<?php
/**
 * Vidal Security AI — Reporte completo por email (v1.9.0).
 *
 * Convierte el parte semanal en un REPORTE de verdad: puntuación con
 * tendencia, riesgos del escaneo, escudo de bots con motivos, parte del
 * Guardián IA, pulso de la tienda (fraude, cobros fallidos, atascados),
 * archivos y actualizaciones pendientes. HTML cuidado + texto plano de
 * respaldo. Frecuencia semanal o mensual y botón «Enviar ahora».
 *
 * @package VidalSecurityAI
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/** Frecuencia elegida: weekly | monthly. */
function vsai_report_freq() {
	$f = get_option( 'vsai_report_freq', 'weekly' );
	return 'monthly' === $f ? 'monthly' : 'weekly';
}

/** Recuentos de la tienda para el periodo (solo WooCommerce). */
function vsai_report_woo_counts() {
	if ( ! function_exists( 'wc_get_orders' ) ) {
		return null;
	}
	$since = time() - 7 * DAY_IN_SECONDS;
	$fraud = wc_get_orders(
		array(
			'limit'        => 200,
			'return'       => 'ids',
			'date_created' => '>=' . $since,
			'meta_query'   => array( // phpcs:ignore WordPress.DB.SlowDBQuery
				array(
					'key'     => '_vsai_fraud_score',
					'value'   => 30,
					'compare' => '>=',
					'type'    => 'NUMERIC',
				),
			),
		)
	);
	$failed = wc_get_orders(
		array(
			'limit'        => 200,
			'return'       => 'ids',
			'status'       => 'failed',
			'date_created' => '>=' . $since,
		)
	);
	$stuck = 0;
	$pend  = wc_get_orders(
		array(
			'limit'        => 50,
			'status'       => 'pending',
			'date_created' => '<' . ( time() - 2 * HOUR_IN_SECONDS ),
		)
	);
	foreach ( (array) $pend as $o ) {
		$pm = method_exists( $o, 'get_payment_method' ) ? $o->get_payment_method() : '';
		if ( $pm && ! in_array( $pm, array( 'cod', 'bacs', 'cheque' ), true ) && $o->get_transaction_id() ) {
			$stuck++;
		}
	}
	return array(
		'fraud'  => is_array( $fraud ) ? count( $fraud ) : 0,
		'failed' => is_array( $failed ) ? count( $failed ) : 0,
		'stuck'  => $stuck,
	);
}

/** Actualizaciones pendientes (mismas fuentes que el chequeo 14). */
function vsai_report_pending_updates() {
	$n = 0;
	$up = get_site_transient( 'update_plugins' );
	if ( $up && ! empty( $up->response ) ) {
		$n += count( $up->response );
	}
	$ut = get_site_transient( 'update_themes' );
	if ( $ut && ! empty( $ut->response ) ) {
		$n += count( $ut->response );
	}
	return $n;
}

/**
 * Construye el reporte: devuelve [ 'score' => int|null, 'trend' => string,
 * 'sections' => [ [titulo, [lineas...] ], ... ] ].
 */
function vsai_report_build() {
	$scan  = (array) get_option( 'vsai_scan', array() );
	$score = function_exists( 'vsai_scanner_score' ) ? vsai_scanner_score( $scan ) : null;
	$hist  = (array) get_option( 'vsai_report_hist', array() );
	$trend = '';
	$prev  = null;
	foreach ( array_reverse( $hist ) as $h ) {
		if ( isset( $h['score'] ) && null !== $h['score'] && (int) $h['score'] > 0 ) {
			$prev = (int) $h['score'];
			break;
		}
	}
	if ( null !== $score && null !== $prev ) {
		$diff  = $score - $prev;
		if ( $diff > 0 ) {
			$trend = sprintf( /* translators: %d: points the security score changed since the last report. */ __( '▲ %d points since the last report', 'vidal-security-ai' ), $diff );
		} elseif ( $diff < 0 ) {
			$trend = sprintf( /* translators: %d: points the security score changed since the last report. */ __( '▼ %d points since the last report', 'vidal-security-ai' ), abs( $diff ) );
		} else {
			$trend = __( 'Same as the last report', 'vidal-security-ai' );
		}
	}
	$sections = array();

