<?php
/**
 * Main plugin class.
 *
 * @package SameSquareEditableQRCodes
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Registers QR codes, redirects, statistics, and editor integrations.
 */
final class SMSQR_Plugin {

	/** Post type used for QR codes. */
	const POST_TYPE = 'smsqr_code';

	/** Public redirect query variable. */
	const QUERY_VAR = 'smsqr';

	/** Database version option. */
	const DB_VERSION_OPTION = 'smsqr_db_version';

	/** Destination URL meta key. */
	const META_DESTINATION = '_smsqr_destination';

	/** Public token meta key. */
	const META_TOKEN = '_smsqr_token';

	/** Foreground color meta key. */
	const META_FOREGROUND = '_smsqr_foreground';

	/** Background color meta key. */
	const META_BACKGROUND = '_smsqr_background';

	/** Start timestamp meta key. */
	const META_STARTS_AT = '_smsqr_starts_at';

	/** Expiration timestamp meta key. */
	const META_EXPIRES_AT = '_smsqr_expires_at';

	/** Print card layout meta key. */
	const META_CARD_LAYOUT = '_smsqr_card_layout';

	/** Print card heading meta key. */
	const META_CARD_HEADING = '_smsqr_card_heading';

	/** Print card description meta key. */
	const META_CARD_DESCRIPTION = '_smsqr_card_description';

	/** Print card paper size meta key. */
	const META_CARD_PAPER = '_smsqr_card_paper';

	/** Print card orientation meta key. */
	const META_CARD_ORIENTATION = '_smsqr_card_orientation';

	/** Print card name visibility meta key. */
	const META_CARD_SHOW_NAME = '_smsqr_card_show_name';

	/** Print card URL visibility meta key. */
	const META_CARD_SHOW_URL = '_smsqr_card_show_url';

	/** Print card logo attachment meta key. */
	const META_CARD_LOGO_ID = '_smsqr_card_logo_id';

	/** Print card background color meta key. */
	const META_CARD_BACKGROUND = '_smsqr_card_background';

	/** Print card text color meta key. */
	const META_CARD_TEXT = '_smsqr_card_text';

	/**
	 * Singleton instance.
	 *
	 * @var SMSQR_Plugin|null
	 */
	private static $instance = null;

	/**
	 * Return the plugin instance.
	 *
	 * @return SMSQR_Plugin
	 */
	public static function instance() {
		if ( null === self::$instance ) {
			self::$instance = new self();
		}

		return self::$instance;
	}

	/**
	 * Register hooks.
	 */
	private function __construct() {
		add_action( 'plugins_loaded', array( $this, 'maybe_upgrade_database' ) );
		add_action( 'init', array( $this, 'register_post_type' ), 5 );
		add_action( 'init', array( $this, 'register_assets' ), 6 );
		add_action( 'init', array( $this, 'register_rewrite_rules' ), 7 );
		add_action( 'init', array( $this, 'register_block' ), 8 );
		add_filter( 'query_vars', array( $this, 'register_query_var' ) );
		add_action( 'template_redirect', array( $this, 'handle_redirect' ), 0 );
		add_action( 'add_meta_boxes_' . self::POST_TYPE, array( $this, 'add_meta_boxes' ) );
		add_action( 'save_post_' . self::POST_TYPE, array( $this, 'save_code' ), 10, 2 );
		add_action( 'before_delete_post', array( $this, 'delete_scan_data' ), 10, 2 );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_admin_assets' ) );
		add_action( 'admin_menu', array( $this, 'register_admin_menu' ) );
		add_action( 'enqueue_block_editor_assets', array( $this, 'prepare_block_editor' ) );
		add_action( 'admin_notices', array( $this, 'render_admin_notice' ) );
		add_filter( 'manage_' . self::POST_TYPE . '_posts_columns', array( $this, 'manage_columns' ) );
		add_action( 'manage_' . self::POST_TYPE . '_posts_custom_column', array( $this, 'render_column' ), 10, 2 );
		add_filter( 'enter_title_here', array( $this, 'title_placeholder' ), 10, 2 );
		add_filter( 'post_updated_messages', array( $this, 'post_updated_messages' ) );
		add_filter( 'plugin_action_links_' . plugin_basename( SMSQR_PLUGIN_FILE ), array( $this, 'add_plugin_action_links' ) );
		add_shortcode( 'same_square_qr', array( $this, 'render_shortcode' ) );
	}

	/**
	 * Add the analytics screen beneath the Same Square menu.
	 */
	public function register_admin_menu() {
		add_submenu_page(
			'edit.php?post_type=' . self::POST_TYPE,
			__( 'Scan Analytics', 'same-square' ),
			__( 'Analytics', 'same-square' ),
			'edit_others_posts',
			'smsqr-analytics',
			array( $this, 'render_analytics_page' )
		);
	}

	/**
	 * Create required data structures when the plugin is activated.
	 */
	public static function activate() {
		self::install_database();
		self::register_post_type_definition();
		self::register_rewrite_rules_definition();
		flush_rewrite_rules();
	}

	/**
	 * Flush rewrite rules when the plugin is deactivated.
	 */
	public static function deactivate() {
		flush_rewrite_rules();
	}

	/**
	 * Install or update the aggregate scan table.
	 */
	private static function install_database() {
		global $wpdb;

		$table_name      = $wpdb->prefix . 'smsqr_scans';
		$charset_collate = $wpdb->get_charset_collate();
		$sql             = "CREATE TABLE {$table_name} (
			code_id bigint(20) unsigned NOT NULL,
			scan_date date NOT NULL,
			scans bigint(20) unsigned NOT NULL DEFAULT 0,
			PRIMARY KEY  (code_id,scan_date),
			KEY scan_date (scan_date)
		) {$charset_collate};";

		require_once ABSPATH . 'wp-admin/includes/upgrade.php';
		dbDelta( $sql );
		update_option( self::DB_VERSION_OPTION, SMSQR_DB_VERSION, false );
	}

	/**
	 * Keep the scan table in sync after plugin updates.
	 */
	public function maybe_upgrade_database() {
		if ( SMSQR_DB_VERSION !== get_option( self::DB_VERSION_OPTION ) ) {
			self::install_database();
		}
	}

	/**
	 * Register the QR code post type.
	 */
	public function register_post_type() {
		self::register_post_type_definition();
	}

	/**
	 * Shared post type registration for init and activation.
	 */
	private static function register_post_type_definition() {
		$labels = array(
			'name'               => __( 'QR Codes', 'same-square' ),
			'singular_name'      => __( 'QR Code', 'same-square' ),
			'menu_name'          => __( 'Same Square', 'same-square' ),
			'name_admin_bar'     => __( 'QR Code', 'same-square' ),
			'add_new'            => __( 'Add New', 'same-square' ),
			'add_new_item'       => __( 'Add New QR Code', 'same-square' ),
			'edit_item'          => __( 'Edit QR Code', 'same-square' ),
			'new_item'           => __( 'New QR Code', 'same-square' ),
			'view_item'          => __( 'View QR Code', 'same-square' ),
			'search_items'       => __( 'Search QR Codes', 'same-square' ),
			'not_found'          => __( 'No QR codes found.', 'same-square' ),
			'not_found_in_trash' => __( 'No QR codes found in Trash.', 'same-square' ),
			'all_items'          => __( 'All QR Codes', 'same-square' ),
		);

		register_post_type(
			self::POST_TYPE,
			array(
				'labels'              => $labels,
				'public'              => false,
				'publicly_queryable'  => false,
				'show_ui'             => true,
				'show_in_menu'        => true,
				'show_in_admin_bar'   => true,
				'show_in_rest'        => false,
				'exclude_from_search' => true,
				'menu_icon'           => 'dashicons-grid-view',
				'menu_position'       => 58,
				'supports'            => array( 'title' ),
				'map_meta_cap'        => true,
				'capability_type'     => 'post',
			)
		);
	}

	/**
	 * Register public and editor assets.
	 */
	public function register_assets() {
		wp_register_script(
			'smsqr-qrcode',
			SMSQR_PLUGIN_URL . 'assets/js/vendor/qrcode.js',
			array(),
			'2.0.4',
			true
		);

		wp_register_script(
			'smsqr-frontend',
			SMSQR_PLUGIN_URL . 'assets/js/frontend.js',
			array( 'smsqr-qrcode' ),
			SMSQR_VERSION,
			true
		);

		wp_register_script(
			'smsqr-admin',
			SMSQR_PLUGIN_URL . 'assets/js/admin.js',
			array( 'smsqr-frontend' ),
			SMSQR_VERSION,
			true
		);

		wp_register_script(
			'smsqr-block-editor',
			SMSQR_PLUGIN_URL . 'assets/js/block.js',
			array( 'wp-blocks', 'wp-block-editor', 'wp-components', 'wp-element', 'wp-i18n', 'smsqr-frontend' ),
			SMSQR_VERSION,
			true
		);

		wp_register_style(
			'smsqr-frontend',
			SMSQR_PLUGIN_URL . 'assets/css/frontend.css',
			array(),
			SMSQR_VERSION
		);

		wp_register_style(
			'smsqr-admin',
			SMSQR_PLUGIN_URL . 'assets/css/admin.css',
			array(),
			SMSQR_VERSION
		);
	}

