<?php
namespace AntivirusAI\V1;

final class Privacy {
	/** Suggested owner-policy wording; rendering it performs no external request. */
	public static function policy(): string {
		$paragraphs = array(
			__( 'Optional accepted-finding review dates are stored locally with the existing reason and administrator identifier. Dates are UTC reminders and do not expire an exception or change protection. Pro can save up to ten finding views per administrator on this site; names, filter search text and save times stay local until deleted, erased through WordPress privacy tools or included in reviewed local removal. Erasure keeps an empty local version marker to reject older forms; account deletion or reviewed local removal deletes that marker. Pro investigation notes, next actions and review dates are local administrator annotations, separate from scanner evidence. WordPress privacy tools can export or erase those annotations while preserving security evidence and review progress, including when Pro is inactive. Forgetting an investigation review clears its notes and progress while retaining a minimal account/investigation revision marker and record timestamps to reject stale forms; reviewed full local removal deletes that marker. Printable summary agency and client labels are used only for the requested local preview, not saved by the plugin or uploaded. Downloaded or printed files and host backups need separate handling.', 'shieldlume-security' ),
			__( 'Optional review invitations use a local first completed broad-scan time and up to three distinct scan days; scan results, findings and severity do not determine eligibility. After at least 30 days and three scan days, only an administrator visiting this plugin dashboard can see the invitation, at most three times with at least 30 days between displays. Per-administrator/site display counts, dates and review/remind/never choices remain local. Opening the confirmed WordPress.org review link sends no site, scan, finding or referral identifiers and suppresses further invitations; WordPress.org handles the resulting visit under its own privacy policy. No review is posted automatically, and opening the link does not prove a review was submitted. No invitation appears until existing core directory metadata or an explicit publisher-reviewed local setting confirms the destination. The privacy exporter/eraser covers local review choices; erasure also clears dismissal and may permit a later invitation. Explicit full Data cleanup removes usage and choices; ordinary uninstall retains them.', 'shieldlume-security' ),
			__( 'Welcome choices are optional and separate. They are the final guided-setup step after saved preferences, with manual access from Protection settings and no automatic dashboard consent dialog. Installation consent sends the site domain, WordPress/PHP versions and site language to antivirus.ai, with updates at most weekly. Email consent sends an editable email and Free/Pro status for how-to guides, product updates and occasional Pro offers. Edition status refreshes weekly and after edition changes while sharing remains enabled; signup requires email confirmation. Requests include a random connection identifier and versioned consent evidence, and the service receives the network address. Local connection credentials are excluded from diagnostics and privacy exports. No files, findings, names or plugin lists are sent. Skip sends nothing and local security tools remain available. Protection settings links to the sharing controls. Stopping installation sharing removes compatibility details. Stopping email and edition sharing cancels this connection’s pending signup; an unconfirmed combined delivery request is cancelled in full. Confirmed subscribers must use an email unsubscribe link to stop mail. Deactivation and default Keep uninstall stop scheduled updates and retain the local welcome connection; reinstalling and activating may resume previously enabled sharing. Neither unsubscribes confirmed email recipients. A changed site address pauses sharing. See https://antivirus.ai/privacy/ for provider, retention and rights information.', 'shieldlume-security' ),
