<?php
/**
 * StorePinger (free): live visitors, their countries and today's visitors.
 *
 * Privacy: no cookies. The browser keeps a random visitor id in localStorage; IP addresses are
 * only used for the country lookup and are never stored. Data older than 48 hours is deleted.
 *
 * @package StorePinger
 */

defined( 'ABSPATH' ) || exit;

final class StorePinger_Free {

	const DB_VERSION = 1;
	const LIVE       = 300;     // A visitor counts as live for 5 minutes after their last ping.
	const KEEP       = 172800;  // Keep 48 hours of data.
	const PRICING    = 'https://storepinger.com/pricing.html?utm_source=storepinger-free&utm_medium=wp-admin';
	const BOTS       = '/bot|crawl|spider|slurp|facebookexternalhit|preview|headless|lighthouse|pingdom|uptime|monitor|curl|wget|python|java\/|httpclient|go-http|axios|node-fetch|scrapy|ahrefs|semrush|mj12|dotbot|petal|bytespider|gptbot|claudebot|perplexitybot/i';
	const CF_RANGES  = array( '173.245.48.0/20', '103.21.244.0/22', '103.22.200.0/22', '103.31.4.0/22', '141.101.64.0/18', '108.162.192.0/18', '190.93.240.0/20', '188.114.96.0/20', '197.234.240.0/22', '198.41.128.0/17', '162.158.0.0/15', '104.16.0.0/13', '104.24.0.0/14', '172.64.0.0/13', '131.0.72.0/22', '2400:cb00::/32', '2606:4700::/32', '2803:f800::/32', '2405:b500::/32', '2405:8100::/32', '2a06:98c0::/29', '2c0f:f248::/32' );

	/* ================= Setup ================= */

	public static function init() {
		if ( defined( 'ECT_VERSION' ) ) {
			// The full StorePinger plugin is active: it does everything this one does.
			add_action( 'admin_notices', array( __CLASS__, 'pro_notice' ) );
			return;
		}
		if ( (int) get_option( 'storepinger_db', 0 ) < self::DB_VERSION ) {
			self::install();
		}
		StorePinger_Llms::init();
		add_action( 'wp_enqueue_scripts', array( __CLASS__, 'tracker' ) );
		add_action( 'rest_api_init', array( __CLASS__, 'routes' ) );
		add_action( 'admin_menu', array( __CLASS__, 'menu' ) );
		add_action( 'admin_init', array( __CLASS__, 'privacy' ) );
		add_action( 'admin_enqueue_scripts', array( __CLASS__, 'admin_assets' ) );
		add_action( 'wp_dashboard_setup', array( __CLASS__, 'widget' ) );
		add_action( 'admin_post_storepinger_settings', array( __CLASS__, 'save_settings' ) );
		add_action( 'storepinger_cleanup', array( __CLASS__, 'cleanup' ) );
		if ( ! wp_next_scheduled( 'storepinger_cleanup' ) ) {
			wp_schedule_event( time() + HOUR_IN_SECONDS, 'hourly', 'storepinger_cleanup' ); // Also covers multisite and lost cron events.
		}
		add_filter( 'plugin_action_links_' . plugin_basename( STOREPINGER_FILE ), array( __CLASS__, 'action_links' ) );
	}

	public static function activate() {
		self::install();
		if ( ! wp_next_scheduled( 'storepinger_cleanup' ) ) {
			wp_schedule_event( time() + HOUR_IN_SECONDS, 'hourly', 'storepinger_cleanup' );
		}
	}

	public static function deactivate() {
		wp_clear_scheduled_hook( 'storepinger_cleanup' );
	}

	public static function table() {
		global $wpdb;
		return $wpdb->prefix . 'storepinger_visits';
	}

	public static function pages_table() {
		global $wpdb;
		return $wpdb->prefix . 'storepinger_pageviews';
	}

