<?php
namespace SmoothBundle\Sandbox;
defined( 'ABSPATH' ) || exit;
// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exceptions are returned as JSON or escaped at the HTML notice sink.

final class Admin {
    public const SLUG = 'smooth-sandbox';
    public function __construct() {
        add_action( 'admin_menu', [ $this, 'menu' ] );
        add_action( 'admin_enqueue_scripts', [ $this, 'assets' ] );
        add_action( 'wp_ajax_smooth_sandbox', [ $this, 'ajax' ] );
        add_action( 'admin_post_smooth_sandbox_action', [ $this, 'action' ] );
    }
    public static function authorize(): void {
        if ( ! current_user_can( 'manage_options' ) ) { wp_die( esc_html__( 'You cannot manage sandboxes.', 'smooth-sandbox' ), '', [ 'response' => 403 ] ); }
    }
    public static function origin(): string {
        $origin = defined( 'SMOOTH_SANDBOX_PLUGINPEER_ORIGIN' ) ? SMOOTH_SANDBOX_PLUGINPEER_ORIGIN : 'https://pluginpeer.com';
        $local = 'local' === wp_get_environment_type() || 'development' === wp_get_environment_type();
        if ( 'https://pluginpeer.com' !== $origin && ! ( $local && preg_match( '#^http://(localhost|127\.0\.0\.1):[0-9]{2,5}$#D', $origin ) ) ) {
            throw new \RuntimeException( __( 'The PluginPeer origin is invalid. Use the official service or a loopback development server.', 'smooth-sandbox' ) );
        }
        return $origin;
    }
    public static function url( string $tab = '' ): string { return admin_url( 'admin.php?page=' . self::SLUG . ( $tab ? '--' . $tab : '' ) ); }
    public function menu(): void {
        add_menu_page( 'Smooth Sandbox', 'Smooth Sandbox', 'manage_options', self::SLUG, [ $this, 'sandbox' ], 'dashicons-welcome-view-site', 82 );
        add_submenu_page( self::SLUG, __( 'Sandbox', 'smooth-sandbox' ), __( 'Sandbox', 'smooth-sandbox' ), 'manage_options', self::SLUG, [ $this, 'sandbox' ] );
        add_submenu_page( self::SLUG, __( 'Recordings', 'smooth-sandbox' ), __( 'Recordings', 'smooth-sandbox' ), 'manage_options', self::SLUG . '--recordings', [ $this, 'recordings' ] );
        add_submenu_page( self::SLUG, __( 'Settings', 'smooth-sandbox' ), __( 'Settings', 'smooth-sandbox' ), 'manage_options', self::SLUG . '--settings', [ $this, 'settings' ] );
    }
    public function assets( string $hook ): void {
        if ( false === strpos( $hook, self::SLUG ) ) { return; }
        // Refresh changed assets without bumping the unpublished plugin version.
        $asset_version = static fn( string $file ): string => SMOOTH_SANDBOX_VERSION . '.' . filemtime( dirname( SMOOTH_SANDBOX_FILE ) . '/assets/' . $file );
        wp_enqueue_style( self::SLUG, plugins_url( 'assets/admin.css', SMOOTH_SANDBOX_FILE ), [], $asset_version( 'admin.css' ) );
        wp_register_style( self::SLUG . '-preparing', false, [], $asset_version( 'preparing.css' ) );
        wp_enqueue_style( self::SLUG . '-preparing' );
        // The initial about:blank tab reuses this WordPress-generated style without a request.