	/**
	 * Register the dynamic QR block from metadata.
	 */
	public function register_block() {
		register_block_type(
			SMSQR_PLUGIN_DIR . 'blocks/qr-code',
			array(
				'editor_script'   => 'smsqr-block-editor',
				'render_callback' => array( $this, 'render_block' ),
			)
		);
	}

	/**
	 * Register the public redirect route.
	 */
	public function register_rewrite_rules() {
		self::register_rewrite_rules_definition();
	}

	/**
	 * Shared rewrite rule registration.
	 */
	private static function register_rewrite_rules_definition() {
		add_rewrite_rule( '^same-square/([a-z0-9]{12})/?$', 'index.php?' . self::QUERY_VAR . '=$matches[1]', 'top' );
	}

	/**
	 * Add the redirect token to public query variables.
	 *
	 * @param string[] $query_vars Public query variables.
	 * @return string[]
	 */
	public function register_query_var( $query_vars ) {
		$query_vars[] = self::QUERY_VAR;
		return $query_vars;
	}

	/**
	 * Redirect a valid QR scan and record an aggregate count.
	 */
	public function handle_redirect() {
		$token = get_query_var( self::QUERY_VAR );

		// The public scan token cannot have a nonce; it is validated against a strict 12-character pattern below.
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( ! $token && isset( $_GET[ self::QUERY_VAR ] ) ) {
			// phpcs:ignore WordPress.Security.NonceVerification.Recommended
			$token = sanitize_key( wp_unslash( $_GET[ self::QUERY_VAR ] ) );
		}

		if ( ! is_string( $token ) || ! preg_match( '/^[a-z0-9]{12}$/', $token ) ) {
			return;
		}

		$code_ids = get_posts(
			array(
				'post_type'              => self::POST_TYPE,
				'post_status'            => 'publish',
				'posts_per_page'         => 1,
				'fields'                 => 'ids',
				'no_found_rows'          => true,
				'ignore_sticky_posts'    => true,
				'update_post_meta_cache' => false,
				'update_post_term_cache' => false,
				'meta_key'               => self::META_TOKEN, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- A unique token lookup is required for the redirect route.
				'meta_value'             => $token, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- A unique token lookup is required for the redirect route.
			)
		);

		if ( empty( $code_ids ) ) {
			$this->stop_scan( __( 'This QR code is not available.', 'same-square' ), 404 );
		}

		$code_id = (int) $code_ids[0];
		$status  = $this->get_code_status( $code_id );

		if ( 'scheduled' === $status ) {
			$this->stop_scan( __( 'This QR code is not active yet.', 'same-square' ), 404 );
		}

		if ( 'expired' === $status ) {
			$this->stop_scan( __( 'This QR code has expired.', 'same-square' ), 410 );
		}

		if ( 'active' !== $status ) {
			$this->stop_scan( __( 'This QR code is not available.', 'same-square' ), 404 );
		}

		$destination = get_post_meta( $code_id, self::META_DESTINATION, true );

		if ( ! is_string( $destination ) || ! $this->is_valid_destination( $destination ) ) {
			$this->stop_scan( __( 'This QR code does not have a valid destination.', 'same-square' ), 404 );
		}

		if ( ! defined( 'DONOTCACHEPAGE' ) ) {
			// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- Standard cache-plugin interoperability constant.
			define( 'DONOTCACHEPAGE', true );
		}

		$this->record_scan( $code_id );
		nocache_headers();
		header( 'X-Robots-Tag: noindex, nofollow, noarchive', true );
		wp_redirect( $destination, 302, 'Same Square' ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- External destinations are the purpose of this redirect endpoint.
		exit;
	}

	/**
	 * End a scan request with a small error response.
	 *
	 * @param string $message Message displayed to the visitor.
	 * @param int    $status  HTTP status code.
	 */
	private function stop_scan( $message, $status ) {
		nocache_headers();
		header( 'X-Robots-Tag: noindex, nofollow, noarchive', true );
		wp_die(
			esc_html( $message ),
			esc_html__( 'QR code unavailable', 'same-square' ),
			array( 'response' => (int) $status )
		);
	}

	/**
	 * Increment the privacy-friendly daily scan counter.
	 *
	 * @param int $code_id QR code post ID.
	 */
	private function record_scan( $code_id ) {
		global $wpdb;

		$table_name = $wpdb->prefix . 'smsqr_scans';
		$scan_date  = wp_date( 'Y-m-d' );

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- An atomic aggregate counter requires one direct write and stores no personal data.
		$wpdb->query(
			$wpdb->prepare(
				'INSERT INTO %i (code_id, scan_date, scans) VALUES (%d, %s, 1) ON DUPLICATE KEY UPDATE scans = scans + 1',
				$table_name,
				$code_id,
				$scan_date
			)
		);
	}

	/**
	 * Return the total scans recorded for a code.
	 *
	 * @param int $code_id QR code post ID.
	 * @return int
	 */
	public function get_total_scans( $code_id ) {
		global $wpdb;

		$table_name = $wpdb->prefix . 'smsqr_scans';

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Aggregate data changes on every scan and must be current in the admin list.
		$total = $wpdb->get_var(
			$wpdb->prepare(
				'SELECT SUM(scans) FROM %i WHERE code_id = %d',
				$table_name,
				$code_id
			)
		);

		return max( 0, (int) $total );
	}

	/**
	 * Return daily aggregate scans, including zero-value days.
	 *
	 * @param int $code_id QR code post ID.
	 * @param int $days    Number of recent days to return.
	 * @return array<string, int>
	 */
	public function get_daily_scans( $code_id, $days = 30 ) {
		global $wpdb;

		$days       = min( 90, max( 1, absint( $days ) ) );
		$table_name = $wpdb->prefix . 'smsqr_scans';
		$today      = new DateTimeImmutable( 'today', wp_timezone() );
		$start      = $today->modify( '-' . ( $days - 1 ) . ' days' );

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Admin analytics must reflect the latest aggregate scan counts.
		$rows   = $wpdb->get_results(
			$wpdb->prepare(
				'SELECT scan_date, scans FROM %i WHERE code_id = %d AND scan_date >= %s ORDER BY scan_date ASC',
				$table_name,
				$code_id,
				$start->format( 'Y-m-d' )
			),
			ARRAY_A
		);
		$stored = array();

		foreach ( $rows as $row ) {
			$stored[ $row['scan_date'] ] = max( 0, (int) $row['scans'] );
		}

		$daily = array();

		for ( $offset = 0; $offset < $days; $offset++ ) {
			$date           = $start->modify( '+' . $offset . ' days' )->format( 'Y-m-d' );
			$daily[ $date ] = isset( $stored[ $date ] ) ? $stored[ $date ] : 0;
		}

		return $daily;
	}

	/**
	 * Return daily aggregate scans across every QR code.
	 *
	 * @param int $days Number of recent days to return.
	 * @return array<string, int>
	 */
	public function get_site_daily_scans( $days = 30 ) {
		global $wpdb;

		$days       = min( 90, max( 1, absint( $days ) ) );
		$table_name = $wpdb->prefix . 'smsqr_scans';
		$today      = new DateTimeImmutable( 'today', wp_timezone() );
		$start      = $today->modify( '-' . ( $days - 1 ) . ' days' );

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Admin analytics must reflect the latest aggregate scan counts.
		$rows   = $wpdb->get_results(
			$wpdb->prepare(
				'SELECT scan_date, SUM(scans) AS scans FROM %i WHERE scan_date >= %s GROUP BY scan_date ORDER BY scan_date ASC',
				$table_name,
				$start->format( 'Y-m-d' )
			),
			ARRAY_A
		);
		$stored = array();

		foreach ( $rows as $row ) {
			$stored[ $row['scan_date'] ] = max( 0, (int) $row['scans'] );
		}

		$daily = array();

		for ( $offset = 0; $offset < $days; $offset++ ) {
			$date           = $start->modify( '+' . $offset . ' days' )->format( 'Y-m-d' );
			$daily[ $date ] = isset( $stored[ $date ] ) ? $stored[ $date ] : 0;
		}

		return $daily;
	}

	/**
	 * Return totals, recent activity, and last scan for every tracked code.
	 *
	 * @param int $days Recent period used for the comparison total.
	 * @return array<int, array<string, int|string>>
	 */
	public function get_code_scan_metrics( $days = 30 ) {
		global $wpdb;

		$days       = min( 90, max( 1, absint( $days ) ) );
		$table_name = $wpdb->prefix . 'smsqr_scans';
		$today      = new DateTimeImmutable( 'today', wp_timezone() );
		$start      = $today->modify( '-' . ( $days - 1 ) . ' days' )->format( 'Y-m-d' );

