<?php
/**
 * Login widget inside the theme's login form.
 *
 * @package Rahkar\WP
 */

declare( strict_types = 1 );

namespace Rahkar\WP\Modules\OtpAuth;

use Rahkar\WP\Plugin;
use Rahkar\WP\Support\InlineStyle;
use Rahkar\WP\Support\Settings;

defined( 'ABSPATH' ) || exit;

/**
 * Adds code login to whatever login form the active theme renders.
 *
 * The two hooks it uses — `woocommerce_login_form_start` and
 * `woocommerce_register_form_start` — are WooCommerce's own, fired by every
 * theme's login form because they all render through WooCommerce's template.
 * So this is theme-agnostic by construction. In Woodmart that one hook reaches
 * every entry point the theme has: the header account popup, the my-account
 * page, the checkout login, the Elementor widget, the WPBakery shortcode and
 * the block — without touching a template.
 *
 * The panel holds the same widget the standalone login page uses, in the skin
 * chosen on the skins screen.
 *
 * ## Why nothing is enqueued
 *
 * Some themes — Woodmart among them — render a login form on **every page**,
 * whether or not anyone opens it. Enqueueing the widget here would put its
 * script and stylesheets on every page view of the store, paid by every visitor
 * so that the few who log in get a form that is already wired up.
 *
 * So the panel renders as markup, and a small inline loader fetches the script
 * the first time someone engages with it. When the panel is shown open from the
 * start (code login as the default) its stylesheets are printed with it, since
 * an unstyled form would be on screen; when it starts closed they wait for the
 * first click like the script.
 */
final class LoginPanel {

	/** The theme's own form is shown first; a button switches to code login. */
	public const MODE_PASSWORD_FIRST = 'password_first';

	/** Code login is shown first; a link goes back to the password form. */
	public const MODE_OTP_FIRST = 'otp_first';

	/** Code login is the only method offered. */
	public const MODE_OTP_ONLY = 'otp_only';

	/**
	 * Has the shared loader been printed on this request?
	 *
	 * @var bool
	 */
	private static bool $bootstrapPrinted = false;

	/**
	 * Have the flash-preventing rules been printed on this request?
	 *
	 * @var bool
	 */
	private static bool $criticalPrinted = false;

	/**
	 * Have the stylesheets been printed on this request?
	 *
	 * @var bool
	 */
	private static bool $stylesPrinted = false;

	/**
	 * Whether a caller has demanded the panel open regardless of the setting.
	 *
	 * @var bool
	 */
	private static bool $forcedOpen = false;

	/**
	 * Open the panel for the next render, whatever the site-wide default is.
	 *
	 * Used by {@see CheckoutGate}, where proving a phone number is the entire
	 * point of the screen. A gate that opened on a password form would strand
	 * every customer who does not have an account yet.
	 *
	 * Never downgrades an explicit "code only" choice.
	 */
	public static function forceOpen(): void {
		self::$forcedOpen = true;
	}

	/**
	 * Inject the panel into a login form.
	 *
	 * @internal Hooked callback.
	 */
	public function renderLoginPanel(): void {
		$this->renderPanel(
			__( 'ورود با کد پیامکی', 'rahkar-toolkit' ),
			__( 'ورود با رمز عبور', 'rahkar-toolkit' )
		);
	}

	/**
	 * Inject the panel into a register form.
	 *
	 * The same flow serves both: verifying a number that has no account creates
	 * one, so there is nothing extra to register.
	 *
	 * @internal Hooked callback.
	 */
	public function renderRegisterPanel(): void {
		$this->renderPanel(
			__( 'ثبت‌نام با شماره موبایل', 'rahkar-toolkit' ),
			__( 'ثبت‌نام با ایمیل', 'rahkar-toolkit' )
		);
	}

	/**
	 * Which login methods this render should offer.
	 *
	 * Not memoised: a page can render several login forms — the header popup
	 * paints long before the checkout content — and {@see self::forceOpen()} may
	 * be called in between. A cached value would let the header decide what the
	 * checkout shows.
	 */
	private function mode(): string {
		$stored = (string) Settings::get( OtpAuthModule::SLUG . '.login_mode', self::MODE_PASSWORD_FIRST );

