<?php
/**
 * SEO fields box on the post edit screen.
 *
 * @package OrbitstemSEO
 */

namespace Orbitstem\SEO\Admin;

use Orbitstem\SEO\Content\MetaRepository;
use Orbitstem\SEO\Core\Settings;
use Orbitstem\SEO\Plugin;
use WP_Post;

defined( 'ABSPATH' ) || exit;

/**
 * One meta box used by both the block editor and the classic editor, so
 * there is a single save path to secure and test.
 */
class PostMetaBox {

	const NONCE_ACTION = 'orbitstem_seo_save_post';
	const NONCE_FIELD  = 'orbitstem_seo_post_nonce';
	const INPUT        = 'orbitstem_seo';

	/**
	 * Fields this box has inputs for; saving touches only these.
	 */
	const RENDERED = array( 'title', 'description', 'focus_keyword', 'extra_keyphrases', 'social_title', 'social_description', 'social_image', 'canonical', 'noindex', 'nofollow', 'sitemap_exclude', 'schema' );

	/**
	 * Plugin services.
	 *
	 * @var Plugin
	 */
	private $plugin;

	/**
	 * Constructor.
	 *
	 * @param Plugin $plugin Plugin services.
	 */
	public function __construct( Plugin $plugin ) {
		$this->plugin = $plugin;
	}

	/**
	 * Registers hooks.
	 */
	public function register() {
		add_action( 'add_meta_boxes', array( $this, 'add' ) );
		add_action( 'save_post', array( $this, 'save' ), 10, 2 );
		add_action( 'enqueue_block_editor_assets', array( $this, 'enqueue_sidebar' ) );
	}

	/**
	 * Whether a post type gets the block-editor sidebar instead of the box.
	 *
	 * The sidebar saves through the REST API, which only exposes meta for
	 * post types that support custom fields; others keep the box.
	 *
	 * @param string $post_type Post type.
	 * @return bool
	 */
	public function uses_sidebar( $post_type ) {
		return post_type_supports( $post_type, 'custom-fields' ) && use_block_editor_for_post_type( $post_type );
	}

	/**
	 * Adds the box to every managed post type. Where the block editor sidebar
	 * is used, the box appears in the classic editor only.
	 */
	public function add() {
		foreach ( array_keys( $this->plugin->types->post_types() ) as $post_type ) {
			add_meta_box(
				'orbitstem-seo',
				__( 'Orbitstem SEO', 'orbitstem-seo' ),
				array( $this, 'render' ),
				$post_type,
				'normal',
				'default',
				array( '__back_compat_meta_box' => $this->uses_sidebar( $post_type ) )
			);
		}
	}

	/**
	 * Loads the block-editor sidebar for managed post types.
	 */
	public function enqueue_sidebar() {
		$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
		if ( ! $screen || ! $screen->post_type || ! $this->plugin->types->supports_post_type( $screen->post_type ) || ! $this->uses_sidebar( $screen->post_type ) ) {
			return;
		}

		$types = array();
		foreach ( array_keys( $this->plugin->types->post_types() ) as $post_type ) {
			$types[ $post_type ] = array(
				'title'       => (string) $this->plugin->settings->post_type( $post_type, 'title' ),
				'description' => (string) $this->plugin->settings->post_type( $post_type, 'description' ),
				'schema'      => (string) $this->plugin->settings->post_type( $post_type, 'schema' ),
				'typeName'    => wp_specialchars_decode( (string) get_post_type_object( $post_type )->labels->name, ENT_QUOTES ),
			);
		}