        wp_add_inline_style( self::SLUG . '-preparing', file_get_contents( dirname( SMOOTH_SANDBOX_FILE ) . '/assets/preparing.css' ) );
        wp_enqueue_script( self::SLUG, plugins_url( 'assets/admin.js', SMOOTH_SANDBOX_FILE ), [], $asset_version( 'admin.js' ), true );
        wp_enqueue_script( self::SLUG . '-environment', plugins_url( 'assets/environment.js', SMOOTH_SANDBOX_FILE ), [ self::SLUG, self::SLUG . '-snapshot' ], $asset_version( 'environment.js' ), true );
        wp_enqueue_script( self::SLUG . '-snapshot', plugins_url( 'assets/snapshot.js', SMOOTH_SANDBOX_FILE ), [ self::SLUG ], $asset_version( 'snapshot.js' ), true );
        wp_enqueue_script( self::SLUG . '-settings', plugins_url( 'assets/settings.js', SMOOTH_SANDBOX_FILE ), [ self::SLUG . '-snapshot' ], $asset_version( 'settings.js' ), true );
        try { $origin = self::origin(); } catch ( \Throwable $e ) { $origin = ''; }
        wp_localize_script( self::SLUG, 'smooth_sandbox', [
            'ajax' => admin_url( 'admin-ajax.php' ), 'nonce' => wp_create_nonce( 'smooth_sandbox' ), 'origin' => $origin,
            'recordings' => self::url( 'recordings' ), 'maxBytes' => Recordings::MAX_BYTES, 'chunkBytes' => Recordings::CHUNK,
            'strings' => [
                'working' => __( 'Preparing content preview…', 'smooth-sandbox' ),
                'review' => __( 'Review the exact data below, then confirm the transfer.', 'smooth-sandbox' ),
                'changed' => __( 'Selection changed. Prepare a new preview before launching.', 'smooth-sandbox' ),
                'waiting' => __( 'Waiting for PluginPeer… Keep this page open.', 'smooth-sandbox' ),
                'recheckTimeout' => __( 'WordPress did not finish checking the reviewed content in time. Nothing was sent. Check your connection and retry.', 'smooth-sandbox' ),
                'rechecking' => __( 'Checking your permissions and the reviewed content again…', 'smooth-sandbox' ),
                'stale' => __( 'Content changed after your review. Nothing was sent. Prepare a new preview and review it again.', 'smooth-sandbox' ),
                'bootTimeout' => __( 'WordPress did not become ready within 3 minutes. Startup was cancelled. Try again with a smaller selection or check your connection.', 'smooth-sandbox' ),
                'bootFailed' => __( 'PluginPeer could not finish starting WordPress. Launch a new sandbox to retry.', 'smooth-sandbox' ),
                'ready' => __( 'WordPress is ready in PluginPeer. Manage tools are available. Changes stay in this temporary browser copy.', 'smooth-sandbox' ),
                'closed' => __( 'The PluginPeer window was closed or its connection was blocked. Allow popups and launch again.', 'smooth-sandbox' ),
                'cancelled' => __( 'Startup cancelled. You can launch a new sandbox from the reviewed selection.', 'smooth-sandbox' ),
                'stage_files' => __( 'Content transferred. Preparing the WordPress runtime…', 'smooth-sandbox' ),
                'stage_runtime' => __( 'Content transferred. Loading WordPress…', 'smooth-sandbox' ),
                'stage_setup' => __( 'Content transferred. Importing the selected content…', 'smooth-sandbox' ),
                'stage_screen' => __( 'Content transferred. Preparing the WordPress screen…', 'smooth-sandbox' ),
                /* translators: 1: selected item count, 2: JSON size in KiB. */
                'summary' => __( 'Selected: %1$s · JSON: %2$s KiB / 512 KiB', 'smooth-sandbox' ),
                /* translators: %s: elapsed seconds measured in this browser. */
                'timing' => __( 'Ready after %s seconds in this browser. This timing is not uploaded.', 'smooth-sandbox' ),
                'opened' => __( 'Content transferred. The sandbox is starting in PluginPeer. Keep this page open until WordPress is ready.', 'smooth-sandbox' ),
