( $_GET['os_type'] ) ? sanitize_key( wp_unslash( $_GET['os_type'] ) ) : 'post';
		$missing   = isset( $_GET['missing'] ) ? sanitize_key( wp_unslash( $_GET['missing'] ) ) : '';
		$search    = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';
		$paged     = isset( $_GET['paged'] ) ? max( 1, absint( $_GET['paged'] ) ) : 1;
		// phpcs:enable

		return array(
			'post_type' => in_array( $post_type, $types, true ) ? $post_type : ( $types ? $types[0] : 'post' ),
			'missing'   => in_array( $missing, array( 'title', 'description' ), true ) ? $missing : '',
			's'         => $search,
			'paged'     => $paged,
		);
	}

	/**
	 * Query for the current page of items.
	 *
	 * @param array $filters Filters.
	 * @return WP_Query
	 */
	public function query( array $filters ) {
		$args = array(
			'post_type'              => $filters['post_type'],
			'post_status'            => 'publish',
			'posts_per_page'         => self::PER_PAGE,
			'paged'                  => $filters['paged'],
			'orderby'                => 'date',
			'order'                  => 'DESC',
			'update_post_term_cache' => false,
		);
		if ( '' !== $filters['s'] ) {
			$args['s'] = $filters['s'];
		}
		if ( '' !== $filters['missing'] ) {
			$args['meta_query'] = array( MetaRepository::missing_clause( $filters['missing'] ) ); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
		}
		return new WP_Query( $args );
	}

	/**
	 * Renders the page.
	 */
	public function render() {
		if ( ! current_user_can( Admin::capability() ) ) {
			wp_die( esc_html__( 'You do not have permission to view this page.', 'orbitstem-seo' ) );
		}
		$filters = $this->filters();
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- display of counts after redirect.
		$saved     = isset( $_GET['orbitstem_seo_saved'] ) ? absint( $_GET['orbitstem_seo_saved'] ) : null;
		$conflicts = isset( $_GET['orbitstem_seo_conflicts'] ) ? absint( $_GET['orbitstem_seo_conflicts'] ) : 0;
		$csv_view  = isset( $_GET['csv'] ) ? sanitize_key( wp_unslash( $_GET['csv'] ) ) : '';
		// phpcs:enable
		$plan = 'preview' === $csv_view ? get_transient( self::plan_key() ) : false;
		if ( is_array( $plan ) ) {
			$this->render_csv_preview( $plan );
			return;
		}
		$query = $this->query( $filters );
		$meta  = $this->plugin->meta;
		Ui::open( self::SLUG, __( 'Bulk Editor', 'orbitstem-seo' ), __( 'Edit SEO titles, descriptions and noindex for many items at once, or by spreadsheet.', 'orbitstem-seo' ) );
		?>
			<?php
			RedirectsPage::print_notice();
			if ( 'done' === $csv_view ) {
				$this->render_csv_result();
			}
			?>
			<?php if ( null !== $saved ) : ?>
				<div class="notice notice-success is-dismissible"><p>
					<?php
					/* translators: %d: number of items */
					echo esc_html( sprintf( _n( '%d item updated.', '%d items updated.', $saved, 'orbitstem-seo' ), $saved ) );
					?>
				</p></div>
			<?php endif; ?>
			<?php if ( $conflicts ) : ?>
				<div class="notice notice-warning"><p>
					<?php
					/* translators: %d: number of items */
					echo esc_html( sprintf( _n( '%d item was not saved because someone else changed it after you opened this page. Review it and save again.', '%d items were not saved because someone else changed them after you opened this page. Review them and save again.', $conflicts, 'orbitstem-seo' ), $conflicts ) );
					?>
				</p></div>
			<?php endif; ?>

