<?php
/**
 * Authenticated CSV exports (never written to public files).
 *
 * @package SiteAuditHub
 */

namespace SiteAuditHub;

defined( 'ABSPATH' ) || exit;

/**
 * CSV exporter.
 */
class Exporter {

	/**
	 * Register hooks.
	 */
	public static function init() {
		add_action( 'admin_post_sah_export', array( __CLASS__, 'handle' ) );
		add_action( 'admin_post_sah_export_logins', array( __CLASS__, 'handle_logins' ) );
	}

	/**
	 * Signed export URL.
	 *
	 * @param int    $scan_id Scan.
	 * @param string $what    findings|urls.
	 * @param string $module  Optional module filter.
	 * @return string
	 */
	public static function url( $scan_id, $what = 'findings', $module = '' ) {
		return wp_nonce_url(
			add_query_arg(
				array(
					'action' => 'siteaudithub_export',
					'scan'   => (int) $scan_id,
					'what'   => $what,
					'module' => $module,
				),
				admin_url( 'admin-post.php' )
			),
			'siteaudithub_export_' . (int) $scan_id
		);
	}

	/**
	 * Signed login-activity export URL.
	 *
	 * @return string
	 */
	public static function logins_url() {
		return wp_nonce_url( add_query_arg( array( 'action' => 'siteaudithub_export_logins' ), admin_url( 'admin-post.php' ) ), 'siteaudithub_export_logins' );
	}

	/**
	 * Stream login activity as CSV.
	 */
	public static function handle_logins() {
		if ( ! Security::can() ) {
			wp_die( esc_html__( 'You are not allowed to export SiteAuditHub reports.', 'siteaudithub' ), '', array( 'response' => 403 ) );
		}
		check_admin_referer( 'siteaudithub_export_logins' );
		nocache_headers();
		header( 'Content-Type: text/csv; charset=utf-8' );
		header( 'X-Content-Type-Options: nosniff' );
		header( 'Content-Disposition: attachment; filename="siteaudithub-login-activity.csv"' );
		$out = fopen( 'php://output', 'w' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
		fwrite( $out, "\xEF\xBB\xBF" ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite
		fputcsv( $out, array( 'date_utc', 'event', 'username', 'user_id', 'browser_device' ) );
		$labels = Login_Log::labels();
		$page   = 1;
		do {
			list( $rows ) = Login_Log::query(
				array(
					'page'     => $page,
					'per_page' => 500,
				)
			);
			foreach ( $rows as $r ) {
				fputcsv( $out, array_map( array( Security::class, 'csv_cell' ), array( $r->created_at, isset( $labels[ $r->event ] ) ? $labels[ $r->event ] : $r->event, '' !== $r->user_login ? $r->user_login : '(unknown username)', $r->user_id, $r->device ) ) );
			}
			++$page;
		} while ( count( $rows ) === 500 );
		fclose( $out ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
		exit;
	}

	/**
	 * Stream the CSV.
	 */
	public static function handle() {
		$scan_id = isset( $_GET['scan'] ) ? absint( $_GET['scan'] ) : 0;
		if ( ! Security::can() ) {
			wp_die( esc_html__( 'You are not allowed to export SiteAuditHub reports.', 'siteaudithub' ), '', array( 'response' => 403 ) );
		}
		check_admin_referer( 'siteaudithub_export_' . $scan_id );
		$scan = Repository::get_scan( $scan_id );
		if ( ! $scan ) {
			wp_die( esc_html__( 'Scan not found.', 'siteaudithub' ), '', array( 'response' => 404 ) );
		}
		$what   = isset( $_GET['what'] ) && 'urls' === $_GET['what'] ? 'urls' : 'findings';
		$module = isset( $_GET['module'] ) ? sanitize_key( wp_unslash( $_GET['module'] ) ) : '';
		if ( $module && ! isset( Catalog::modules()[ $module ] ) ) {
			$module = '';
		}

		nocache_headers();
		header( 'Content-Type: text/csv; charset=utf-8' );
		header( 'X-Content-Type-Options: nosniff' );
		header( 'Content-Disposition: attachment; filename="siteaudithub-scan-' . (int) $scan_id . '-' . $what . ( $module ? '-' . $module : '' ) . '.csv"' );

		$out = fopen( 'php://output', 'w' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
		fwrite( $out, "\xEF\xBB\xBF" ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- UTF-8 BOM for spreadsheet apps.

		if ( 'urls' === $what ) {
			fputcsv( $out, array( 'url', 'type', 'source', 'depth', 'in_sitemap', 'status', 'http_status', 'response_ms', 'final_url', 'word_count', 'findings', 'processed_at' ) );
			$page = 1;
			do {
				list( $rows ) = Repository::query_items(
					$scan_id,
					array(
						'page'     => $page,
						'per_page' => 200,
					)
				);
				foreach ( $rows as $r ) {
					fputcsv( $out, array_map( array( Security::class, 'csv_cell' ), array( $r->item_key, $r->item_type, $r->source, $r->depth, $r->in_sitemap, $r->status, $r->http_status, $r->response_ms, $r->final_url, $r->word_count, $r->findings_count, $r->processed_at ) ) );
				}
				++$page;
			} while ( count( $rows ) === 200 );
		} else {
			fputcsv( $out, array( 'module', 'severity', 'classification', 'check_id', 'title', 'item', 'evidence', 'recommendation', 'detection_method', 'change', 'scan_date_utc' ) );
			Repository::each_finding(
				$scan_id,
				array(
					'module' => $module,
					'view'   => 'open',
				),
				static function ( $f ) use ( $out ) {
					fputcsv(
						$out,
						array_map(
							array( Security::class, 'csv_cell' ),
							array(
								Catalog::label( 'module', $f->module ),
								Catalog::label( 'severity', $f->severity ),
								Catalog::label( 'classification', $f->classification ),
								$f->check_id,
								$f->title,
								$f->item_key,
								$f->evidence,
								$f->recommendation,
								$f->detection_method,
								$f->change_status,
								$f->created_at,
							)
						)
					);
				}
			);
		}
		fclose( $out ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
		exit;
	}
}