                'timeout' => __( 'PluginPeer did not confirm the private import protocol. No content was sent. The Smooth Sandbox adapter must be deployed in PluginPeer.', 'smooth-sandbox' ),
                'popup' => __( 'Allow the PluginPeer window to open, then retry.', 'smooth-sandbox' ),
                'originUnavailable' => __( 'The PluginPeer address is invalid. Check the SMOOTH_SANDBOX_PLUGINPEER_ORIGIN configuration before launching.', 'smooth-sandbox' ),
                'randomUnavailable' => __( 'This browser cannot create a secure transfer channel. Use a current browser on HTTPS or localhost.', 'smooth-sandbox' ),
                'error' => __( 'The request failed. Keep this page open and retry. If your login expired, sign in in another tab first.', 'smooth-sandbox' ),
                'unsupported' => __( 'This browser cannot record a tab here. Use a desktop browser with screen capture support on HTTPS or localhost.', 'smooth-sandbox' ),
                'recording' => __( 'Recording the surface you selected. Stop when finished. Audio is not recorded.', 'smooth-sandbox' ),
                'recorded' => __( 'Review the video below. It is only in this browser until you save it privately.', 'smooth-sandbox' ),
                'empty' => __( 'No video was captured. Try recording again.', 'smooth-sandbox' ),
                'limit' => __( 'The video reached the 20 MB limit. Record a shorter session.', 'smooth-sandbox' ),
                'uploading' => __( 'Saving privately…', 'smooth-sandbox' ),
                'saved' => __( 'Saved privately. Open Recordings to review, publish or delete it.', 'smooth-sandbox' ),
                'leave' => __( 'An unsaved video will be lost if you leave this page.', 'smooth-sandbox' ),
            ],
        ] );
    }
    private function header( string $title ): void {
        self::authorize();
        echo '<div class="wrap smooth-sandbox"><h1>' . esc_html( $title ) . '</h1>';
        ?>
        <section class="card ss-snapshot-job" id="ss-snapshot-job" aria-labelledby="ss-snapshot-job-title" hidden>
            <div class="ss-snapshot-job-content">
                <h2 id="ss-snapshot-job-title"><?php esc_html_e( 'Snapshot generation', 'smooth-sandbox' ); ?></h2>
                <p id="ss-snapshot-job-message" role="status" aria-live="polite"></p>
                <progress id="ss-snapshot-job-progress" max="100" aria-label="<?php esc_attr_e( 'Current Snapshot stage', 'smooth-sandbox' ); ?>"></progress>
                <p class="description" id="ss-snapshot-job-details"></p>
            </div>
            <a class="button button-primary" href="<?php echo esc_url( self::url( 'settings' ) . '#ss-snapshot-title' ); ?>"><?php esc_html_e( 'Snapshot settings', 'smooth-sandbox' ); ?></a>
        </section>
        <?php
        $notice = get_transient( 'smooth_sandbox_notice_' . get_current_user_id() );
        if ( is_array( $notice ) ) {
            delete_transient( 'smooth_sandbox_notice_' . get_current_user_id() );
            echo '<div class="notice ' . ( $notice['error'] ? 'notice-error' : 'notice-success' ) . '"><p>' . esc_html( $notice['message'] ) . '</p></div>';
        }
    }
    public function sandbox(): void {
        $this->header( 'Smooth Sandbox' );
        try { $inventory = Snapshot::inventory(); $versions = Runtime_Versions::get(); }
        catch ( \Throwable $error ) {
            echo '<div class="notice notice-error"><p>' . esc_html( $error->getMessage() ) . '</p></div></div>';
            return;
        }
        $default_wp = in_array( $inventory['wp'], $versions['wordpress'], true ) ? $inventory['wp'] : Runtime_Versions::newest( $versions['wordpress'] );
        ?>
        <section class="card" aria-labelledby="ss-content-title">
            <h2 id="ss-content-title"><?php esc_html_e( 'Sandbox environment', 'smooth-sandbox' ); ?></h2>