			<form method="get" class="os-toolbar">
				<input type="hidden" name="page" value="<?php echo esc_attr( self::SLUG ); ?>" />
				<label for="orbitstem-seo-type" class="screen-reader-text"><?php esc_html_e( 'Content type', 'orbitstem-seo' ); ?></label>
				<select id="orbitstem-seo-type" name="os_type">
					<?php foreach ( $this->plugin->types->post_types() as $name => $object ) : ?>
						<option value="<?php echo esc_attr( $name ); ?>" <?php selected( $filters['post_type'], $name ); ?>><?php echo esc_html( $object->labels->name ); ?></option>
					<?php endforeach; ?>
				</select>
				<label for="orbitstem-seo-missing" class="screen-reader-text"><?php esc_html_e( 'Show', 'orbitstem-seo' ); ?></label>
				<select id="orbitstem-seo-missing" name="missing">
					<option value=""><?php esc_html_e( 'All items', 'orbitstem-seo' ); ?></option>
					<option value="title" <?php selected( $filters['missing'], 'title' ); ?>><?php esc_html_e( 'Without a custom title', 'orbitstem-seo' ); ?></option>
					<option value="description" <?php selected( $filters['missing'], 'description' ); ?>><?php esc_html_e( 'Without a custom description', 'orbitstem-seo' ); ?></option>
				</select>
				<label for="orbitstem-seo-search" class="screen-reader-text"><?php esc_html_e( 'Search', 'orbitstem-seo' ); ?></label>
				<input type="search" id="orbitstem-seo-search" name="s" value="<?php echo esc_attr( $filters['s'] ); ?>" />
				<?php submit_button( __( 'Filter', 'orbitstem-seo' ), 'secondary', '', false ); ?>
			</form>

			<?php $this->render_csv_box( $filters ); ?>

			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" data-os-dirty>
				<input type="hidden" name="action" value="<?php echo esc_attr( self::ACTION ); ?>" />
				<input type="hidden" name="redirect" value="
				<?php
				echo esc_attr(
					add_query_arg(
						array_filter(
							array(
								'page'    => self::SLUG,
								'os_type' => $filters['post_type'],
								'missing' => $filters['missing'],
								's'       => $filters['s'],
								'paged'   => $filters['paged'],
							)
						),
						admin_url( 'admin.php' )
					)
				);
				?>
															" />
				<?php wp_nonce_field( self::ACTION ); ?>
				<p class="description"><?php esc_html_e( 'Empty fields use the template from Settings, shown in grey. Only changed rows are saved.', 'orbitstem-seo' ); ?></p>
				<div class="os-table-wrap">
				<table class="widefat os-bulk">
					<thead>
						<tr>
							<th scope="col" style="width:22%"><?php esc_html_e( 'Item', 'orbitstem-seo' ); ?></th>
							<th scope="col"><?php esc_html_e( 'SEO title', 'orbitstem-seo' ); ?></th>
							<th scope="col"><?php esc_html_e( 'Meta description', 'orbitstem-seo' ); ?></th>
							<th scope="col" style="width:7%"><?php esc_html_e( 'noindex', 'orbitstem-seo' ); ?></th>
						</tr>
					</thead>
					<tbody>
					<?php if ( ! $query->have_posts() ) : ?>
						<tr><td colspan="4"><?php esc_html_e( 'No items match.', 'orbitstem-seo' ); ?></td></tr>
					<?php endif; ?>
					<?php
					foreach ( $query->posts as $post ) :
						$resolved = $this->plugin->resolver->for_post( $post );
						$id       = (int) $post->ID;
						$title    = $meta->get_post( $id, 'title' );
						$desc     = $meta->get_post( $id, 'description' );
						$noindex  = $meta->get_post( $id, 'noindex' );
						$name     = 'items[' . $id . ']';
						?>
						<tr>
							<td>
								<strong><a href="<?php echo esc_url( get_edit_post_link( $id ) ); ?>"><?php echo esc_html( get_the_title( $post ) ); ?></a></strong><br />
								<a href="<?php echo esc_url( get_permalink( $post ) ); ?>" class="description"><?php esc_html_e( 'View', 'orbitstem-seo' ); ?></a>
								<input type="hidden" name="<?php echo esc_attr( $name ); ?>[orig]" value="<?php echo esc_attr( md5( $title . "\0" . $desc . "\0" . ( $noindex ? '1' : '' ) ) ); ?>" />
							</td>
							<td>
								<label class="screen-reader-text" for="os-t-<?php echo esc_attr( $id ); ?>"><?php esc_html_e( 'SEO title', 'orbitstem-seo' ); ?></label>
								<input type="text" class="widefat" id="os-t-<?php echo esc_attr( $id ); ?>" name="<?php echo esc_attr( $name ); ?>[title]" value="<?php echo esc_textarea( $title ); /* Encodes every "&" (esc_attr() keeps "&amp;" as is), so the browser sends back exactly the stored text. */ ?>" placeholder="<?php echo esc_attr( $resolved ? $resolved['title'] : '' ); ?>" />
							</td>
							<td>
								<label class="screen-reader-text" for="os-d-<?php echo esc_attr( $id ); ?>"><?php esc_html_e( 'Meta description', 'orbitstem-seo' ); ?></label>
								<textarea class="widefat" rows="1" id="os-d-<?php echo esc_attr( $id ); ?>" name="<?php echo esc_attr( $name ); ?>[description]" placeholder="<?php echo esc_attr( $resolved ? $resolved['description'] : '' ); ?>"><?php echo esc_textarea( $desc ); ?></textarea>
							</td>
							<td>
								<input type="hidden" name="<?php echo esc_attr( $name ); ?>[noindex]" value="0" />
								<label><input type="checkbox" name="<?php echo esc_attr( $name ); ?>[noindex]" value="1" <?php checked( $noindex ); ?> /><span class="screen-reader-text"><?php esc_html_e( 'noindex', 'orbitstem-seo' ); ?></span></label>
							</td>
						</tr>
					<?php endforeach; ?>
					</tbody>
				</table>
				<?php
				echo '</div>';
				?>
				<div class="os-save-bar">
					<span class="os-dirty-note" aria-live="polite"><?php esc_html_e( 'You have unsaved changes', 'orbitstem-seo' ); ?></span>
					<?php submit_button( __( 'Save changes', 'orbitstem-seo' ), 'primary', 'submit', false ); ?>
				</div>
				<?php
				// paginate_links() copies the current URL's arguments into every link; drop the one-time notices.
				$one_time = function ( $link ) {
					return remove_query_arg( array( 'orbitstem_seo_saved', 'orbitstem_seo_conflicts', 'csv' ), $link );
				};
				add_filter( 'paginate_links', $one_time );
				echo wp_kses_post(
					paginate_links(
						array(
							'base'    => add_query_arg( 'paged', '%#%', remove_query_arg( array( 'orbitstem_seo_saved', 'orbitstem_seo_conflicts', 'csv' ) ) ),
							'format'  => '',
							'current' => $filters['paged'],
							'total'   => max( 1, (int) $query->max_num_pages ),
						)
					) ?? ''
				);
				remove_filter( 'paginate_links', $one_time );
				?>
			</form>
		<?php
		Ui::close();
	}