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Admin analytics must reflect the latest aggregate scan counts.
		$rows    = $wpdb->get_results(
			$wpdb->prepare(
				'SELECT code_id, SUM(scans) AS total_scans, SUM(CASE WHEN scan_date >= %s THEN scans ELSE 0 END) AS period_scans, MAX(scan_date) AS last_scan FROM %i GROUP BY code_id',
				$start,
				$table_name
			),
			ARRAY_A
		);
		$metrics = array();

		foreach ( $rows as $row ) {
			$code_id             = (int) $row['code_id'];
			$metrics[ $code_id ] = array(
				'total'     => max( 0, (int) $row['total_scans'] ),
				'period'    => max( 0, (int) $row['period_scans'] ),
				'last_scan' => sanitize_text_field( $row['last_scan'] ),
			);
		}

		return $metrics;
	}

	/**
	 * Render the main scan analytics screen.
	 */
	public function render_analytics_page() {
		if ( ! current_user_can( 'edit_others_posts' ) ) {
			wp_die( esc_html__( 'You do not have permission to view scan analytics.', 'same-square' ) );
		}

		$daily        = $this->get_site_daily_scans( 30 );
		$daily_values = array_values( $daily );
		$metrics      = $this->get_code_scan_metrics( 30 );
		$total_scans  = 0;

		foreach ( $metrics as $code_metrics ) {
			$total_scans += (int) $code_metrics['total'];
		}

		$today_scans = empty( $daily_values ) ? 0 : (int) end( $daily_values );
		$seven_scans = array_sum( array_slice( $daily_values, -7 ) );
		$month_scans = array_sum( $daily_values );
		$posts       = get_posts(
			array(
				'post_type'      => self::POST_TYPE,
				'post_status'    => array( 'publish', 'draft', 'pending', 'private', 'future' ),
				'posts_per_page' => -1,
				'orderby'        => 'title',
				'order'          => 'ASC',
			)
		);
		$rows        = array();

		foreach ( $posts as $post ) {
			$code_metrics = isset( $metrics[ $post->ID ] ) ? $metrics[ $post->ID ] : array(
				'total'     => 0,
				'period'    => 0,
				'last_scan' => '',
			);
			$rows[]       = array(
				'post'        => $post,
				'total'       => (int) $code_metrics['total'],
				'period'      => (int) $code_metrics['period'],
				'last_scan'   => (string) $code_metrics['last_scan'],
				'destination' => (string) get_post_meta( $post->ID, self::META_DESTINATION, true ),
				'status'      => $this->get_code_status( $post->ID ),
			);
		}

		usort(
			$rows,
			static function ( $first, $second ) {
				if ( $first['period'] !== $second['period'] ) {
					return $second['period'] <=> $first['period'];
				}

				if ( $first['total'] !== $second['total'] ) {
					return $second['total'] <=> $first['total'];
				}

				return strcasecmp( $first['post']->post_title, $second['post']->post_title );
			}
		);
		?>
		<div class="wrap smsqr-analytics-page">
			<h1><?php esc_html_e( 'Scan Analytics', 'same-square' ); ?></h1>
			<p class="smsqr-analytics-intro"><?php esc_html_e( 'See how often visitors use your permanent Same Square URLs. Counts update whenever an active QR code redirects successfully.', 'same-square' ); ?></p>

			<div class="smsqr-stat-grid">
				<?php $this->render_stat_card( __( 'All-time scans', 'same-square' ), $total_scans ); ?>
				<?php $this->render_stat_card( __( 'Scans today', 'same-square' ), $today_scans ); ?>
				<?php $this->render_stat_card( __( 'Last 7 days', 'same-square' ), $seven_scans ); ?>
				<?php $this->render_stat_card( __( 'Last 30 days', 'same-square' ), $month_scans ); ?>
			</div>

			<section class="smsqr-analytics-panel">
				<h2><?php esc_html_e( 'Scans over the last 30 days', 'same-square' ); ?></h2>
				<?php $this->render_scan_chart( $daily ); ?>
			</section>

			<section class="smsqr-analytics-panel">
				<div class="smsqr-panel-heading">
					<div>
						<h2><?php esc_html_e( 'QR code performance', 'same-square' ); ?></h2>
						<p><?php esc_html_e( 'Scans are counted, not unique visitors.', 'same-square' ); ?></p>
					</div>
					<a class="button button-primary" href="<?php echo esc_url( admin_url( 'post-new.php?post_type=' . self::POST_TYPE ) ); ?>"><?php esc_html_e( 'Add QR code', 'same-square' ); ?></a>
				</div>

				<div class="smsqr-table-scroll">
					<table class="widefat striped smsqr-analytics-table">
						<thead>
							<tr>
								<th><?php esc_html_e( 'QR code', 'same-square' ); ?></th>
								<th><?php esc_html_e( 'Destination', 'same-square' ); ?></th>
								<th><?php esc_html_e( 'Status', 'same-square' ); ?></th>
								<th class="smsqr-number-column"><?php esc_html_e( 'Last 30 days', 'same-square' ); ?></th>
								<th class="smsqr-number-column"><?php esc_html_e( 'All time', 'same-square' ); ?></th>
								<th><?php esc_html_e( 'Last scan', 'same-square' ); ?></th>
							</tr>
						</thead>
						<tbody>
							<?php if ( empty( $rows ) ) : ?>
								<tr><td colspan="6"><?php esc_html_e( 'Create your first QR code to begin tracking scans.', 'same-square' ); ?></td></tr>
							<?php else : ?>
								<?php foreach ( $rows as $row ) : ?>
									<?php
									$title     = '' !== $row['post']->post_title ? $row['post']->post_title : __( '(Untitled QR code)', 'same-square' );
									$edit_link = get_edit_post_link( $row['post']->ID );
									?>
									<tr>
										<td><strong><a href="<?php echo esc_url( $edit_link ); ?>"><?php echo esc_html( $title ); ?></a></strong></td>
										<td class="smsqr-destination-cell">
											<?php if ( $this->is_valid_destination( $row['destination'] ) ) : ?>
												<a href="<?php echo esc_url( $row['destination'] ); ?>" target="_blank" rel="noopener noreferrer"><?php echo esc_html( $row['destination'] ); ?></a>
											<?php else : ?>
												&mdash;
											<?php endif; ?>
										</td>
										<td><span class="smsqr-status smsqr-status--<?php echo esc_attr( $row['status'] ); ?>"><?php echo esc_html( $this->get_status_label( $row['status'] ) ); ?></span></td>
										<td class="smsqr-number-column"><strong><?php echo esc_html( number_format_i18n( $row['period'] ) ); ?></strong></td>
										<td class="smsqr-number-column"><?php echo esc_html( number_format_i18n( $row['total'] ) ); ?></td>
										<td><?php echo esc_html( $this->format_scan_date( $row['last_scan'] ) ); ?></td>
									</tr>
								<?php endforeach; ?>
							<?php endif; ?>
						</tbody>
					</table>
				</div>
			</section>

			<p class="description smsqr-privacy-note"><?php esc_html_e( 'Privacy note: Same Square stores one aggregate count per QR code per day. It does not store IP addresses, devices, browsers, referrers, locations, or an individual visit log.', 'same-square' ); ?></p>
		</div>
		<?php
	}

	/**
	 * Render one analytics summary card.
	 *
	 * @param string $label Card label.
	 * @param int    $value Scan count.
	 */
	private function render_stat_card( $label, $value ) {
		?>
		<div class="smsqr-stat-card">
			<span><?php echo esc_html( $label ); ?></span>
			<strong><?php echo esc_html( number_format_i18n( $value ) ); ?></strong>
		</div>
		<?php
	}

	/**
	 * Render an accessible, dependency-free scan chart.
	 *
	 * @param array<string, int> $daily   Daily aggregate scan counts.
	 * @param bool               $compact Whether to render the compact editor version.
	 */
	private function render_scan_chart( $daily, $compact = false ) {
		$maximum = empty( $daily ) ? 0 : max( $daily );
		$dates   = array_keys( $daily );
		?>
		<div class="smsqr-chart<?php echo $compact ? ' smsqr-chart--compact' : ''; ?>" role="img" aria-label="<?php esc_attr_e( 'Daily scan counts', 'same-square' ); ?>">
			<?php foreach ( $daily as $date => $scans ) : ?>
				<?php
				$height = $maximum > 0 ? max( 3, round( ( (int) $scans / $maximum ) * 100, 2 ) ) : 3;
				/* translators: 1: Date, 2: Number of scans. */
				$label = sprintf( __( '%1$s: %2$s scans', 'same-square' ), $this->format_scan_date( $date ), number_format_i18n( $scans ) );
				?>
				<span class="smsqr-chart-column" title="<?php echo esc_attr( $label ); ?>">
					<span class="smsqr-chart-bar<?php echo 0 === (int) $scans ? ' smsqr-chart-bar--empty' : ''; ?>" style="height: <?php echo esc_attr( $height ); ?>%"></span>
					<span class="screen-reader-text"><?php echo esc_html( $label ); ?></span>
				</span>
			<?php endforeach; ?>
		</div>
		<?php if ( ! $compact && ! empty( $dates ) ) : ?>
			<div class="smsqr-chart-axis">
				<span><?php echo esc_html( $this->format_scan_date( reset( $dates ) ) ); ?></span>
				<span><?php echo esc_html( $this->format_scan_date( end( $dates ) ) ); ?></span>
			</div>
		<?php endif; ?>
		<?php
	}