	// Escaneo: riesgos (fail) y atenciones (warn) vivos, con su explicación.
	if ( ! empty( $scan['checks'] ) ) {
		$risk = array();
		$warn = array();
		foreach ( (array) $scan['checks'] as $c ) {
			$line = '• ' . ( $c['title'] ?? '' );
			if ( ! empty( $c['detail'] ) ) {
				$d = trim( wp_strip_all_tags( (string) $c['detail'] ) );
				if ( strlen( $d ) > 150 ) {
					$d = substr( $d, 0, 150 ) . '…';
				}
				$line .= ' — ' . $d;
			}
			if ( 'fail' === ( $c['status'] ?? '' ) ) {
				$risk[] = $line;
			} elseif ( 'warn' === ( $c['status'] ?? '' ) ) {
				$warn[] = $line;
			}
		}
		$lines = array();
		if ( $risk ) {
			$lines[] = __( 'Risks to fix:', 'vidal-security-ai' );
			$lines   = array_merge( $lines, $risk );
		}
		if ( $warn ) {
			$lines[] = __( 'Worth a look:', 'vidal-security-ai' );
			$lines   = array_merge( $lines, $warn );
		}
		if ( ! $lines ) {
			$lines[] = __( 'All 15 checks are green. Nothing to fix.', 'vidal-security-ai' );
		}
		$sections[] = array( '🔍 ' . __( 'Security diagnosis', 'vidal-security-ai' ), $lines );
	}

	// Escudo de bots.
	$bs     = (array) get_option( 'vsai_bot_stats', array() );
	$ledger = (array) get_option( 'vsai_bot_ledger', array() );
	$nblocks = isset( $bs['blocks'] ) && is_array( $bs['blocks'] ) ? count( $bs['blocks'] ) : (int) ( $bs['blocks'] ?? 0 );
	$ledger_blocks = 0;
	foreach ( $ledger as $e ) {
		$ledger_blocks += (int) ( $e['blocks'] ?? 0 );
	}
	$nblocks = max( $nblocks, $ledger_blocks );
	$lines  = array(
		sprintf( /* translators: 1: blocks applied by the bot shield so far. 2: IP addresses being watched. */ __( '%1$d blocks applied so far · %2$d IPs being watched.', 'vidal-security-ai' ), $nblocks, count( $ledger ) ),
	);
	$now      = time();
	$blocked  = array_filter(
		$ledger,
		function ( $e ) use ( $now ) {
			return ! empty( $e['blocked_until'] ) && (int) $e['blocked_until'] > $now;
		}
	);
	if ( $blocked ) {
		$lines[] = __( 'Blocked right now:', 'vidal-security-ai' );
		foreach ( array_slice( $blocked, 0, 5, true ) as $ip => $e ) {
			$lines[] = '• ' . $ip . ' (' . (int) ( $e['points'] ?? 0 ) . ' pts)';
		}
	}
	$good_bots = function_exists( 'vsai_bot_good_list' ) ? vsai_bot_good_list() : array();
	if ( $good_bots ) {
		$gnames = array();
		foreach ( $good_bots as $g ) {
			if ( ! empty( $g['name'] ) ) {
				$gnames[ $g['name'] ] = true;
			}
		}
		$lines[] = sprintf( /* translators: 1: number of verified good bots. 2: their names, separated by commas. */ __( '✅ Good bots verified (never blocked): %1$d — %2$s.', 'vidal-security-ai' ), count( $good_bots ), implode( ', ', array_keys( $gnames ) ) );
	}
	$sections[] = array( '🤖 ' . __( 'Bot shield', 'vidal-security-ai' ), $lines );

	// Guardián IA (el parte del cerebro, como en el panel).
	if ( function_exists( 'vsai_premium_fetch_report' ) ) {
		$data  = vsai_premium_fetch_report();
		$parte = '';
		if ( is_array( $data ) ) {
			foreach ( array( 'parte', 'text', 'summary', 'report' ) as $k ) {
				if ( ! empty( $data[ $k ] ) && is_string( $data[ $k ] ) ) {
					$parte = $data[ $k ];
					break;
				}
			}
		}
		if ( '' !== $parte ) {
			$glines = array_values( array_filter( array_map( 'trim', explode( "\n", $parte ) ) ) );
			if ( $glines && ( false !== stripos( $glines[0], 'Parte del guardia' ) || false !== stripos( $glines[0], 'Guardian report' ) ) ) {
				array_shift( $glines );
			}
			if ( $glines ) {
				$glines     = array_map( function ( $l ) { return '• ' . ltrim( $l, '-–— ' ); }, $glines );
				$sections[] = array( '🧠 ' . __( 'AI Guardian', 'vidal-security-ai' ), $glines );
			}
		}
	}

