<?php
/**
 * Plugin Name:       Trackum
 * Plugin URI:        https://trackum.app
 * Description:       Switches on your Google Tag Manager container on your website. Connects to your Trackum order with one click.
 * Version:           1.6.0
 * Requires at least: 5.7
 * Requires PHP:      7.4
 * Author:            ARAVILO
 * Author URI:        https://aravilo.com
 * License:           GPL-2.0-or-later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain:       trackum
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! defined( 'TRACKUM_SERVICE' ) ) {
	define( 'TRACKUM_SERVICE', 'https://dienst.trackum.app' ); // Can be overridden in wp-config.php for testing.
}
define( 'TRACKUM_ID_PATTERN', '/^GTM-[A-Z0-9]{4,10}\z/' );

// The plugin contacts the Trackum service only after an administrator asked for it ("Connect now" or "Connect WordPress" in Trackum).
function trackum_allowed() {
	return (bool) get_option( 'trackum_allowed' );
}

function trackum_allow() {
	update_option( 'trackum_allowed', 1, false );
}

function trackum_valid_id( $id ) {
	return is_string( $id ) && 1 === preg_match( TRACKUM_ID_PATTERN, $id );
}

/* ---------- Connect: fetch the container ID from the Trackum service ---------- */

// Active one-time codes (code => expiry). Several can be active at once (cron and a click at the same time).
function trackum_challenges() {
	$all = get_transient( 'trackum_challenges' );
	$now = time();
	return is_array( $all ) ? array_filter( $all, function ( $expires ) use ( $now ) {
		return $expires > $now;
	} ) : array();
}

add_action( 'rest_api_init', function () {
	// The Trackum service asks this to verify that a connect request really comes from this website.
	// Public on purpose: the service is not logged in. It sends the code it received and only gets back
	// whether that code is active; active codes are never listed. A confirmed code is used up at once.
	register_rest_route( 'trackum/v1', '/pruefung', array(
		'methods'             => 'GET',
		'permission_callback' => '__return_true',
		'args'                => array(
			'pruefzahl' => array(
				'type'              => 'string',
				'required'          => true,
				'validate_callback' => function ( $value ) {
					return is_string( $value ) && 1 === preg_match( '/^[A-Za-z0-9]{20,64}\z/', $value );
				},
			),
		),
		'callback'            => function ( WP_REST_Request $request ) {
			$code       = (string) $request->get_param( 'pruefzahl' );
			$challenges = trackum_challenges();
			$valid      = false;
			foreach ( array_keys( $challenges ) as $known ) {
				if ( hash_equals( (string) $known, $code ) ) {
					$valid = true;
					unset( $challenges[ $known ] );
					set_transient( 'trackum_challenges', $challenges, 2 * MINUTE_IN_SECONDS );
					break;
				}
			}
			$response = new WP_REST_Response( array( 'gueltig' => $valid ) );
			$response->header( 'Cache-Control', 'no-store, max-age=0' );
			return $response;
		},
	) );
	// Used by "Connect WordPress": Trackum hands over the container of this order directly (administrators only).
	register_rest_route( 'trackum/v1', '/container', array(
		'methods'             => 'POST',
		'permission_callback' => function () {
			return current_user_can( 'manage_options' );
		},
		'args'                => array(
			'gtm' => array(
				'type'              => 'string',
				'required'          => true,
				'validate_callback' => function ( $value ) {
					return trackum_valid_id( $value );
				},
			),
		),
		'callback'            => function ( WP_REST_Request $request ) {
			$ok = trackum_set_container( $request->get_param( 'gtm' ) );
			return array( 'gtm' => trackum_container_id(), 'pending' => ! $ok && (bool) get_option( 'trackum_pending' ) );
		},
	) );
	// Used by "Connect WordPress" in Trackum right after installing the plugin (administrators only).
	register_rest_route( 'trackum/v1', '/verbinden', array(
		'methods'             => 'POST',
		'permission_callback' => function () {
			return current_user_can( 'manage_options' );
		},
		'callback'            => function () {
			trackum_allow();
			$ok = trackum_connect();
			return array( 'gtm' => $ok ? trackum_container_id() : '', 'meldung' => $ok ? '' : trackum_status_message() );
		},
	) );
} );