            <form id="ss-content-form" data-environment="1">
                <div class="ss-environment-grid">
                    <p><label for="ss-wp"><?php esc_html_e( 'WordPress version', 'smooth-sandbox' ); ?></label><select id="ss-wp" required>
                        <?php foreach ( $versions['wordpress'] as $version ) : ?><option value="<?php echo esc_attr( $version ); ?>" <?php selected( $version, $default_wp ); ?>><?php echo esc_html( $version ); ?></option><?php endforeach; ?>
                    </select></p>
                    <p><label for="ss-php"><?php esc_html_e( 'PHP version', 'smooth-sandbox' ); ?></label><select id="ss-php" required>
                        <?php if ( ! in_array( $inventory['php'], $versions['php'], true ) ) : ?><option value="" selected><?php esc_html_e( 'Choose a version', 'smooth-sandbox' ); ?></option><?php endif; ?>
                        <?php foreach ( $versions['php'] as $version ) : ?><option value="<?php echo esc_attr( $version ); ?>" <?php selected( $version, $inventory['php'] ); ?>><?php echo esc_html( $version ); ?></option><?php endforeach; ?>
                    </select></p>
                    <p><label for="ss-theme"><?php esc_html_e( 'Theme', 'smooth-sandbox' ); ?></label><select id="ss-theme" required>
                        <?php foreach ( $inventory['themes'] as $theme ) : ?><option value="<?php echo esc_attr( $theme['slug'] ); ?>" <?php selected( $theme['slug'], $inventory['theme'] ); ?>><?php echo esc_html( $theme['name'] ); ?></option><?php endforeach; ?>
                    </select></p>
                </div>
                <h3><?php esc_html_e( 'Plugins', 'smooth-sandbox' ); ?></h3>
                <table class="widefat striped ss-plugin-list"><thead><tr><th><?php esc_html_e( 'Include plugin', 'smooth-sandbox' ); ?></th><th><?php esc_html_e( 'Version', 'smooth-sandbox' ); ?></th><th><?php esc_html_e( 'Source state', 'smooth-sandbox' ); ?></th></tr></thead><tbody>
                    <?php foreach ( $inventory['plugins'] as $index => $plugin ) : ?><tr data-active="<?php echo $plugin['active'] ? '1' : '0'; ?>">
                        <td><label><input class="ss-plugin" type="checkbox" value="<?php echo esc_attr( $plugin['file'] ); ?>" <?php checked( $plugin['active'] ); ?>> <?php echo esc_html( $plugin['name'] ); ?></label></td>
                        <td class="ss-plugin-version"><?php echo esc_html( $plugin['version'] ); ?></td>
                        <td><?php echo esc_html( $plugin['active'] ? __( 'Active', 'smooth-sandbox' ) : __( 'Inactive', 'smooth-sandbox' ) ); ?></td>
                    </tr><?php endforeach; ?>
                </tbody></table>
                <p id="ss-snapshot-launch-status" role="status"><?php esc_html_e( 'Checking Snapshot…', 'smooth-sandbox' ); ?></p>
                <p class="ss-boot-action">
                    <button type="submit" class="button button-primary" id="ss-launch" disabled><?php esc_html_e( 'Boot up sandbox', 'smooth-sandbox' ); ?></button>
                    <a class="button button-primary" id="ss-go-settings" href="<?php echo esc_url( self::url( 'settings' ) ); ?>" hidden><?php esc_html_e( 'Go to settings', 'smooth-sandbox' ); ?></a>
                </p>
            </form>
        </section>
        <section class="card ss-startup" id="ss-startup" aria-labelledby="ss-startup-title" hidden>
            <h2 id="ss-startup-title" tabindex="-1"><?php esc_html_e( 'Preparing sandbox', 'smooth-sandbox' ); ?></h2>
            <p class="description"><?php esc_html_e( 'Opens a private Playground from the last completed Snapshot and your selected packages.', 'smooth-sandbox' ); ?></p>
            <div class="ss-startup-content">
                <p id="ss-status" role="status" aria-live="polite"></p>
