<?php
/**
 * Uninstall handler — runs when the plugin is deleted via the WordPress admin.
 * Drops all plugin tables and removes all options. Data removal only happens
 * here, never during deactivation (which only clears scheduled crons).
 *
 * Deletion is also the moment the pairing genuinely ends, so the backend is
 * told before the credentials that prove it are destroyed. Strictly best
 * effort, and deliberately impatient: an owner deleting a plugin must never
 * wait on our network, and an unreachable backend must never leave data
 * behind on this site. One second to mint a token, then a non-blocking
 * disconnect, and the cleanup below runs either way.
 *
 * That call DISCONNECTS; it does not delete. The backend revokes this site's
 * tokens and keeps the owner's WPPilot history, so reinstalling resumes it.
 * Deleting that history is the owner's explicit choice ("Remove site and
 * data" in WPPilot's Account Settings), never a side effect of removing a
 * plugin, which is routine troubleshooting as often as it is goodbye.
 *
 * On a multisite network every site holds its own pairing, tables, options
 * and transients, so each one is cleaned, not only the site deleting it.
 *
 * What is removed is listed in the arrays below, and plugin/tests/uninstall-test.php
 * fails the build when the plugin writes an option, transient or user meta key
 * these lists do not name — so the list cannot drift from the code. What is
 * deliberately kept: leads (`wppilot_lead` posts and their meta) are the
 * owner's own records, and images copied into the media library stay with
 * their provenance (`_wppilot_source_url`). The WPPilot Advanced Actions
 * module's `wppilot_advanced_*` options belong to that plugin and are its own
 * uninstaller's to remove.
 */

defined( 'WP_UNINSTALL_PLUGIN' ) || exit;

if ( ! defined( 'WPPILOT_BACKEND_URL' ) ) {
	define( 'WPPILOT_BACKEND_URL', 'https://api.getwppilot.com' );
}

/** Options this plugin writes. */
/*
 * Option families whose names carry an id (written with add_option for its
 * atomicity, e.g. the custom-field write lock). Swept by exact prefix only,
 * never by a broad sweep of every plugin option (that would take the add-on's).
 */
const WPPILOT_UNINSTALL_OPTION_PREFIXES = array(
	'wppilot_cf_lock_',
);

const WPPILOT_UNINSTALL_OPTIONS = array(
	'wppilot_connected',
	'wppilot_log_level',
	'wppilot_db_version',
	'wppilot_forms',
	'wppilot_jwt_issued_at',
	'wppilot_pairing_rejected',
	'wppilot_delivery_auth',
	'wppilot_event_outbox',
	'wppilot_last_site_summary',
	'wppilot_activation_redirect',
	// The one-search-at-a-time lock of GET /find (1.5.21).
	'wppilot_find_lock',
);

/** Transients this plugin writes under a fixed name. */
const WPPILOT_UNINSTALL_TRANSIENTS = array(
	'wppilot_connect_window',
	'wppilot_admin_notice',
	'wppilot_site_summary',
	'wppilot_briefing_summary',
	'wppilot_event_buffer',
	'wppilot_public_page_rate',
	'wppilot_backend_unreachable',
);

/**
 * Transient families written under a computed name: the recent-activity cache
 * (one per display limit) and the per-visitor form rate limit.
 */
const WPPILOT_UNINSTALL_TRANSIENT_PREFIXES = array(
	'wppilot_recent_activity_',
	'wppilot_frl_',
	// The last answer of GET /find for one text, kept a minute (1.5.21).
	'wppilot_find_',
);

/**
 * Network-wide (site) transients. The WordPress.org copy writes none; this one
 * may be left by a copy of the plugin installed from getwppilot.com earlier.
 */
const WPPILOT_UNINSTALL_SITE_TRANSIENTS = array(
	'wppilot_update_manifest',
);

/** User meta this plugin writes (users are shared across a network). */
const WPPILOT_UNINSTALL_USER_META = array(
	'wppilot_connect_notice_dismissed',
);

/** Scheduled hooks this plugin registers. */
const WPPILOT_UNINSTALL_CRON_HOOKS = array(
	'wppilot_heartbeat_cron',
	'wppilot_deliver_events',
);

