<?php

use Automattic\WooCommerce\Utilities\FeaturesUtil;

/**
 * Plugin Name: Provedly
 * Plugin URI:  https://provedly.app/docs
 * Description: Shows verified purchase notifications, a real live-visitor counter and countdown bars from Provedly on your store, and sends WooCommerce orders to Provedly over a signed webhook so they earn the "Verified purchase" mark.
 * Version:     1.0.3
 * Author:      Provedly
 * Author URI:  https://provedly.app
 * License:     GPLv2 or later
 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain: provedly
 * Requires at least: 6.0
 * Requires PHP: 8.0
 * WC requires at least: 7.0
 * WC tested up to: 9.5
 */
if (! defined('ABSPATH')) {
    exit;
}

final class Provedly_Plugin
{
    const OPTION = 'provedly_settings';

    const WEBHOOK_OPTION = 'provedly_webhook_id';

    /** First-party cookie the Provedly widget sets on the storefront ('pw_vid' was a wrong name in 1.0.x, still read). */
    const VISITOR_COOKIES = ['pv_vid', 'pw_vid'];

    const ORDER_META = '_provedly_visitor';

    const DEFAULT_HOST = 'https://provedly.app';

    public static function boot(): void
    {
        add_action('admin_menu', [__CLASS__, 'menu']);
        add_action('admin_init', [__CLASS__, 'register_settings']);
        add_action('admin_init', [__CLASS__, 'redirect_old_settings_url']);
        add_action('wp_enqueue_scripts', [__CLASS__, 'enqueue_scripts']);
        add_filter('script_loader_tag', [__CLASS__, 'script_tag'], 10, 2);
        add_action('woocommerce_checkout_create_order', [__CLASS__, 'remember_visitor'], 10, 1);
        add_action('woocommerce_store_api_checkout_order_processed', [__CLASS__, 'remember_visitor'], 10, 1);
        add_action('update_option_'.self::OPTION, [__CLASS__, 'sync_webhook'], 10, 2);
        // The very first save of a new option fires add_option_*, not update_option_*.
        add_action('add_option_'.self::OPTION, static fn ($option, $value) => self::sync_webhook(null, $value), 10, 2);
        add_filter('plugin_action_links_'.plugin_basename(__FILE__), [__CLASS__, 'action_links']);
        add_action('before_woocommerce_init', static function () {
            if (class_exists(FeaturesUtil::class)) {
                FeaturesUtil::declare_compatibility('custom_order_tables', __FILE__, true);
            }
        });
    }

    /** @return array{host:string,widget_token:string,bar_tokens:string,webhook_url:string,webhook_secret:string} */
    public static function settings(): array
    {
        $saved = get_option(self::OPTION, []);

        return wp_parse_args(is_array($saved) ? $saved : [], [
            'host' => self::DEFAULT_HOST,
            'widget_token' => '',
            'bar_tokens' => '',
            'webhook_url' => '',
            'webhook_secret' => '',
        ]);
    }

    // ---------------------------------------------------------------- storefront

    /**
     * Enqueue the widget and one loader per bar. Each loader reads its token
     * from a data-token attribute, added through script_loader_tag below.
     */
    public static function enqueue_scripts(): void
    {
        $s = self::settings();
        $host = untrailingslashit(esc_url_raw($s['host'] ?: self::DEFAULT_HOST));
        $args = ['strategy' => 'async', 'in_footer' => true];

        if ($s['widget_token'] !== '') {
            wp_enqueue_script('provedly-widget', $host . '/w/widget.js', [], null, $args); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.MissingVersion -- versioned by the service
            self::$tokens['provedly-widget'] = $s['widget_token'];
        }

        foreach (preg_split('/[\s,]+/', (string) $s['bar_tokens']) ?: [] as $token) {
            $token = trim($token);
            if ($token === '') {
                continue;
            }
            $handle = 'provedly-bar-' . sanitize_key($token);
            wp_enqueue_script($handle, $host . '/w/cta.js', [], null, $args); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.MissingVersion -- versioned by the service
            self::$tokens[$handle] = $token;
        }
    }

    /** @var array<string,string> handle => token */
    private static array $tokens = [];

    public static function script_tag(string $tag, string $handle): string
    {
        if (! isset(self::$tokens[$handle])) {
            return $tag;
        }

        return str_replace(' src=', ' data-token="' . esc_attr(self::$tokens[$handle]) . '" defer src=', $tag);
    }

    /**
     * Copy the widget's anonymous visitor id onto the order so Provedly can
     * attribute the purchase to a notification the buyer saw (30-day window).
     * The id is random, set by the widget, and contains no personal data.
     */
    public static function remember_visitor($order): void
    {
        if (! is_object($order) || ! method_exists($order, 'update_meta_data')) {
            return;
        }
        $vid = '';
        foreach (self::VISITOR_COOKIES as $cookie) {
            if (isset($_COOKIE[$cookie])) {
                $vid = sanitize_text_field(wp_unslash($_COOKIE[$cookie]));
                break;
            }
        }
        if ($vid !== '' && strlen($vid) <= 64) {
            $order->update_meta_data(self::ORDER_META, $vid);
        }
    }

