<?php
/**
 * Settings: the stored option with its defaults and sanitising, and the Settings → Waysill page.
 *
 * @package Waysill
 */

defined( 'ABSPATH' ) || exit;

/**
 * Settings used when nothing is stored yet.
 *
 * @return array{level: string, best_practice: bool, roles: string[], check_on_save: bool}
 */
function waysill_default_settings(): array {
	return array(
		'level'         => 'AA',
		'best_practice' => false,
		'roles'         => array( 'administrator', 'editor', 'author', 'contributor' ),
		'check_on_save' => false,
	);
}

/**
 * Turns any stored or submitted value into valid settings; unknown or broken fields fall back to the defaults.
 *
 * @param mixed $raw Value of the option or of the submitted form.
 * @return array{level: string, best_practice: bool, roles: string[], check_on_save: bool}
 */
function waysill_sanitize_settings( $raw ): array {
	$settings = waysill_default_settings();
	if ( ! is_array( $raw ) ) {
		return $settings;
	}
	if ( isset( $raw['level'] ) && in_array( $raw['level'], array( 'A', 'AA', 'AAA' ), true ) ) {
		$settings['level'] = $raw['level'];
	}
	// Checkboxes: a submitted form leaves out unchecked boxes, so a missing key means off.
	$settings['best_practice'] = ! empty( $raw['best_practice'] );
	$settings['check_on_save'] = ! empty( $raw['check_on_save'] );
	$roles                     = array();
	if ( isset( $raw['roles'] ) && is_array( $raw['roles'] ) ) {
		foreach ( $raw['roles'] as $role ) {
			if ( is_string( $role ) && '' !== sanitize_key( $role ) ) {
				$roles[] = sanitize_key( $role );
			}
		}
	}
	$settings['roles'] = array_slice( array_values( array_unique( $roles ) ), 0, 100 );
	return $settings;
}

/**
 * The current settings, always complete and valid.
 *
 * @return array{level: string, best_practice: bool, roles: string[], check_on_save: bool}
 */
function waysill_settings(): array {
	$stored = get_option( 'waysill_settings', null );
	return null === $stored ? waysill_default_settings() : waysill_sanitize_settings( $stored );
}

/**
 * The settings in the shape of the shared core's `Settings`, as the editor scripts expect them.
 *
 * @return array{level: string, bestPractice: bool}
 */
function waysill_core_settings(): array {
	$settings = waysill_settings();
	return array(
		'level'        => $settings['level'],
		'bestPractice' => $settings['best_practice'],
	);
}

/**
 * Whether check on save is on for a user: the user's own choice, else the site default.
 *
 * @param int $user_id User id.
 */
function waysill_user_check_on_save( int $user_id ): bool {
	$own = get_user_meta( $user_id, 'waysill_check_on_save', true );
	if ( '1' === $own || '0' === $own ) {
		return '1' === $own;
	}
	return waysill_settings()['check_on_save'];
}

/** Registers the option with its sanitiser, so options.php stores only valid settings. */
function waysill_register_settings(): void {
	register_setting(
		'waysill',
		'waysill_settings',
		array(
			'type'              => 'object',
			'sanitize_callback' => 'waysill_sanitize_settings',
			'default'           => waysill_default_settings(),
		)
	);
}
add_action( 'admin_init', 'waysill_register_settings' );

/** Adds Settings → Waysill. Freemius shows its opt-in screen on this page until the admin allows or skips. */
function waysill_settings_menu(): void {
	add_options_page(
		__( 'Waysill', 'waysill' ),
		__( 'Waysill', 'waysill' ),
		'manage_options',
		'waysill',
		'waysill_settings_page'
	);
}
add_action( 'admin_menu', 'waysill_settings_menu' );

/** Deletes every stored check result (admin-post action from the settings page). */
function waysill_handle_delete_results(): void {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You are not allowed to delete Waysill results.', 'waysill' ), 403 );
	}
	check_admin_referer( 'waysill_delete_results' );
	waysill_delete_all_results();
	add_settings_error( 'waysill_settings', 'waysill_deleted', __( 'All stored Waysill results were deleted.', 'waysill' ), 'success' );
	// The same hand-over options.php uses: the settings page shows the message once.
	set_transient( 'settings_errors', get_settings_errors(), 30 );
	wp_safe_redirect( add_query_arg( 'settings-updated', 'true', admin_url( 'options-general.php?page=waysill' ) ) );
	exit;
}
add_action( 'admin_post_waysill_delete_results', 'waysill_handle_delete_results' );