	private static function install() {
		global $wpdb;
		require_once ABSPATH . 'wp-admin/includes/upgrade.php';
		$c = $wpdb->get_charset_collate();
		dbDelta(
			'CREATE TABLE ' . self::table() . " (
				id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
				skey CHAR(32) NOT NULL,
				visitor CHAR(32) NOT NULL,
				started INT UNSIGNED NOT NULL,
				last_seen INT UNSIGNED NOT NULL,
				pages SMALLINT UNSIGNED NOT NULL DEFAULT 1,
				country CHAR(2) NOT NULL DEFAULT '',
				PRIMARY KEY  (id),
				UNIQUE KEY skey (skey),
				KEY last_seen (last_seen),
				KEY started (started)
			) {$c};"
		);
		dbDelta(
			'CREATE TABLE ' . self::pages_table() . " (
				id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
				ts INT UNSIGNED NOT NULL,
				PRIMARY KEY  (id),
				KEY ts (ts)
			) {$c};"
		);
		update_option( 'storepinger_db', self::DB_VERSION, false );
		add_option( 'storepinger_settings', array( 'track_admins' => 0 ), '', false );
	}

	/** Suggested text for the site's privacy policy (Settings → Privacy). */
	public static function privacy() {
		if ( function_exists( 'wp_add_privacy_policy_content' ) ) {
			wp_add_privacy_policy_content( 'StorePinger', wp_kses_post( '<p>' . __( 'This site uses StorePinger to count visits. StorePinger sets no cookies. It keeps a random visitor ID in your browser\'s local storage so a returning visit is not counted twice. Your IP address is used only for a moment to find your country and is never stored. Visit data stays on this website and is deleted after 48 hours.', 'storepinger' ) . '</p>' ) );
		}
	}

	public static function cleanup() {
		global $wpdb;
		$before = time() - self::KEEP;
		$wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE last_seen < %d', self::table(), $before ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- plugin's own table, nothing to cache.
		$wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE ts < %d', self::pages_table(), $before ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- plugin's own table, nothing to cache.
	}

	private static function settings() {
		return wp_parse_args( (array) get_option( 'storepinger_settings', array() ), array( 'track_admins' => 0 ) );
	}

	/* ================= Tracking ================= */

	public static function tracker() {
		if ( is_user_logged_in() && current_user_can( 'manage_options' ) && ! self::settings()['track_admins'] ) {
			return;
		}
		wp_enqueue_script( 'storepinger', STOREPINGER_URL . 'assets/tracker.js', array(), STOREPINGER_VERSION, array( 'strategy' => 'defer', 'in_footer' => true ) );
		wp_localize_script( 'storepinger', 'storepinger', array( 'url' => esc_url_raw( rest_url( 'storepinger/v1/hit' ) ), 'admins' => (int) self::settings()['track_admins'] ) );
	}

	public static function routes() {
		register_rest_route(
			'storepinger/v1',
			'/hit',
			array(
				'methods'             => 'POST',
				'callback'            => array( __CLASS__, 'hit' ),
				'permission_callback' => '__return_true', // Public by design: visitors send page views.
			)
		);
		register_rest_route(
			'storepinger/v1',
			'/stats',
			array(
				'methods'             => 'GET',
				'callback'            => array( __CLASS__, 'stats_rest' ),
				'permission_callback' => function () {
					return current_user_can( 'manage_options' );
				},
			)
		);
	}

	public static function hit( WP_REST_Request $req ) {
		$ok = new WP_REST_Response( null, 204 );
		$ua = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
		if ( '' === $ua || preg_match( self::BOTS, $ua ) || self::limited() ) {
			return $ok;
		}
		$p = $req->get_json_params();
		if ( ! is_array( $p ) ) {
			return $ok;
		}
		$v = isset( $p['v'] ) ? (string) $p['v'] : '';
		$s = isset( $p['s'] ) ? (string) $p['s'] : '';
		if ( ! preg_match( '/^[A-Za-z0-9]{16,40}$/', $v ) || ! preg_match( '/^[A-Za-z0-9]{16,40}$/', $s ) ) {
			return $ok;
		}
		$hb   = isset( $p['e'] ) && 'hb' === $p['e'];
		$now  = time();
		$salt = wp_salt( 'nonce' );
		$skey = hash( 'sha256', 'spl|' . $s . '|' . $salt );
		$skey = substr( $skey, 0, 32 );

