<?php
/**
 * Plugin Name:       Scribelo
 * Plugin URI:        https://scribelo.io/wordpress-website-feedback/
 * Description:       Adds your Scribelo review script to every page, so clients can leave visual feedback on this site. Paste your install code under Settings → Scribelo.
 * Version:           1.2.0
 * Requires at least: 5.7
 * Requires PHP:      7.4
 * Author:            Scribelo
 * Author URI:        https://scribelo.io
 * License:           GPL-2.0-or-later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain:       scribelo
 */

if (!defined('ABSPATH')) {
    exit;
}

const SCRIBELO_OPTION = 'scribelo_settings';

/** Stored settings: the script address and project key pulled out of the pasted install code. */
function scribelo_settings(): array
{
    $saved = get_option(SCRIBELO_OPTION, []);
    return wp_parse_args(is_array($saved) ? $saved : [], ['src' => '', 'key' => '', 'enabled' => true]);
}

/**
 * Read the script address and project key out of whatever the user pasted: the full install line from
 * Scribelo's Share & install tab, or just the pk_ key. Anything else is rejected rather than printed.
 */
function scribelo_parse_install_code(string $code): ?array
{
    $code = trim(wp_unslash($code));
    if (preg_match('/^pk_[A-Za-z0-9_-]{8,}$/', $code)) {
        return ['src' => 'https://scribelo.io/snippet.js', 'key' => $code];
    }
    if (!preg_match('/\bsrc\s*=\s*["\']([^"\']+)["\']/i', $code, $src) || !preg_match('/\bdata-project\s*=\s*["\'](pk_[A-Za-z0-9_-]{8,})["\']/i', $code, $key)) {
        return null;
    }
    $url = esc_url_raw($src[1], ['https', 'http']);
    $path = (string) wp_parse_url($url, PHP_URL_PATH);
    if ($url === '' || substr($path, -strlen('/snippet.js')) !== '/snippet.js') {
        return null;
    }
    return ['src' => $url, 'key' => $key[1]];
}

// ---------------------------------------------------------------- front end

add_action('wp_enqueue_scripts', function () {
    $s = scribelo_settings();
    if (!$s['enabled'] || $s['src'] === '' || $s['key'] === '') {
        return;
    }
    // The script does nothing for normal visitors; it only wakes up when opened from a Scribelo review link.
    // No version is added to the address: the script is served by Scribelo and kept up to date there.
    wp_enqueue_script('scribelo-review', $s['src'], [], null, true); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.MissingVersion
});

/**
 * Add the project key and async to the script tag. The data-* flags ask speed-optimisation tools (LiteSpeed,
 * Cloudflare Rocket Loader, WP Rocket, Jetpack Boost…) not to delay, defer or merge it: it has to run as soon
 * as the review screen opens the page.
 */
add_filter('script_loader_tag', function ($tag, $handle) {
    if ($handle !== 'scribelo-review') {
        return $tag;
    }
    $attrs = ' data-project="' . esc_attr(scribelo_settings()['key']) . '" async data-no-optimize="1" data-no-defer="1" data-no-minify="1" data-cfasync="false" data-jetpack-boost="ignore"';
    return preg_replace('/<script\b/', '<script' . $attrs, $tag, 1);
}, 10, 2);

/** Keep optimisation plugins from delaying, combining or minifying the review script. */
function scribelo_exclude_from_optimisers(array $list): array
{
    $list[] = 'snippet.js';
    $list[] = 'scribelo';
    return $list;
}
foreach ([
    'rocket_delay_js_exclusions', 'rocket_exclude_js', 'rocket_exclude_defer_js', 'rocket_minify_excluded_external_js', // WP Rocket
    'litespeed_optimize_js_excludes', 'litespeed_optm_js_defer_exc', 'litespeed_optm_gm_js_exc',                      // LiteSpeed Cache
    'sgo_js_minify_exclude', 'sgo_javascript_combine_exclude', 'sgo_js_async_exclude',                                 // SiteGround Optimizer
    'wp-optimize-minify-default-exclusions',                                                                          // WP-Optimize
] as $filter) {
    add_filter($filter, 'scribelo_exclude_from_optimisers');
}
add_filter('autoptimize_filter_js_exclude', function ($exclude) {                                                   // Autoptimize
    return trim((string) $exclude . ', snippet.js', ', ');
});