	/**
	 * Format an aggregate scan date in the site's timezone.
	 *
	 * @param string $date Date in Y-m-d format.
	 * @return string
	 */
	private function format_scan_date( $date ) {
		if ( ! preg_match( '/^\d{4}-\d{2}-\d{2}$/', $date ) ) {
			return __( 'Never', 'same-square' );
		}

		$value = DateTimeImmutable::createFromFormat( '!Y-m-d', $date, wp_timezone() );

		if ( false === $value ) {
			return __( 'Never', 'same-square' );
		}

		return wp_date( get_option( 'date_format' ), $value->getTimestamp(), wp_timezone() );
	}

	/**
	 * Delete a code's aggregate scan rows when it is permanently deleted.
	 *
	 * @param int     $post_id Post ID.
	 * @param WP_Post $post    Post object.
	 */
	public function delete_scan_data( $post_id, $post ) {
		if ( self::POST_TYPE !== $post->post_type ) {
			return;
		}

		global $wpdb;
		$table_name = $wpdb->prefix . 'smsqr_scans';

		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Cleanup belongs to the deleted code and has no cache representation.
		$wpdb->delete( $table_name, array( 'code_id' => (int) $post_id ), array( '%d' ) );
	}

	/**
	 * Add the QR code details meta box.
	 */
	public function add_meta_boxes() {
		add_meta_box(
			'smsqr-details',
			__( 'QR Code Details', 'same-square' ),
			array( $this, 'render_meta_box' ),
			self::POST_TYPE,
			'normal',
			'high'
		);

		add_meta_box(
			'smsqr-print-card',
			__( 'Print Card Designer', 'same-square' ),
			array( $this, 'render_print_card_meta_box' ),
			self::POST_TYPE,
			'normal',
			'default'
		);

		add_meta_box(
			'smsqr-analytics',
			__( 'Scan Analytics', 'same-square' ),
			array( $this, 'render_analytics_meta_box' ),
			self::POST_TYPE,
			'side',
			'high'
		);
	}

	/**
	 * Render the QR code editing interface.
	 *
	 * @param WP_Post $post Current QR code post.
	 */
	public function render_meta_box( $post ) {
		$token       = $this->get_or_create_token( $post->ID );
		$scan_url    = $this->get_scan_url( $post->ID );
		$destination = (string) get_post_meta( $post->ID, self::META_DESTINATION, true );
		$foreground  = $this->get_color( $post->ID, self::META_FOREGROUND, '#111827' );
		$background  = $this->get_color( $post->ID, self::META_BACKGROUND, '#ffffff' );
		$starts_at   = $this->get_local_datetime_value( (int) get_post_meta( $post->ID, self::META_STARTS_AT, true ) );
		$expires_at  = $this->get_local_datetime_value( (int) get_post_meta( $post->ID, self::META_EXPIRES_AT, true ) );

		wp_nonce_field( 'smsqr_save_code', 'smsqr_meta_nonce' );
		?>
		<div class="smsqr-editor">
			<div class="smsqr-fields">
				<p>
					<label for="smsqr-destination"><strong><?php esc_html_e( 'Destination URL', 'same-square' ); ?></strong></label>
					<input id="smsqr-destination" class="widefat" name="smsqr_destination" type="url" value="<?php echo esc_attr( $destination ); ?>" placeholder="https://example.com/menu" required>
					<span class="description"><?php esc_html_e( 'You can change this destination later without reprinting the QR code.', 'same-square' ); ?></span>
				</p>

				<p>
					<label for="smsqr-scan-url"><strong><?php esc_html_e( 'Permanent scan URL', 'same-square' ); ?></strong></label>
					<span class="smsqr-copy-row">
						<input id="smsqr-scan-url" class="widefat" type="text" value="<?php echo esc_attr( $scan_url ); ?>" readonly>
						<button class="button smsqr-copy" type="button" data-copy-target="smsqr-scan-url"><?php esc_html_e( 'Copy', 'same-square' ); ?></button>
					</span>
					<span class="description"><?php esc_html_e( 'Every QR image uses this URL. It redirects visitors to the destination above, which can be changed later.', 'same-square' ); ?></span>
				</p>

				<div class="smsqr-field-grid">
					<p>
						<label for="smsqr-starts-at"><strong><?php esc_html_e( 'Starts', 'same-square' ); ?></strong></label>
						<input id="smsqr-starts-at" class="widefat" name="smsqr_starts_at" type="datetime-local" value="<?php echo esc_attr( $starts_at ); ?>">
						<span class="description"><?php esc_html_e( 'Optional.', 'same-square' ); ?></span>
					</p>
					<p>
						<label for="smsqr-expires-at"><strong><?php esc_html_e( 'Expires', 'same-square' ); ?></strong></label>
						<input id="smsqr-expires-at" class="widefat" name="smsqr_expires_at" type="datetime-local" value="<?php echo esc_attr( $expires_at ); ?>">
						<span class="description"><?php esc_html_e( 'Optional.', 'same-square' ); ?></span>
					</p>
				</div>

				<div class="smsqr-field-grid">
					<p>
						<label for="smsqr-foreground"><strong><?php esc_html_e( 'Foreground', 'same-square' ); ?></strong></label><br>
						<input id="smsqr-foreground" name="smsqr_foreground" type="color" value="<?php echo esc_attr( $foreground ); ?>" data-smsqr-color="foreground">
					</p>
					<p>
						<label for="smsqr-background"><strong><?php esc_html_e( 'Background', 'same-square' ); ?></strong></label><br>
						<input id="smsqr-background" name="smsqr_background" type="color" value="<?php echo esc_attr( $background ); ?>" data-smsqr-color="background">
					</p>
				</div>
			</div>

			<div class="smsqr-preview-panel">
				<div
					id="smsqr-admin-preview"
					class="smsqr-qr-code"
					data-smsqr-value="<?php echo esc_attr( $scan_url ); ?>"
					data-smsqr-size="256"
					data-smsqr-foreground="<?php echo esc_attr( $foreground ); ?>"
					data-smsqr-background="<?php echo esc_attr( $background ); ?>"
					data-smsqr-label="<?php echo esc_attr( get_the_title( $post ) ); ?>"
				></div>
				<p class="smsqr-token"><?php echo esc_html( $token ); ?></p>
				<div class="smsqr-preview-actions">
					<button class="button" type="button" data-smsqr-download="png" data-smsqr-target="smsqr-admin-preview"><?php esc_html_e( 'Download PNG', 'same-square' ); ?></button>
					<button class="button" type="button" data-smsqr-download="svg" data-smsqr-target="smsqr-admin-preview"><?php esc_html_e( 'Download SVG', 'same-square' ); ?></button>
					<button class="button" type="button" data-smsqr-print data-smsqr-target="smsqr-admin-preview"><?php esc_html_e( 'Print card', 'same-square' ); ?></button>
				</div>
				<p class="description"><?php esc_html_e( 'Test every printed code with a phone before distributing it.', 'same-square' ); ?></p>
			</div>
		</div>
		<?php
	}

	/**
	 * Return saved print card settings with safe defaults.
	 *
	 * @param int $post_id QR code post ID.
	 * @return array<string, int|string|bool>
	 */
	private function get_card_settings( $post_id ) {
		$layout      = sanitize_key( get_post_meta( $post_id, self::META_CARD_LAYOUT, true ) );
		$paper       = sanitize_key( get_post_meta( $post_id, self::META_CARD_PAPER, true ) );
		$orientation = sanitize_key( get_post_meta( $post_id, self::META_CARD_ORIENTATION, true ) );
		$heading     = (string) get_post_meta( $post_id, self::META_CARD_HEADING, true );
		$logo_id     = absint( get_post_meta( $post_id, self::META_CARD_LOGO_ID, true ) );

		if ( ! in_array( $layout, array( 'poster', 'minimal', 'table' ), true ) ) {
			$layout = 'poster';
		}

		if ( ! in_array( $paper, array( 'a4', 'letter', 'a5', '4x6' ), true ) ) {
			$paper = 'a4';
		}

		if ( ! in_array( $orientation, array( 'portrait', 'landscape' ), true ) ) {
			$orientation = 'portrait';
		}

		return array(
			'layout'      => $layout,
			'heading'     => '' !== $heading ? $heading : __( 'Scan me', 'same-square' ),
			'description' => (string) get_post_meta( $post_id, self::META_CARD_DESCRIPTION, true ),
			'paper'       => $paper,
			'orientation' => $orientation,
			'show_name'   => ! metadata_exists( 'post', $post_id, self::META_CARD_SHOW_NAME ) || '1' === get_post_meta( $post_id, self::META_CARD_SHOW_NAME, true ),
			'show_url'    => ! metadata_exists( 'post', $post_id, self::META_CARD_SHOW_URL ) || '1' === get_post_meta( $post_id, self::META_CARD_SHOW_URL, true ),
			'logo_id'     => $logo_id,
			'logo_url'    => $logo_id ? (string) wp_get_attachment_image_url( $logo_id, 'medium' ) : '',
			'background'  => $this->get_color( $post_id, self::META_CARD_BACKGROUND, '#ffffff' ),
			'text'        => $this->get_color( $post_id, self::META_CARD_TEXT, '#111827' ),
		);
	}