function trackum_connect() {
	$challenge                = wp_generate_password( 40, false, false );
	$challenges               = trackum_challenges();
	$challenges[ $challenge ] = time() + 2 * MINUTE_IN_SECONDS;
	set_transient( 'trackum_challenges', $challenges, 2 * MINUTE_IN_SECONDS );

	$response = wp_remote_post( TRACKUM_SERVICE . '/api/wp/verbinden', array(
		'timeout'             => 10,
		'limit_response_size' => 4096,
		'headers'             => array( 'Content-Type' => 'application/json' ),
		'body'                => wp_json_encode( array( 'site' => home_url( '/' ), 'pruefzahl' => $challenge ) ),
	) );

	$challenges = trackum_challenges();
	unset( $challenges[ $challenge ] );
	set_transient( 'trackum_challenges', $challenges, 2 * MINUTE_IN_SECONDS );

	if ( is_wp_error( $response ) ) {
		update_option( 'trackum_status', 'unreachable', false );
		return false;
	}
	$data = json_decode( wp_remote_retrieve_body( $response ), true );
	$id   = ( is_array( $data ) && isset( $data['gtm'] ) ) ? $data['gtm'] : null;
	if ( 200 === wp_remote_retrieve_response_code( $response ) && trackum_valid_id( $id ) ) {
		return trackum_set_container( $id );
	}
	$codes = array( 'kein_auftrag' => 'no_order', 'pruefung' => 'not_reachable_back', 'zu_oft' => 'too_many' );
	$error = ( is_array( $data ) && isset( $data['fehler'] ) && is_string( $data['fehler'] ) && isset( $codes[ $data['fehler'] ] ) ) ? $codes[ $data['fehler'] ] : 'failed';
	update_option( 'trackum_status', $error, false );
	return false;
}

// Store a container ID. Never replaces a working container silently: a different ID waits for an administrator.
function trackum_set_container( $id ) {
	if ( ! trackum_valid_id( $id ) ) {
		return false;
	}
	$current = trackum_container_id();
	if ( $current && $current !== $id ) {
		update_option( 'trackum_pending', $id, false );
		update_option( 'trackum_status', 'pending', false );
		return false;
	}
	update_option( 'trackum_container', $id, true );
	delete_option( 'trackum_status' );
	delete_option( 'trackum_pending' );
	delete_option( 'trackum_retry_since' );
	wp_clear_scheduled_hook( 'trackum_retry' );
	return true;
}

function trackum_status_message() {
	switch ( get_option( 'trackum_status' ) ) {
		case 'no_order':
			return __( 'There is no Trackum order with a Tag Manager container for this website yet. As soon as there is one, the plugin connects itself (it retries every hour for 7 days).', 'trackum' );
		case 'gave_up':
			return __( 'No Trackum order was found within 7 days, so the plugin stopped asking. Click “Connect now” to try again, or enter your container ID by hand below.', 'trackum' );
		case 'not_reachable_back':
			return __( 'Trackum could not reach your website. Is a security plugin blocking the WordPress REST API?', 'trackum' );
		case 'too_many':
			return __( 'Too many attempts. Please try again in an hour.', 'trackum' );
		case 'unreachable':
			return __( 'Could not reach the Trackum service. Please try again later.', 'trackum' );
		case 'invalid_id':
			return __( 'That is not a valid container ID. It starts with GTM- (for example GTM-AB12CD3).', 'trackum' );
		case 'pending':
			return __( 'Trackum suggests a different container. Please check and confirm it below.', 'trackum' );
		case 'failed':
			return __( 'Connecting did not work. Please try again later.', 'trackum' );
		default:
			return __( 'Click “Connect now” to fetch your container from Trackum.', 'trackum' );
	}
}