		global $wpdb;
		$t   = self::table();
		$row = $wpdb->get_row( $wpdb->prepare( 'SELECT id, last_seen FROM %i WHERE skey = %s', $t, $skey ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- live tracking needs the current row.
		if ( $row && $row->last_seen > $now - 1800 ) {
			if ( $hb ) {
				$wpdb->query( $wpdb->prepare( 'UPDATE %i SET last_seen = %d WHERE id = %d', $t, $now, $row->id ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- plugin's own table.
			} else {
				$wpdb->query( $wpdb->prepare( 'UPDATE %i SET last_seen = %d, pages = LEAST(pages + 1, 65000) WHERE id = %d', $t, $now, $row->id ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- plugin's own table.
				$wpdb->insert( self::pages_table(), array( 'ts' => $now ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- plugin's own table.
			}
			return $ok;
		}
		if ( $hb ) {
			return $ok; // A heartbeat never starts a visit.
		}
		if ( $row ) {
			// Same tab after 30 minutes away: a new visit. The old row keeps its own key.
			$wpdb->update( $t, array( 'skey' => substr( hash( 'sha256', $skey . '|' . $row->id ), 0, 32 ) ), array( 'id' => $row->id ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- plugin's own table.
		}
		// Never more than 600 new visits a minute site-wide (stops scripted floods).
		if ( self::bump( 'storepinger_new_' . gmdate( 'YmdHi' ) ) > 600 ) {
			return $ok;
		}
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- plugin's own table.
		$wpdb->insert(
			$t,
			array(
				'skey'      => $skey,
				'visitor'   => substr( hash( 'sha256', 'splv|' . $v . '|' . $salt ), 0, 32 ),
				'started'   => $now,
				'last_seen' => $now,
				'pages'     => 1,
								'country'   => self::country(),
			)
		);
		$wpdb->insert( self::pages_table(), array( 'ts' => $now ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- plugin's own table.
		return $ok;
	}

	/** Counts in the object cache when there is one, otherwise in a short-lived transient. */
	private static function bump( $k ) {
		if ( wp_using_ext_object_cache() ) {
			wp_cache_add( $k, 0, 'storepinger', MINUTE_IN_SECONDS );
			return (int) wp_cache_incr( $k, 1, 'storepinger' );
		}
		$n = (int) get_transient( $k ) + 1;
		set_transient( $k, $n, MINUTE_IN_SECONDS );
		return $n;
	}

	private static function limited() {
		$ip = self::ip();
		// IPv6 visitors share one bucket per /64 network (one home or phone usually has a whole /64).
		$bin = @inet_pton( $ip ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
		if ( false !== $bin && 16 === strlen( $bin ) ) {
			$ip = bin2hex( substr( $bin, 0, 8 ) );
		}
		return self::bump( 'storepinger_rl_' . substr( md5( $ip . wp_salt( 'nonce' ) ), 0, 16 ) ) > 120;
	}

	/** Visitor IP, used only for the country lookup and the rate limit. Never stored. */
	private static function ip() {
		$r = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
		if ( ! empty( $_SERVER['HTTP_CF_CONNECTING_IP'] ) && self::in_ranges( $r, self::CF_RANGES ) ) {
			$c = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) );
			if ( filter_var( $c, FILTER_VALIDATE_IP ) ) {
				return $c;
			}
		}
		/**
		 * Sites behind their own proxy or load balancer can return the visitor IP here.
		 *
		 * @param string $ip The IP StorePinger would use.
		 */
		return (string) apply_filters( 'storepinger_client_ip', $r );
	}

	private static function in_ranges( $ip, $ranges ) {
		$bin = @inet_pton( $ip ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
		if ( false === $bin ) {
			return false;
		}
		foreach ( $ranges as $cidr ) {
			list( $net, $bits ) = explode( '/', $cidr );
			$n = inet_pton( $net );
			if ( strlen( $n ) !== strlen( $bin ) ) {
				continue;
			}
			$by = intdiv( (int) $bits, 8 );
			$re = (int) $bits % 8;
			if ( substr( $bin, 0, $by ) === substr( $n, 0, $by ) && ( ! $re || 0 === ( ( ord( $bin[ $by ] ) ^ ord( $n[ $by ] ) ) & ( 0xFF << ( 8 - $re ) ) & 0xFF ) ) ) {
				return true;
			}
		}
		return false;
	}