		$mode = in_array( $stored, [ self::MODE_PASSWORD_FIRST, self::MODE_OTP_FIRST, self::MODE_OTP_ONLY ], true )
			? $stored
			: self::MODE_PASSWORD_FIRST;

		// The store asked for no password forms anywhere.
		if ( OtpAuthModule::codeOnly() ) {
			return self::MODE_OTP_ONLY;
		}

		// Promote, never demote: a store that chose "code only" keeps it.
		if ( self::$forcedOpen && self::MODE_PASSWORD_FIRST === $mode ) {
			$mode = self::MODE_OTP_FIRST;
		}

		return $mode;
	}

	/**
	 * Emit one panel.
	 *
	 * @param string $switchLabel Text for the button that opens the panel.
	 * @param string $backLabel   Text for the link back to the theme's form.
	 */
	private function renderPanel( string $switchLabel, string $backLabel ): void {
		// Codes are not getting through: the theme's own form, untouched, is the
		// way in until they are. See Failsafe.
		if ( Failsafe::isActive() ) {
			return;
		}

		$mode     = $this->mode();
		$otpFirst = self::MODE_PASSWORD_FIRST !== $mode;
		$otpOnly  = self::MODE_OTP_ONLY === $mode;

		// The active class is rendered by PHP rather than added by script: adding
		// it on load would let the theme's password form paint first and then
		// vanish — a visible flash on every page for a store that chose code
		// login as its default.
		$classes = 'rahkar-wd' . ( $otpFirst ? ' is-active' : '' ) . ( $otpOnly ? ' is-only' : '' );

		$this->printCriticalStylesOnce();

		if ( $otpFirst ) {
			$this->printStylesOnce();
		}

		$purpose = self::$forcedOpen ? LoginWidget::PURPOSE_CHECKOUT : LoginWidget::PURPOSE_EMBEDDED;
		$widget  = Plugin::make( LoginWidget::class );

		?>
		<div class="<?php echo esc_attr( $classes ); ?>" data-rahkar-wd data-mode="<?php echo esc_attr( $mode ); ?>">
			<?php if ( ! $otpFirst ) : ?>
				<button type="button" class="button btn rahkar-wd__switch" data-rahkar-open><?php echo esc_html( $switchLabel ); ?></button>
			<?php endif; ?>
			<div class="rahkar-wd__panel" data-rahkar-panel<?php echo $otpFirst ? '' : ' hidden'; ?>>
				<?php $widget->output( $purpose ); ?>
				<?php if ( ! $otpOnly ) : ?>
					<p class="rahkar-wd__foot">
						<button type="button" class="rahkar-wd__back" data-rahkar-close><?php echo esc_html( $backLabel ); ?></button>
					</p>
				<?php endif; ?>
			</div>
		</div>
		<?php

		$this->printBootstrapOnce();
	}

	/**
	 * Hide the theme's own fields behind an open panel, before first paint, and
	 * lay out the panel's own chrome.
	 *
	 * Inline, because a panel that renders open needs the theme's password
	 * fields gone before the page is shown; waiting for a stylesheet makes them
	 * flash into view and vanish.
	 */
	private function printCriticalStylesOnce(): void {
		if ( self::$criticalPrinted ) {
			return;
		}

		self::$criticalPrinted = true;
		?>
		<?php ob_start(); ?>
		.rahkar-wd.is-active~p,.rahkar-wd.is-active~.login-form-footer,.rahkar-wd.is-active~.wd-login-divider,.rahkar-wd.is-active~.wd-social-login{display:none}
		.rahkar-wd__panel[hidden]{display:none}
		.rahkar-wd__switch{width:100%;margin-bottom:1rem}
		.rahkar-wd__foot{margin:1rem 0 0;text-align:center}
		.rahkar-wd__back{background:none;border:0;padding:0;font:inherit;color:inherit;text-decoration:underline;cursor:pointer}
		<?php InlineStyle::printBuffered( 'rahkar-otp-critical' ); ?>
		<?php
	}

