<?php
/**
 * Settings UI — an "Editorial Workflow" admin screen with three tabs:
 *   Overview      — read-only view of the active workflow + escalation + cron status.
 *   Notifications — from-name / from-email / master toggle (Settings API).
 *   Tools         — JSON export / import (validated) / reset to default.
 *
 * A full drag-and-drop workflow builder is a later enhancement; JSON import/export is
 * the supported way to edit the chain itself without touching PHP.
 *
 * @package OST\EditorialWorkflow
 */

namespace OST\EditorialWorkflow\Admin;

use OST\EditorialWorkflow\Audit;
use OST\EditorialWorkflow\Config;
use OST\EditorialWorkflow\Statuses;
use OST\EditorialWorkflow\Workflow;
use OST\EditorialWorkflow\Escalation\Escalation;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Renders the plugin settings screen.
 */
class Settings {

	const MENU_SLUG   = 'ost-editorial-workflow';
	const SETTING     = 'ostew_settings';
	const SETTING_GRP = 'ostew_settings_group';

	/**
	 * Config service.
	 *
	 * @var Config
	 */
	private $config;

	/**
	 * Workflow service.
	 *
	 * @var Workflow
	 */
	private $workflow;

	/**
	 * Statuses service.
	 *
	 * @var Statuses
	 */
	private $statuses;

	/**
	 * Audit service.
	 *
	 * @var Audit
	 */
	private $audit;

	/**
	 * Constructor.
	 *
	 * @param Config   $config   Config service.
	 * @param Workflow $workflow Workflow service.
	 * @param Statuses $statuses Statuses service.
	 * @param Audit    $audit    Audit service.
	 */
	public function __construct( Config $config, Workflow $workflow, Statuses $statuses, Audit $audit ) {
		$this->config   = $config;
		$this->workflow = $workflow;
		$this->statuses = $statuses;
		$this->audit    = $audit;
	}

	/**
	 * Human-readable reasons a configuration change would strand content.
	 *
	 * A status that is about to leave the configuration while posts still hold it
	 * is refused rather than saved, because those posts would lose every action.
	 *
	 * @param array $proposed Proposed workflow definitions.
	 * @return string[] Empty when the change is safe.
	 */
	private function stranding_errors( $proposed ) {
		$removed = $this->config->statuses_removed_by( $proposed );
		if ( empty( $removed ) ) {
			return array();
		}

		$errors = array();
		foreach ( $this->statuses->count_posts_in_statuses( $removed ) as $status => $total ) {
			$errors[] = sprintf(
				/* translators: 1: status key, 2: number of items. */
				_n(
					'Status "%1$s" is being removed, but %2$d item still has it. Move that item to another status first.',
					'Status "%1$s" is being removed, but %2$d items still have it. Move those items to another status first.',
					$total,
					'ost-editorial-workflow'
				),
				$status,
				$total
			);
		}
		return $errors;
	}

	/**
	 * Register hooks.
	 *
	 * @return void
	 */
	public function register_hooks() {
		add_action( 'admin_menu', array( $this, 'add_menu' ) );
		add_action( 'admin_init', array( $this, 'register_settings' ) );
		add_action( 'admin_post_ostew_export', array( $this, 'handle_export' ) );
		add_action( 'admin_post_ostew_import', array( $this, 'handle_import' ) );
		add_action( 'admin_post_ostew_reset', array( $this, 'handle_reset' ) );
		add_action( 'admin_post_ostew_audit_export', array( $this, 'handle_audit_export' ) );
	}

	/**
	 * Add the top-level menu.
	 *
	 * @return void
	 */
	public function add_menu() {
		add_menu_page(
			__( 'Editorial Workflow', 'ost-editorial-workflow' ),
			__( 'Editorial Workflow', 'ost-editorial-workflow' ),
			'manage_options',
			self::MENU_SLUG,
			array( $this, 'render' ),
			'dashicons-randomize',
			58
		);
	}