	/**
	 * Render the print card designer.
	 *
	 * @param WP_Post $post Current QR code post.
	 */
	public function render_print_card_meta_box( $post ) {
		$settings   = $this->get_card_settings( $post->ID );
		$scan_url   = $this->get_scan_url( $post->ID );
		$foreground = $this->get_color( $post->ID, self::META_FOREGROUND, '#111827' );
		$background = $this->get_color( $post->ID, self::META_BACKGROUND, '#ffffff' );
		$title      = '' !== get_the_title( $post ) ? get_the_title( $post ) : __( 'Your QR code', 'same-square' );
		?>
		<div class="smsqr-card-designer">
			<div class="smsqr-card-controls">
				<div class="smsqr-field-grid">
					<p>
						<label for="smsqr-card-layout"><strong><?php esc_html_e( 'Layout', 'same-square' ); ?></strong></label>
						<select id="smsqr-card-layout" class="widefat" name="smsqr_card_layout" data-smsqr-card-input>
							<option value="poster" <?php selected( $settings['layout'], 'poster' ); ?>><?php esc_html_e( 'Poster', 'same-square' ); ?></option>
							<option value="minimal" <?php selected( $settings['layout'], 'minimal' ); ?>><?php esc_html_e( 'Minimal', 'same-square' ); ?></option>
							<option value="table" <?php selected( $settings['layout'], 'table' ); ?>><?php esc_html_e( 'Table card', 'same-square' ); ?></option>
						</select>
					</p>
					<p>
						<label for="smsqr-card-heading"><strong><?php esc_html_e( 'Heading', 'same-square' ); ?></strong></label>
						<input id="smsqr-card-heading" class="widefat" name="smsqr_card_heading" type="text" maxlength="120" value="<?php echo esc_attr( $settings['heading'] ); ?>" data-smsqr-card-input>
					</p>
				</div>

				<p>
					<label for="smsqr-card-description"><strong><?php esc_html_e( 'Description', 'same-square' ); ?></strong></label>
					<textarea id="smsqr-card-description" class="widefat" name="smsqr_card_description" rows="3" maxlength="280" placeholder="<?php esc_attr_e( 'Point your camera at the code to get started.', 'same-square' ); ?>" data-smsqr-card-input><?php echo esc_textarea( $settings['description'] ); ?></textarea>
				</p>

				<div class="smsqr-field-grid">
					<p>
						<label for="smsqr-card-paper"><strong><?php esc_html_e( 'Paper size', 'same-square' ); ?></strong></label>
						<select id="smsqr-card-paper" class="widefat" name="smsqr_card_paper" data-smsqr-card-input>
							<option value="a4" <?php selected( $settings['paper'], 'a4' ); ?>><?php esc_html_e( 'A4', 'same-square' ); ?></option>
							<option value="letter" <?php selected( $settings['paper'], 'letter' ); ?>><?php esc_html_e( 'US Letter', 'same-square' ); ?></option>
							<option value="a5" <?php selected( $settings['paper'], 'a5' ); ?>><?php esc_html_e( 'A5', 'same-square' ); ?></option>
							<option value="4x6" <?php selected( $settings['paper'], '4x6' ); ?>><?php esc_html_e( '4 × 6 inch', 'same-square' ); ?></option>
						</select>
					</p>
					<p>
						<label for="smsqr-card-orientation"><strong><?php esc_html_e( 'Orientation', 'same-square' ); ?></strong></label>
						<select id="smsqr-card-orientation" class="widefat" name="smsqr_card_orientation" data-smsqr-card-input>
							<option value="portrait" <?php selected( $settings['orientation'], 'portrait' ); ?>><?php esc_html_e( 'Portrait', 'same-square' ); ?></option>
							<option value="landscape" <?php selected( $settings['orientation'], 'landscape' ); ?>><?php esc_html_e( 'Landscape', 'same-square' ); ?></option>
						</select>
					</p>
				</div>

				<div class="smsqr-field-grid smsqr-card-colours">
					<p>
						<label for="smsqr-card-background"><strong><?php esc_html_e( 'Card background', 'same-square' ); ?></strong></label><br>
						<input id="smsqr-card-background" name="smsqr_card_background" type="color" value="<?php echo esc_attr( $settings['background'] ); ?>" data-smsqr-card-input>
					</p>
					<p>
						<label for="smsqr-card-text"><strong><?php esc_html_e( 'Text color', 'same-square' ); ?></strong></label><br>
						<input id="smsqr-card-text" name="smsqr_card_text" type="color" value="<?php echo esc_attr( $settings['text'] ); ?>" data-smsqr-card-input>
					</p>
				</div>

				<fieldset class="smsqr-card-options">
					<legend class="screen-reader-text"><?php esc_html_e( 'Card content', 'same-square' ); ?></legend>
					<label><input id="smsqr-card-show-name" name="smsqr_card_show_name" type="checkbox" value="1" data-smsqr-card-input <?php checked( $settings['show_name'] ); ?>> <?php esc_html_e( 'Show QR code name', 'same-square' ); ?></label>
					<label><input id="smsqr-card-show-url" name="smsqr_card_show_url" type="checkbox" value="1" data-smsqr-card-input <?php checked( $settings['show_url'] ); ?>> <?php esc_html_e( 'Show fallback scan URL', 'same-square' ); ?></label>
				</fieldset>

				<div class="smsqr-logo-control">
					<p><strong><?php esc_html_e( 'Logo (optional)', 'same-square' ); ?></strong></p>
					<input id="smsqr-card-logo-id" name="smsqr_card_logo_id" type="hidden" value="<?php echo esc_attr( $settings['logo_id'] ); ?>" data-smsqr-card-input>
					<div class="smsqr-logo-preview"<?php echo $settings['logo_url'] ? '' : ' hidden'; ?>>
						<img id="smsqr-card-logo-image" src="<?php echo esc_url( $settings['logo_url'] ); ?>" alt="">
					</div>
					<p>
						<button class="button" type="button" data-smsqr-logo-choose><?php esc_html_e( 'Choose logo', 'same-square' ); ?></button>
						<button class="button button-link-delete" type="button" data-smsqr-logo-remove<?php echo $settings['logo_url'] ? '' : ' hidden'; ?>><?php esc_html_e( 'Remove', 'same-square' ); ?></button>
					</p>
				</div>
			</div>

			<div class="smsqr-card-preview-wrap">
				<p class="smsqr-card-preview-label"><strong><?php esc_html_e( 'Live preview', 'same-square' ); ?></strong></p>
				<div id="smsqr-card-preview" class="smsqr-card-preview smsqr-card-preview--<?php echo esc_attr( $settings['layout'] ); ?>" style="--smsqr-card-bg: <?php echo esc_attr( $settings['background'] ); ?>; --smsqr-card-text: <?php echo esc_attr( $settings['text'] ); ?>;">
					<img class="smsqr-card-preview-logo" src="<?php echo esc_url( $settings['logo_url'] ); ?>" alt=""<?php echo $settings['logo_url'] ? '' : ' hidden'; ?>>
					<h3 class="smsqr-card-preview-heading"><?php echo esc_html( $settings['heading'] ); ?></h3>
					<p class="smsqr-card-preview-description"<?php echo $settings['description'] ? '' : ' hidden'; ?>><?php echo esc_html( $settings['description'] ); ?></p>
					<div
						id="smsqr-card-qr"
						class="smsqr-qr-code"
						data-smsqr-value="<?php echo esc_attr( $scan_url ); ?>"
						data-smsqr-size="256"
						data-smsqr-foreground="<?php echo esc_attr( $foreground ); ?>"
						data-smsqr-background="<?php echo esc_attr( $background ); ?>"
						data-smsqr-label="<?php echo esc_attr( $title ); ?>"
					></div>
					<p class="smsqr-card-preview-name"<?php echo $settings['show_name'] ? '' : ' hidden'; ?>><?php echo esc_html( $title ); ?></p>
					<p class="smsqr-card-preview-url"<?php echo $settings['show_url'] ? '' : ' hidden'; ?>><?php echo esc_html( $scan_url ); ?></p>
				</div>
				<p><button class="button button-primary" type="button" data-smsqr-print data-smsqr-target="smsqr-card-qr"><?php esc_html_e( 'Print this card', 'same-square' ); ?></button></p>
				<p class="description"><?php esc_html_e( 'Save the QR code to keep these card settings for next time.', 'same-square' ); ?></p>
			</div>
		</div>
		<?php
	}

