<?php
/**
 * This file is part of Rollora – Made-to-Measure Roller Blinds.
 * It is free software, licensed under GPL-2.0-or-later. See license.txt.
 * Blinds controlled CSV import — admin workflow (price books).
 *
 * Registers its own submenu page under the existing 'blinds-proto-import'
 * menu (hook admin_menu, priority 30, capability manage_options). This
 * file does NOT replace the existing staging-only preview page; it adds
 * the controlled workflow that page deliberately lacks: preview → diff
 * vs the active book → explicit approval → draft creation + activation.
 *
 * Three steps, one page, no auto-promotion:
 *  (a) Upload CSV — is_uploaded_file + nonce + capability, same column
 *      mapping as the existing page (width_min_mm→width_min,
 *      width_max_mm→width_max, drop_min_mm→drop_min, drop_max_mm→drop_max,
 *      price_pence→price, option_code→option_code). CSV flattened band
 *      rows only; XLSX is not parsed here.
 *  (b) Preview — staged rows + row-level errors + diff vs the active
 *      price book (blinds_price_book_diff_with_options). When errors
 *      exist, a clear "cannot promote with errors" block is shown and
 *      NO approve button is rendered at all.
 *  (c) Approve — a second nonce-checked button, "Approve and activate
 *      this price book", which re-validates the submitted staged rows
 *      (never trust the preview submission blindly), creates a draft
 *      book, and immediately activates it, recording the approver in
 *      activated_by / activated_at. That click IS the approval record.
 *
 * Promotion rule: zero errors AND an explicit approval click. Rejected
 * rows are shown in the preview, never silently dropped, and supplier
 * values are never silently changed: the approved book stores exactly
 * the staged rows that were previewed and re-validated.
 *
 * Safe loading: the admin_menu hook is only registered when add_action()
 * exists, and the page callback bails out when WordPress admin functions
 * or the price-book functions are unavailable. Loader order: require
 * class-blinds-price-books.php BEFORE this file (see parent handoff).
 */

declare(strict_types=1);

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

if (function_exists('add_action')) {
    add_action('admin_menu', 'blinds_import_admin_register_menu', 30);
}

function blinds_import_admin_register_menu(): void
{
    if (!function_exists('add_submenu_page')) {
        return;
    }
    add_submenu_page(
        'blinds-proto-import',
        'Rollora — Price Books: Controlled Import',
        'Price Books',
        'manage_options',
        'blinds-proto-price-books',
        'blinds_import_admin_render_page'
    );
}

/**
 * Column mapping shared with the existing staging-only import page.
 */
function blinds_import_admin_mapping(): array
{
    return [
        'width_min_mm' => 'width_min',
        'width_max_mm' => 'width_max',
        'drop_min_mm' => 'drop_min',
        'drop_max_mm' => 'drop_max',
        'price_pence' => 'price',
        'option_code' => 'option_code',
    ];
}