		wp_enqueue_script(
			'orbitstem-seo-editor',
			ORBITSTEM_SEO_URL . 'assets/editor.js',
			array( 'wp-plugins', 'wp-edit-post', 'wp-editor', 'wp-element', 'wp-components', 'wp-data', 'wp-i18n', 'wp-api-fetch', 'wp-block-editor', 'wp-core-data' ),
			ORBITSTEM_SEO_VERSION,
			true
		);
		wp_enqueue_style( 'orbitstem-seo-editor', ORBITSTEM_SEO_URL . 'assets/editor.css', array(), ORBITSTEM_SEO_VERSION );
		wp_add_inline_script(
			'orbitstem-seo-editor',
			'window.orbitstemSeoEditor = ' . wp_json_encode(
				array(
					'types'        => $types,
					'schemaTypes'  => Settings::schema_types(),
					'autoRedirect' => (bool) $this->plugin->settings->get( 'guardian_auto_redirect' ),
					'siteName'     => wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ),
					'tagline'      => wp_specialchars_decode( get_bloginfo( 'description' ), ENT_QUOTES ),
					'separator'    => $this->plugin->settings->separator(),
					'homeUrl'      => home_url( '/' ),
					'locale'       => get_locale(),
					'defaultImage' => (string) $this->plugin->settings->get( 'og_default_image' ),
					'twitterSite'  => (string) $this->plugin->settings->get( 'twitter_site' ),
					'richTypes'    => \Orbitstem\SEO\Schema\RichTypes::definitions(),
					'currencies'   => \Orbitstem\SEO\Schema\RichTypes::currencies(),
					'wooProduct'   => \Orbitstem\SEO\Schema\Woo::active() && 'product' === $screen->post_type,
					'canIndexing'  => ( function () use ( $screen ) {
						$type = get_post_type_object( $screen->post_type );
						return $type && current_user_can( $type->cap->publish_posts );
					} )(),
				)
			) . ';',
			'before'
		);
		wp_set_script_translations( 'orbitstem-seo-editor', 'orbitstem-seo' );
	}