	/**
	 * Export and import controls.
	 *
	 * @param array $filters Current filters.
	 */
	private function render_csv_box( array $filters ) {
		$type_object = get_post_type_object( $filters['post_type'] );
		?>
		<details class="card" style="max-width:none;margin:12px 0">
			<summary style="cursor:pointer"><strong><?php esc_html_e( 'Export or import a spreadsheet (CSV)', 'orbitstem-seo' ); ?></strong></summary>
			<p><?php esc_html_e( 'Export, edit the SEO columns in Excel, Google Sheets or LibreOffice, and import the file again. Nothing changes until you have reviewed a preview, and every imported change can be undone.', 'orbitstem-seo' ); ?></p>
			<form method="get" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="margin-bottom:12px">
				<input type="hidden" name="action" value="<?php echo esc_attr( self::EXPORT_ACTION ); ?>" />
				<input type="hidden" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( self::EXPORT_ACTION ) ); ?>" />
				<input type="hidden" name="os_type" value="<?php echo esc_attr( $filters['post_type'] ); ?>" />
				<input type="hidden" name="missing" value="<?php echo esc_attr( $filters['missing'] ); ?>" />
				<input type="hidden" name="s" value="<?php echo esc_attr( $filters['s'] ); ?>" />
				<label for="os-csv-scope"><?php esc_html_e( 'Export', 'orbitstem-seo' ); ?></label>
				<select id="os-csv-scope" name="scope">
					<option value="type">
						<?php
						/* translators: %s: content type name */
						echo esc_html( sprintf( __( '%s matching the filter above', 'orbitstem-seo' ), $type_object ? $type_object->labels->name : $filters['post_type'] ) );
						?>
					</option>
					<option value="all"><?php esc_html_e( 'All content types matching the filter above', 'orbitstem-seo' ); ?></option>
				</select>
				<?php submit_button( __( 'Download CSV', 'orbitstem-seo' ), 'secondary', '', false ); ?>
			</form>
			<form method="post" enctype="multipart/form-data" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
				<input type="hidden" name="action" value="<?php echo esc_attr( self::CSV_ACTION ); ?>" />
				<input type="hidden" name="task" value="preview" />
				<?php wp_nonce_field( self::CSV_ACTION ); ?>
				<label for="os-csv-file"><?php esc_html_e( 'Import', 'orbitstem-seo' ); ?></label>
				<input type="file" id="os-csv-file" name="csv_file" accept=".csv,text/csv" required />
				<?php submit_button( __( 'Upload and preview', 'orbitstem-seo' ), 'secondary', '', false ); ?>
			</form>
			<p class="description">
				<?php
				echo wp_kses(
					sprintf(
						/* translators: 1: list of columns, 2: maximum rows */
						esc_html__( 'Columns: id (required) and any of %1$s. A column you leave out is not changed; an empty cell removes the custom value so the template is used (an empty slug keeps the address). noindex and nofollow take yes or no. A new slug on a published item redirects the old address automatically. Up to %2$d rows per file, separated by commas or semicolons.', 'orbitstem-seo' ),
						'<code>' . implode( '</code>, <code>', array_keys( SeoCsv::COLUMNS ) ) . '</code>',
						(int) SeoCsv::MAX_ROWS
					),
					array( 'code' => array() )
				);
				?>
			</p>
		</details>
		<?php
	}