/**
 * Sanitize submitted staged rows (WordPress.org review, 2026-11-05).
 *
 * The approve step re-submits the previewed rows as JSON in a hidden
 * field, so every field must be sanitized here before it is stored —
 * json_decode() alone does not sanitize anything. Rules, most
 * restrictive per field type:
 *  - Only the allow-listed keys survive: row, width_min, width_max,
 *    drop_min, drop_max, price, option_code, fabric_group. Any other
 *    key (including injected keys) is dropped with the row.
 *  - Integer fields (row, width_min, width_max, drop_min, drop_max,
 *    price) must match /^-?\d+$/ and are cast to int. Non-integer
 *    values (floats, strings, arrays, objects) make the row malformed.
 *    Negative values are kept as-is so the validator can report them
 *    (MIN_GT_MAX / NEGATIVE_PRICE / NEGATIVE_DIMENSION) instead of
 *    being silently clamped.
 *  - option_code is a lowercase snake_case key: sanitize_key().
 *  - fabric_group is free text: sanitize_text_field().
 *  - A row that is not an array, or that fails any of the above, is
 *    counted in 'dropped' and NOT included in 'rows'. The caller must
 *    refuse approval when dropped > 0 — malformed rows are never
 *    silently dropped and never promoted.
 *
 * Pure function except for the WP sanitizers, which are guarded with
 * function_exists() fallbacks so it stays testable outside WordPress.
 *
 * @return array {rows: array, dropped: int}
 */
function blinds_import_admin_sanitize_staged_rows($staged): array
{
    $rows = [];
    $dropped = 0;
    if (!is_array($staged)) {
        return ['rows' => [], 'dropped' => 0];
    }
    $sanitizeKey = function ($value): string {
        if (function_exists('sanitize_key')) {
            return sanitize_key((string) $value);
        }
        return strtolower((string) preg_replace('/[^a-zA-Z0-9_\-]/', '', (string) $value));
    };
    $sanitizeText = function ($value): string {
        if (function_exists('sanitize_text_field')) {
            return sanitize_text_field((string) $value);
        }
        return trim(strip_tags((string) $value));
    };
    $allowedKeys = ['row', 'width_min', 'width_max', 'drop_min', 'drop_max', 'price', 'option_code', 'fabric_group'];
    foreach ($staged as $r) {
        if (!is_array($r)) {
            $dropped++;
            continue;
        }
        $malformed = false;
        // Any key outside the allow-list (e.g. an injected field) makes
        // the whole row malformed: it is refused, not silently stripped.
        foreach (array_keys($r) as $k) {
            if (!in_array($k, $allowedKeys, true)) {
                $malformed = true;
                break;
            }
        }
        $clean = [];
        // Row number: integer, required (the parser always sets it).
        $rowNo = $r['row'] ?? null;
        if (is_int($rowNo)) {
            $clean['row'] = $rowNo;
        } elseif (is_string($rowNo) && preg_match('/^\d+$/', trim($rowNo))) {
            $clean['row'] = (int) trim($rowNo);
        } else {
            $malformed = true;
        }
        // Integer fields: integer-like strings or ints only.
        foreach (['width_min', 'width_max', 'drop_min', 'drop_max', 'price'] as $f) {
            $v = $r[$f] ?? null;
            if (is_int($v)) {
                $clean[$f] = $v;
            } elseif (is_string($v) && preg_match('/^-?\d+$/', trim($v))) {
                $clean[$f] = (int) trim($v);
            } else {
                $malformed = true;
            }
        }
        // option_code: optional key, sanitized as a key when present.
        if (isset($r['option_code']) && $r['option_code'] !== '') {
            if (!is_string($r['option_code']) && !is_int($r['option_code'])) {
                $malformed = true;
            } else {
                $clean['option_code'] = $sanitizeKey($r['option_code']);
            }
        }
        // fabric_group: optional free text, sanitized as text when present.
        if (isset($r['fabric_group']) && $r['fabric_group'] !== '') {
            if (!is_string($r['fabric_group']) && !is_int($r['fabric_group'])) {
                $malformed = true;
            } else {
                $clean['fabric_group'] = $sanitizeText($r['fabric_group']);
            }
        }
        if ($malformed) {
            $dropped++;
            continue;
        }
        $rows[] = $clean;
    }
    return ['rows' => $rows, 'dropped' => $dropped];
}

function blinds_import_admin_render_page(): void
{
    if (!function_exists('current_user_can') || !current_user_can('manage_options')) {
        if (function_exists('wp_die')) {
            wp_die('You do not have permission to access this page.');
        }
        echo '<p>You do not have permission to access this page.</p>';
        return;
    }
    if (!class_exists('Blinds_Csv_Importer') || !function_exists('blinds_price_book_create')) {
        echo '<div class="wrap"><h1>Rollora — Price Books: Controlled Import</h1>';
        echo '<p>Import is unavailable: the CSV importer or price-book module is not loaded. Check the plugin loader order (price books before import admin).</p></div>';
        return;
    }


    echo '<div class="wrap"><h1>Blinds Price Books — Controlled Import</h1>';
    echo '<p><strong>SYNTHETIC defaults.</strong> CSV flattened band rows only. '
        . 'Nothing is promoted automatically: a book is created and activated only when you click '
        . '"Approve and activate this price book" on an error-free preview, and that click is recorded as the approval.</p>';

    // Existing books, newest last in storage; show newest first here.
    $books = function_exists('blinds_price_book_list') ? blinds_price_book_list() : [];
    $active = function_exists('blinds_price_book_get_active') ? blinds_price_book_get_active() : null;