	/**
	 * Renders the box.
	 *
	 * @param WP_Post $post Post being edited.
	 */
	public function render( $post ) {
		$meta     = $this->plugin->meta;
		$resolved = $this->plugin->resolver->for_post( $post );
		$type     = $post->post_type;
		wp_nonce_field( self::NONCE_ACTION, self::NONCE_FIELD );
		?>
		<p class="description">
			<?php
			printf(
				/* translators: 1: example variable, 2: example variable */
				esc_html__( 'Leave a field empty to use the template from Orbitstem SEO > Settings. Variables such as %1$s and %2$s work here too.', 'orbitstem-seo' ),
				'<code>%title%</code>',
				'<code>%sitename%</code>'
			);
			?>
		</p>
		<p>
			<label for="orbitstem-seo-title"><strong><?php esc_html_e( 'SEO title', 'orbitstem-seo' ); ?></strong></label><br />
			<input type="text" class="widefat" id="orbitstem-seo-title" name="<?php echo esc_attr( self::INPUT ); ?>[title]" value="<?php echo esc_textarea( $meta->get_post( $post->ID, 'title' ) ); /* Encodes every "&", so an unchanged title is sent back exactly. */ ?>" placeholder="<?php echo esc_attr( $this->plugin->settings->post_type( $type, 'title' ) ); ?>" />
		</p>
		<p>
			<label for="orbitstem-seo-description"><strong><?php esc_html_e( 'Meta description', 'orbitstem-seo' ); ?></strong></label><br />
			<textarea class="widefat" rows="2" id="orbitstem-seo-description" name="<?php echo esc_attr( self::INPUT ); ?>[description]" placeholder="<?php echo esc_attr( $this->plugin->settings->post_type( $type, 'description' ) ); ?>"><?php echo esc_textarea( $meta->get_post( $post->ID, 'description' ) ); ?></textarea>
		</p>
		<p>
			<label for="orbitstem-seo-focus-keyword"><strong><?php esc_html_e( 'Focus keyword (optional)', 'orbitstem-seo' ); ?></strong></label><br />
			<input type="text" class="widefat" id="orbitstem-seo-focus-keyword" name="<?php echo esc_attr( self::INPUT ); ?>[focus_keyword]" value="<?php echo esc_textarea( $meta->get_post( $post->ID, 'focus_keyword' ) ); ?>" />
			<span class="description"><?php esc_html_e( 'The search phrase this page should be found for. Add synonyms after a comma. Used by the checklist in the block editor; never shown to visitors.', 'orbitstem-seo' ); ?></span>
		</p>
		<p>
			<label for="orbitstem-seo-extra-keyphrases"><strong><?php esc_html_e( 'More keyphrases (optional)', 'orbitstem-seo' ); ?></strong></label><br />
			<textarea class="widefat" rows="2" id="orbitstem-seo-extra-keyphrases" name="<?php echo esc_attr( self::INPUT ); ?>[extra_keyphrases]"><?php echo esc_textarea( $meta->get_post( $post->ID, 'extra_keyphrases' ) ); ?></textarea>
			<span class="description"><?php esc_html_e( 'Up to four, one per line.', 'orbitstem-seo' ); ?></span>
		</p>
		<p>
			<label for="orbitstem-seo-social-title"><strong><?php esc_html_e( 'Social title (Facebook, X, LinkedIn)', 'orbitstem-seo' ); ?></strong></label><br />
			<input type="text" class="widefat" id="orbitstem-seo-social-title" name="<?php echo esc_attr( self::INPUT ); ?>[social_title]" value="<?php echo esc_textarea( $meta->get_post( $post->ID, 'social_title' ) ); ?>" placeholder="<?php esc_attr_e( 'Empty uses the SEO title', 'orbitstem-seo' ); ?>" />
		</p>
		<p>
			<label for="orbitstem-seo-social-description"><strong><?php esc_html_e( 'Social description', 'orbitstem-seo' ); ?></strong></label><br />
			<textarea class="widefat" rows="2" id="orbitstem-seo-social-description" name="<?php echo esc_attr( self::INPUT ); ?>[social_description]" placeholder="<?php esc_attr_e( 'Empty uses the meta description', 'orbitstem-seo' ); ?>"><?php echo esc_textarea( $meta->get_post( $post->ID, 'social_description' ) ); ?></textarea>
		</p>
		<p>
			<label for="orbitstem-seo-social-image"><strong><?php esc_html_e( 'Social image URL', 'orbitstem-seo' ); ?></strong></label><br />
			<input type="url" class="widefat" id="orbitstem-seo-social-image" name="<?php echo esc_attr( self::INPUT ); ?>[social_image]" value="<?php echo esc_textarea( $meta->get_post( $post->ID, 'social_image' ) ); ?>" placeholder="<?php esc_attr_e( 'Empty uses the featured image', 'orbitstem-seo' ); ?>" />
		</p>
		<?php $can_index = MetaRepository::can_edit_field( $post->ID, 'noindex' ); ?>
		<p>
			<label for="orbitstem-seo-canonical"><strong><?php esc_html_e( 'Canonical URL', 'orbitstem-seo' ); ?></strong></label><br />
			<input type="url" class="widefat" id="orbitstem-seo-canonical" name="<?php echo esc_attr( self::INPUT ); ?>[canonical]" value="<?php echo esc_textarea( $meta->get_post( $post->ID, 'canonical' ) ); /* Encodes every "&", so "&amp;" in a stored address survives a save. */ ?>" placeholder="<?php esc_attr_e( 'Leave empty to use this page\'s own URL', 'orbitstem-seo' ); ?>" <?php disabled( ! $can_index ); ?> />
		</p>
		<p>
			<label><input type="checkbox" name="<?php echo esc_attr( self::INPUT ); ?>[noindex]" value="1" <?php checked( $meta->get_post( $post->ID, 'noindex' ) ); ?> <?php disabled( ! $can_index ); ?> /> <?php esc_html_e( 'Hide from search results (noindex)', 'orbitstem-seo' ); ?></label><br />
			<label><input type="checkbox" name="<?php echo esc_attr( self::INPUT ); ?>[nofollow]" value="1" <?php checked( $meta->get_post( $post->ID, 'nofollow' ) ); ?> <?php disabled( ! $can_index ); ?> /> <?php esc_html_e( 'Ask search engines not to follow links on this page (nofollow)', 'orbitstem-seo' ); ?></label><br />
			<label><input type="checkbox" name="<?php echo esc_attr( self::INPUT ); ?>[sitemap_exclude]" value="1" <?php checked( $meta->get_post( $post->ID, 'sitemap_exclude' ) ); ?> <?php disabled( ! $can_index ); ?> /> <?php esc_html_e( 'Leave out of the XML sitemap', 'orbitstem-seo' ); ?></label>
			<input type="hidden" name="<?php echo esc_attr( self::INPUT ); ?>[_rendered]" value="<?php echo esc_attr( implode( ',', self::RENDERED ) ); ?>" />
			<?php if ( ! $can_index ) : ?>
				<br /><span class="description"><?php esc_html_e( 'Canonical URL, noindex, nofollow and the sitemap setting can be changed by users who can publish this content.', 'orbitstem-seo' ); ?></span>
			<?php endif; ?>
		</p>
		<p>
			<label for="orbitstem-seo-schema"><strong><?php esc_html_e( 'Schema type', 'orbitstem-seo' ); ?></strong></label><br />
			<select id="orbitstem-seo-schema" name="<?php echo esc_attr( self::INPUT ); ?>[schema]">
				<option value="">
					<?php
					/* translators: %s: schema type */
					echo esc_html( sprintf( __( 'Default (%s)', 'orbitstem-seo' ), $this->plugin->settings->post_type( $type, 'schema' ) ) );
					?>
				</option>
				<?php foreach ( Settings::schema_types() as $schema_type ) : ?>
					<option value="<?php echo esc_attr( $schema_type ); ?>" <?php selected( $meta->get_post( $post->ID, 'schema' ), $schema_type ); ?>><?php echo esc_html( $schema_type ); ?></option>
				<?php endforeach; ?>
			</select>
		</p>
		<?php if ( $resolved && 'publish' === $post->post_status ) : ?>
			<p class="description">
				<?php esc_html_e( 'Current output (as of the last save):', 'orbitstem-seo' ); ?><br />
				<strong><?php echo esc_html( $resolved['title'] ); ?></strong><br />
				<?php echo esc_html( $resolved['description'] ); ?><br />
				<?php echo $resolved['noindex'] ? esc_html__( 'noindex', 'orbitstem-seo' ) : esc_html( $resolved['canonical'] ); ?>
			</p>
		<?php endif; ?>
		<?php
	}