                <div id="ss-progress" class="ss-progress" role="progressbar" aria-label="<?php esc_attr_e( 'Sandbox startup', 'smooth-sandbox' ); ?>" aria-valuemin="0" aria-valuemax="100" hidden><div id="ss-progress-bar"></div></div>
                <p id="ss-progress-caption" class="ss-progress-caption" hidden></p>
                <div id="ss-preview" hidden>
                    <table id="ss-summary" class="widefat striped" aria-label="<?php esc_attr_e( 'Environment summary', 'smooth-sandbox' ); ?>"><tbody></tbody></table>
                    <p id="ss-media-summary" class="description"></p>
                </div>
                <p id="ss-timing" class="description"></p>
                <p id="ss-recording-link-wrap" hidden><a id="ss-recording-link" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Open recording', 'smooth-sandbox' ); ?></a></p>
                <p id="ss-recording-retry-wrap" hidden><button type="button" class="button" id="ss-recording-retry"><?php esc_html_e( 'Retry saving recording link', 'smooth-sandbox' ); ?></button></p>
                <div class="ss-startup-actions"><button type="button" class="button" id="ss-cancel" hidden><?php esc_html_e( 'Cancel sandbox startup', 'smooth-sandbox' ); ?></button></div>
            </div>
        </section>
        </div>
        <?php
    }
    public function settings(): void {
        $this->header( __( 'Settings', 'smooth-sandbox' ) );
        ?>
        <form id="ss-settings-form">
            <section class="card" aria-labelledby="ss-snapshot-title">
                <h2 id="ss-snapshot-title"><?php esc_html_e( 'Snapshot', 'smooth-sandbox' ); ?></h2>
                <p><?php esc_html_e( 'Prepare a private copy on this WordPress server for faster Sandbox startup.', 'smooth-sandbox' ); ?></p>
                <p id="ss-snapshot-status" role="status" aria-live="polite"><?php esc_html_e( 'Checking Snapshot…', 'smooth-sandbox' ); ?></p>
                <table class="widefat striped" id="ss-snapshot-metadata" aria-label="<?php esc_attr_e( 'Last completed Snapshot', 'smooth-sandbox' ); ?>" hidden><tbody></tbody></table>
                <p id="ss-snapshot-queue-note" class="description" hidden></p>
                <p class="ss-actions">
                    <button type="button" class="button" id="ss-snapshot-queue" disabled><?php esc_html_e( 'Queue Snapshot generation', 'smooth-sandbox' ); ?></button>
                    <button type="button" class="button ss-button-danger" id="ss-snapshot-delete" disabled><?php esc_html_e( 'Delete Snapshot', 'smooth-sandbox' ); ?></button>
                </p>
            </section>
            <section class="card" aria-labelledby="ss-data-title">
                <h2 id="ss-data-title"><?php esc_html_e( 'Site data', 'smooth-sandbox' ); ?></h2>
                <p><?php esc_html_e( 'Copy the site database, including options, transients, metadata, comments and content. Draft, pending, private, scheduled and password-protected content requires the option below. Trash and transfer locks are excluded.', 'smooth-sandbox' ); ?></p>
                <p><label><input id="ss-private-content" type="checkbox"> <?php esc_html_e( 'Include drafts, pending, scheduled, private and password-protected content', 'smooth-sandbox' ); ?></label></p>
            </section>
            <section class="card" aria-labelledby="ss-users-title">
                <h2 id="ss-users-title"><?php esc_html_e( 'Users', 'smooth-sandbox' ); ?></h2>
                <p><?php esc_html_e( 'Sandbox always creates its own administrator account.', 'smooth-sandbox' ); ?></p>
                <table class="widefat ss-users"><thead><tr><th scope="col"><?php esc_html_e( 'User', 'smooth-sandbox' ); ?></th><th scope="col"><?php esc_html_e( 'Sandbox password', 'smooth-sandbox' ); ?></th><th scope="col"><span class="screen-reader-text"><?php esc_html_e( 'Actions', 'smooth-sandbox' ); ?></span></th></tr></thead><tbody id="ss-user-rows"></tbody></table>