/** Renders Settings → Waysill. */
function waysill_settings_page(): void {
	if ( ! current_user_can( 'manage_options' ) ) {
		return;
	}
	$settings = waysill_settings();
	$levels   = array(
		'A'   => __( 'Level A', 'waysill' ),
		'AA'  => __( 'Level AA (recommended)', 'waysill' ),
		'AAA' => __( 'Level AAA', 'waysill' ),
	);
	?>
	<div class="wrap waysill-settings">
		<h1><?php echo esc_html( get_admin_page_title() ); ?></h1>
		<form method="post" action="options.php">
			<?php settings_fields( 'waysill' ); ?>
			<table class="form-table" role="presentation">
				<tr>
					<th scope="row"><?php esc_html_e( 'WCAG level', 'waysill' ); ?></th>
					<td>
						<fieldset>
							<legend class="screen-reader-text"><?php esc_html_e( 'WCAG level', 'waysill' ); ?></legend>
							<?php foreach ( $levels as $level => $label ) : ?>
								<label>
									<input type="radio" name="waysill_settings[level]" value="<?php echo esc_attr( $level ); ?>" <?php checked( $settings['level'], $level ); ?>>
									<?php echo esc_html( $label ); ?>
								</label><br>
							<?php endforeach; ?>
							<p class="description"><?php esc_html_e( 'Checks run the rules of this level and the levels below it.', 'waysill' ); ?></p>
						</fieldset>
					</td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'Best-practice rules', 'waysill' ); ?></th>
					<td>
						<label>
							<input type="checkbox" name="waysill_settings[best_practice]" value="1" <?php checked( $settings['best_practice'] ); ?>>
							<?php esc_html_e( 'Also report best-practice issues that no WCAG criterion requires', 'waysill' ); ?>
						</label>
					</td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'Roles that see results', 'waysill' ); ?></th>
					<td>
						<fieldset>
							<legend class="screen-reader-text"><?php esc_html_e( 'Roles that see results', 'waysill' ); ?></legend>
							<?php foreach ( wp_roles()->get_names() as $role => $name ) : ?>
								<label>
									<input type="checkbox" name="waysill_settings[roles][]" value="<?php echo esc_attr( $role ); ?>" <?php checked( in_array( $role, $settings['roles'], true ) ); ?>>
									<?php echo esc_html( translate_user_role( $name ) ); ?>
								</label><br>
							<?php endforeach; ?>
							<p class="description"><?php esc_html_e( 'Users also need permission to edit the post. Administrators always see results.', 'waysill' ); ?></p>
						</fieldset>
					</td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'Check on save', 'waysill' ); ?></th>
					<td>
						<label>
							<input type="checkbox" name="waysill_settings[check_on_save]" value="1" <?php checked( $settings['check_on_save'] ); ?>>
							<?php esc_html_e( 'Check a post again after each save, for users who have not chosen themselves', 'waysill' ); ?>
						</label>
						<p class="description"><?php esc_html_e( 'The check runs in the editor after saving and never delays saving or publishing. Each user can turn it on or off in the editor.', 'waysill' ); ?></p>
					</td>
				</tr>
			</table>
			<?php submit_button(); ?>
		</form>

		<h2><?php esc_html_e( 'Stored results', 'waysill' ); ?></h2>
		<p><?php esc_html_e( 'Each check stores its result with the post. Deleting them does not change any content; the next check stores a new result.', 'waysill' ); ?></p>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="waysill_delete_results">
			<?php wp_nonce_field( 'waysill_delete_results' ); ?>
			<?php submit_button( __( 'Delete all stored results', 'waysill' ), 'delete', 'waysill-delete-results', false ); ?>
		</form>

		<?php
		// The Pro build turns this off once a licence is active.
		if ( apply_filters( 'waysill_show_pro_line', true ) ) :
			?>
		<p class="waysill-pro-line">
			<?php
			echo esc_html(
				sprintf(
					/* translators: %s: price in US dollars, for example $79. */
					__( 'Waysill Pro adds a site-wide scan, a list of all issues, CSV export, scan history and a weekly digest for %s per year for one site.', 'waysill' ),
					'$' . WAYSILL_PRO_PRICE_USD
				)
			);
			?>
			<a href="<?php echo esc_url( WAYSILL_PRICING_URL ); ?>" target="_blank" rel="noopener noreferrer">
				<?php esc_html_e( 'See Waysill Pro', 'waysill' ); ?>
				<span class="screen-reader-text"><?php esc_html_e( '(opens in a new tab)', 'waysill' ); ?></span>
			</a>
		</p>
		<?php endif; ?>
	</div>
	<?php
}