    /* ---- Rollback (handled before rendering, so the display below is fresh) ----
     * WordPress.org review, 2026-11-05: blinds_price_book_rollback()
     * existed but no admin UI exposed it. A superseded book can now be
     * reactivated from the history table below. Capability is already
     * checked at the top of this page (manage_options); the action is
     * nonce-checked here. Only 'superseded' books can be rolled back —
     * the function itself enforces that — and the current active book
     * becomes superseded. Rollback is core safety, not premium-gated. */
    if (!empty($_POST['blinds_price_books_rollback'])
        && isset($_POST['blinds_price_books_rollback_nonce'])
        && function_exists('wp_verify_nonce')
        && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['blinds_price_books_rollback_nonce'])), 'blinds_price_books_rollback')) {
        $rollbackId = absint($_POST['blinds_price_books_rollback']);
        $rollbackUser = function_exists('get_current_user_id') ? (int) get_current_user_id() : 0;
        if (function_exists('blinds_price_book_rollback') && blinds_price_book_rollback($rollbackId, $rollbackUser)) {
            echo '<div class="notice notice-success"><p>Rolled back: price book #' . esc_html((string) $rollbackId)
                . ' is now the active price book. The previous active book is now superseded.</p></div>';
            $books = function_exists('blinds_price_book_list') ? blinds_price_book_list() : [];
            $active = function_exists('blinds_price_book_get_active') ? blinds_price_book_get_active() : null;
        } else {
            echo '<div class="notice notice-error"><p>Rollback failed: only a superseded price book can be rolled back (book #' . esc_html((string) $rollbackId) . ' was not superseded, or does not exist). Nothing was changed.</p></div>';
        }
    }

    /* ---- Step (c): approve (handled before rendering the forms) ---- */
    if (!empty($_POST['blinds_price_books_approve'])
        && isset($_POST['blinds_price_books_approve_nonce'])
        && function_exists('wp_verify_nonce')
        && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['blinds_price_books_approve_nonce'])), 'blinds_price_books_approve')) {
        $stagedJson = isset($_POST['blinds_staged_rows']) ? wp_unslash($_POST['blinds_staged_rows']) : '';
        $staged = json_decode((string) $stagedJson, true);
        $source = isset($_POST['blinds_source_filename']) ? sanitize_text_field(wp_unslash($_POST['blinds_source_filename'])) : '';
        $dataLabel = isset($_POST['blinds_data_label']) ? sanitize_text_field(wp_unslash($_POST['blinds_data_label'])) : 'SYNTHETIC';
        if (!is_array($staged)) {
            echo '<div class="notice notice-error"><p>Approval failed: the submitted staged data could not be read. Nothing was created or activated.</p></div>';
        } else {
            // Sanitize every submitted field first: json_decode() does
            // not sanitize. Malformed rows are refused, never silently
            // dropped and never promoted (review fix, 2026-11-05).
            $sanitized = blinds_import_admin_sanitize_staged_rows($staged);
            $validRows = $sanitized['rows'];
            if ($sanitized['dropped'] > 0) {
                echo '<div class="notice notice-error"><p>Approval refused: ' . esc_html((string) $sanitized['dropped'])
                    . ' submitted row(s) were malformed (non-integer measurements/prices, unexpected fields, or non-text option codes) and were not sanitized. Nothing was created or activated. Preview the CSV again.</p></div>';
            } else {
            // Re-validate on approval: never trust the preview submission.
            // Re-run the full row checks (numeric, min<=max, negative,
            // known option, overlap/duplicate/gap) on the submitted rows,
            // and block promotion while any row is unmapped to a band.
            $configForApproval = function_exists('blinds_proto_load_config') ? blinds_proto_load_config() : [];
            $knownForApproval = array_column($configForApproval['options'] ?? [], 'code');
            $errors = blinds_price_book_validate_rows($validRows, $knownForApproval);
            $unmappedForApproval = function_exists('blinds_price_book_unmapped_rows') ? blinds_price_book_unmapped_rows($validRows, $configForApproval) : [];
            if ($errors !== [] || $unmappedForApproval !== []) {
                echo '<div class="notice notice-error"><p>Approval refused: the submitted staged set did not pass validation'
                    . ' (' . esc_html((string) count($errors)) . ' errors, ' . esc_html((string) count($unmappedForApproval)) . ' unmapped rows). Nothing was created or activated.</p></div>';
            } else {
                $userId = function_exists('get_current_user_id') ? (int) get_current_user_id() : 0;
                $book = blinds_price_book_create($validRows, [], $source, $userId, $dataLabel);
                if (is_wp_error($book)) {
                    echo '<div class="notice notice-error"><p>Approval failed: ' . esc_html((string) $book->get_error_message()) . ' Nothing was activated.</p></div>';
                } elseif (!blinds_price_book_activate((int) $book['id'], $userId)) {
                    echo '<div class="notice notice-error"><p>Book #' . esc_html((string) $book['id']) . ' was created as a draft but activation failed. No book is active from this approval.</p></div>';
                } else {
                    echo '<div class="notice notice-success"><p>Approved and activated: price book #' . esc_html((string) $book['id'])
                        . ' (' . esc_html((string) count($validRows)) . ' rows, source: ' . esc_html((string) $source)
                        . ') is now the active price book. The previous active book, if any, is now superseded.</p></div>';
                    $active = blinds_price_book_get_active();
                }
            }
            }
        }
    }