	/* ================= Country ================= */

	private static function geo_dir() {
		$u = wp_upload_dir();
		return trailingslashit( $u['basedir'] ) . 'storepinger/';
	}

	private static function geo_file() {
		$name = get_option( 'storepinger_geo_file' );
		return $name ? self::geo_dir() . $name : '';
	}

	private static function country() {
		$r = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
		if ( ! empty( $_SERVER['HTTP_CF_IPCOUNTRY'] ) && self::in_ranges( $r, self::CF_RANGES ) ) {
			$c = strtoupper( sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_IPCOUNTRY'] ) ) );
			if ( preg_match( '/^[A-Z]{2}$/', $c ) && 'XX' !== $c && 'T1' !== $c ) {
				return $c;
			}
		}
		$file = self::geo_file();
		if ( ! $file || ! file_exists( $file ) ) {
			return '';
		}
		try {
			$db  = new StorePinger_MMDB_Reader( $file );
			$rec = $db->get( self::ip() );
		} catch ( Throwable $e ) {
			return '';
		}
		$c = $rec['country']['iso_code'] ?? ( $rec['country_code'] ?? '' );
		return preg_match( '/^[A-Za-z]{2}$/', (string) $c ) ? strtoupper( $c ) : '';
	}

	/** Downloads the free DB-IP Lite country database (CC BY 4.0). Only when the site owner clicks the button. */
	private static function download_geo() {
		require_once ABSPATH . 'wp-admin/includes/file.php';
		$dir = self::geo_dir();
		if ( ! wp_mkdir_p( $dir ) ) {
			return new WP_Error( 'spl', __( 'Could not create the uploads folder.', 'storepinger' ) );
		}
		if ( ! file_exists( $dir . 'index.php' ) ) {
			file_put_contents( $dir . 'index.php', "<?php // Silence is golden.\n" ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
			file_put_contents( $dir . '.htaccess', "Deny from all\n" ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
		}
		foreach ( array( 0, 1 ) as $back ) {
			$ym  = gmdate( 'Y-m', strtotime( "first day of -{$back} month" ) );
			$res = wp_safe_remote_get( "https://download.db-ip.com/free/dbip-country-lite-{$ym}.mmdb.gz", array( 'timeout' => 120 ) );
			if ( is_wp_error( $res ) || 200 !== (int) wp_remote_retrieve_response_code( $res ) ) {
				continue;
			}
			$data = function_exists( 'gzdecode' ) ? gzdecode( (string) wp_remote_retrieve_body( $res ) ) : false;
			unset( $res );
			if ( ! $data || false === strpos( substr( $data, -131072 ), StorePinger_MMDB_Reader::METADATA_MARKER ) ) {
				continue;
			}
			$name = 'country-' . wp_generate_password( 16, false ) . '.mmdb';
			file_put_contents( $dir . $name, $data ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
			$old = self::geo_file();
			update_option( 'storepinger_geo_file', $name, false );
			update_option( 'storepinger_geo_updated', time(), false );
			if ( $old && file_exists( $old ) ) {
				wp_delete_file( $old );
			}
			return true;
		}
		return new WP_Error( 'spl', __( 'The country database could not be downloaded. Please try again later.', 'storepinger' ) );
	}

	/* ================= Stats ================= */

	public static function stats() {
		global $wpdb;
		$t     = self::table();
		$pt    = self::pages_table();
		$now   = time();
		$live  = $now - self::LIVE;
		$today = (int) ( new DateTime( 'today', wp_timezone() ) )->getTimestamp();
		// phpcs:disable WordPress.DB.DirectDatabaseQuery -- live numbers from the plugin's own tables; caching would make them stale.
		$out = array(
			'live'          => (int) $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(DISTINCT visitor) FROM %i WHERE last_seen >= %d', $t, $live ) ),
			'live_countries' => $wpdb->get_results( $wpdb->prepare( 'SELECT country AS k, COUNT(DISTINCT visitor) AS n FROM %i WHERE last_seen >= %d GROUP BY country ORDER BY n DESC', $t, $live ), ARRAY_A ),
			'live_list'     => $wpdb->get_results( $wpdb->prepare( 'SELECT MAX(country) AS country, SUM(pages) AS pages, %d - MAX(last_seen) AS ago FROM %i WHERE last_seen >= %d GROUP BY visitor ORDER BY MAX(last_seen) DESC LIMIT 12', $now, $t, $live ), ARRAY_A ),
			'visitors'      => (int) $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(DISTINCT visitor) FROM %i WHERE started >= %d', $t, $today ) ),
			'visits'        => (int) $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(*) FROM %i WHERE started >= %d', $t, $today ) ),
			'pageviews'     => (int) $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(*) FROM %i WHERE ts >= %d', $pt, $today ) ),
			'countries'     => $wpdb->get_results( $wpdb->prepare( 'SELECT country AS k, COUNT(DISTINCT visitor) AS n FROM %i WHERE started >= %d GROUP BY country ORDER BY n DESC LIMIT 8', $t, $today ), ARRAY_A ),
			'time'          => $now,
		);
		// phpcs:enable
		return $out;
	}