/**
 * Clear page caches after the install code changes, so pages cached before Scribelo was set up
 * (which don't have the script) stop being served. Covers WordPress itself and the common cache plugins;
 * host and CDN caches outside WordPress can't be reached from here, so the settings page reminds you.
 * Returns the names of the caches that were cleared.
 */
function scribelo_clear_caches(): array
{
    $cleared = [];
    $try = function (string $name, callable $fn) use (&$cleared) {
        try {
            $fn();
            $cleared[] = $name;
        } catch (\Throwable $e) {
            // a cache plugin failing to clear must never stop the settings saving
        }
    };
    $try('WordPress object cache', 'wp_cache_flush');
    if (function_exists('rocket_clean_domain')) { $try('WP Rocket', 'rocket_clean_domain'); }
    if (function_exists('w3tc_flush_all')) { $try('W3 Total Cache', 'w3tc_flush_all'); }
    if (function_exists('wp_cache_clear_cache')) { $try('WP Super Cache', 'wp_cache_clear_cache'); }
    if (defined('LSCWP_V')) { $try('LiteSpeed Cache', fn () => do_action('litespeed_purge_all')); }
    if (function_exists('sg_cachepress_purge_cache')) { $try('SiteGround Optimizer', 'sg_cachepress_purge_cache'); }
    if (isset($GLOBALS['wp_fastest_cache']) && method_exists($GLOBALS['wp_fastest_cache'], 'deleteCache')) { $try('WP Fastest Cache', fn () => $GLOBALS['wp_fastest_cache']->deleteCache(true)); }
    if (class_exists('autoptimizeCache')) { $try('Autoptimize', ['autoptimizeCache', 'clearall']); }
    if (class_exists('Cache_Enabler')) { $try('Cache Enabler', fn () => do_action('cache_enabler_clear_complete_cache')); }
    if (class_exists('Breeze_PurgeCache')) { $try('Breeze', ['Breeze_PurgeCache', 'breeze_cache_flush']); }
    if (defined('WPHB_VERSION')) { $try('Hummingbird', fn () => do_action('wphb_clear_page_cache')); }
    if (defined('NGINX_HELPER_BASENAME')) { $try('Nginx Helper', fn () => do_action('rt_nginx_helper_purge_all')); }
    return $cleared;
}

// ---------------------------------------------------------------- settings page

add_action('admin_menu', function () {
    add_options_page(__('Scribelo', 'scribelo'), __('Scribelo', 'scribelo'), 'manage_options', 'scribelo', 'scribelo_settings_page');
});

add_filter('plugin_action_links_' . plugin_basename(__FILE__), function (array $links): array {
    array_unshift($links, '<a href="' . esc_url(admin_url('options-general.php?page=scribelo')) . '">' . esc_html__('Settings', 'scribelo') . '</a>');
    return $links;
});

add_action('admin_post_scribelo_save', function () {
    if (!current_user_can('manage_options')) {
        wp_die(esc_html__('You are not allowed to change these settings.', 'scribelo'));
    }
    check_admin_referer('scribelo_save');
    $s = scribelo_settings();
    $s['enabled'] = !empty($_POST['scribelo_enabled']);
    // Not sanitised here because sanitising would strip the <script> tag we need to read. scribelo_parse_install_code()
    // validates it instead and keeps only an https/http address ending /snippet.js and a pk_ key; nothing else is stored.
    $code = isset($_POST['scribelo_code']) ? (string) $_POST['scribelo_code'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
    $status = 'saved';
    if (isset($_POST['scribelo_remove'])) {
        $s['src'] = $s['key'] = '';
        $status = 'removed';
    } elseif (trim($code) !== '') {
        $parsed = scribelo_parse_install_code($code);
        if ($parsed) {
            $s = array_merge($s, $parsed);
        } else {
            $status = 'invalid';
        }
    }
    if ($status !== 'invalid') {
        update_option(SCRIBELO_OPTION, $s);
        set_transient('scribelo_cleared', scribelo_clear_caches(), 300);
    }
    wp_safe_redirect(add_query_arg('scribelo', $status, admin_url('options-general.php?page=scribelo')));
    exit;
});