			__( 'Optional Pro task reminders retain the chosen workflow, bounded record references, requested interval and administrator/site binding locally for seven days. They exclude approvals, source content and credentials. Forget removes the reminder; expired transients are not reused but WordPress cleanup may remove their rows later. Thirty-day snooze, permanent suggestion dismissals and the hide/restore Pro previews preference remain in local administrator metadata for this site until changed or removed. Preview pages do not record a task; only explicit continuation or Get Pro actions do. The Get Pro link carries no site, finding, task or referral identifiers. There is no conversion telemetry. The WordPress privacy exporter covers local preview and dismissal choices and saved task workflow, dates and interval, without task tokens or security-record references. The eraser removes matching choices and reminders for the requested account on this site; clearing dismissals may show suggestions again. Security evidence and service permissions are unchanged. Scans also retain bounded local hashes of rules, settings, inventory and reference coverage for optional comparisons, with no additional provider requests. Ordinary uninstall retains local records.', 'shieldlume-security' ),
			__( 'Shieldlume Security keeps local security findings, relative and absolute file paths, hashes, selected database observations, administrator identifiers, repair evidence and notification attempts. Optional installation sharing and newsletter signup remain off until explicitly selected in Welcome choices. Online references, vulnerability checks, signed indicator downloads, IP reputation, breached-password checks, exposure probes and email have independent owner settings. Optional PRO connections have their own permission and disclosures. Activation does not start a scan or enable these services.', 'shieldlume-security' ),
			__( 'Permitted official-reference and approved repair jobs request component versions from WordPress.org, which also receives the server network address. A permitted vulnerability connection uses the owner’s Wordfence Intelligence credential; the provider receives the API request and server network address, without source-file uploads. Protection shows provider terms, privacy, freshness and withdrawal controls. A saved credential is encrypted with WordPress authentication salts; changing those salts requires reconnecting. Optional signed indicator requests go only to the host-configured publisher disclosed in Protection, sending protocol/version metadata and server network address, without inventory, findings or samples. Stopping these downloads rejects in-flight results; signed snapshots and anti-rollback history may remain locally until their separate retention review.', 'shieldlume-security' ),
			__( 'Optional ClamAV assessment streams eligible file contents, up to 2 MiB per file, to a protected Unix socket on this host. This integration sends no files to antivirus.ai or an AI provider. The host separately operates the daemon, definition updates and any daemon logging. Disable local engine assessment in Protection to stop future streams; existing findings remain. The engine and host archive limits are separate from local structural analysis.', 'shieldlume-security' ),
			__( 'With separate permission, the Emerging Threats compromised-IP list is downloaded over HTTPS from rules.emergingthreats.net, normally every 12 hours. The provider receives the server IP and request timing; no visitor IPs, inventory or file contents are uploaded. Source-address matching happens locally using the connection address or an explicitly configured trusted-proxy chain. Stopping downloads erases the operational list and rejects in-flight results. Provider privacy: https://www.proofpoint.com/us/legal/privacy-policy . GPL2 source: https://community.emergingthreats.net/t/licensing-is-the-compromised-ips-list-also-open/676 .', 'shieldlume-security' ),
			__( 'The local firewall stores sampled rule decisions and salted route/field fingerprints, without request values or IP addresses. Explicit seven-day exceptions retain exact paths and reasons locally. Optional endpoint limits retain up to 512 salted source buckets; their two-minute expiry is enforced during use, with removal on the next protected request or hourly cleanup. Missed cron can delay physical removal. Turning rate limits off clears the buckets. Optional Pro host-assisted early filtering stores at most 64 sampled rule/method/time decisions in verified private storage, without request values, paths or IPs. Its host bootstrap is retained after deactivation to avoid breaking PHP startup. Login throttle keys are salted hashes with a 15-minute expiry.', 'shieldlume-security' ),