	public static function stats_rest() {
		$r = new WP_REST_Response( self::stats() );
		$r->header( 'Cache-Control', 'no-store' );
		return $r;
	}

	/* ================= Admin ================= */

	public static function menu() {
		$icon = 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgLTU2MCAxNTk0IDE1OTQiPjxwYXRoIGZpbGw9ImJsYWNrIiBkPSJNIDAsMzkzIEwgMzEwLDM5MyBMIDMzNiwzOTAgTCAzNjksMzgxIEwgNDAwLDM2NSBMIDQyNywzNDIgTCA0NDUsMzE3IEwgNDU4LDI4MyBMIDQ1OCwyNTAgTCA0NDYsMjE4IEwgNDMzLDE5OSBMIDQyMCwxODYgTCAzODksMTY4IEwgMzU4LDE2MCBMIDE2OSwxNTkgTCAxNTYsMTU1IEwgMTM5LDE0MyBMIDEzMywxMzMgTCAxMzIsMTE5IEwgMTM3LDEwOCBMIDE0OCw5NyBMIDE2MSw5MSBMIDE3Niw4OCBMIDQxNCw4OSBMIDQyNCw5MiBMIDQzNyw5OSBMIDQ0OCwxMTEgTCA0ODksMTkzIEwgNTAzLDIwMyBMIDY0NywyMDIgTCA2NTgsMTkzIEwgNjg4LDEzOCBMIDc2NywzMDQgTCA3NzQsMzA5IEwgNzg1LDMwNyBMIDc5MiwyOTcgTCA4NjgsMTA3IEwgOTI0LDMxNiBMIDkzMSwzMzYgTCA5MzksMzQyIEwgOTQ2LDM0MiBMIDk1NCwzMzUgTCAxMDA3LDE5MyBMIDEwMTgsMTg1IEwgMTQ1NSwxODggTCAxNDcxLDE5NSBMIDE0ODIsMjA2IEwgMTQ4NywyMjAgTCAxNDg3LDIyOCBMIDE0ODIsMjQwIEwgMTQ3MiwyNTAgTCAxNDU2LDI1NyBMIDEyNjIsMjU4IEwgMTIzNywyNjQgTCAxMjE3LDI3NyBMIDExOTksMzAyIEwgMTE5MiwzMjggTCAxMTk2LDQ3MCBMIDExOTgsNDczIEwgMTI4Nyw0NzMgTCAxMjkwLDQ3MSBMIDEyOTAsMzU0IEwgMTI5MiwzNDggTCAxMzAwLDM0MSBMIDE0ODIsMzQwIEwgMTUwOSwzMzUgTCAxNTM3LDMyMyBMIDE1NjMsMzAyIEwgMTU3NCwyODggTCAxNTg0LDI2OSBMIDE1OTIsMjQyIEwgMTU5MiwyMTEgTCAxNTgyLDE4MiBMIDE1NjIsMTU2IEwgMTUzNiwxMzkgTCAxNDk5LDEyOSBMIDk5NywxMzIgTCA5ODQsMTM4IEwgOTc0LDE1MiBMIDk0NCwyNDEgTCA5MTEsMTEzIEwgODgwLDE1IEwgODcxLDEwIEwgODYzLDEzIEwgODU4LDIwIEwgNzc0LDIzMiBMIDY5OCw4MiBMIDY5Miw3NyBMIDY4NSw3NyBMIDY3OCw4MyBMIDY0MCwxNTMgTCA2MzMsMTYxIEwgNjI4LDE2MyBMIDUyMCwxNjMgTCA1MTEsMTU5IEwgNDk5LDE0NiBMIDQ0MCwyNSBMIDQzMSwxNCBMIDQxOCw1IEwgNDAxLDAgTCAxNDYsMSBMIDEwOSwxMCBMIDc2LDI2IEwgNTgsMzkgTCA0Miw1NSBMIDI3LDc3IEwgMTYsMTA5IEwgMTUsMTMyIEwgMjEsMTU4IEwgMzYsMTg1IEwgNTEsMjAxIEwgNzAsMjE0IEwgOTIsMjI0IEwgMTE0LDIzMCBMIDEzNiwyMzMgTCAzMDMsMjMzIEwgMzI1LDI0MSBMIDMzNywyNTMgTCAzNDEsMjYyIEwgMzQwLDI3NyBMIDMzMywyODggTCAzMjMsMjk2IEwgMzAwLDMwMyBMIDc4LDMwNCBMIDYyLDMxNCBaIi8+PC9zdmc+';
		add_menu_page( 'StorePinger', 'StorePinger', 'manage_options', 'storepinger', array( __CLASS__, 'page' ), $icon, 59 );
	}