	/**
	 * Register the notification settings.
	 *
	 * @return void
	 */
	public function register_settings() {
		register_setting(
			self::SETTING_GRP,
			self::SETTING,
			array(
				'type'              => 'array',
				'sanitize_callback' => array( $this, 'sanitize_settings' ),
				'default'           => array(),
			)
		);
	}

	/**
	 * Sanitize the settings array.
	 *
	 * @param mixed $input Raw input.
	 * @return array
	 */
	public function sanitize_settings( $input ) {
		$input = is_array( $input ) ? $input : array();
		return array(
			'from_name'             => isset( $input['from_name'] ) ? sanitize_text_field( $input['from_name'] ) : '',
			'from_email'            => isset( $input['from_email'] ) ? sanitize_email( $input['from_email'] ) : '',
			'notifications_enabled' => empty( $input['notifications_enabled'] ) ? 0 : 1,
		);
	}

	/**
	 * Current tab.
	 *
	 * @return string
	 */
	private function tab() {
		$tab = isset( $_GET['tab'] ) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : 'overview'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		return in_array( $tab, array( 'overview', 'notifications', 'tools' ), true ) ? $tab : 'overview';
	}

	/**
	 * Render the settings page.
	 *
	 * @return void
	 */
	public function render() {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		$tab  = $this->tab();
		$base = admin_url( 'admin.php?page=' . self::MENU_SLUG );
		?>
		<div class="wrap">
			<h1><?php esc_html_e( 'Editorial Workflow', 'ost-editorial-workflow' ); ?></h1>
			<h2 class="nav-tab-wrapper">
				<?php
				foreach ( array(
					'overview'      => __( 'Overview', 'ost-editorial-workflow' ),
					'notifications' => __( 'Notifications', 'ost-editorial-workflow' ),
					'tools'         => __( 'Tools', 'ost-editorial-workflow' ),
				) as $slug => $label ) {
					printf(
						'<a href="%s" class="nav-tab %s">%s</a>',
						esc_url( add_query_arg( 'tab', $slug, $base ) ),
						$tab === $slug ? 'nav-tab-active' : '',
						esc_html( $label )
					);
				}
				?>
			</h2>
			<?php
			$this->notices();
			if ( 'notifications' === $tab ) {
				$this->render_notifications();
			} elseif ( 'tools' === $tab ) {
				$this->render_tools();
			} else {
				$this->render_overview();
			}
			?>
		</div>
		<?php
	}

	/**
	 * Overview tab — read-only workflow summary.
	 *
	 * @return void
	 */
	private function render_overview() {
		foreach ( $this->config->all() as $wf ) {
			echo '<h2>' . esc_html( isset( $wf['label'] ) ? $wf['label'] : $wf['id'] ) . '</h2>';
			echo '<p><strong>' . esc_html__( 'Applies to:', 'ost-editorial-workflow' ) . '</strong> ' . esc_html( implode( ', ', (array) $wf['post_types'] ) ) . '</p>';

			echo '<table class="widefat striped" style="max-width:820px;"><thead><tr>';
			echo '<th>' . esc_html__( 'Status', 'ost-editorial-workflow' ) . '</th><th>' . esc_html__( 'Who acts', 'ost-editorial-workflow' ) . '</th><th>' . esc_html__( 'Advances to', 'ost-editorial-workflow' ) . '</th></tr></thead><tbody>';
			foreach ( $wf['steps'] as $step ) {
				$who = '';
				if ( ! empty( $step['actor_roles'] ) ) {
					$who = implode( ', ', $step['actor_roles'] );
				} elseif ( ! empty( $step['approver_roles'] ) ) {
					$who = implode( ', ', $step['approver_roles'] );
				}
				$to = array();
				if ( isset( $step['advance_to'] ) ) {
					$to[] = $step['advance_to'];
				}
				if ( isset( $step['conditional_to']['status'] ) ) {
					$to[] = $step['conditional_to']['status'] . ' ' . __( '(if flagged)', 'ost-editorial-workflow' );
				}
				if ( isset( $step['on_approve'] ) ) {
					$to[] = __( 'approve → ', 'ost-editorial-workflow' ) . $step['on_approve'];
				}
				if ( isset( $step['on_reject'] ) ) {
					$to[] = __( 'send back → ', 'ost-editorial-workflow' ) . $step['on_reject'];
				}
				printf(
					'<tr><td><code>%s</code></td><td>%s</td><td>%s</td></tr>',
					esc_html( $step['status'] ),
					esc_html( $who ),
					esc_html( implode( '; ', $to ) )
				);
			}
			echo '</tbody></table>';