	/**
	 * Render scan metrics for one QR code in the editor sidebar.
	 *
	 * @param WP_Post $post Current QR code post.
	 */
	public function render_analytics_meta_box( $post ) {
		$daily        = $this->get_daily_scans( $post->ID, 30 );
		$daily_values = array_values( $daily );
		$metrics      = $this->get_code_scan_metrics( 30 );
		$code_metrics = isset( $metrics[ $post->ID ] ) ? $metrics[ $post->ID ] : array(
			'total'     => 0,
			'period'    => 0,
			'last_scan' => '',
		);
		$today_scans  = empty( $daily_values ) ? 0 : (int) end( $daily_values );
		?>
		<div class="smsqr-meta-stats">
			<div><span><?php esc_html_e( 'All time', 'same-square' ); ?></span><strong><?php echo esc_html( number_format_i18n( $code_metrics['total'] ) ); ?></strong></div>
			<div><span><?php esc_html_e( 'Today', 'same-square' ); ?></span><strong><?php echo esc_html( number_format_i18n( $today_scans ) ); ?></strong></div>
			<div><span><?php esc_html_e( 'Last 7 days', 'same-square' ); ?></span><strong><?php echo esc_html( number_format_i18n( array_sum( array_slice( $daily_values, -7 ) ) ) ); ?></strong></div>
			<div><span><?php esc_html_e( 'Last 30 days', 'same-square' ); ?></span><strong><?php echo esc_html( number_format_i18n( $code_metrics['period'] ) ); ?></strong></div>
		</div>
		<?php $this->render_scan_chart( $daily, true ); ?>
		<p class="smsqr-last-scan"><strong><?php esc_html_e( 'Last scan:', 'same-square' ); ?></strong> <?php echo esc_html( $this->format_scan_date( $code_metrics['last_scan'] ) ); ?></p>
		<p><a href="<?php echo esc_url( admin_url( 'edit.php?post_type=' . self::POST_TYPE . '&page=smsqr-analytics' ) ); ?>"><?php esc_html_e( 'View all scan analytics', 'same-square' ); ?> &rarr;</a></p>
		<p class="description"><?php esc_html_e( 'Aggregate scans only; unique visitors are not tracked.', 'same-square' ); ?></p>
		<?php
	}

	/**
	 * Save QR code details.
	 *
	 * @param int     $post_id Post ID.
	 * @param WP_Post $post    Post object.
	 */
	public function save_code( $post_id, $post ) {
		if ( ! isset( $_POST['smsqr_meta_nonce'] ) ) {
			return;
		}

		$nonce = sanitize_text_field( wp_unslash( $_POST['smsqr_meta_nonce'] ) );

		if ( ! wp_verify_nonce( $nonce, 'smsqr_save_code' ) || ! current_user_can( 'edit_post', $post_id ) ) {
			return;
		}

		if ( wp_is_post_autosave( $post_id ) || wp_is_post_revision( $post_id ) || self::POST_TYPE !== $post->post_type ) {
			return;
		}

		$this->get_or_create_token( $post_id );

		$destination_input = isset( $_POST['smsqr_destination'] ) ? sanitize_text_field( wp_unslash( $_POST['smsqr_destination'] ) ) : '';
		$destination       = esc_url_raw( $destination_input, array( 'http', 'https' ) );

		if ( '' !== $destination_input && ! $this->is_valid_destination( $destination ) ) {
			delete_post_meta( $post_id, self::META_DESTINATION );
			$this->set_admin_notice( __( 'Enter a complete destination URL beginning with http:// or https://.', 'same-square' ), 'error' );
		} elseif ( '' === $destination ) {
			delete_post_meta( $post_id, self::META_DESTINATION );
		} else {
			update_post_meta( $post_id, self::META_DESTINATION, $destination );
		}

		$foreground = isset( $_POST['smsqr_foreground'] ) ? sanitize_hex_color( wp_unslash( $_POST['smsqr_foreground'] ) ) : '';
		$background = isset( $_POST['smsqr_background'] ) ? sanitize_hex_color( wp_unslash( $_POST['smsqr_background'] ) ) : '';

		update_post_meta( $post_id, self::META_FOREGROUND, $foreground ? $foreground : '#111827' );
		update_post_meta( $post_id, self::META_BACKGROUND, $background ? $background : '#ffffff' );

		$starts_input  = isset( $_POST['smsqr_starts_at'] ) ? sanitize_text_field( wp_unslash( $_POST['smsqr_starts_at'] ) ) : '';
		$expires_input = isset( $_POST['smsqr_expires_at'] ) ? sanitize_text_field( wp_unslash( $_POST['smsqr_expires_at'] ) ) : '';
		$starts_at     = $this->parse_local_datetime( $starts_input );
		$expires_at    = $this->parse_local_datetime( $expires_input );

		$this->save_timestamp( $post_id, self::META_STARTS_AT, $starts_at );

		if ( $starts_at && $expires_at && $expires_at <= $starts_at ) {
			delete_post_meta( $post_id, self::META_EXPIRES_AT );
			$this->set_admin_notice( __( 'The expiration must be later than the start time. The expiration was not saved.', 'same-square' ), 'warning' );
		} else {
			$this->save_timestamp( $post_id, self::META_EXPIRES_AT, $expires_at );
		}

		if ( isset( $_POST['smsqr_card_layout'] ) ) {
			$layout = sanitize_key( wp_unslash( $_POST['smsqr_card_layout'] ) );
			$paper  = isset( $_POST['smsqr_card_paper'] ) ? sanitize_key( wp_unslash( $_POST['smsqr_card_paper'] ) ) : 'a4';
			$orient = isset( $_POST['smsqr_card_orientation'] ) ? sanitize_key( wp_unslash( $_POST['smsqr_card_orientation'] ) ) : 'portrait';

			update_post_meta( $post_id, self::META_CARD_LAYOUT, in_array( $layout, array( 'poster', 'minimal', 'table' ), true ) ? $layout : 'poster' );
			update_post_meta( $post_id, self::META_CARD_PAPER, in_array( $paper, array( 'a4', 'letter', 'a5', '4x6' ), true ) ? $paper : 'a4' );
			update_post_meta( $post_id, self::META_CARD_ORIENTATION, in_array( $orient, array( 'portrait', 'landscape' ), true ) ? $orient : 'portrait' );
			update_post_meta( $post_id, self::META_CARD_HEADING, isset( $_POST['smsqr_card_heading'] ) ? sanitize_text_field( wp_unslash( $_POST['smsqr_card_heading'] ) ) : '' );
			update_post_meta( $post_id, self::META_CARD_DESCRIPTION, isset( $_POST['smsqr_card_description'] ) ? sanitize_textarea_field( wp_unslash( $_POST['smsqr_card_description'] ) ) : '' );
			update_post_meta( $post_id, self::META_CARD_SHOW_NAME, isset( $_POST['smsqr_card_show_name'] ) ? '1' : '0' );
			update_post_meta( $post_id, self::META_CARD_SHOW_URL, isset( $_POST['smsqr_card_show_url'] ) ? '1' : '0' );

			$card_background = isset( $_POST['smsqr_card_background'] ) ? sanitize_hex_color( wp_unslash( $_POST['smsqr_card_background'] ) ) : '';
			$card_text       = isset( $_POST['smsqr_card_text'] ) ? sanitize_hex_color( wp_unslash( $_POST['smsqr_card_text'] ) ) : '';
			$logo_id         = isset( $_POST['smsqr_card_logo_id'] ) ? absint( $_POST['smsqr_card_logo_id'] ) : 0;

			update_post_meta( $post_id, self::META_CARD_BACKGROUND, $card_background ? $card_background : '#ffffff' );
			update_post_meta( $post_id, self::META_CARD_TEXT, $card_text ? $card_text : '#111827' );

			if ( $logo_id && wp_attachment_is_image( $logo_id ) ) {
				update_post_meta( $post_id, self::META_CARD_LOGO_ID, $logo_id );
			} else {
				delete_post_meta( $post_id, self::META_CARD_LOGO_ID );
			}
		}
	}

	/**
	 * Store or remove a timestamp meta value.
	 *
	 * @param int    $post_id  Post ID.
	 * @param string $meta_key Meta key.
	 * @param int    $value    UTC timestamp, or zero.
	 */
	private function save_timestamp( $post_id, $meta_key, $value ) {
		if ( $value > 0 ) {
			update_post_meta( $post_id, $meta_key, $value );
		} else {
			delete_post_meta( $post_id, $meta_key );
		}
	}