// After the administrator connected once: keep trying every hour until connected, for at most 7 days (then only "Connect now"
// starts again). Scheduled lazily so it also works on every site of a multisite network.
define( 'TRACKUM_RETRY_DAYS', 7 );

function trackum_retry_expired() {
	$since = (int) get_option( 'trackum_retry_since' );
	return $since && time() - $since > TRACKUM_RETRY_DAYS * DAY_IN_SECONDS;
}

function trackum_schedule_retry() {
	if ( ! trackum_allowed() || trackum_container_id() ) {
		return;
	}
	if ( ! get_option( 'trackum_retry_since' ) ) {
		update_option( 'trackum_retry_since', time(), false ); // also for sites updated from 1.5 while still waiting
	}
	if ( ! trackum_retry_expired() && ! wp_next_scheduled( 'trackum_retry' ) ) {
		wp_schedule_event( time() + HOUR_IN_SECONDS, 'hourly', 'trackum_retry' );
	}
}
register_deactivation_hook( __FILE__, function () {
	wp_clear_scheduled_hook( 'trackum_retry' );
} );
add_action( 'trackum_retry', function () {
	if ( ! trackum_allowed() || trackum_container_id() ) {
		return;
	}
	if ( trackum_retry_expired() ) {
		wp_clear_scheduled_hook( 'trackum_retry' );
		update_option( 'trackum_status', 'gave_up', false );
		return;
	}
	trackum_connect();
} );
add_action( 'admin_init', function () {
	if ( current_user_can( 'manage_options' ) && ! wp_doing_ajax() ) {
		trackum_schedule_retry();
	}
} );

/* ---------- Output the Tag Manager code on the website ---------- */

function trackum_container_id() {
	$id = get_option( 'trackum_container' );
	return trackum_valid_id( $id ) ? $id : '';
}

// Strict privacy mode (only with the Trackum cookie banner): instead of the Tag Manager code, one script from the Trackum
// service. Until your tracking is live it loads Google Tag Manager as usual; afterwards it shows the cookie banner and loads
// Google Tag Manager only after a visitor agrees. Nothing is sent to Google before that.
function trackum_strict() {
	return (bool) get_option( 'trackum_strict' );
}

add_action( 'wp_head', function () {
	$id = trackum_container_id();
	if ( ! $id ) {
		return;
	}
	if ( trackum_strict() ) {
		echo "<!-- Trackum: cookie banner, Google Tag Manager only after consent -->\n";
		wp_print_script_tag( array( 'src' => esc_url( TRACKUM_SERVICE . '/b/' . $id . '.js?streng=1' ), 'async' => true, 'id' => 'trackum-banner-js' ) );
		return;
	}
	$code = "(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer'," . wp_json_encode( $id ) . ');';
	echo "<!-- Google Tag Manager (Trackum) -->\n";
	wp_print_inline_script_tag( $code, array( 'id' => 'trackum-gtm' ) );
}, 1 );

add_action( 'wp_body_open', function () {
	$id = trackum_container_id();
	if ( ! $id || trackum_strict() ) {
		return;
	}
	echo '<noscript><iframe src="' . esc_url( 'https://www.googletagmanager.com/ns.html?id=' . $id ) . '" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>' . "\n";
}, 1 );

/* ---------- Settings page: Settings → Trackum ---------- */

add_action( 'admin_menu', function () {
	add_options_page( 'Trackum', 'Trackum', 'manage_options', 'trackum', 'trackum_settings_page' );
} );

add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), function ( $links ) {
	array_unshift( $links, '<a href="' . esc_url( admin_url( 'options-general.php?page=trackum' ) ) . '">' . esc_html__( 'Settings', 'trackum' ) . '</a>' );
	return $links;
} );