			if ( ! empty( $wf['escalation'] ) ) {
				echo '<p style="margin-top:10px;"><strong>' . esc_html__( 'Escalation:', 'ost-editorial-workflow' ) . '</strong> ';
				$bits = array();
				foreach ( $wf['escalation'] as $e ) {
					$urgent = isset( $e['urgent']['sla_hours'] ) ? ' / ' . (int) $e['urgent']['sla_hours'] . 'h ' . __( 'urgent', 'ost-editorial-workflow' ) : '';
					$bits[] = sprintf( '%s: %dh%s', $e['status'], (int) $e['sla_hours'], $urgent );
				}
				echo esc_html( implode( ' · ', $bits ) ) . '</p>';
			}
			echo '<hr>';
		}

		$next = wp_next_scheduled( Escalation::CRON_HOOK );
		echo '<p><strong>' . esc_html__( 'Escalation scan:', 'ost-editorial-workflow' ) . '</strong> ';
		echo $next
			? esc_html( sprintf( /* translators: %s: time. */ __( 'next run %s', 'ost-editorial-workflow' ), get_date_from_gmt( gmdate( 'Y-m-d H:i:s', $next ), 'Y-m-d H:i' ) ) )
			: esc_html__( 'not scheduled', 'ost-editorial-workflow' );
		echo '</p>';
		echo '<p class="description">' . esc_html__( 'To change the chain itself, export the JSON under the Tools tab, edit it, and import it back.', 'ost-editorial-workflow' ) . '</p>';
	}

	/**
	 * Notifications tab.
	 *
	 * @return void
	 */
	private function render_notifications() {
		$opts = get_option( self::SETTING, array() );
		?>
		<form method="post" action="options.php">
			<?php settings_fields( self::SETTING_GRP ); ?>
			<table class="form-table" role="presentation">
				<tr>
					<th scope="row"><label for="ostew_from_name"><?php esc_html_e( 'From name', 'ost-editorial-workflow' ); ?></label></th>
					<td><input name="<?php echo esc_attr( self::SETTING ); ?>[from_name]" id="ostew_from_name" type="text" class="regular-text" value="<?php echo esc_attr( isset( $opts['from_name'] ) ? $opts['from_name'] : '' ); ?>" placeholder="<?php echo esc_attr( get_bloginfo( 'name' ) ); ?>"></td>
				</tr>
				<tr>
					<th scope="row"><label for="ostew_from_email"><?php esc_html_e( 'From email', 'ost-editorial-workflow' ); ?></label></th>
					<td><input name="<?php echo esc_attr( self::SETTING ); ?>[from_email]" id="ostew_from_email" type="email" class="regular-text" value="<?php echo esc_attr( isset( $opts['from_email'] ) ? $opts['from_email'] : '' ); ?>" placeholder="<?php echo esc_attr( get_option( 'admin_email' ) ); ?>"></td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'Notifications', 'ost-editorial-workflow' ); ?></th>
					<td><label><input name="<?php echo esc_attr( self::SETTING ); ?>[notifications_enabled]" type="checkbox" value="1" <?php checked( ! isset( $opts['notifications_enabled'] ) || $opts['notifications_enabled'] ); ?>> <?php esc_html_e( 'Send email notifications on workflow handoffs', 'ost-editorial-workflow' ); ?></label></td>
				</tr>
			</table>
			<?php submit_button(); ?>
		</form>
		<?php
	}