	/**
	 * Preview of an uploaded file: changes, rows that cannot be imported, apply or cancel.
	 *
	 * @param array $plan Plan from SeoCsv::plan().
	 */
	private function render_csv_preview( array $plan ) {
		$labels = array(
			'slug'          => __( 'Address (slug)', 'orbitstem-seo' ),
			'focus_keyword' => __( 'Focus keyword', 'orbitstem-seo' ),
			'title'         => __( 'SEO title', 'orbitstem-seo' ),
			'description'   => __( 'Meta description', 'orbitstem-seo' ),
			'canonical'     => __( 'Canonical URL', 'orbitstem-seo' ),
			'noindex'       => __( 'noindex', 'orbitstem-seo' ),
			'nofollow'      => __( 'nofollow', 'orbitstem-seo' ),
			'schema'        => __( 'Schema type', 'orbitstem-seo' ),
		);
		$show   = function ( $value ) {
			if ( is_bool( $value ) ) {
				return $value ? __( 'yes', 'orbitstem-seo' ) : __( 'no', 'orbitstem-seo' );
			}
			return '' === $value ? '' : $value;
		};
		$count  = count( $plan['changes'] );
		Ui::open( self::SLUG, __( 'Import preview', 'orbitstem-seo' ), __( 'Nothing is saved until you confirm.', 'orbitstem-seo' ) );
		?>
			<p>
				<?php
				/* translators: 1: file name, 2: items that will change, 3: items already matching, 4: rows that cannot be imported */
				echo esc_html( sprintf( __( '%1$s. Will change: %2$d. Already match: %3$d. Cannot be imported: %4$d.', 'orbitstem-seo' ), '' !== $plan['file'] ? $plan['file'] : __( 'File', 'orbitstem-seo' ), $count, $plan['unchanged'], count( $plan['errors'] ) ) );
				?>
			</p>
			<?php if ( $plan['errors'] ) : ?>
				<h2><?php esc_html_e( 'Rows that cannot be imported', 'orbitstem-seo' ); ?></h2>
				<table class="widefat striped" style="margin-bottom:16px">
					<thead><tr>
						<th scope="col" style="width:8%"><?php esc_html_e( 'Line', 'orbitstem-seo' ); ?></th>
						<th scope="col" style="width:10%"><?php esc_html_e( 'ID', 'orbitstem-seo' ); ?></th>
						<th scope="col"><?php esc_html_e( 'Reason', 'orbitstem-seo' ); ?></th>
					</tr></thead>
					<tbody>
					<?php foreach ( array_slice( $plan['errors'], 0, self::PREVIEW_ROWS ) as $error ) : ?>
						<tr><td><?php echo esc_html( (string) $error['line'] ); ?></td><td><?php echo esc_html( $error['id'] ); ?></td><td><?php echo esc_html( $error['message'] ); ?></td></tr>
					<?php endforeach; ?>
					</tbody>
				</table>
			<?php endif; ?>
			<?php if ( $count ) : ?>
				<h2><?php esc_html_e( 'Changes', 'orbitstem-seo' ); ?></h2>
				<table class="widefat striped">
					<thead><tr>
						<th scope="col" style="width:22%"><?php esc_html_e( 'Item', 'orbitstem-seo' ); ?></th>
						<th scope="col" style="width:14%"><?php esc_html_e( 'Field', 'orbitstem-seo' ); ?></th>
						<th scope="col"><?php esc_html_e( 'Now', 'orbitstem-seo' ); ?></th>
						<th scope="col"><?php esc_html_e( 'After import', 'orbitstem-seo' ); ?></th>
					</tr></thead>
					<tbody>
					<?php foreach ( array_slice( $plan['changes'], 0, self::PREVIEW_ROWS ) as $change ) : ?>
						<?php $first = true; ?>
						<?php foreach ( $change['fields'] as $field => $pair ) : ?>
							<tr>
								<td>
									<?php if ( $first ) : ?>
										<a href="<?php echo esc_url( (string) get_edit_post_link( $change['id'] ) ); ?>"><?php echo esc_html( get_the_title( $change['id'] ) ); ?></a>
										<span class="description">#<?php echo esc_html( (string) $change['id'] ); ?></span>
									<?php endif; ?>
								</td>
								<td><?php echo esc_html( $labels[ $field ] ); ?></td>
								<?php
								// Only title, description and the like fall back to a template; an empty keyword or slug is just empty.
								$blank = in_array( $field, array( 'title', 'description', 'social_title', 'social_description' ), true ) ? __( '(template)', 'orbitstem-seo' ) : __( '(empty)', 'orbitstem-seo' );
								?>
								<td><?php echo '' === $show( $pair[0] ) ? '<em class="description">' . esc_html( $blank ) . '</em>' : esc_html( $show( $pair[0] ) ); ?></td>
								<td><?php echo '' === $show( $pair[1] ) ? '<em class="description">' . esc_html( $blank ) . '</em>' : '<strong>' . esc_html( $show( $pair[1] ) ) . '</strong>'; ?></td>
							</tr>
							<?php $first = false; ?>
						<?php endforeach; ?>
					<?php endforeach; ?>
					</tbody>
				</table>
				<?php if ( $count > self::PREVIEW_ROWS ) : ?>
					<p class="description">
						<?php
						/* translators: 1: items shown, 2: total items */
						echo esc_html( sprintf( __( 'Showing the first %1$d of %2$d items. All of them are imported.', 'orbitstem-seo' ), self::PREVIEW_ROWS, $count ) );
						?>
					</p>
				<?php endif; ?>
			<?php else : ?>
				<p><?php esc_html_e( 'Nothing to change.', 'orbitstem-seo' ); ?></p>
			<?php endif; ?>
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="margin-top:16px">
				<input type="hidden" name="action" value="<?php echo esc_attr( self::CSV_ACTION ); ?>" />
				<?php wp_nonce_field( self::CSV_ACTION ); ?>
				<?php if ( $count ) : ?>
					<button type="submit" name="task" value="apply" class="button button-primary">
						<?php
						/* translators: %d: number of items */
						echo esc_html( sprintf( _n( 'Import %d change', 'Import %d changes', $count, 'orbitstem-seo' ), $count ) );
						?>
					</button>
				<?php endif; ?>
				<button type="submit" name="task" value="cancel" class="button"><?php esc_html_e( 'Cancel', 'orbitstem-seo' ); ?></button>
			</form>
		<?php
		Ui::close();
	}