function scribelo_settings_page(): void
{
    if (!current_user_can('manage_options')) {
        return;
    }
    $s = scribelo_settings();
    $status = isset($_GET['scribelo']) ? sanitize_key((string) $_GET['scribelo']) : '';
    $messages = [
        'saved' => ['success', __('Settings saved.', 'scribelo')],
        'removed' => ['success', __('The install code has been removed. The review script is no longer added to this site.', 'scribelo')],
        'invalid' => ['error', __("That doesn't look like a Scribelo install code. Copy it again from your project's Share & install tab in Scribelo.", 'scribelo')],
    ];
    ?>
    <div class="wrap">
        <h1><?php esc_html_e('Scribelo', 'scribelo'); ?></h1>
        <?php if (isset($messages[$status])) : ?>
            <div class="notice notice-<?php echo esc_attr($messages[$status][0]); ?> is-dismissible"><p><?php echo esc_html($messages[$status][1]); ?></p></div>
        <?php endif; ?>
        <?php $cleared = get_transient('scribelo_cleared'); if (is_array($cleared) && $status !== 'invalid') : delete_transient('scribelo_cleared'); ?>
            <div class="notice notice-info is-dismissible">
                <p><strong><?php esc_html_e('Caches cleared:', 'scribelo'); ?></strong> <?php echo esc_html(implode(', ', $cleared)); ?>.</p>
                <p><?php esc_html_e("If your host or a CDN also caches pages (for example 20i StackCache, Cloudflare, SiteGround or Kinsta), purge that cache from your hosting control panel too. Otherwise visitors may be served pages saved before Scribelo was set up, and the review can't connect.", 'scribelo'); ?></p>
            </div>
        <?php endif; ?>
        <p><?php esc_html_e('Scribelo lets your clients click anything on this website and leave a comment. This plugin adds the review script to every page for you.', 'scribelo'); ?></p>

        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
            <input type="hidden" name="action" value="scribelo_save">
            <?php wp_nonce_field('scribelo_save'); ?>
            <table class="form-table" role="presentation">
                <tr>
                    <th scope="row"><?php esc_html_e('Status', 'scribelo'); ?></th>
                    <td>
                        <?php if ($s['key']) : ?>
                            <p><strong style="color:#1e9457">&#10003; <?php esc_html_e('Connected', 'scribelo'); ?></strong> &middot; <?php esc_html_e('Project key', 'scribelo'); ?> <code><?php echo esc_html($s['key']); ?></code></p>
                            <p class="description"><?php
                                /* translators: %s: the address of the Scribelo review script, e.g. https://scribelo.io/snippet.js */
                                echo esc_html(sprintf(__('Script address: %s', 'scribelo'), $s['src']));
                            ?></p>
                        <?php else : ?>
                            <p><strong><?php esc_html_e('Not connected yet.', 'scribelo'); ?></strong> <?php esc_html_e('Paste your install code below.', 'scribelo'); ?></p>
                        <?php endif; ?>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><label for="scribelo_code"><?php echo $s['key'] ? esc_html__('Replace install code', 'scribelo') : esc_html__('Install code', 'scribelo'); ?></label></th>
                    <td>
                        <textarea name="scribelo_code" id="scribelo_code" class="large-text code" rows="3" placeholder="&lt;script src=&quot;https://scribelo.io/snippet.js&quot; data-project=&quot;pk_…&quot; async&gt;&lt;/script&gt;"></textarea>
                        <p class="description"><?php esc_html_e("In Scribelo, open your project, go to Share & install and click Copy next to the install line. Paste it here as it is.", 'scribelo'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Reviews', 'scribelo'); ?></th>
                    <td>
                        <label><input type="checkbox" name="scribelo_enabled" value="1" <?php checked($s['enabled']); ?>> <?php esc_html_e('Add the review script to this site', 'scribelo'); ?></label>
                        <p class="description"><?php esc_html_e('Untick to pause reviews without losing your settings. The script is invisible to normal visitors either way.', 'scribelo'); ?></p>
                    </td>
                </tr>
            </table>
            <p class="submit">
                <?php submit_button(__('Save changes', 'scribelo'), 'primary', 'submit', false); ?>
                <?php if ($s['key']) : ?>
                    &nbsp;<?php submit_button(__('Remove install code', 'scribelo'), 'secondary', 'scribelo_remove', false); ?>
                <?php endif; ?>
            </p>
        </form>
    </div>
    <?php
}