                <p><button type="button" class="button" id="ss-add-user"><?php esc_html_e( 'Add user to import', 'smooth-sandbox' ); ?></button></p>
            </section>
            <section class="card" aria-labelledby="ss-credentials-title">
                <h2 id="ss-credentials-title"><?php esc_html_e( 'Credentials', 'smooth-sandbox' ); ?></h2>
                <p class="description"><?php esc_html_e( 'Selected keys and tokens are copied with their real values.', 'smooth-sandbox' ); ?></p>
                <div class="ss-search">
                    <label for="ss-credential-search"><?php esc_html_e( 'Find a key', 'smooth-sandbox' ); ?></label>
                    <input type="search" id="ss-credential-search" class="regular-text" autocomplete="off">
                    <button type="button" class="button" id="ss-credentials-refresh"><?php esc_html_e( 'Refresh keys', 'smooth-sandbox' ); ?></button>
                </div>
                <p id="ss-credentials-status" role="status" aria-live="polite"><?php esc_html_e( 'Scanning credential fields…', 'smooth-sandbox' ); ?></p>
                <table class="widefat striped ss-credential-list" aria-labelledby="ss-credentials-title" hidden><thead><tr><th scope="col"><?php esc_html_e( 'Copy key', 'smooth-sandbox' ); ?></th><th scope="col"><?php esc_html_e( 'Stored in', 'smooth-sandbox' ); ?></th></tr></thead><tbody id="ss-credential-rows"></tbody></table>
            </section>
            <p class="description"><?php esc_html_e( 'Saving queues a Snapshot if none exists or if your content, user or credential settings differ from the last Snapshot.', 'smooth-sandbox' ); ?></p>
            <p class="submit"><button type="submit" class="button button-primary" id="ss-settings-save" disabled><?php esc_html_e( 'Save settings', 'smooth-sandbox' ); ?></button></p>
            <p id="ss-settings-status" role="status" aria-live="polite"></p>
        </form>
        </div>
        <?php
    }
    // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Called only after nonce/capability checks; each operation validates its own typed payload, including strict binary base64.
    private static function input( string $key ): string { return isset( $_POST[ $key ] ) && is_string( $_POST[ $key ] ) ? wp_unslash( $_POST[ $key ] ) : ''; }
    public function ajax(): void {
        self::authorize();
        check_ajax_referer( 'smooth_sandbox', 'nonce' );
        if ( 'POST' !== sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ?? '' ) ) ) { wp_send_json_error( [ 'message' => 'POST required' ], 405 ); }
        try {
            $operation = self::input( 'operation' );
            switch ( $operation ) {
                case 'snapshot_status':
                    wp_send_json_success( Snapshot::status() ); break;
                case 'snapshot_settings':
                    wp_send_json_success( Snapshot::settings() ); break;
                case 'snapshot_save':
                    $settings = json_decode( self::input( 'settings' ), true, 32, JSON_THROW_ON_ERROR );
                    if ( ! is_array( $settings ) ) { throw new \RuntimeException( 'Invalid Snapshot settings.' ); }
                    wp_send_json_success( Snapshot::save( $settings ) ); break;
                case 'snapshot_queue':
                    wp_send_json_success( Snapshot::queue() ); break;
                case 'snapshot_delete':
                    wp_send_json_success( Snapshot::remove() ); break;
                case 'snapshot_prepare':
                    $selection = json_decode( self::input( 'selection' ), true, 32, JSON_THROW_ON_ERROR );
                    if ( ! is_array( $selection ) ) { throw new \RuntimeException( 'Invalid Sandbox selection.' ); }
                    wp_send_json_success( Snapshot::prepare( $selection ) ); break;
                case 'snapshot_download':