	/**
	 * Print the widget's stylesheets where the panel is, once.
	 */
	private function printStylesOnce(): void {
		if ( self::$stylesPrinted ) {
			return;
		}

		self::$stylesPrinted = true;

		foreach ( LoginWidget::styleUrls() as $handle => $url ) {
			// Registered and printed here, beside a panel that is shown open, rather
			// than enqueued: enqueueing would put the stylesheet on every page.
			wp_register_style( $handle, $url, [], RAHKAR_WP_VERSION );
			wp_print_styles( $handle );
		}
	}

	/**
	 * Print the on-demand loader, once per request.
	 */
	private function printBootstrapOnce(): void {
		if ( self::$bootstrapPrinted ) {
			return;
		}

		self::$bootstrapPrinted = true;

		$assets = [
			'script' => add_query_arg( 'ver', RAHKAR_WP_VERSION, LoginWidget::scriptUrl() ),
			'styles' => array_map(
				static fn( string $url ): string => add_query_arg( 'ver', RAHKAR_WP_VERSION, $url ),
				array_values( LoginWidget::styleUrls() )
			),
		];
		?>
		<?php ob_start(); ?>
		( function () {
			var assets = <?php echo wp_json_encode( $assets ); ?>;
			var loaded = false;

			// Fetched once, the first time anyone engages with a panel. Woodmart
			// puts a login form on every page, so loading these up front would
			// charge every visitor for a form most of them never open.
			function loadAssets() {
				if ( loaded ) {
					if ( window.rahkarLoginBoot ) { window.rahkarLoginBoot( document ); }
					return;
				}
				loaded = true;
				assets.styles.forEach( function ( href ) {
					if ( document.querySelector( 'link[href="' + href + '"]' ) ) { return; }
					var link = document.createElement( 'link' );
					link.rel = 'stylesheet';
					link.href = href;
					document.head.appendChild( link );
				} );
				var script = document.createElement( 'script' );
				script.src = assets.script;
				script.defer = true;
				document.body.appendChild( script );
			}

			function open( wrap ) {
				if ( ! wrap ) { return; }
				wrap.classList.add( 'is-active' );
				var panel = wrap.querySelector( '[data-rahkar-panel]' );
				if ( panel ) { panel.hidden = false; }
				loadAssets();
			}

			function close( wrap ) {
				// In code-only mode there is nothing to go back to.
				if ( ! wrap || wrap.classList.contains( 'is-only' ) ) { return; }
				wrap.classList.remove( 'is-active' );
				var panel = wrap.querySelector( '[data-rahkar-panel]' );
				if ( panel ) { panel.hidden = true; }
			}

			// One delegated listener for the whole document: Woodmart injects login
			// forms over AJAX, and delegation keeps working for markup that
			// appears after this ran.
			document.addEventListener( 'click', function ( event ) {
				if ( ! event.target.closest ) { return; }
				var opener = event.target.closest( '[data-rahkar-open]' );
				if ( opener ) {
					event.preventDefault();
					open( opener.closest( '[data-rahkar-wd]' ) );
					return;
				}
				var closer = event.target.closest( '[data-rahkar-close]' );
				if ( closer ) {
					event.preventDefault();
					close( closer.closest( '[data-rahkar-wd]' ) );
				}
			} );

			// With code login as the default there is no button to press, so the
			// trigger is touching the panel at all. `focusin` fires before any
			// keystroke, so the script is ready by the time a number is typed.
			document.addEventListener( 'focusin', function ( event ) {
				if ( event.target.closest && event.target.closest( '[data-rahkar-wd].is-active' ) ) {
					loadAssets();
				}
			} );
		} )();
		<?php wp_print_inline_script_tag( (string) ob_get_clean(), [ 'id' => 'rahkar-otp-boot' ] ); ?>
		<?php
	}
}