	public static function admin_assets( $hook ) {
		if ( 'toplevel_page_storepinger' !== $hook && 'index.php' !== $hook ) {
			return;
		}
		wp_enqueue_style( 'storepinger-admin', STOREPINGER_URL . 'assets/admin.css', array(), STOREPINGER_VERSION );
		if ( 'toplevel_page_storepinger' === $hook ) {
			wp_enqueue_script( 'storepinger-world', STOREPINGER_URL . 'assets/world.js', array(), STOREPINGER_VERSION, true );
			wp_enqueue_script( 'storepinger-admin', STOREPINGER_URL . 'assets/admin.js', array( 'storepinger-world' ), STOREPINGER_VERSION, true );
			wp_localize_script(
				'storepinger-admin',
				'storepingerAdmin',
				array(
					'url'    => esc_url_raw( rest_url( 'storepinger/v1/stats' ) ),
					'nonce'  => wp_create_nonce( 'wp_rest' ),
					'locale' => str_replace( '_', '-', get_user_locale() ),
					'data'   => self::stats(),
				)
			);
		}
	}

	public static function action_links( $links ) {
		array_unshift( $links, '<a href="' . esc_url( admin_url( 'admin.php?page=storepinger' ) ) . '">' . esc_html__( 'Dashboard', 'storepinger' ) . '</a>' );
		$links[] = '<a href="' . esc_url( self::PRICING . '&utm_campaign=plugins-list' ) . '" target="_blank" style="font-weight:600">' . esc_html__( 'Go Pro', 'storepinger' ) . '</a>';
		return $links;
	}

	public static function pro_notice() {
		if ( current_user_can( 'activate_plugins' ) ) {
			echo '<div class="notice notice-info"><p>' . esc_html__( 'StorePinger Pro is active and includes everything in the free StorePinger plugin. You can deactivate and delete the free version.', 'storepinger' ) . '</p></div>';
		}
	}

	public static function save_settings() {
		if ( ! current_user_can( 'manage_options' ) || ! check_admin_referer( 'storepinger_settings' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'storepinger' ) );
		}
		$msg = 'saved';
		if ( isset( $_POST['storepinger_geo'] ) ) {
			$r   = self::download_geo();
			$msg = is_wp_error( $r ) ? 'geo_failed' : 'geo_ok';
		} else {
			update_option( 'storepinger_settings', array( 'track_admins' => empty( $_POST['track_admins'] ) ? 0 : 1 ), false );
		}
		wp_safe_redirect( admin_url( 'admin.php?page=storepinger&spl=' . $msg . '#spl-settings' ) );
		exit;
	}