// Notice at the top of the admin area while not connected or while a change waits for confirmation.
add_action( 'admin_notices', function () {
	$page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	if ( ! current_user_can( 'manage_options' ) || 'trackum' === $page || ( trackum_container_id() && ! get_option( 'trackum_pending' ) ) ) {
		return;
	}
	$link = '<a href="' . esc_url( admin_url( 'options-general.php?page=trackum' ) ) . '">' . esc_html__( 'Take a look', 'trackum' ) . '</a>';
	/* translators: %s: link to the Trackum settings page */
	$text = trackum_container_id() ? __( 'Trackum: a container change is waiting for your confirmation. %s', 'trackum' ) : __( 'Trackum: not connected yet. %s', 'trackum' );
	printf( '<div class="notice notice-warning"><p>%s</p></div>', sprintf( esc_html( $text ), $link ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- text escaped above, link built with esc_url/esc_html.
} );

function trackum_settings_page() {
	if ( ! current_user_can( 'manage_options' ) ) {
		return;
	}
	if ( isset( $_POST['trackum_action'] ) && check_admin_referer( 'trackum_settings' ) ) {
		$action = sanitize_key( wp_unslash( $_POST['trackum_action'] ) );
		if ( 'connect' === $action ) {
			trackum_allow();
			update_option( 'trackum_retry_since', time(), false ); // a new click starts a new 7-day window
			trackum_connect();
			trackum_schedule_retry();
		} elseif ( 'apply_pending' === $action ) {
			$pending = get_option( 'trackum_pending' );
			if ( trackum_valid_id( $pending ) ) {
				update_option( 'trackum_container', $pending, true );
			}
			delete_option( 'trackum_pending' );
			delete_option( 'trackum_status' );
		} elseif ( 'discard_pending' === $action ) {
			delete_option( 'trackum_pending' );
			delete_option( 'trackum_status' );
		} elseif ( 'save_strict' === $action ) {
			update_option( 'trackum_strict', ! empty( $_POST['trackum_strict'] ), true );
		} elseif ( 'save' === $action ) {
			$id = strtoupper( sanitize_text_field( wp_unslash( isset( $_POST['trackum_container'] ) ? $_POST['trackum_container'] : '' ) ) );
			if ( '' === $id ) {
				delete_option( 'trackum_container' );
				trackum_schedule_retry();
			} elseif ( trackum_valid_id( $id ) ) {
				update_option( 'trackum_container', $id, true );
				delete_option( 'trackum_status' );
				delete_option( 'trackum_pending' );
				delete_option( 'trackum_retry_since' );
				wp_clear_scheduled_hook( 'trackum_retry' );
			} else {
				update_option( 'trackum_status', 'invalid_id', false );
			}
		}
	}
	$id      = trackum_container_id();
	$pending = get_option( 'trackum_pending' );
	?>
	<div class="wrap">
		<h1>Trackum</h1>
		<?php if ( $id && trackum_valid_id( $pending ) ) : ?>
			<div class="notice notice-warning inline"><p>
				<?php
				/* translators: 1: suggested container ID, 2: current container ID */
				printf( esc_html__( 'Trackum suggests the container %1$s instead of %2$s. Only apply it if you expected this change.', 'trackum' ), '<code>' . esc_html( $pending ) . '</code>', '<code>' . esc_html( $id ) . '</code>' );
				?>
			</p>
			<form method="post"><?php wp_nonce_field( 'trackum_settings' ); ?>
				<p><button class="button button-primary" name="trackum_action" value="apply_pending"><?php esc_html_e( 'Apply', 'trackum' ); ?></button>
				<button class="button" name="trackum_action" value="discard_pending"><?php esc_html_e( 'Keep current', 'trackum' ); ?></button></p>
			</form></div>
		<?php elseif ( $id ) : ?>
			<div class="notice notice-success inline"><p>
				<b><?php esc_html_e( 'Connected.', 'trackum' ); ?></b>
				<?php