	/**
	 * Result of the last import, with undo.
	 */
	private function render_csv_result() {
		$last = get_transient( self::last_key() );
		if ( ! is_array( $last ) ) {
			return;
		}
		$problem = $last['conflicts'] || $last['failed'];
		?>
		<div class="notice notice-<?php echo $problem ? 'warning' : 'success'; ?>">
			<p>
				<?php
				/* translators: 1: items updated, 2: items skipped, 3: items whose stored values differ */
				echo esc_html( sprintf( __( 'Import finished. Updated and verified: %1$d. Skipped because they changed after the preview: %2$d. Saved with different values: %3$d.', 'orbitstem-seo' ), $last['updated'], $last['conflicts'], $last['failed'] ) );
				?>
			</p>
			<?php if ( $last['messages'] ) : ?>
				<ul style="list-style:disc;margin-left:20px">
					<?php foreach ( array_slice( $last['messages'], 0, 20 ) as $message ) : ?>
						<li><?php echo esc_html( $message ); ?></li>
					<?php endforeach; ?>
				</ul>
			<?php endif; ?>
			<?php if ( $last['change_ids'] ) : ?>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="margin:0 0 8px" onsubmit="return confirm('<?php echo esc_js( __( 'Restore the values from before this import?', 'orbitstem-seo' ) ); ?>');">
					<input type="hidden" name="action" value="<?php echo esc_attr( self::CSV_ACTION ); ?>" />
					<input type="hidden" name="task" value="undo" />
					<?php wp_nonce_field( self::CSV_ACTION ); ?>
					<button type="submit" class="button"><?php esc_html_e( 'Undo this import', 'orbitstem-seo' ); ?></button>
					<a href="<?php echo esc_url( admin_url( 'admin.php?page=' . RepairPage::SLUG . '&tab=history' ) ); ?>"><?php esc_html_e( 'History', 'orbitstem-seo' ); ?></a>
				</form>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * Saves submitted rows, then redirects back.
	 */
	public function save() {
		if ( ! current_user_can( Admin::capability() ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'orbitstem-seo' ), 403 );
		}
		check_admin_referer( self::ACTION );

