<?php

declare(strict_types=1);

namespace Sentinelo\Scanner\Checks;

use Sentinelo\Scanner\CheckResult;

class FilePermissionsCheck
{
    public function run(): CheckResult
    {
        try {
        if (stripos(PHP_OS, 'WIN') === 0) {
            return new CheckResult(
                'file_permissions',
                'skip',
                10,
                10,
                'info',
                ['os' => PHP_OS, 'note' => 'Unix permissions inapplicables sur Windows'],
                ''
            );
        }

        $issues = [];
        $penalty = 0;

        $checks = [
            ['path' => ABSPATH . 'wp-config.php', 'expected' => [0400, 0440, 0600], 'label' => 'wp-config.php'],
            ['path' => ABSPATH . '.htaccess', 'expected' => [0444, 0644], 'label' => '.htaccess'],
            ['path' => WP_CONTENT_DIR, 'expected' => [0755], 'label' => 'wp-content/'],
            ['path' => (string) wp_upload_dir(null, false)['basedir'], 'expected' => [0755], 'label' => 'uploads/'],
        ];

        foreach ($checks as $check) {
            if (!file_exists($check['path'])) {
                continue;
            }
            $perms = fileperms($check['path']) & 0777;
            if (!in_array($perms, $check['expected'], true)) {
                $issues[] = [
                    'file'     => $check['label'],
                    'current'  => sprintf('%04o', $perms),
                    'expected' => implode(' ou ', array_map(static fn($p) => sprintf('%04o', $p), $check['expected'])),
                ];
                $penalty += 2;
            }
        }

        // Check for 777 files (recursive, limited depth)
        $badPerms = [];
        $depth = 0;
        $this->scanForBadPermissions(ABSPATH, $badPerms, $depth, 3);

        if (!empty($badPerms)) {
            $issues = array_merge($issues, $badPerms);
            $penalty += min(count($badPerms), 5);
        }

        $score = max(0, 10 - $penalty);
        $status = empty($issues) ? 'pass' : ($score < 5 ? 'fail' : 'warn');

        return new CheckResult(
            'file_permissions',
            $status,
            $score,
            10,
            $status === 'fail' ? 'high' : 'medium',
            $issues,
            empty($issues)
                ? 'Permissions des fichiers correctes'
                : sprintf('%d problème(s) de permissions détecté(s)', count($issues))
        );
        } catch (\Throwable $e) {
            return new CheckResult(
                'file_permissions',
                'skip',
                10,
                10,
                'info',
                ['error' => $e->getMessage()],
                'Vérification ignorée (exception interne) : ' . $e->getMessage()
            );
        }
    }

    private function scanForBadPermissions(string $dir, array &$issues, int $depth, int $maxDepth): void
    {
        if ($depth > $maxDepth) {
            return;
        }

        $items = @scandir($dir);
        if ($items === false) {
            return;
        }

        foreach ($items as $item) {
            if ($item === '.' || $item === '..') {
                continue;
            }
            $path = $dir . '/' . $item;
            if (!file_exists($path)) {
                continue;
            }

            $perms = fileperms($path) & 0777;
            if ($perms === 0777) {
                $issues[] = [
                    'file'     => str_replace(ABSPATH, '', wp_normalize_path($path)),
                    'current'  => '0777',
                    'expected' => 'pas 0777',
                ];
            }

            if (is_dir($path)) {
                $this->scanForBadPermissions($path, $issues, $depth + 1, $maxDepth);
            }
        }
    }
}