	/**
	 * Tools tab — export / import / reset.
	 *
	 * @return void
	 */
	private function render_tools() {
		$json   = wp_json_encode( $this->config->all(), JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE );
		$action = admin_url( 'admin-post.php' );
		?>
		<h2><?php esc_html_e( 'Export', 'ost-editorial-workflow' ); ?></h2>
		<p><?php esc_html_e( 'Download the current workflow configuration as JSON (portable + reproducible).', 'ost-editorial-workflow' ); ?></p>
		<form method="post" action="<?php echo esc_url( $action ); ?>">
			<input type="hidden" name="action" value="ostew_export">
			<?php wp_nonce_field( 'ostew_export' ); ?>
			<?php submit_button( __( 'Download JSON', 'ost-editorial-workflow' ), 'secondary', 'submit', false ); ?>
		</form>

		<h2 style="margin-top:24px;"><?php esc_html_e( 'Import', 'ost-editorial-workflow' ); ?></h2>
		<p><?php esc_html_e( 'Paste a workflow configuration to replace the current one. It is validated before saving.', 'ost-editorial-workflow' ); ?></p>
		<form method="post" action="<?php echo esc_url( $action ); ?>">
			<input type="hidden" name="action" value="ostew_import">
			<?php wp_nonce_field( 'ostew_import' ); ?>
			<textarea name="ostew_json" rows="14" class="large-text code" spellcheck="false"><?php echo esc_textarea( $json ); ?></textarea>
			<?php submit_button( __( 'Validate & Save', 'ost-editorial-workflow' ) ); ?>
		</form>

		<h2 style="margin-top:24px;"><?php esc_html_e( 'Audit trail', 'ost-editorial-workflow' ); ?></h2>
		<p><?php esc_html_e( 'Download every recorded transition as CSV. Deleting the plugin removes the audit table, so take a copy first if you need to keep it.', 'ost-editorial-workflow' ); ?></p>
		<form method="post" action="<?php echo esc_url( $action ); ?>">
			<input type="hidden" name="action" value="ostew_audit_export">
			<?php wp_nonce_field( 'ostew_audit_export' ); ?>
			<?php submit_button( __( 'Download audit log (CSV)', 'ost-editorial-workflow' ), 'secondary', 'submit', false ); ?>
		</form>

		<h2 style="margin-top:24px;"><?php esc_html_e( 'Reset', 'ost-editorial-workflow' ); ?></h2>
		<p><?php esc_html_e( 'Discard customisations and restore the shipped default workflow.', 'ost-editorial-workflow' ); ?></p>
		<form method="post" action="<?php echo esc_url( $action ); ?>" onsubmit="return confirm('<?php echo esc_js( __( 'Reset to the default workflow? This cannot be undone.', 'ost-editorial-workflow' ) ); ?>');">
			<input type="hidden" name="action" value="ostew_reset">
			<?php wp_nonce_field( 'ostew_reset' ); ?>
			<?php submit_button( __( 'Reset to default', 'ost-editorial-workflow' ), 'delete', 'submit', false ); ?>
		</form>
		<?php
	}

	/**
	 * Export handler.
	 *
	 * @return void
	 */
	public function handle_export() {
		check_admin_referer( 'ostew_export' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'ost-editorial-workflow' ) );
		}
		$json = wp_json_encode( $this->config->all(), JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE );
		header( 'Content-Type: application/json; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename="ost-editorial-workflow-config.json"' );
		echo $json; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
		exit;
	}

	/**
	 * Audit trail CSV download.
	 *
	 * @return void
	 */
	public function handle_audit_export() {
		check_admin_referer( 'ostew_audit_export' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'ost-editorial-workflow' ) );
		}
		$csv = $this->audit->to_csv();
		header( 'Content-Type: text/csv; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename="ost-editorial-workflow-audit-' . gmdate( 'Y-m-d' ) . '.csv"' );
		echo $csv; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
		exit;
	}