		$items  = isset( $_POST['items'] ) && is_array( $_POST['items'] ) ? wp_unslash( $_POST['items'] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each field sanitized by MetaRepository.
		$result = $this->save_items( $items );

		$redirect = isset( $_POST['redirect'] ) ? wp_validate_redirect( esc_url_raw( wp_unslash( $_POST['redirect'] ) ), admin_url( 'admin.php?page=' . self::SLUG ) ) : admin_url( 'admin.php?page=' . self::SLUG );
		wp_safe_redirect(
			add_query_arg(
				array(
					'orbitstem_seo_saved'     => $result['updated'],
					'orbitstem_seo_conflicts' => $result['conflicts'],
				),
				$redirect
			)
		);
		exit;
	}

	/**
	 * Applies submitted rows. Separate from save() so it can be tested.
	 *
	 * A row is skipped as a conflict when its stored values changed after the
	 * form was loaded (someone else saved meanwhile), so no edit is lost.
	 *
	 * @param array $items Rows keyed by post ID.
	 * @return array{updated:int,conflicts:int}
	 */
	public function save_items( array $items ) {
		$meta      = $this->plugin->meta;
		$updated   = 0;
		$conflicts = 0;
		foreach ( $items as $id => $row ) {
			$id = absint( $id );
			if ( ! $id || ! is_array( $row ) || ! current_user_can( 'edit_post', $id ) ) {
				continue;
			}
			$post = get_post( $id );
			if ( ! $post || ! $this->plugin->types->supports_post_type( $post->post_type ) ) {
				continue;
			}
			// A field sent back exactly as stored is untouched: keep it byte for byte,
			// even when cleaning would alter it (e.g. "&amp;" or "&lt;" from an import).
			$field   = function ( $key ) use ( $row, $meta, $id ) {
				$stored = (string) $meta->get_post( $id, $key );
				if ( ! isset( $row[ $key ] ) || ! is_string( $row[ $key ] ) ) {
					return '';
				}
				return $row[ $key ] === $stored ? $stored : MetaRepository::sanitize( 'text', $row[ $key ] );
			};
			$title   = $field( 'title' );
			$desc    = $field( 'description' );
			$noindex = ! empty( $row['noindex'] );

			$current = md5( $meta->get_post( $id, 'title' ) . "\0" . $meta->get_post( $id, 'description' ) . "\0" . ( $meta->get_post( $id, 'noindex' ) ? '1' : '' ) );
			$posted  = md5( $title . "\0" . $desc . "\0" . ( $noindex ? '1' : '' ) );
			if ( $posted === $current ) {
				continue;
			}
			if ( isset( $row['orig'] ) && is_string( $row['orig'] ) && ! hash_equals( $current, $row['orig'] ) ) {
				++$conflicts;
				continue;
			}
			$meta->update_fields(
				'post',
				$id,
				array(
					'title'       => $title,
					'description' => $desc,
					'noindex'     => $noindex,
				)
			);
			++$updated;
		}
		return array(
			'updated'   => $updated,
			'conflicts' => $conflicts,
		);
	}
}