    /* ---- Active price book (rendered AFTER the approve/rollback
     * handlers above, so it names the book that is active now) ----
     * 1.0.1 fix: this line was previously rendered before the approve
     * handler ran, so on the approval response it still named the
     * previous active book while the notice and history table below
     * already showed the newly activated one. $active is re-fetched
     * by the handlers above after any activation or rollback. */
    if ($active !== null) {
        echo '<h2>Active price book</h2><p>Book #' . esc_html((string) $active['id'] ?? '')
            . ' — source: ' . esc_html((string) $active['source_filename'] ?? '')
            . ' — rows: ' . esc_html((string) count($active['rows'] ?? []))
            . ' — label: ' . esc_html((string) ($active['data_label'] ?? 'SYNTHETIC'))
            . ' — activated by user ' . esc_html((string) $active['activated_by'] ?? '')
            . ' at ' . esc_html((string) $active['activated_at'] ?? '') . '</p>';
    } else {
        echo '<h2>Active price book</h2><p>None active yet.</p>';
    }

    /* ---- Step (a): upload ---- */
    echo '<h2>Step 1 — Upload CSV</h2>';
    echo '<form method="post" enctype="multipart/form-data">';
    wp_nonce_field('blinds_price_books_upload', 'blinds_price_books_upload_nonce');
    echo '<input type="file" name="blinds_csv" accept=".csv" required> ';
    echo '<button type="submit" name="blinds_price_books_upload" value="1">Preview import</button></form>';

    /* ---- Step (b): preview ---- */
    if (!empty($_POST['blinds_price_books_upload'])
        && isset($_FILES['blinds_csv']['tmp_name'])
        && isset($_POST['blinds_price_books_upload_nonce'])
        && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['blinds_price_books_upload_nonce'])), 'blinds_price_books_upload')) {
        if (!empty($_FILES['blinds_csv']['error']) || !is_uploaded_file(wp_unslash($_FILES['blinds_csv']['tmp_name']))) {
            echo '<div class="notice notice-error"><p>Import failed: no valid uploaded file.</p></div>';
        } else {
            $csv = file_get_contents(wp_unslash($_FILES['blinds_csv']['tmp_name']));
            $sourceName = isset($_FILES['blinds_csv']['name']) ? sanitize_file_name(wp_unslash($_FILES['blinds_csv']['name'])) : '';
            $config = function_exists('blinds_proto_load_config') ? blinds_proto_load_config() : [];
            $known = array_column($config['options'] ?? [], 'code');
            $parsed = (new Blinds_Csv_Importer())->parse((string) $csv, blinds_import_admin_mapping(), $known);
            $rows = $parsed['rows'];
            $errors = $parsed['errors'];

            echo '<h2>Step 2 — Preview</h2>';
            echo '<p>Source: ' . esc_html((string) $sourceName) . ' — staged rows: ' . esc_html((string) count($rows)) . ' — errors: ' . esc_html((string) count($errors)) . '</p>';

            if ($errors !== []) {
                echo '<h3>Row-level errors</h3><pre style="overflow-x:auto;max-width:100%">' . esc_html((string) print_r($errors, true)) . '</pre>';
            }
            echo '<h3>Staged rows</h3><pre style="overflow-x:auto;max-width:100%">' . esc_html((string) print_r($rows, true)) . '</pre>';

            $activeRows = ($active !== null && isset($active['rows']) && is_array($active['rows'])) ? $active['rows'] : [];
            $diff = blinds_price_book_diff_with_options($activeRows, $rows);
            echo '<h3>Diff vs active price book</h3>';
            echo '<p>Added: ' . esc_html((string) count($diff['added'])) . ' — Changed (price, option_code, or fabric_group): '
                . esc_html((string) count($diff['changed'])) . ' — Removed: ' . esc_html((string) count($diff['removed'])) . '</p>';
            echo '<pre style="overflow-x:auto;max-width:100%">' . esc_html((string) print_r($diff, true)) . '</pre>';