                    Snapshot::stream( self::input( 'id' ) ); break;
                case 'snapshot_end':
                    Snapshot::end( self::input( 'id' ) ); wp_send_json_success(); break;
                case 'snapshot_credentials':
                    $selection = json_decode( self::input( 'selection' ), true, 32, JSON_THROW_ON_ERROR );
                    if ( ! is_array( $selection ) ) { throw new \RuntimeException( 'Invalid data selection.' ); }
                    $selection['plugins'] = Environment::inventory()['plugins'];
                    wp_send_json_success( Environment::credential_inventory( $selection ) ); break;

                case 'recording_link_save':
                    $data = json_decode( self::input( 'recording' ), true, 8, JSON_THROW_ON_ERROR );
                    if ( ! is_array( $data ) ) { throw new \RuntimeException( 'Invalid recording link.' ); }
                    wp_send_json_success( Recording_Webhook::save_link( $data ) );
                    break;
                case 'recording_webhook_create':
                    wp_send_json_success( Recording_Webhook::create() );
                    break;
                case 'recording_webhook_revoke':
                    Recording_Webhook::revoke( self::input( 'id' ) ); wp_send_json_success();
                    break;
                case 'environment_preview':
                case 'environment_begin':
                    $selection = json_decode( self::input( 'selection' ), true, 32, JSON_THROW_ON_ERROR );
                    if ( ! is_array( $selection ) ) { throw new \RuntimeException( 'Invalid environment selection.' ); }
                    wp_send_json_success( 'environment_preview' === $operation ? Environment::build( $selection ) : Environment::begin( $selection, self::input( 'reviewHash' ) ) );
                    break;
                case 'environment_batch':
                    $index = self::input( 'index' ); $offset = self::input( 'offset' );
                    if ( ! ctype_digit( $index ) || ! ctype_digit( $offset ) ) { throw new \RuntimeException( 'Invalid file cursor.' ); }
                    wp_send_json_success( Environment::batch( self::input( 'id' ), (int) $index, (int) $offset ) );
                    break;
                case 'environment_end':
                    Environment::end( self::input( 'id' ) ); wp_send_json_success();
                    break;
                case 'environment_users':
                    if ( ! current_user_can( 'list_users' ) ) { throw new \RuntimeException( 'You cannot list users.' ); }
                    $found = get_users( [ 'search' => '*' . sanitize_text_field( self::input( 'search' ) ) . '*', 'search_columns' => [ 'user_login', 'display_name' ], 'number' => 200, 'offset' => min( 1000000, absint( self::input( 'page' ) ) ) * 200, 'fields' => [ 'ID', 'user_login', 'display_name' ] ] );
                    wp_send_json_success( array_values( array_map( static fn( $user ) => [ 'id' => (int) $user->ID, 'login' => $user->user_login, 'name' => $user->display_name ], array_filter( $found, static fn( $user ) => current_user_can( 'edit_user', $user->ID ) ) ) ) );
                    break;
                case 'environment_credentials':
                    $selection = json_decode( self::input( 'selection' ), true, 32, JSON_THROW_ON_ERROR );
                    if ( ! is_array( $selection ) ) { throw new \RuntimeException( 'Invalid environment selection.' ); }
                    wp_send_json_success( Environment::credential_inventory( $selection ) );
                    break;
                case 'preview':
                    $ids = isset( $_POST['ids'] ) && is_array( $_POST['ids'] ) ? wp_unslash( $_POST['ids'] ) : []; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Content::build strictly validates each scalar ID and rejects nested arrays before querying.