	/**
	 * Convert a datetime-local value in the site timezone to a UTC timestamp.
	 *
	 * @param string $value Datetime-local input value.
	 * @return int
	 */
	public function parse_local_datetime( $value ) {
		if ( '' === $value ) {
			return 0;
		}

		$date = DateTimeImmutable::createFromFormat( '!Y-m-d\TH:i', $value, wp_timezone() );

		if ( false === $date || $date->format( 'Y-m-d\TH:i' ) !== $value ) {
			return 0;
		}

		return $date->getTimestamp();
	}

	/**
	 * Format a stored timestamp for a datetime-local field.
	 *
	 * @param int $timestamp UTC timestamp.
	 * @return string
	 */
	private function get_local_datetime_value( $timestamp ) {
		if ( $timestamp <= 0 ) {
			return '';
		}

		return wp_date( 'Y-m-d\TH:i', $timestamp, wp_timezone() );
	}

	/**
	 * Validate an HTTP or HTTPS destination.
	 *
	 * @param string $destination Destination URL.
	 * @return bool
	 */
	public function is_valid_destination( $destination ) {
		$scheme = wp_parse_url( $destination, PHP_URL_SCHEME );
		$host   = wp_parse_url( $destination, PHP_URL_HOST );

		return in_array( $scheme, array( 'http', 'https' ), true ) && is_string( $host ) && '' !== $host;
	}

	/**
	 * Get a saved color or its fallback.
	 *
	 * @param int    $post_id  Post ID.
	 * @param string $meta_key Color meta key.
	 * @param string $fallback Default color.
	 * @return string
	 */
	private function get_color( $post_id, $meta_key, $fallback ) {
		$color = sanitize_hex_color( get_post_meta( $post_id, $meta_key, true ) );
		return $color ? $color : $fallback;
	}

	/**
	 * Return or create a stable public token.
	 *
	 * @param int $post_id Post ID.
	 * @return string
	 */
	private function get_or_create_token( $post_id ) {
		$token = (string) get_post_meta( $post_id, self::META_TOKEN, true );

		if ( preg_match( '/^[a-z0-9]{12}$/', $token ) ) {
			return $token;
		}

		$token = $this->generate_unique_token();
		update_post_meta( $post_id, self::META_TOKEN, $token );

		return $token;
	}

	/**
	 * Generate a unique 12-character token.
	 *
	 * @return string
	 */
	public function generate_unique_token() {
		for ( $attempt = 0; $attempt < 10; $attempt++ ) {
			try {
				$token = bin2hex( random_bytes( 6 ) );
			} catch ( Exception $exception ) {
				$token = strtolower( wp_generate_password( 12, false, false ) );
			}

			$existing = get_posts(
				array(
					'post_type'              => self::POST_TYPE,
					'post_status'            => 'any',
					'posts_per_page'         => 1,
					'fields'                 => 'ids',
					'no_found_rows'          => true,
					'update_post_meta_cache' => false,
					'update_post_term_cache' => false,
					'meta_key'               => self::META_TOKEN, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Token uniqueness must include every saved QR code.
					'meta_value'             => $token, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- Token uniqueness must include every saved QR code.
				)
			);

			if ( empty( $existing ) ) {
				return $token;
			}
		}

		return substr( md5( wp_generate_uuid4() ), 0, 12 );
	}

	/**
	 * Return the stable scan URL for a code.
	 *
	 * @param int $post_id QR code post ID.
	 * @return string
	 */
	public function get_scan_url( $post_id ) {
		$token = (string) get_post_meta( $post_id, self::META_TOKEN, true );

		if ( ! preg_match( '/^[a-z0-9]{12}$/', $token ) ) {
			return '';
		}

		if ( get_option( 'permalink_structure' ) ) {
			return home_url( user_trailingslashit( 'same-square/' . $token ) );
		}

		return add_query_arg( self::QUERY_VAR, $token, home_url( '/' ) );
	}

	/**
	 * Return the operational status of a code.
	 *
	 * @param int $post_id QR code post ID.
	 * @return string active, draft, missing, scheduled, or expired.
	 */
	public function get_code_status( $post_id ) {
		if ( 'publish' !== get_post_status( $post_id ) ) {
			return 'draft';
		}

		$destination = (string) get_post_meta( $post_id, self::META_DESTINATION, true );

		if ( ! $this->is_valid_destination( $destination ) ) {
			return 'missing';
		}

		$now        = time();
		$starts_at  = (int) get_post_meta( $post_id, self::META_STARTS_AT, true );
		$expires_at = (int) get_post_meta( $post_id, self::META_EXPIRES_AT, true );

		if ( $starts_at > $now ) {
			return 'scheduled';
		}

		if ( $expires_at > 0 && $expires_at <= $now ) {
			return 'expired';
		}

		return 'active';
	}

	/**
	 * Human-readable status label.
	 *
	 * @param string $status Status key.
	 * @return string
	 */
	private function get_status_label( $status ) {
		$labels = array(
			'active'    => __( 'Active', 'same-square' ),
			'draft'     => __( 'Draft', 'same-square' ),
			'missing'   => __( 'Needs URL', 'same-square' ),
			'scheduled' => __( 'Scheduled', 'same-square' ),
			'expired'   => __( 'Expired', 'same-square' ),
		);

		return isset( $labels[ $status ] ) ? $labels[ $status ] : $labels['draft'];
	}

	/**
	 * Load assets on Same Square admin screens.
	 *
	 * @param string $hook_suffix Current admin page hook.
	 */
	public function enqueue_admin_assets( $hook_suffix ) {
		$screen       = get_current_screen();
		$is_code_page = $screen && self::POST_TYPE === $screen->post_type;
		$is_analytics = 'smsqr_code_page_smsqr-analytics' === $hook_suffix;
		$is_edit_page = in_array( $hook_suffix, array( 'post.php', 'post-new.php' ), true );

		if ( ! $is_code_page && ! $is_analytics ) {
			return;
		}

		wp_enqueue_style( 'smsqr-admin' );

		if ( ! $is_code_page ) {
			return;
		}

		wp_enqueue_script( 'smsqr-admin' );
		wp_enqueue_style( 'smsqr-frontend' );

		if ( $is_edit_page ) {
			wp_enqueue_media();
		}

		wp_localize_script(
			'smsqr-admin',
			'smsqrAdmin',
			array(
				'copied'          => __( 'Copied', 'same-square' ),
				'copy'            => __( 'Copy', 'same-square' ),
				'fileName'        => __( 'same-square-qr-code', 'same-square' ),
				'printHeading'    => __( 'Scan me', 'same-square' ),
				'printFallback'   => __( 'Open this address:', 'same-square' ),
				'printStylesheet' => SMSQR_PLUGIN_URL . 'assets/css/print-card.css',
				'chooseLogo'      => __( 'Choose a card logo', 'same-square' ),
				'useLogo'         => __( 'Use this logo', 'same-square' ),
				'hookSuffix'      => $hook_suffix,
			)
		);
	}

	/**
	 * Supply QR codes to the block editor and load preview styles.
	 */
	public function prepare_block_editor() {
		$posts = get_posts(
			array(
				'post_type'      => self::POST_TYPE,
				'post_status'    => 'publish',
				'posts_per_page' => -1,
				'orderby'        => 'title',
				'order'          => 'ASC',
			)
		);
		$codes = array();

		foreach ( $posts as $post ) {
			$scan_url = $this->get_scan_url( $post->ID );

			if ( '' === $scan_url ) {
				continue;
			}

			$codes[] = array(
				'id'         => $post->ID,
				'title'      => get_the_title( $post ),
				'url'        => $scan_url,
				'foreground' => $this->get_color( $post->ID, self::META_FOREGROUND, '#111827' ),
				'background' => $this->get_color( $post->ID, self::META_BACKGROUND, '#ffffff' ),
			);
		}

		wp_localize_script(
			'smsqr-block-editor',
			'smsqrBlockData',
			array( 'codes' => $codes )
		);
		wp_enqueue_style( 'smsqr-frontend' );
	}