				/* translators: %s: Google Tag Manager container ID, e.g. GTM-AB12CD3 */
				printf( esc_html__( 'Your Google Tag Manager %s is switched on on your website. There is nothing else to do.', 'trackum' ), '<code>' . esc_html( $id ) . '</code>' );
				?>
			</p></div>
		<?php else : ?>
			<div class="notice notice-warning inline"><p><b><?php esc_html_e( 'Not connected yet.', 'trackum' ); ?></b> <?php echo esc_html( trackum_status_message() ); ?></p></div>
		<?php endif; ?>
		<form method="post">
			<?php wp_nonce_field( 'trackum_settings' ); ?>
			<p><button class="button button-primary" name="trackum_action" value="connect"><?php esc_html_e( 'Connect now', 'trackum' ); ?></button></p>
			<p class="description"><?php esc_html_e( 'Connecting sends the address of your website and a one-time code to the Trackum service (dienst.trackum.app). Until you click, the plugin contacts no server.', 'trackum' ); ?></p>
		</form>
		<h2><?php esc_html_e( 'Strict privacy mode', 'trackum' ); ?></h2>
		<form method="post">
			<?php wp_nonce_field( 'trackum_settings' ); ?>
			<p><label><input type="checkbox" name="trackum_strict" value="1" <?php checked( trackum_strict() ); ?>>
			<?php esc_html_e( 'Load Google Tag Manager only after a visitor agrees in the Trackum cookie banner.', 'trackum' ); ?></label></p>
			<p class="description"><?php esc_html_e( 'Only works with the Trackum cookie banner. Nothing is sent to Google before consent. Services in your Tag Manager that must run without consent, such as a chat, then also start only after consent. The banner is loaded from dienst.trackum.app.', 'trackum' ); ?></p>
			<p><button class="button" name="trackum_action" value="save_strict"><?php esc_html_e( 'Save', 'trackum' ); ?></button></p>
		</form>
		<form method="post">
			<?php wp_nonce_field( 'trackum_settings' ); ?>
			<h2><?php esc_html_e( 'Container ID by hand', 'trackum' ); ?></h2>
			<p><?php esc_html_e( 'Only needed if connecting does not work. You find the ID in the email from Trackum.', 'trackum' ); ?></p>
			<p><input type="text" name="trackum_container" value="<?php echo esc_attr( $id ); ?>" placeholder="GTM-XXXXXXX" class="regular-text">
			<button class="button" name="trackum_action" value="save"><?php esc_html_e( 'Save', 'trackum' ); ?></button></p>
		</form>
		<h2><?php esc_html_e( 'Is your tracking working?', 'trackum' ); ?></h2>
		<p><?php esc_html_e( 'The free Trackum check opens your website in a real browser and shows what is sent before and after consent: Google Analytics, Google Ads, Meta and your cookie banner. It takes about two minutes, no sign-up.', 'trackum' ); ?></p>
		<?php
		$trackum_check = add_query_arg( array(
			'domain'       => rawurlencode( (string) wp_parse_url( home_url(), PHP_URL_HOST ) ),
			'utm_source'   => 'wordpress',
			'utm_medium'   => 'plugin',
			'utm_campaign' => 'trackum_plugin',
		), 'https://trackum.app/check' );
		?>
		<p><a class="button" href="<?php echo esc_url( $trackum_check ); ?>" target="_blank" rel="noopener"><?php esc_html_e( 'Check my website for free', 'trackum' ); ?></a>
		<a href="<?php echo esc_url( 'https://trackum.app/preise?utm_source=wordpress&utm_medium=plugin&utm_campaign=trackum_plugin' ); ?>" target="_blank" rel="noopener" style="margin-left:10px"><?php esc_html_e( 'Have it set up and checked daily at a fixed price', 'trackum' ); ?></a></p>
		<p class="description"><?php esc_html_e( 'Trackum sets up your tracking; this plugin only switches on Google Tag Manager on your website. Questions? Just reply to our email or write to anfrage@trackum.app.', 'trackum' ); ?></p>
	</div>
	<?php
}