    // ---------------------------------------------------------------- webhook

    /**
     * Create (or update) the WooCommerce webhook that delivers orders to
     * Provedly, signed with the secret from the Provedly dashboard.
     */
    public static function sync_webhook($old, $new): void
    {
        if (! is_array($new) || empty($new['webhook_url']) || ! class_exists('WC_Webhook')) {
            return;
        }
        $url = esc_url_raw($new['webhook_url']);
        $secret = (string) ($new['webhook_secret'] ?? '');
        // Reuse the webhook this plugin created before (by id, so a changed URL
        // updates it instead of leaving a stale one), else adopt one with the same URL.
        $existing = self::own_webhook() ?: self::find_webhook($url);
        $webhook = $existing ?: new WC_Webhook;

        $webhook->set_name('Provedly – order updates');
        $webhook->set_topic('order.updated');
        $webhook->set_delivery_url($url);
        $webhook->set_secret($secret);
        $webhook->set_status('active');
        $webhook->set_api_version('wp_api_v3');
        // WooCommerce builds the payload through the REST API as this user; with no
        // user (WP-CLI, cron) the payload would be a permission error, so fall back
        // to an administrator.
        if (! $existing || ! $webhook->get_user_id()) {
            $webhook->set_user_id(self::webhook_user_id());
        }
        $webhook->save();
        update_option(self::WEBHOOK_OPTION, $webhook->get_id(), false);
    }

    private static function webhook_user_id(): int
    {
        $current = get_current_user_id();
        if ($current > 0) {
            return $current;
        }
        $admins = get_users(['role' => 'administrator', 'number' => 1, 'orderby' => 'ID', 'order' => 'ASC', 'fields' => 'ID']);

        return $admins ? (int) $admins[0] : 0;
    }

    private static function own_webhook()
    {
        $id = (int) get_option(self::WEBHOOK_OPTION, 0);
        if ($id <= 0 || ! function_exists('wc_get_webhook')) {
            return null;
        }
        $hook = wc_get_webhook($id);

        return $hook && $hook->get_id() ? $hook : null;
    }

    private static function find_webhook(string $url)
    {
        if (! class_exists('WC_Data_Store')) {
            return null;
        }
        try {
            $store = WC_Data_Store::load('webhook');
            foreach ($store->search_webhooks(['limit' => 50]) as $id) {
                $hook = wc_get_webhook($id);
                if ($hook && $hook->get_delivery_url() === $url) {
                    return $hook;
                }
            }
        } catch (Throwable $e) {
            return null;
        }

        return null;
    }

    // ---------------------------------------------------------------- admin

    public static function menu(): void
    {
        // WordPress recolours a base64 SVG menu icon to match the admin colour scheme.
        $icon = (string) file_get_contents(__DIR__.'/assets/menu-icon.svg');
        add_menu_page('Provedly', 'Provedly', 'manage_options', 'provedly', [__CLASS__, 'render_page'], 'data:image/svg+xml;base64,'.base64_encode($icon), 58);
    }

    /** Until 1.0.2 the page lived under Settings; keep old bookmarks working. */
    public static function redirect_old_settings_url(): void
    {
        global $pagenow;
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only redirect, no state change
        $page = isset($_GET['page']) ? sanitize_key(wp_unslash($_GET['page'])) : '';
        if ($pagenow === 'options-general.php' && $page === 'provedly') {
            wp_safe_redirect(admin_url('admin.php?page=provedly'));
            exit;
        }
    }

    public static function action_links(array $links): array
    {
        array_unshift($links, '<a href="'.esc_url(admin_url('admin.php?page=provedly')).'">'.esc_html__('Settings', 'provedly').'</a>');

        return $links;
    }

    public static function register_settings(): void
    {
        register_setting('provedly', self::OPTION, [
            'type' => 'array',
            'sanitize_callback' => [__CLASS__, 'sanitize'],
            'default' => [],
        ]);
    }

    public static function sanitize($input): array
    {
        $input = is_array($input) ? $input : [];
        $host = isset($input['host']) ? esc_url_raw(trim((string) $input['host'])) : self::DEFAULT_HOST;

        return [
            'host' => $host !== '' ? $host : self::DEFAULT_HOST,
            'widget_token' => preg_replace('/[^a-z0-9_]/', '', strtolower((string) ($input['widget_token'] ?? ''))),
            'bar_tokens' => implode("\n", array_filter(array_map(
                static fn ($t) => preg_replace('/[^a-z0-9_]/', '', strtolower(trim($t))),
                preg_split('/[\s,]+/', (string) ($input['bar_tokens'] ?? '')) ?: []
            ))),
            'webhook_url' => isset($input['webhook_url']) ? esc_url_raw(trim((string) $input['webhook_url'])) : '',
            'webhook_secret' => sanitize_text_field((string) ($input['webhook_secret'] ?? '')),
        ];
    }