			__( 'Account protection retains encrypted authenticator secrets, hashed one-use recovery codes, public passkey credentials and local per-account enrollment grace records. QR codes are generated locally. Supported WordPress and WooCommerce frontend sign-in forms send the second-factor response only to this website; custom sign-in integrations need separate compatibility review. Session review reads existing WordPress browser-session metadata. Optional administrator browser approval uses a Secure, HttpOnly, SameSite=Strict cookie lasting up to 30 days. Local records contain its verifier hash, account binding, security-generation/password-state fingerprints and approval/expiry times, with at most ten active approvals per account. No new email, raw IP or browser fingerprint is collected for approval. Revoking approvals invalidates them; disabling the policy invalidates retained approvals without deleting all records. Expired records may remain until a later account action or authorized retention review. Administrator security-change records contain account identifiers and changed-field labels, never passwords.', 'shieldlume-security' ),
			__( 'Optional administrator breached-password checks use Have I Been Pwned Pwned Passwords at api.pwnedpasswords.com. The provider receives five characters of a SHA-1 password hash, the server IP and timing; it receives no password, complete hash, username or email from this plugin. Matching is local and padded responses are discarded. A keyed local fingerprint, result and account identifier are cached for up to 24 hours. Stopping checks rejects in-flight results and requests cleanup; hourly bounded cleanup removes expired fingerprints. Missed cron or database failures can delay deletion, but expired results are never reused. Provider privacy: https://haveibeenpwned.com/Privacy .', 'shieldlume-security' ),
			__( 'Optional daily public-exposure probes request selected sensitive filenames from this website’s own public HTTPS WordPress address. The host/CDN receives the request path, server IP and timing. Up to 512 response bytes are compared in memory with the local file prefix; response contents are not stored in results or sent to antivirus.ai. Results retain relative filenames, status and time. Stopping rejects in-flight results; existing records remain. These checks do not alter files, hosting rules or caches.', 'shieldlume-security' ),
			__( 'Free provides read-only content evidence and native WordPress editor links; it does not store administrator-authored replacement content. The separate Pro add-on can retain encrypted original file evidence, hashes and authorized repair outcomes. Original files may contain personal data, credentials or malicious code. Pro restoration requires explicit approval and current authentication. Its browser checks use a three-minute challenge bound to a session-token hash; the repair journal keeps the administrator identifier, plan binding, check time and result. Authentication cookies are not copied into server-side HTTP requests. Findings require verification and a later rescan. Protect recovery keys and exported files and review their retention deliberately.', 'shieldlume-security' ),
			__( 'Keep data is the default. Deactivation and ordinary uninstall stop scheduled work and retain local settings, security records, recovery material and saved welcome connection credentials. Reinstalling and activating can resume previously enabled sharing; keeping data is not withdrawal. The separate Data & uninstall screen can prepare reviewed local removal. Stop welcome sharing first; failed withdrawal retains its retry credential. After the safety checks, current authentication, acknowledgments and exact confirmation phrase, the same administrator can deactivate Free, wait at least two minutes and use WordPress Delete within 30 minutes. Viewing, preparing or arming does not erase local security records. Checks run again at deletion; failures retain remaining state, and cancellation cannot restore records already removed. Delete Pro first after resolving its external audit/monitoring withdrawals and disconnecting it. Unauthenticated, unjournaled or unsafe recovery files, unfinished work, a persistent object cache or uncertain host early-filter storage block automatic removal. Host PHP references must be removed before bootstrap files. Confirmed newsletter unsubscribe, service records, provider-token revocation, host keys/configuration/backups, browser storage, downloaded exports and unjournaled repair temporary files require separate handling. Removal does not undo repairs or delete WordPress users or content. One minimal local safety marker remains after removal to reject delayed writes; it contains no email address, connection credential or security evidence and is cleared on reactivation.', 'shieldlume-security' ),