	/**
	 * Customize the QR code list columns.
	 *
	 * @param array<string, string> $columns Existing columns.
	 * @return array<string, string>
	 */
	public function manage_columns( $columns ) {
		$new_columns = array();

		foreach ( $columns as $key => $label ) {
			$new_columns[ $key ] = $label;

			if ( 'title' === $key ) {
				$new_columns['smsqr_qr']          = __( 'QR Code', 'same-square' );
				$new_columns['smsqr_destination'] = __( 'Destination', 'same-square' );
				$new_columns['smsqr_status']      = __( 'Status', 'same-square' );
				$new_columns['smsqr_scans']       = __( 'Scans', 'same-square' );
				$new_columns['smsqr_shortcode']   = __( 'Shortcode', 'same-square' );
			}
		}

		return $new_columns;
	}

	/**
	 * Render a custom QR code list column.
	 *
	 * @param string $column  Column key.
	 * @param int    $post_id Post ID.
	 */
	public function render_column( $column, $post_id ) {
		if ( 'smsqr_qr' === $column ) {
			$scan_url = $this->get_scan_url( $post_id );
			if ( $scan_url ) {
				printf(
					'<div class="smsqr-qr-code smsqr-list-qr" data-smsqr-value="%1$s" data-smsqr-size="72" data-smsqr-foreground="%2$s" data-smsqr-background="%3$s" data-smsqr-label="%4$s"></div>',
					esc_attr( $scan_url ),
					esc_attr( $this->get_color( $post_id, self::META_FOREGROUND, '#111827' ) ),
					esc_attr( $this->get_color( $post_id, self::META_BACKGROUND, '#ffffff' ) ),
					esc_attr( get_the_title( $post_id ) )
				);
			}
			return;
		}

		if ( 'smsqr_destination' === $column ) {
			$destination = (string) get_post_meta( $post_id, self::META_DESTINATION, true );
			if ( $this->is_valid_destination( $destination ) ) {
				printf( '<a href="%1$s" target="_blank" rel="noopener noreferrer">%2$s</a>', esc_url( $destination ), esc_html( $destination ) );
			} else {
				echo '&mdash;';
			}
			return;
		}

		if ( 'smsqr_status' === $column ) {
			$status = $this->get_code_status( $post_id );
			printf( '<span class="smsqr-status smsqr-status--%1$s">%2$s</span>', esc_attr( $status ), esc_html( $this->get_status_label( $status ) ) );
			return;
		}

		if ( 'smsqr_scans' === $column ) {
			printf(
				'<a href="%1$s"><strong>%2$s</strong></a>',
				esc_url( get_edit_post_link( $post_id ) . '#smsqr-analytics' ),
				esc_html( number_format_i18n( $this->get_total_scans( $post_id ) ) )
			);
			return;
		}

		if ( 'smsqr_shortcode' === $column ) {
			printf( '<code>[same_square_qr id=&quot;%d&quot;]</code>', (int) $post_id );
		}
	}

	/**
	 * Change the title field placeholder for QR codes.
	 *
	 * @param string  $placeholder Current placeholder.
	 * @param WP_Post $post        Current post.
	 * @return string
	 */
	public function title_placeholder( $placeholder, $post ) {
		if ( self::POST_TYPE === $post->post_type ) {
			return __( 'Name this QR code, for example “Lunch menu”', 'same-square' );
		}

		return $placeholder;
	}

	/**
	 * Customize post update messages.
	 *
	 * @param array<string, array<int, string>> $messages Post type messages.
	 * @return array<string, array<int, string>>
	 */
	public function post_updated_messages( $messages ) {
		$messages[ self::POST_TYPE ] = array(
			0  => '',
			1  => __( 'QR code updated.', 'same-square' ),
			2  => __( 'Custom field updated.', 'same-square' ),
			3  => __( 'Custom field deleted.', 'same-square' ),
			4  => __( 'QR code updated.', 'same-square' ),
			5  => isset( $_GET['revision'] ) ? sprintf( /* translators: %s: Revision date. */ __( 'QR code restored to revision from %s.', 'same-square' ), wp_post_revision_title( (int) $_GET['revision'], false ) ) : false, // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Core provides this display-only revision value.
			6  => __( 'QR code published.', 'same-square' ),
			7  => __( 'QR code saved.', 'same-square' ),
			8  => __( 'QR code submitted.', 'same-square' ),
			9  => __( 'QR code scheduled.', 'same-square' ),
			10 => __( 'QR code draft updated.', 'same-square' ),
		);

		return $messages;
	}

	/**
	 * Render a QR code from shortcode attributes.
	 *
	 * @param array<string, mixed> $attributes Shortcode attributes.
	 * @return string
	 */
	public function render_shortcode( $attributes ) {
		$attributes = shortcode_atts(
			array(
				'id'    => 0,
				'size'  => 256,
				'label' => 'false',
			),
			$attributes,
			'same_square_qr'
		);

		return $this->render_qr(
			absint( $attributes['id'] ),
			$this->sanitize_size( $attributes['size'] ),
			filter_var( $attributes['label'], FILTER_VALIDATE_BOOLEAN ),
			''
		);
	}

	/**
	 * Render the dynamic block.
	 *
	 * @param array<string, mixed> $attributes Block attributes.
	 * @return string
	 */
	public function render_block( $attributes ) {
		$code_id    = isset( $attributes['codeId'] ) ? absint( $attributes['codeId'] ) : 0;
		$size       = isset( $attributes['size'] ) ? $this->sanitize_size( $attributes['size'] ) : 256;
		$show_label = ! empty( $attributes['showLabel'] );
		$classes    = 'wp-block-same-square-qr-code';

		if ( ! empty( $attributes['align'] ) ) {
			$classes .= ' align' . sanitize_html_class( $attributes['align'] );
		}

		return $this->render_qr( $code_id, $size, $show_label, $classes );
	}

	/**
	 * Render a QR code figure.
	 *
	 * @param int    $code_id    QR code post ID.
	 * @param int    $size       Display size in pixels.
	 * @param bool   $show_label Whether to show the saved title.
	 * @param string $classes    Additional CSS classes.
	 * @return string
	 */
	private function render_qr( $code_id, $size, $show_label, $classes ) {
		if ( self::POST_TYPE !== get_post_type( $code_id ) || 'publish' !== get_post_status( $code_id ) ) {
			return '';
		}

		$scan_url = $this->get_scan_url( $code_id );

		if ( '' === $scan_url ) {
			return '';
		}

		$title      = get_the_title( $code_id );
		$foreground = $this->get_color( $code_id, self::META_FOREGROUND, '#111827' );
		$background = $this->get_color( $code_id, self::META_BACKGROUND, '#ffffff' );
		$class_name = trim( 'smsqr-figure ' . $classes );

		wp_enqueue_script( 'smsqr-frontend' );
		wp_enqueue_style( 'smsqr-frontend' );

		ob_start();
		?>
		<figure class="<?php echo esc_attr( $class_name ); ?>" style="--smsqr-size: <?php echo esc_attr( $size ); ?>px">
			<div
				class="smsqr-qr-code"
				data-smsqr-value="<?php echo esc_attr( $scan_url ); ?>"
				data-smsqr-size="<?php echo esc_attr( $size ); ?>"
				data-smsqr-foreground="<?php echo esc_attr( $foreground ); ?>"
				data-smsqr-background="<?php echo esc_attr( $background ); ?>"
				data-smsqr-label="<?php echo esc_attr( $title ); ?>"
			></div>
			<?php if ( $show_label && '' !== $title ) : ?>
				<figcaption><?php echo esc_html( $title ); ?></figcaption>
			<?php endif; ?>
			<noscript><a href="<?php echo esc_url( $scan_url ); ?>"><?php esc_html_e( 'Open QR code destination', 'same-square' ); ?></a></noscript>
		</figure>
		<?php

		return (string) ob_get_clean();
	}

	/**
	 * Constrain QR display dimensions.
	 *
	 * @param mixed $size Requested size.
	 * @return int
	 */
	public function sanitize_size( $size ) {
		return min( 1024, max( 96, absint( $size ) ) );
	}

	/**
	 * Save an administrator notice for the next request.
	 *
	 * @param string $message Notice message.
	 * @param string $type    Notice type.
	 */
	private function set_admin_notice( $message, $type ) {
		set_transient(
			'smsqr_notice_' . get_current_user_id(),
			array(
				'message' => $message,
				'type'    => $type,
			),
			MINUTE_IN_SECONDS
		);
	}

	/**
	 * Display a saved administrator notice.
	 */
	public function render_admin_notice() {
		$key    = 'smsqr_notice_' . get_current_user_id();
		$notice = get_transient( $key );

		if ( ! is_array( $notice ) || empty( $notice['message'] ) ) {
			return;
		}

		delete_transient( $key );
		$type = isset( $notice['type'] ) && in_array( $notice['type'], array( 'error', 'warning', 'success', 'info' ), true ) ? $notice['type'] : 'info';
		printf( '<div class="notice notice-%1$s is-dismissible"><p>%2$s</p></div>', esc_attr( $type ), esc_html( $notice['message'] ) );
	}

	/**
	 * Add a QR codes link to the Plugins screen.
	 *
	 * @param string[] $links Existing links.
	 * @return string[]
	 */
	public function add_plugin_action_links( $links ) {
		$url = admin_url( 'edit.php?post_type=' . self::POST_TYPE );
		array_unshift( $links, '<a href="' . esc_url( $url ) . '">' . esc_html__( 'QR Codes', 'same-square' ) . '</a>' );
		return $links;
	}
}