                    wp_send_json_success( Content::build( $ids ) );
                    break;
                case 'recording_start':
                    wp_send_json_success( [ 'id' => Recordings::start( self::input( 'title' ), self::input( 'mime' ) ) ] );
                    break;
                case 'recording_chunk':
                    $sequence = self::input( 'sequence' );
                    if ( ! ctype_digit( $sequence ) ) { throw new \RuntimeException( 'Invalid chunk sequence' ); }
                    Recordings::append( self::input( 'id' ), (int) $sequence, self::input( 'data' ) );
                    wp_send_json_success();
                    break;
                case 'recording_finish':
                    Recordings::finish( self::input( 'id' ), (int) self::input( 'size' ) );
                    wp_send_json_success();
                    break;
                case 'recording_discard':
                    Recordings::owned( self::input( 'id' ) );
                    Recordings::remove( self::input( 'id' ) );
                    wp_send_json_success();
                    break;
                default: throw new \RuntimeException( __( 'Unknown action.', 'smooth-sandbox' ) );
            }
        } catch ( \Throwable $e ) { wp_send_json_error( [ 'message' => $e->getMessage() ], 400 ); }
    }
    public static function form( string $operation, string $id, string $label, bool $confirm = false ): void {
        echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" class="ss-action-form">';
        wp_nonce_field( 'smooth_sandbox_action' );
        echo '<input type="hidden" name="action" value="smooth_sandbox_action"><input type="hidden" name="operation" value="' . esc_attr( $operation ) . '"><input type="hidden" name="id" value="' . esc_attr( $id ) . '">';
        if ( $confirm ) {
            echo '<p><label><input type="checkbox" name="confirm" value="1" required> ' . esc_html( 'publish' === $operation ? __( 'I reviewed the video. Anyone with its link can view and copy it.', 'smooth-sandbox' ) : __( 'Delete this video permanently.', 'smooth-sandbox' ) ) . '</label></p>';
        }
        $button_class = 'unlink_recording' === $operation ? 'button ss-button-danger' : 'button';
        echo '<button class="' . esc_attr( $button_class ) . '" type="submit">' . esc_html( $label ) . '</button></form>';
    }
    public function action(): void {
        self::authorize();
        check_admin_referer( 'smooth_sandbox_action' );
        if ( 'POST' !== sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ?? '' ) ) ) { wp_die( 'POST required', '', [ 'response' => 405 ] ); }
        $error = false;
        try {
            $id = self::input( 'id' );
            if ( 'unlink_recording' !== self::input( 'operation' ) ) { Recordings::owned( $id ); }
            switch ( self::input( 'operation' ) ) {
                case 'unlink_recording':
                    Recording_Webhook::remove_link( $id ); $message = __( 'Recording reference removed. The recording remains in PluginPeer.', 'smooth-sandbox' ); break;
                case 'publish':
                    if ( '1' !== self::input( 'confirm' ) ) { throw new \RuntimeException( __( 'Review the video and confirm publication.', 'smooth-sandbox' ) ); }
                    Recordings::visibility( $id, true ); $message = __( 'Recording published. The sandbox and source content remain separate.', 'smooth-sandbox' ); break;
                case 'private':
                    Recordings::visibility( $id, false ); $message = __( 'Recording is private. Old public links and embeds are invalid. Previously downloaded copies cannot be recalled.', 'smooth-sandbox' ); break;
                case 'delete':
                    if ( '1' !== self::input( 'confirm' ) ) { throw new \RuntimeException( __( 'Confirm permanent deletion.', 'smooth-sandbox' ) ); }
                    Recordings::remove( $id ); $message = __( 'Recording deleted.', 'smooth-sandbox' ); break;
                default: throw new \RuntimeException( __( 'Unknown action.', 'smooth-sandbox' ) );
            }
        } catch ( \Throwable $e ) { $error = true; $message = $e->getMessage(); }
        set_transient( 'smooth_sandbox_notice_' . get_current_user_id(), compact( 'message', 'error' ), 120 );
        wp_safe_redirect( self::url( 'recordings' ) ); exit;
    }
    public function recordings(): void {
        $this->header( __( 'Recordings', 'smooth-sandbox' ) );
        require_once __DIR__ . '/class-recordings-list-table.php';
        $table = new Recordings_List_Table();
        $table->prepare_items();
        echo '<form method="get" action="' . esc_url( admin_url( 'admin.php' ) ) . '"><input type="hidden" name="page" value="' . esc_attr( self::SLUG . '--recordings' ) . '">';
        $table->search_box( __( 'Search recordings', 'smooth-sandbox' ), 'ss-recordings-search' );
        echo '</form>';
        $table->display();
        echo '</div>';
    }
}