<?php

declare(strict_types=1);

namespace Sentinelo\Scanner\Checks;

use Sentinelo\Scanner\CheckResult;

/**
 * Detects outdated core / plugins / themes by comparing installed versions against
 * the updates WordPress already knows about. Running obsolete code is a primary
 * attack surface (most mass-compromises hit known holes in stale extensions).
 *
 * Reads WP's own update transients (refreshed first, WP throttles the API calls
 * internally) rather than querying wordpress.org per item.
 */
class ObsoleteVersionsCheck
{
    public const MAX_SCORE = 8;

    public function run(): CheckResult
    {
        try {
            if (!function_exists('get_plugin_updates') || !function_exists('get_theme_updates')) {
                require_once ABSPATH . 'wp-admin/includes/update.php';
            }
            if (!function_exists('get_plugins')) {
                require_once ABSPATH . 'wp-admin/includes/plugin.php';
            }

            // Refresh update data (WP throttles these internally, ~12h).
            if (function_exists('wp_update_plugins')) {
                wp_update_plugins();
            }
            if (function_exists('wp_update_themes')) {
                wp_update_themes();
            }
            if (function_exists('wp_version_check')) {
                wp_version_check();
            }

            $outdated = [];

            $pluginUpdates = function_exists('get_plugin_updates') ? get_plugin_updates() : [];
            foreach ($pluginUpdates as $file => $data) {
                $outdated[] = [
                    'type'      => 'plugin',
                    'name'      => $data->Name ?? $file,
                    'current'   => $data->Version ?? '',
                    'available' => $data->update->new_version ?? '',
                ];
            }

            $themeUpdates = function_exists('get_theme_updates') ? get_theme_updates() : [];
            foreach ($themeUpdates as $slug => $data) {
                $new = is_array($data->update ?? null) ? ($data->update['new_version'] ?? '') : '';
                $outdated[] = [
                    'type'      => 'theme',
                    'name'      => $data->get('Name') ?: $slug,
                    'current'   => (string) $data->get('Version'),
                    'available' => $new,
                ];
            }

            $coreOutdated = false;
            if (function_exists('get_preferred_from_update_core')) {
                $core = get_preferred_from_update_core();
                if (is_object($core) && ($core->response ?? '') === 'upgrade') {
                    $coreOutdated = true;
                    $outdated[] = [
                        'type'      => 'core',
                        'name'      => 'WordPress',
                        'current'   => get_bloginfo('version'),
                        'available' => $core->current ?? '',
                    ];
                }
            }

            $count = count($outdated);
            // Core being outdated is the worst case; weight it heavily.
            $penalty = ($coreOutdated ? 4 : 0) + ($count - ($coreOutdated ? 1 : 0));
            $score = max(0, self::MAX_SCORE - $penalty);
            $status = $count === 0 ? 'pass' : ($coreOutdated || $count > 3 ? 'fail' : 'warn');

            return new CheckResult(
                'obsolete_versions',
                $status,
                $score,
                self::MAX_SCORE,
                $coreOutdated || $count > 5 ? 'high' : 'medium',
                ['outdated' => array_slice($outdated, 0, 100), 'count' => $count, 'core_outdated' => $coreOutdated],
                $count === 0
                    ? 'Cœur, extensions et thèmes à jour'
                    : sprintf('%d élément(s) obsolète(s)%s', $count, $coreOutdated ? ' (dont le cœur WordPress)' : '')
            );
        } catch (\Throwable $e) {
            return new CheckResult(
                'obsolete_versions',
                'skip',
                0,
                self::MAX_SCORE,
                'info',
                ['error' => $e->getMessage()],
                'Vérification ignorée (exception interne) : ' . $e->getMessage()
            );
        }
    }
}