	// Tienda.
	$woo = vsai_report_woo_counts();
	if ( null !== $woo ) {
		$sections[] = array(
			'🛒 ' . __( 'Your store this week', 'vidal-security-ai' ),
			array(
				sprintf( /* translators: %d: number of orders flagged by the anti-fraud score. */ __( 'Orders flagged by the anti-fraud score: %d', 'vidal-security-ai' ), $woo['fraud'] ),
				sprintf( /* translators: %d: number of failed payments. */ __( 'Failed payments: %d', 'vidal-security-ai' ), $woo['failed'] ),
				sprintf( /* translators: %d: number of paid orders that are stuck. */ __( 'Paid orders stuck: %d', 'vidal-security-ai' ), $woo['stuck'] ),
			),
		);
	}

	// Archivos y actualizaciones.
	$last    = (array) get_option( 'vsai_file_last', array() );
	$flines  = array();
	$flines[] = ! empty( $last['issues'] )
		? sprintf( /* translators: %d: number of unexplained file changes. */ __( '⚠️ %d unexplained file change(s) — check the panel.', 'vidal-security-ai' ), count( $last['issues'] ) )
		: __( 'Files in place; only update-related changes.', 'vidal-security-ai' );
	if ( ! empty( $last['partial'] ) ) {
		$flines = array( __( 'The daily snapshot was partial. The previous baseline was retained; review the deep file scan.', 'vidal-security-ai' ) );
	}
	$pend     = vsai_report_pending_updates();
	$flines[] = $pend > 0
		? sprintf( /* translators: %d: number of pending updates. */ __( '%d update(s) pending — staying current is your first shield.', 'vidal-security-ai' ), $pend )
		: __( 'Everything is up to date.', 'vidal-security-ai' );
	$sections[] = array( '🗂️ ' . __( 'Files & updates', 'vidal-security-ai' ), $flines );

	return array(
		'score'    => $score,
		'trend'    => $trend,
		'sections' => $sections,
	);
}

/** Envía el reporte ahora. Devuelve true si wp_mail aceptó. */
function vsai_report_send() {
	$to = get_option( 'admin_email' );
	if ( ! $to ) {
		return false;
	}
	$r     = vsai_report_build();
	$site  = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
	$panel = admin_url( 'admin.php?page=vidal-security-ai' );
	$score_txt = null !== $r['score'] ? $r['score'] . '/100' : '—';

	// HTML (el cuerpo lleva el texto visible completo de cada sección).
	$body = '';
	foreach ( $r['sections'] as $sec ) {
		$body .= '<tr><td style="padding:14px 22px 4px;font:700 16px Arial,sans-serif;color:#14532d">' . esc_html( $sec[0] ) . '</td></tr>';
		foreach ( $sec[1] as $l ) {
			$body .= '<tr><td style="padding:2px 22px;font:400 14px/1.55 Arial,sans-serif;color:#374151">' . esc_html( $l ) . '</td></tr>';
		}
	}
	$html = '<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f3f4f1;padding:24px 0"><tr><td align="center">'
		. '<table role="presentation" width="600" cellpadding="0" cellspacing="0" style="background:#ffffff;border-radius:14px;overflow:hidden;border:1px solid #e5e7eb">'
		. '<tr><td style="background:#14532d;padding:22px;text-align:center">'
		. '<div style="font:700 13px Arial,sans-serif;letter-spacing:2px;color:#bfe6c8">VIDAL SECURITY AI</div>'
		. '<div style="font:700 52px Georgia,serif;color:#ffffff;margin:6px 0 2px">' . esc_html( $score_txt ) . '</div>'
		. '<div style="font:400 14px Arial,sans-serif;color:#cfe6d4">' . esc_html( $site ) . ( $r['trend'] ? ' · ' . esc_html( $r['trend'] ) : '' ) . '</div>'
		. '</td></tr>'
		. $body
		. '<tr><td style="padding:18px 22px 24px;text-align:center"><a href="' . esc_url( $panel ) . '" style="display:inline-block;background:#14532d;color:#ffffff;font:700 14px Arial,sans-serif;padding:12px 22px;border-radius:9px;text-decoration:none">' . esc_html__( 'Open the full panel', 'vidal-security-ai' ) . '</a></td></tr>'
		. '</table>'
		. '<div style="font:400 12px Arial,sans-serif;color:#9ca3af;margin-top:12px">' . esc_html__( 'You receive this report because Vidal Security AI protects this site. Change the frequency or turn it off in the panel.', 'vidal-security-ai' ) . '</div>'
		. '</td></tr></table>';

