<?php

declare(strict_types=1);

namespace Sentinelo\Scanner\Checks;

use Sentinelo\Scanner\CheckResult;

/**
 * Collects the installed plugin/theme inventory (name + slug + version) and hands
 * it to the backend in the scan payload.
 *
 * Vulnerability correlation is DELEGATED to the backend on purpose: the WPScan free
 * tier is 25 requests/day per ACCOUNT (global, not per site), so querying it from
 * each monitored site would exhaust the quota across a fleet in minutes. The backend
 * holds the single rate-limited token and rotates sites across days (see
 * backend VulnerabilityChecker/WpScanChecker). This check therefore never calls an
 * external vuln API itself — it only produces the inventory the backend needs.
 */
class PluginVulnerabilityCheck
{
    public function run(): CheckResult
    {
        try {
            if (!function_exists('get_plugins')) {
                require_once ABSPATH . 'wp-admin/includes/plugin.php';
            }

            $plugins = get_plugins();
            $themes = function_exists('wp_get_themes') ? wp_get_themes() : [];

            $pluginsInstalled = [];
            foreach ($plugins as $file => $data) {
                $pluginsInstalled[] = [
                    'name'    => $data['Name'] ?? $file,
                    'slug'    => dirname($file) === '.' ? basename($file, '.php') : dirname($file),
                    'version' => $data['Version'] ?? '',
                    'file'    => $file,
                ];
            }

            $themesInstalled = [];
            foreach ($themes as $slug => $theme) {
                $themesInstalled[] = [
                    'name'    => method_exists($theme, 'get') ? (string) $theme->get('Name') : (string) $slug,
                    'slug'    => (string) $slug,
                    'version' => method_exists($theme, 'get') ? (string) $theme->get('Version') : '',
                ];
            }

            $details = [
                'plugins_installed'  => $pluginsInstalled,
                'themes_installed'   => $themesInstalled,
                'correlation_source' => 'backend',
            ];

            return new CheckResult(
                'plugin_vulnerability',
                'info',
                0,
                0,
                'info',
                $details,
                ''
            );
        } catch (\Throwable $e) {
            return new CheckResult(
                'plugin_vulnerability',
                'info',
                0,
                0,
                'info',
                ['error' => $e->getMessage()],
                ''
            );
        }
    }
}