    public static function render_page(): void
    {
        if (! current_user_can('manage_options')) {
            return;
        }
        $s = self::settings();
        $woo = class_exists('WooCommerce');
        $hook = $s['webhook_url'] !== '' && $woo ? (self::own_webhook() ?: self::find_webhook($s['webhook_url'])) : null;
        ?>
        <div class="wrap">
            <h1 class="wp-heading-inline" style="display:inline-flex;align-items:center;gap:10px">
                <img src="<?php echo esc_url(plugins_url('assets/logo.svg', __FILE__)); ?>" width="32" height="32" alt="">
                Provedly
            </h1>
            <a href="<?php echo esc_url(rtrim($s['host'], '/').'/dashboard'); ?>" class="page-title-action" target="_blank" rel="noopener"><?php esc_html_e('Open your Provedly dashboard', 'provedly'); ?></a>
            <hr class="wp-header-end">
            <p><?php esc_html_e('Paste the tokens from your Provedly dashboard. The widget and bars load on every page; orders are sent to Provedly over a signed webhook and earn the "Verified purchase" mark.', 'provedly'); ?></p>
            <form method="post" action="options.php">
                <?php settings_fields('provedly'); ?>
                <table class="form-table" role="presentation">
                    <tr>
                        <th scope="row"><label for="provedly_widget_token"><?php esc_html_e('Widget token', 'provedly'); ?></label></th>
                        <td>
                            <input name="<?php echo esc_attr(self::OPTION); ?>[widget_token]" id="provedly_widget_token" type="text" class="regular-text code" value="<?php echo esc_attr($s['widget_token']); ?>" placeholder="pp_…">
                            <p class="description"><?php esc_html_e('Provedly → Widgets → your widget → Embed tab.', 'provedly'); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="provedly_bar_tokens"><?php esc_html_e('Bar tokens', 'provedly'); ?></label></th>
                        <td>
                            <textarea name="<?php echo esc_attr(self::OPTION); ?>[bar_tokens]" id="provedly_bar_tokens" class="regular-text code" rows="3" placeholder="cta_…"><?php echo esc_textarea($s['bar_tokens']); ?></textarea>
                            <p class="description"><?php esc_html_e('One per line. Countdown, evergreen and counter bars from Provedly → CTA bars.', 'provedly'); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="provedly_webhook_url"><?php esc_html_e('Webhook URL', 'provedly'); ?></label></th>
                        <td>
                            <input name="<?php echo esc_attr(self::OPTION); ?>[webhook_url]" id="provedly_webhook_url" type="url" class="regular-text code" value="<?php echo esc_attr($s['webhook_url']); ?>" placeholder="https://provedly.app/api/hooks/woocommerce/…">
                            <p class="description"><?php esc_html_e('Provedly → your widget → Data tab → Verified sources → Add → WooCommerce. Saving creates the WooCommerce webhook for you.', 'provedly'); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="provedly_webhook_secret"><?php esc_html_e('Signing secret', 'provedly'); ?></label></th>
                        <td>
                            <input name="<?php echo esc_attr(self::OPTION); ?>[webhook_secret]" id="provedly_webhook_secret" type="text" class="regular-text code" value="<?php echo esc_attr($s['webhook_secret']); ?>" autocomplete="off">
                            <p class="description"><?php esc_html_e('Any secret you like (at least 8 characters). Paste the same value into the Provedly source so each order is signature-checked.', 'provedly'); ?></p>
                        </td>
                    </tr>
                    <tr>
                        <th scope="row"><label for="provedly_host"><?php esc_html_e('Provedly host', 'provedly'); ?></label></th>
                        <td><input name="<?php echo esc_attr(self::OPTION); ?>[host]" id="provedly_host" type="url" class="regular-text code" value="<?php echo esc_attr($s['host']); ?>"></td>
                    </tr>
                </table>
                <?php submit_button(); ?>
            </form>
            <h2><?php esc_html_e('Status', 'provedly'); ?></h2>
            <ul>
                <li><?php echo $woo ? '✅ WooCommerce detected' : '⚠️ WooCommerce is not active: the widget and bars still load, orders will not sync.'; ?></li>
                <li><?php echo $s['widget_token'] !== '' ? '✅ Widget loads on the storefront' : '• No widget token yet'; ?></li>
                <li><?php echo $hook ? '✅ WooCommerce webhook "'.esc_html($hook->get_name()).'" is '.esc_html($hook->get_status()) : '• No webhook yet: paste the URL above and save'; ?></li>
            </ul>
        </div>
        <?php
    }
}

Provedly_Plugin::boot();