/**
 * Tell the backend this site's pairing has ended, best effort and impatient.
 */
function wppilot_uninstall_disconnect(): void {
	global $wpdb;

	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	$row    = $wpdb->get_row( $wpdb->prepare( "SELECT secret FROM {$wpdb->prefix}wppilot_connection WHERE id = %d", 1 ) );
	$secret = $row->secret ?? '';
	if ( empty( $secret ) ) {
		return;
	}

	$token_response = wp_remote_post(
		WPPILOT_BACKEND_URL . '/v1/auth/token',
		array(
			'headers'  => array( 'content-type' => 'application/json' ),
			'body'     => wp_json_encode(
				array(
					// Must match what connect() registered, or the backend cannot
					// identify this site.
					'site_url' => get_site_url(),
					'secret'   => $secret,
				)
			),
			'timeout'  => 1,
			'blocking' => true,
		)
	);
	$token = null;
	if ( ! is_wp_error( $token_response ) ) {
		$body  = json_decode( wp_remote_retrieve_body( $token_response ), true );
		$token = is_array( $body ) ? ( $body['token'] ?? null ) : null;
	}
	if ( ! is_string( $token ) || '' === $token ) {
		return;
	}
	wp_remote_post(
		WPPILOT_BACKEND_URL . '/v1/sites/disconnect',
		array(
			'headers'  => array(
				'content-type'  => 'application/json',
				'authorization' => 'Bearer ' . $token,
			),
			'body'     => wp_json_encode( (object) array() ),
			// Nothing here needs the answer, so do not wait for one.
			'timeout'  => 1,
			'blocking' => false,
		)
	);
}

/**
 * Remove everything this plugin stored for the current site (blog).
 */
function wppilot_uninstall_site(): void {
	global $wpdb;

	wppilot_uninstall_disconnect();

	// Drop plugin tables. Table names are built from $wpdb->prefix + fixed suffixes (no user input); a schema change with no caching is correct on uninstall.
	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange
	$wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}wppilot_log" );
	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange
	$wpdb->query( "DROP TABLE IF EXISTS {$wpdb->prefix}wppilot_connection" );

	foreach ( WPPILOT_UNINSTALL_OPTIONS as $option ) {
		delete_option( $option );
	}
	foreach ( WPPILOT_UNINSTALL_TRANSIENTS as $transient ) {
		delete_transient( $transient );
	}

	// The computed families. delete_transient() reaches a persistent object
	// cache; the options-table sweep below catches names nobody can list.
	for ( $limit = 1; $limit <= 20; $limit++ ) {
		delete_transient( 'wppilot_recent_activity_' . $limit );
	}
	foreach ( WPPILOT_UNINSTALL_OPTION_PREFIXES as $prefix ) {
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
		$wpdb->query(
			$wpdb->prepare(
				"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s",
				$wpdb->esc_like( $prefix ) . '%'
			)
		);
	}
	foreach ( WPPILOT_UNINSTALL_TRANSIENT_PREFIXES as $prefix ) {
		foreach ( array( '_transient_', '_transient_timeout_' ) as $kind ) {
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
			$wpdb->query(
				$wpdb->prepare(
					"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s",
					$wpdb->esc_like( $kind . $prefix ) . '%'
				)
			);
		}
	}

	foreach ( WPPILOT_UNINSTALL_CRON_HOOKS as $hook ) {
		wp_clear_scheduled_hook( $hook );
	}
}

if ( is_multisite() ) {
	$wppilot_site_ids = get_sites(
		array(
			'fields' => 'ids',
			'number' => 0,
		)
	);
	foreach ( $wppilot_site_ids as $wppilot_site_id ) {
		switch_to_blog( (int) $wppilot_site_id );
		wppilot_uninstall_site();
		restore_current_blog();
	}
} else {
	wppilot_uninstall_site();
}

// Network-wide transients: once, whichever site uninstalls.
foreach ( WPPILOT_UNINSTALL_SITE_TRANSIENTS as $wppilot_site_transient ) {
	delete_site_transient( $wppilot_site_transient );
}

// Per-user state lives in the shared users table: once, for every user.
foreach ( WPPILOT_UNINSTALL_USER_META as $wppilot_meta_key ) {
	delete_metadata( 'user', 0, $wppilot_meta_key, '', true );
}