<?php
/**
 * Vidal Security AI — Alertas por email (versión gratuita).
 *
 * Avisos CLAROS al correo del administrador, sin tecnicismos y sin spam:
 *  1. Ráfaga de intentos fallidos de login (posible ataque en curso).
 *  2. Un administrador entra desde una IP nunca vista en su cuenta.
 *  3. Se crea una cuenta administradora nueva.
 *
 * Cada tipo de alerta se limita a 1 por hora (transient) salvo la de
 * cuenta nueva, que es crítica. Todo se apaga con el ajuste email_alerts.
 *
 * @package VidalSecurityAI
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/** ¿Están activas las alertas por email? */
function vsai_alerts_enabled() {
	if ( ! function_exists( 'vsai_get_settings' ) ) {
		return false;
	}
	$s = vsai_get_settings();
	return ! empty( $s['email_alerts'] );
}

/** IP del visitante actual, saneada. */
function vsai_alerts_ip() {
	$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
	return $ip ? $ip : 'desconocida';
}

/**
 * Envía una alerta si el tipo no está en su ventana de silencio.
 *
 * @param string $type    Clave del tipo (para el límite por hora).
 * @param string $subject Asunto tras el prefijo del sitio.
 * @param array  $lines   Líneas del cuerpo, en lenguaje claro.
 * @param int    $silence Segundos de silencio tras enviar (defecto 1 h).
 */
function vsai_alerts_send( $type, $subject, $lines, $silence = HOUR_IN_SECONDS ) {
	$key = 'vsai_alert_sent_' . $type;
	if ( get_transient( $key ) ) {
		return;
	}
	set_transient( $key, 1, $silence );

	$to = get_option( 'admin_email' );
	if ( ! $to ) {
		return;
	}
	$site    = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
	$panel   = admin_url( 'admin.php?page=vidal-security-ai' );
	$body    = implode( "\n", $lines );
	$body   .= "\n\n" . __( 'Check your security panel:', 'vidal-security-ai' ) . "\n" . $panel;
	$body   .= "\n\n— " . __( 'Your guardian, Vidal Security AI', 'vidal-security-ai' );
	wp_mail(
		$to,
		sprintf( '🛡️ [%s] %s', $site, $subject ),
		$body
	);
	// Solo lo urgente de verdad sale también por WhatsApp: ráfaga de logins
	// y cuenta administradora nueva. El aviso de IP nueva se queda en email.
	if ( function_exists( 'vsai_premium_send_urgent' ) && in_array( $type, array( 'login_burst', 'new_admin' ), true ) ) {
		vsai_premium_send_urgent( $subject, implode( ' ', array_slice( $lines, 0, 2 ) ), 'alert_' . $type );
	}
}

/* 1. Ráfaga de intentos fallidos de login ------------------------------- */
add_action(
	'wp_login_failed',
	function ( $username ) {
		if ( ! vsai_alerts_enabled() ) {
			return;
		}
		$count = (int) get_transient( 'vsai_lf_count' );
		$count++;
		set_transient( 'vsai_lf_count', $count, HOUR_IN_SECONDS );
		if ( 10 === $count ) {
			vsai_alerts_send(
				'login_burst',
				__( 'Alert: many attempts to get into your site', 'vidal-security-ai' ),
				array(
					__( 'In the last hour there were at least 10 failed login attempts.', 'vidal-security-ai' ),
					sprintf( /* translators: 1: usuario intentado 2: IP */ __( 'The latest attempt used the username “%1$s” from IP %2$s.', 'vidal-security-ai' ), $username, vsai_alerts_ip() ),
					__( 'If it is not you, you do not have to do anything: your guardian is watching and none of the attempts got in. If the burst continues, consider enabling the AI Guardian to block them automatically.', 'vidal-security-ai' ),
				)
			);
		}
	}
);

/* 2. Administrador desde una IP nueva ------------------------------------ */
add_action(
	'wp_login',
	function ( $user_login, $user ) {
		if ( ! vsai_alerts_enabled() || ! $user || ! user_can( $user, 'manage_options' ) ) {
			return;
		}
		$ip    = vsai_alerts_ip();
		$known = get_user_meta( $user->ID, 'vsai_known_ips', true );
		if ( ! is_array( $known ) ) {
			$known = array();
		}
		if ( in_array( $ip, $known, true ) ) {
			return;
		}
		$first = empty( $known );
		$known[] = $ip;
		update_user_meta( $user->ID, 'vsai_known_ips', array_slice( array_unique( $known ), -5 ) );
		if ( $first ) {
			return; // Primera vez: solo se aprende la IP, no se asusta a nadie.
		}
		vsai_alerts_send(
			'admin_new_ip_' . $user->ID,
			__( 'Notice: an administrator signed in from a new place', 'vidal-security-ai' ),
			array(
				sprintf( /* translators: 1: usuario 2: IP */ __( 'The administrator account “%1$s” just signed in from an IP never seen on that account before: %2$s.', 'vidal-security-ai' ), $user_login, $ip ),
				__( 'If it was you (travel, another network, another device), ignore this notice. If you do not recognise the sign-in, change that account’s password right now.', 'vidal-security-ai' ),
			)
		);
	},
	10,
	2
);

/* 3. Cuenta administradora nueva ----------------------------------------- */
add_action(
	'user_register',
	function ( $user_id ) {
		if ( ! vsai_alerts_enabled() ) {
			return;
		}
		$user = get_userdata( $user_id );
		if ( ! $user || ! in_array( 'administrator', (array) $user->roles, true ) ) {
			return;
		}
		vsai_alerts_send(
			'new_admin',
			__( 'Alert: a new administrator account was created', 'vidal-security-ai' ),
			array(
				sprintf( /* translators: 1: usuario 2: correo */ __( 'An account with administrator powers was just created: “%1$s” (%2$s).', 'vidal-security-ai' ), $user->user_login, $user->user_email ),
				__( 'If it was not you, go to Users right now and delete it: it is the classic way of planting a backdoor in a site.', 'vidal-security-ai' ),
			),
			10 * MINUTE_IN_SECONDS
		);
	}
);