	/**
	 * Saves the fields. Requires the box's nonce, so quick edit, bulk edit,
	 * REST and programmatic saves leave the fields untouched.
	 *
	 * @param int     $post_id Post ID.
	 * @param WP_Post $post    Post.
	 */
	public function save( $post_id, $post ) {
		if ( ! isset( $_POST[ self::NONCE_FIELD ] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST[ self::NONCE_FIELD ] ) ), self::NONCE_ACTION ) ) {
			return;
		}
		if ( ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) || wp_is_post_revision( $post_id ) || wp_is_post_autosave( $post_id ) ) {
			return;
		}
		if ( ! $post instanceof WP_Post || ! $this->plugin->types->supports_post_type( $post->post_type ) ) {
			return;
		}
		if ( ! current_user_can( 'edit_post', $post_id ) ) {
			return;
		}
		// Each field is sanitized by MetaRepository::sanitize() according to its type.
		$values = isset( $_POST[ self::INPUT ] ) && is_array( $_POST[ self::INPUT ] ) ? wp_unslash( $_POST[ self::INPUT ] ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		$clean  = array();
		// Only fields this box shows: others (e.g. rich schema, set in the block editor) are kept.
		$shown = isset( $values['_rendered'] ) && is_string( $values['_rendered'] ) ? array_intersect( explode( ',', $values['_rendered'] ), self::RENDERED ) : self::RENDERED;
		foreach ( array_intersect( array_keys( MetaRepository::fields() ), $shown ) as $field ) {
			// Fields the user may not change are left as they are (an unticked box sends nothing).
			if ( MetaRepository::can_edit_field( $post_id, $field ) ) {
				$clean[ $field ] = isset( $values[ $field ] ) ? $values[ $field ] : '';
			}
		}
		$this->plugin->meta->update_fields( 'post', $post_id, $clean );
	}
}