            if (!blinds_price_book_validate_staged($rows, $errors)) {
                // No approve button is rendered on this path, by design.
                echo '<div class="notice notice-error"><p><strong>Cannot promote with errors.</strong> '
                    . 'Fix the CSV and preview again. Rejected rows are shown above — none are silently dropped, '
                    . 'and no price book has been created or activated from this upload.</p></div>';
            } else {
                $unmapped = function_exists('blinds_price_book_unmapped_rows') ? blinds_price_book_unmapped_rows($rows, $config) : [];
                if ($unmapped !== []) {
                    echo '<div class="notice notice-error"><p><strong>Cannot promote: ' . esc_html((string) count($unmapped)) . ' row(s) do not match a configured width/drop band.</strong> '
                        . 'Band rows must match the configured bands exactly, or they cannot become matrix prices. '
                        . 'Fix the CSV (or the band configuration) and preview again. No price book has been created or activated.</p></div>';
                    echo '<pre style="overflow-x:auto;max-width:100%">' . esc_html((string) print_r($unmapped, true)) . '</pre>';
                } else {
                echo '<h2>Step 3 — Approve</h2>';
                echo '<p>Review the staged rows and diff above. Approving creates a draft price book and immediately '
                    . 'activates it; the previous active book becomes superseded. This action is recorded with your user id.</p>';
                echo '<form method="post">';
                wp_nonce_field('blinds_price_books_approve', 'blinds_price_books_approve_nonce');
                echo '<input type="hidden" name="blinds_staged_rows" value="' . esc_attr(wp_json_encode($rows)) . '">';
                echo '<input type="hidden" name="blinds_source_filename" value="' . esc_attr($sourceName) . '">';
                echo '<input type="hidden" name="blinds_data_label" value="SYNTHETIC">';
                echo '<button type="submit" name="blinds_price_books_approve" value="1" class="button button-primary">Approve and activate this price book</button></form>';
                }
            }
        }
    }

    /* ---- Price-book history and rollback (review fix, 2026-11-05) ----
     * The book list was previously fetched but never rendered. It is now
     * shown in full, newest first, with a rollback action for superseded
     * books. Re-fetch here so the table reflects any approval or
     * rollback handled above on this same request. */
    $books = function_exists('blinds_price_book_list') ? blinds_price_book_list() : [];
    $active = function_exists('blinds_price_book_get_active') ? blinds_price_book_get_active() : null;
    echo '<h2>Price-book history</h2>';
    if ($books === []) {
        echo '<p>No price books yet. Upload a CSV above to create the first one.</p>';
    } else {
        echo '<p>Exactly one book is active at a time. Activating a book supersedes the previous one. Rolling back reactivates a superseded book; the current active book becomes superseded.</p>';
        echo '<table class="widefat striped"><thead><tr><th>Book</th><th>Status</th><th>Source</th><th>Rows</th><th>Label</th><th>Created</th><th>Activated</th><th>Action</th></tr></thead><tbody>';
        foreach (array_reverse($books) as $b) {
            if (!is_array($b)) {
                continue;
            }
            $bookId = (int) ($b['id'] ?? 0);
            $status = (string) ($b['status'] ?? '');
            echo '<tr><td>#' . esc_html((string) $bookId) . '</td>'
                . '<td>' . esc_html($status) . '</td>'
                . '<td>' . esc_html((string) ($b['source_filename'] ?? '')) . '</td>'
                . '<td>' . esc_html((string) count($b['rows'] ?? [])) . '</td>'
                . '<td>' . esc_html((string) ($b['data_label'] ?? 'SYNTHETIC')) . '</td>'
                . '<td>' . esc_html((string) ($b['created_at'] ?? '')) . '</td>'
                . '<td>' . esc_html((string) (($b['activated_by'] ?? '') . ' / ' . ($b['activated_at'] ?? ''))) . '</td><td>';
            if ($status === 'superseded') {
                echo '<form method="post" style="margin:0;">';
                wp_nonce_field('blinds_price_books_rollback', 'blinds_price_books_rollback_nonce');
                echo '<button type="submit" name="blinds_price_books_rollback" value="' . esc_attr((string) $bookId) . '" class="button" onclick="return confirm(\'Roll back to price book #' . esc_js((string) $bookId) . '? It will become the active price book and the current active book will become superseded.\');">Roll back to this book</button></form>';
            } elseif ($status === 'active') {
                echo 'Active';
            } else {
                echo '&mdash;';
            }
            echo '</td></tr>';
        }
        echo '</tbody></table>';
    }

    echo '</div>';
}