	public static function page() {
		$s     = self::settings();
		$msg   = isset( $_GET['spl'] ) ? sanitize_key( $_GET['spl'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification
		$notes = array(
			'saved'      => array( 'success', __( 'Settings saved.', 'storepinger' ) ),
			'geo_ok'     => array( 'success', __( 'Country database downloaded. New visits now show their country.', 'storepinger' ) ),
			'geo_failed' => array( 'error', __( 'The country database could not be downloaded. Please try again later.', 'storepinger' ) ),
		);
		$pro = array(
			__( 'City and area of every visitor', 'storepinger' ),
			__( 'Abandoned cart recovery emails', 'storepinger' ),
			__( 'Pages, traffic sources and sales by source', 'storepinger' ),
			__( 'Session recordings and conversion funnel', 'storepinger' ),
			__( 'Email marketing with orders per campaign', 'storepinger' ),
			__( 'Mobile app with order and visitor notifications', 'storepinger' ),
			__( '90 days of history, reports and alerts', 'storepinger' ),
		);
		?>
		<div class="wrap spl">
			<div class="spl-top">
				<div class="spl-brand"><span class="spl-dot" aria-hidden="true"></span><h1>StorePinger</h1><span class="spl-free"><?php esc_html_e( 'Free', 'storepinger' ); ?></span></div>
				<span class="spl-top-actions"><a class="spl-btn spl-app" href="<?php echo esc_url( 'https://storepinger.com/mobile-app.html?utm_source=storepinger-free&utm_medium=header&utm_campaign=app#download' ); ?>" target="_blank" rel="noopener"><span aria-hidden="true">📱</span> <?php esc_html_e( 'Get the mobile app', 'storepinger' ); ?></a>
				<a class="spl-btn" href="<?php echo esc_url( self::PRICING . '&utm_campaign=header' ); ?>" target="_blank"><?php esc_html_e( 'Upgrade to Pro', 'storepinger' ); ?></a></span>
			</div>
			<?php if ( isset( $notes[ $msg ] ) ) : ?>
				<div class="notice notice-<?php echo esc_attr( $notes[ $msg ][0] ); ?> is-dismissible"><p><?php echo esc_html( $notes[ $msg ][1] ); ?></p></div>
			<?php endif; ?>
			<?php if ( ! self::geo_file() && empty( $_SERVER['HTTP_CF_IPCOUNTRY'] ) ) : ?>
				<div class="spl-hint"><b><?php esc_html_e( 'See which countries your visitors come from.', 'storepinger' ); ?></b> <?php esc_html_e( 'Download the free country database once (about 7 MB, from DB-IP). Visitor IP addresses are never stored.', 'storepinger' ); ?>
					<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><?php wp_nonce_field( 'storepinger_settings' ); ?><input type="hidden" name="action" value="storepinger_settings"><button class="spl-btn small" name="storepinger_geo" value="1"><?php esc_html_e( 'Download country database', 'storepinger' ); ?></button></form>
				</div>
			<?php endif; ?>
			<div class="spl-grid">
				<section class="spl-card spl-live">
					<div class="spl-live-h"><span class="spl-pulse"></span><?php esc_html_e( 'Live now', 'storepinger' ); ?><small data-spl-updated></small></div>
					<div class="spl-big"><b data-spl="live">0</b><span><?php esc_html_e( 'people on your site right now', 'storepinger' ); ?></span></div>
					<div class="spl-map" data-spl-map></div>
					<ul class="spl-feed" data-spl-feed></ul>
				</section>
				<div class="spl-col">
					<section class="spl-card"><h2><?php esc_html_e( 'Today', 'storepinger' ); ?></h2>
						<div class="spl-kpis">
							<div><small><?php esc_html_e( 'Visitors', 'storepinger' ); ?></small><b data-spl="visitors">0</b></div>
							<div><small><?php esc_html_e( 'Page views', 'storepinger' ); ?></small><b data-spl="pageviews">0</b></div>
							<div><small><?php esc_html_e( 'Pages per visit', 'storepinger' ); ?></small><b data-spl="ppv">0</b></div>
						</div>
					</section>
					<section class="spl-card spl-pro">
						<h2><?php esc_html_e( 'Turn visitors into sales', 'storepinger' ); ?></h2>
						<p><?php esc_html_e( 'StorePinger Pro shows which ads and cities bring the money, and wins back shoppers who left a cart.', 'storepinger' ); ?></p>
						<ul><?php foreach ( $pro as $f ) : ?><li><?php echo esc_html( $f ); ?></li><?php endforeach; ?></ul>