	/**
	 * Import handler.
	 *
	 * @return void
	 */
	public function handle_import() {
		check_admin_referer( 'ostew_import' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'ost-editorial-workflow' ) );
		}
		// Not sanitized on purpose: it's raw JSON — sanitizing would corrupt it. It is
		// json_decode'd and run through Config::validate() before anything is saved.
		$raw     = isset( $_POST['ostew_json'] ) ? wp_unslash( $_POST['ostew_json'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		$decoded = json_decode( $raw, true );
		$flag    = 'imported';

		if ( null === $decoded && JSON_ERROR_NONE !== json_last_error() ) {
			$flag = 'badjson';
		} else {
			$errors = $this->config->validate( $decoded );
			if ( ! empty( $errors ) ) {
				set_transient( 'ostew_import_errors', $errors, 60 );
				$flag = 'invalid';
			} else {
				$stranding = $this->stranding_errors( $decoded );
				if ( ! empty( $stranding ) ) {
					set_transient( 'ostew_import_errors', $stranding, 60 );
					$flag = 'occupied';
				} else {
					$this->config->update( $decoded );
				}
			}
		}
		wp_safe_redirect(
			add_query_arg(
				array(
					'tab'       => 'tools',
					'ostew_msg' => $flag,
				),
				admin_url( 'admin.php?page=' . self::MENU_SLUG )
			)
		);
		exit;
	}

	/**
	 * Reset handler.
	 *
	 * @return void
	 */
	public function handle_reset() {
		check_admin_referer( 'ostew_reset' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'ost-editorial-workflow' ) );
		}
		$stranding = $this->stranding_errors( $this->config->defaults() );
		if ( ! empty( $stranding ) ) {
			set_transient( 'ostew_import_errors', $stranding, 60 );
			wp_safe_redirect(
				add_query_arg(
					array(
						'tab'       => 'tools',
						'ostew_msg' => 'occupied',
					),
					admin_url( 'admin.php?page=' . self::MENU_SLUG )
				)
			);
			exit;
		}

		$this->config->reset();
		wp_safe_redirect(
			add_query_arg(
				array(
					'tab'       => 'tools',
					'ostew_msg' => 'reset',
				),
				admin_url( 'admin.php?page=' . self::MENU_SLUG )
			)
		);
		exit;
	}

	/**
	 * Admin notices for tool actions.
	 *
	 * @return void
	 */
	private function notices() {
		$msg = isset( $_GET['ostew_msg'] ) ? sanitize_key( wp_unslash( $_GET['ostew_msg'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( ! $msg ) {
			return;
		}
		if ( 'imported' === $msg ) {
			echo '<div class="notice notice-success is-dismissible"><p>' . esc_html__( 'Workflow configuration saved.', 'ost-editorial-workflow' ) . '</p></div>';
		} elseif ( 'reset' === $msg ) {
			echo '<div class="notice notice-success is-dismissible"><p>' . esc_html__( 'Reset to the default workflow.', 'ost-editorial-workflow' ) . '</p></div>';
		} elseif ( 'badjson' === $msg ) {
			echo '<div class="notice notice-error is-dismissible"><p>' . esc_html__( 'That was not valid JSON.', 'ost-editorial-workflow' ) . '</p></div>';
		} elseif ( 'invalid' === $msg ) {
			$errors = get_transient( 'ostew_import_errors' );
			delete_transient( 'ostew_import_errors' );
			echo '<div class="notice notice-error is-dismissible"><p>' . esc_html__( 'Configuration not saved — please fix:', 'ost-editorial-workflow' ) . '</p><ul style="list-style:disc;margin-left:20px;">';
			foreach ( (array) $errors as $e ) {
				echo '<li>' . esc_html( $e ) . '</li>';
			}
			echo '</ul></div>';
		} elseif ( 'occupied' === $msg ) {
			$errors = get_transient( 'ostew_import_errors' );
			delete_transient( 'ostew_import_errors' );
			echo '<div class="notice notice-error is-dismissible"><p>' . esc_html__( 'Configuration not saved — it would leave content with no way forward:', 'ost-editorial-workflow' ) . '</p><ul style="list-style:disc;margin-left:20px;">';
			foreach ( (array) $errors as $e ) {
				echo '<li>' . esc_html( $e ) . '</li>';
			}
			echo '</ul></div>';
		}
	}
}