			__( 'Optional notifications and explicit test messages use the existing WordPress mail provider and configured recipient. Owners can preview and download allowlisted redacted diagnostics; nothing is submitted automatically. Separate false-positive evidence downloads add hashes and rule/version metadata, excluding source code and credentials. Metadata can still be sensitive. Routine FREE history defaults to 30 days and PRO to 90 days while preserving saved choices. Open findings, account/security records and protected recovery require deliberate retention review. Default Keep retains these records and encrypted recovery. The separate Data & uninstall workflow requires current authentication, explicit confirmation and safety checks before supported local removal. The WordPress privacy exporter/eraser covers matching notification preferences and local welcome email choices, excluding connection credentials. Erasing welcome email choices stops edition sharing and requests its remote removal; confirmed mail subscriptions need the emailed unsubscribe control. Security records and provider-held personal data need a separate authorized review.', 'shieldlume-security' ),
		);
		return '<p>' . implode( '</p><p>', $paragraphs ) . '</p>';
	}
	public static function register(): void {
		Journey::registerPrivacy();
		SavedViewPrivacy::register();
		ReviewPrivacy::register();
		add_action(
			'admin_init',
			static function () {
				if ( function_exists( 'wp_add_privacy_policy_content' ) ) {
					wp_add_privacy_policy_content( 'Shieldlume Security', wp_kses_post( self::policy() ) );
				}
			}
		);
		add_filter(
			'wp_privacy_personal_data_exporters',
			static function ( $exporters ) {
				$exporters['antivirus-ai'] = array(
					'exporter_friendly_name' => 'Shieldlume Security email preferences',
					'callback'               => array( self::class, 'export' ),
				);
				return $exporters;
			}
		);
		add_filter(
			'wp_privacy_personal_data_erasers',
			static function ( $erasers ) {
				$erasers['antivirus-ai'] = array(
					'eraser_friendly_name' => 'Shieldlume Security email preferences',
					'callback'             => array( self::class, 'erase' ),
				);
				return $erasers;
			}
		);
	}
	public static function export( string $email, int $page = 1 ): array {
		$settings = get_option( 'antivirus_ai_settings', array() );
		$data     = array();
		if ( 1 === $page && 0 === strcasecmp( (string) ( $settings['email_to'] ?? '' ), $email ) ) {
			$data[] = array(
				'group_id'    => 'antivirus-ai',
				'group_label' => 'Shieldlume Security',
				'item_id'     => 'antivirus-ai-notification-recipient',
				'data'        => array(
					array(
						'name'  => 'Notification recipient',
						'value' => $settings['email_to'],
					),
					array(
						'name'  => 'Notifications enabled',
						'value' => empty( $settings['email'] ) ? 'No' : 'Yes',
					),
				),
			);
		}
		if ( 1 === $page ) { $data = array_merge( $data, Welcome::privacyExport( $email ) ); }
		return array(
			'data' => $data,
			'done' => true,
		);
	}
	public static function erase( string $email, int $page = 1 ): array {
		$removed  = false;
			try {
				FeedConnection::saveSettings( static function ( array $settings ) use ( $email, &$removed ): array {
					if ( '' !== $email && 0 === strcasecmp( (string) ( $settings['email_to'] ?? '' ), $email ) ) {
						$settings['email'] = false;
						$settings['email_to'] = '';
						$removed = true;
					}
					return $settings;
				} );
			} catch ( \RuntimeException $error ) {
				return array(
					'items_removed' => false,
					'items_retained' => true,
					'messages' => array( __( 'The notification preference could not be removed from the database. Restore database access and retry erasure; the saved preference may still be active.', 'shieldlume-security' ) ),
					'done' => true,
				);
			}
		if ( $removed ) { wp_clear_scheduled_hook( 'antivirus_ai_notify' ); }
		try { $welcome = Welcome::privacyErase( $email ); } catch ( \Throwable $error ) { $welcome = new \WP_Error( 'welcome_erase', __( 'Welcome choices could not be removed. Review the saved connection and retry.', 'shieldlume-security' ) ); }
		if ( is_wp_error( $welcome ) ) { return array( 'items_removed' => $removed, 'items_retained' => true, 'messages' => array( $welcome->get_error_message() ), 'done' => true ); }
		$removed = $removed || ! empty( $welcome['removed'] );
		return array(
			'items_removed'  => $removed,
			'items_retained' => true,
			'messages'       => array( __( 'Security evidence, administrator history, and encrypted recovery may contain personal data and require a separate authorized retention review. Matching notification and local welcome email choices are removed. Welcome edition sharing is stopped and its remote removal requested; a confirmed newsletter subscription must be stopped with the unsubscribe link in an email.', 'shieldlume-security' ) ),
			'done'           => true,
		);
	}
}