						<a class="spl-btn" href="<?php echo esc_url( self::PRICING . '&utm_campaign=sidebar' ); ?>" target="_blank"><?php esc_html_e( 'See Pro features', 'storepinger' ); ?></a>
						<small class="spl-muted"><?php esc_html_e( '14-day money-back guarantee', 'storepinger' ); ?></small>
					</section>
				</div>
				<section class="spl-card"><h2><?php esc_html_e( 'Countries today', 'storepinger' ); ?></h2><ol class="spl-bars" data-spl-list="countries"></ol></section>
				<section class="spl-card spl-locked"><h2><?php esc_html_e( 'Know what brings the money', 'storepinger' ); ?></h2>
					<p><?php esc_html_e( 'StorePinger Pro shows the pages people visit, where every visitor came from (Google, Meta ads, ChatGPT, email), their city, and which sources turn into orders.', 'storepinger' ); ?></p>
					<a class="spl-btn ghost small" href="<?php echo esc_url( self::PRICING . '&utm_campaign=sources' ); ?>" target="_blank"><?php esc_html_e( 'See StorePinger Pro', 'storepinger' ); ?></a>
				</section>
			</div>
			<?php if ( class_exists( 'StorePinger_Upgrade' ) ) : ?>
				<?php StorePinger_Upgrade::box(); ?>
			<?php else : ?>
				<section class="spl-card spl-upgrade"><div><h2><?php esc_html_e( 'Already have StorePinger Pro?', 'storepinger' ); ?></h2><p class="spl-muted"><?php esc_html_e( 'Download it from your StorePinger account, then upload it in Plugins → Add New. Your settings stay as they are.', 'storepinger' ); ?></p></div><a class="spl-btn" href="https://account.storepinger.com/" target="_blank"><?php esc_html_e( 'Open my account', 'storepinger' ); ?></a></section>
			<?php endif; ?>
			<section class="spl-card" id="spl-llms"><h2><?php esc_html_e( 'llms.txt for AI search', 'storepinger' ); ?></h2>
				<p class="spl-muted"><?php esc_html_e( 'llms.txt is a plain-text summary of your site for AI assistants such as ChatGPT, Claude and Perplexity: what you offer and links to your key pages. StorePinger writes it for you and keeps it up to date at yoursite.com/llms.txt.', 'storepinger' ); ?></p>
				<?php echo StorePinger_Llms::form(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built with esc_* inside. ?>
			</section>
			<section class="spl-card spl-settings" id="spl-settings"><h2><?php esc_html_e( 'Settings', 'storepinger' ); ?></h2>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><?php wp_nonce_field( 'storepinger_settings' ); ?><input type="hidden" name="action" value="storepinger_settings">
					<label><input type="checkbox" name="track_admins" value="1" <?php checked( $s['track_admins'] ); ?>> <?php esc_html_e( 'Count my own visits while I am logged in as an administrator', 'storepinger' ); ?></label>
					<p><button class="spl-btn small ghost"><?php esc_html_e( 'Save', 'storepinger' ); ?></button>
					<?php if ( self::geo_file() ) : ?>
						<button class="spl-btn small ghost" name="storepinger_geo" value="1"><?php esc_html_e( 'Update country database', 'storepinger' ); ?></button>
					<?php endif; ?></p>
					<p class="spl-muted"><?php esc_html_e( 'StorePinger keeps 48 hours of visits in your own database and deletes older data automatically. No cookies, and IP addresses are never stored.', 'storepinger' ); ?></p>
				</form>
			</section>
		</div>
		<?php
	}

	public static function widget() {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		wp_add_dashboard_widget(
			'storepinger',
			'StorePinger',
			function () {
				$d = self::stats();
				echo '<div class="spl-w"><div><small>' . esc_html__( 'Live now', 'storepinger' ) . '</small><b>' . (int) $d['live'] . '</b></div><div><small>' . esc_html__( 'Visitors today', 'storepinger' ) . '</small><b>' . (int) $d['visitors'] . '</b></div><div><small>' . esc_html__( 'Page views today', 'storepinger' ) . '</small><b>' . (int) $d['pageviews'] . '</b></div></div>';
				echo '<p><a class="button button-primary" href="' . esc_url( admin_url( 'admin.php?page=storepinger' ) ) . '">' . esc_html__( 'Open live dashboard', 'storepinger' ) . '</a></p>';
			}
		);
	}
}