	$subject = sprintf( '🛡️ [%s] %s %s', $site, __( 'Security report — score', 'vidal-security-ai' ), $score_txt );
	add_filter( 'wp_mail_content_type', 'vsai_report_ct_html' );
	$ok = wp_mail( $to, $subject, $html );
	remove_filter( 'wp_mail_content_type', 'vsai_report_ct_html' );
	if ( ! $ok ) {
		return false; // A failed delivery must not postpone the next monthly attempt.
	}

	// Historial (tendencia) y última fecha. Solo puntuaciones reales:
	// un envío sin escaneo guardaría un nulo y falsearía la tendencia.
	$hist = (array) get_option( 'vsai_report_hist', array() );
	if ( null !== $r['score'] ) {
		$hist[] = array(
			'ts'    => time(),
			'score' => $r['score'],
		);
	}
	update_option( 'vsai_report_hist', array_slice( $hist, -24 ), false );
	update_option( 'vsai_report_last', time(), false );
	return (bool) $ok;
}
function vsai_report_ct_html() {
	return 'text/html';
}

/** Cron semanal: respeta el interruptor y la frecuencia. */
function vsai_report_maybe_send() {
	if ( function_exists( 'vsai_get_settings' ) ) {
		$s = vsai_get_settings();
		if ( isset( $s['weekly_digest'] ) && ! $s['weekly_digest'] ) {
			return;
		}
	}
	if ( 'monthly' === vsai_report_freq() ) {
		$last = (int) get_option( 'vsai_report_last', 0 );
		if ( $last && ( time() - $last ) < 27 * DAY_IN_SECONDS ) {
			return;
		}
	}
	vsai_report_send();
}

/* --- Panel: tarjeta del reporte ---------------------------------------------------- */
function vsai_report_panel_html() {
	$last = (int) get_option( 'vsai_report_last', 0 );
	$freq = vsai_report_freq();
	ob_start();
	?>
	<section class="vsai-card">
		<h2 class="vsai-card__title">📧 <?php esc_html_e( 'Email report', 'vidal-security-ai' ); ?></h2>
		<p>
			<?php
			echo esc_html(
				$last
					? sprintf( /* translators: %s: elapsed time since the last report was sent, for example "2 days". */ __( 'Last report sent %s ago to the admin email. It carries your score with its trend, the bot shield, the AI Guardian, your store and pending updates.', 'vidal-security-ai' ), human_time_diff( $last, time() ) )
					: __( 'No report sent yet. It carries your score with its trend, the bot shield, the AI Guardian, your store and pending updates.', 'vidal-security-ai' )
			);
			?>
		</p>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="vsai_report_opts" />
			<?php wp_nonce_field( 'vsai_report_opts' ); ?>
			<label>
				<?php esc_html_e( 'Frequency:', 'vidal-security-ai' ); ?>
				<select name="vsai_report_freq">
					<option value="weekly" <?php selected( $freq, 'weekly' ); ?>><?php esc_html_e( 'Weekly', 'vidal-security-ai' ); ?></option>
					<option value="monthly" <?php selected( $freq, 'monthly' ); ?>><?php esc_html_e( 'Monthly', 'vidal-security-ai' ); ?></option>
				</select>
			</label>
			<button type="submit" name="vsai_report_action" value="save" class="vsai-btn"><?php esc_html_e( 'Save', 'vidal-security-ai' ); ?></button>
			<button type="submit" name="vsai_report_action" value="send" class="vsai-btn vsai-btn--ghost"><?php esc_html_e( 'Send it now', 'vidal-security-ai' ); ?></button>
		</form>
	</section>
	<?php
	return ob_get_clean();
}

add_action(
	'admin_post_vsai_report_opts',
	function () {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'vidal-security-ai' ) );
		}
		check_admin_referer( 'vsai_report_opts' );
		$act = isset( $_POST['vsai_report_action'] ) ? sanitize_key( wp_unslash( $_POST['vsai_report_action'] ) ) : 'save'; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
		if ( isset( $_POST['vsai_report_freq'] ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
			update_option( 'vsai_report_freq', 'monthly' === sanitize_key( wp_unslash( $_POST['vsai_report_freq'] ) ) ? 'monthly' : 'weekly', false ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
		}
		$msg = 'saved';
		if ( 'send' === $act ) {
			$msg = vsai_report_send() ? 'sent' : 'failed';
		}
		wp_safe_redirect( admin_url( 'admin.php?page=vidal-security-ai&vsai_report=' . $msg ) );
		exit;
	}
);