<?php
/**
 * TOOL: wp_list_autoloaded_code
 *
 * Inventories mu-plugins and WordPress drop-ins. Both autoload with no
 * admin-UI listing, which makes them a common persistence spot. Hashes
 * only — no manifest exists for either, since they aren't part of core.
 *
 * @package MIINTG
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Drop-in filenames this tool checks for in WP_CONTENT_DIR.
 *
 * @return string[]
 */
function miintg_dropin_filenames() {
	return array(
		'object-cache.php',
		'advanced-cache.php',
		'db.php',
		'maintenance.php',
		'sunrise.php',
	);
}

/**
 * @param array $args Unused; reserved for future filtering.
 * @return array
 */
function miintg_list_autoloaded_code( $args = array() ) {
	$limits = miintg_limits();
	$walker = new MIINTG_FileWalker(
		array(
			'max_files'      => $limits['max_files'],
			'max_depth'      => $limits['max_depth'],
			'max_read_bytes' => $limits['max_read_bytes'],
		)
	);

	/* ---------------------------------------------------------------
	 * mu-plugins: only top-level *.php files autoload. Subdirectories
	 * hold supporting code for those files and are named, not hashed.
	 * ------------------------------------------------------------ */

	$mu_dir = defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : WP_CONTENT_DIR . '/mu-plugins';

	$mu_plugins = array(
		'dir_exists'    => is_dir( $mu_dir ),
		'php_files'     => array(),
		'other_files'   => array(),
		'subdirectories'=> array(),
	);

	if ( $mu_plugins['dir_exists'] ) {
		foreach ( $walker->walk( $mu_dir, false ) as $abs_path ) {
			$entry = $walker->describe( $abs_path, true );

			if ( 'php' === $entry['ext'] ) {
				$mu_plugins['php_files'][] = $entry;
			} else {
				$mu_plugins['other_files'][] = $entry;
			}
		}

		$handle = @opendir( $mu_dir );
		if ( $handle ) {
			while ( false !== ( $item = readdir( $handle ) ) ) {
				if ( '.' === $item || '..' === $item ) {
					continue;
				}
				if ( is_dir( $mu_dir . DIRECTORY_SEPARATOR . $item ) ) {
					$mu_plugins['subdirectories'][] = $item;
				}
			}
			closedir( $handle );
			sort( $mu_plugins['subdirectories'] );
		}
	}

	/* ---------------------------------------------------------------
	 * Drop-ins: fixed filenames, direct children of WP_CONTENT_DIR.
	 * Presence alone isn't necessarily malicious (caching plugins add
	 * object-cache.php legitimately) — surfaced for review, not as an
	 * automatic critical.
	 * ------------------------------------------------------------ */

	$drop_ins = array(
		'present' => array(),
		'absent'  => array(),
	);

	foreach ( miintg_dropin_filenames() as $filename ) {
		$abs_path = trailingslashit( WP_CONTENT_DIR ) . $filename;

		if ( file_exists( $abs_path ) && is_file( $abs_path ) ) {
			$drop_ins['present'][] = $walker->describe( $abs_path, true );
		} else {
			$drop_ins['absent'][] = $filename;
		}
	}

	$max = $limits['max_results'];

	$result = array(
		'mu_plugins_dir'      => $walker->relpath( $mu_dir ),
		'mu_plugins'          => array(
			'dir_exists'      => $mu_plugins['dir_exists'],
			'php_file_count'  => count( $mu_plugins['php_files'] ),
			'other_file_count'=> count( $mu_plugins['other_files'] ),
			'php_files'       => array_slice( $mu_plugins['php_files'], 0, $max ),
			'other_files'     => array_slice( $mu_plugins['other_files'], 0, $max ),
			'subdirectories'  => $mu_plugins['subdirectories'],
		),
		'drop_ins'            => array(
			'present_count' => count( $drop_ins['present'] ),
			'present'       => $drop_ins['present'],
			'absent'        => $drop_ins['absent'],
		),
		'truncated'           => ( count( $mu_plugins['php_files'] ) > $max || count( $mu_plugins['other_files'] ) > $max ),
		'notes'               => 'Inventory only, no comparison manifest exists for mu-plugins or drop-ins. Subdirectory contents under mu-plugins are named, not hashed. Drop-in presence is not itself a finding — review against what was intentionally installed.',
	);

	return miintg_envelope( 'wp_list_autoloaded_code', $result );
}