<?php
/**
 * Plugin Name:       WLock - Lock Your Site Against Unapproved Installs
 * Description:       Lock your site so only approved plugins and themes can be installed. Manage the allowed list from the dashboard.
 * Version:           1.0.0
 * Requires at least: 6.3
 * Requires PHP:      7.4
 * Author:            Riduan Chowdhury
 * Author URI:        https://bytesvibe.com
 * Text Domain:       wlock
 * License:           GPLv2 or later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 *
 * @package WLock
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit; // No direct access.
}

define( 'WLOCK_VERSION', '1.0.0' );
define( 'WLOCK_FILE', __FILE__ );

final class WLock {

	const OPT_ENABLED  = 'wlock_enabled';
	const OPT_PLUGINS  = 'wlock_allowed_plugins';
	const OPT_THEMES   = 'wlock_allowed_themes';
	const OPT_LOG      = 'wlock_blocked_log';
	const OPTION_GROUP = 'wlock_settings_group';
	const MAX_LOG      = 50;

	private static $instance = null;

	public static function instance() {
		if ( null === self::$instance ) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	private function __construct() {
		register_activation_hook( WLOCK_FILE, array( $this, 'on_activate' ) );

		add_filter( 'upgrader_source_selection', array( $this, 'check_install' ), 20, 4 );
		add_action( 'admin_menu', array( $this, 'add_settings_page' ) );
		add_action( 'admin_init', array( $this, 'register_settings' ) );
		add_filter( 'plugin_action_links_' . plugin_basename( WLOCK_FILE ), array( $this, 'add_settings_link' ) );
	}

	/* ------------------------------------------------------------------ */
	/* Activation                                                         */
	/* ------------------------------------------------------------------ */

	public function on_activate() {
		add_option( self::OPT_ENABLED, '0' );
		add_option( self::OPT_PLUGINS, array() );
		add_option( self::OPT_THEMES, array() );
		add_option( self::OPT_LOG, array() );
	}

	/* ------------------------------------------------------------------ */
	/* Enforcement                                                        */
	/* ------------------------------------------------------------------ */

	/**
	 * Runs after a plugin/theme package is unzipped to a temp directory,
	 * before it is copied into its final wp-content/plugins or
	 * wp-content/themes location.
	 */
	public function check_install( $source, $remote_source, $upgrader, $hook_extra ) {
		if ( is_wp_error( $source ) || ! $source ) {
			return $source;
		}

		if ( '1' !== get_option( self::OPT_ENABLED, '0' ) ) {
			return $source;
		}

		$type = $this->detect_type( $hook_extra );

		if ( ! $type ) {
			return $source; // Not a plugin/theme operation (e.g. core update).
		}

		if ( $this->is_update( $hook_extra ) ) {
			return $source; // Only fresh installs are restricted, not updates.
		}

		$slug = $this->detect_slug( $source );

		if ( ! $slug ) {
			return $this->reject( $type, __( '(unrecognized package)', 'wlock' ) );
		}

		if ( in_array( strtolower( $slug ), $this->get_allowed( $type ), true ) ) {
			return $source;
		}

		return $this->reject( $type, $slug );
	}

	private function get_allowed( $type ) {
		$option = 'theme' === $type ? self::OPT_THEMES : self::OPT_PLUGINS;
		$slugs  = get_option( $option, array() );
		return is_array( $slugs ) ? array_map( 'strtolower', $slugs ) : array();
	}

	private function detect_type( $hook_extra ) {
		if ( isset( $hook_extra['type'] ) && in_array( $hook_extra['type'], array( 'plugin', 'theme' ), true ) ) {
			return $hook_extra['type'];
		}
		if ( isset( $hook_extra['plugin'] ) ) {
			return 'plugin';
		}
		if ( isset( $hook_extra['theme'] ) ) {
			return 'theme';
		}
		return false;
	}

	private function is_update( $hook_extra ) {
		return isset( $hook_extra['action'] ) && 'update' === $hook_extra['action'];
	}

	private function detect_slug( $source ) {
		$slug = basename( untrailingslashit( $source ) );

		if ( ! $slug ) {
			return false;
		}

		// Defense in depth: the folder name originates from inside an
		// uploaded/downloaded archive. Strip anything unexpected and cap the
		// length before it is ever stored or echoed anywhere, even though it
		// is only escaped output at that point too.
		$slug = sanitize_text_field( $slug );
		$slug = substr( $slug, 0, 100 );

		return '' !== $slug ? $slug : false;
	}

	private function reject( $type, $slug ) {
		$this->log_block( $type, $slug );

		$label = 'theme' === $type
			? __( 'This theme', 'wlock' )
			: __( 'This plugin', 'wlock' );

		return new WP_Error(
			'wlock_not_whitelisted',
			sprintf(
				/* translators: 1: "This plugin"/"This theme", 2: slug of the rejected package */
				__( '%1$s ("%2$s") is not on the approved list for this site and cannot be installed. An administrator can add it under Settings → WLock.', 'wlock' ),
				$label,
				$slug
			)
		);
	}

	private function log_block( $type, $slug ) {
		$log = get_option( self::OPT_LOG, array() );

		array_unshift(
			$log,
			array(
				'time' => current_time( 'mysql' ),
				'user' => wp_get_current_user()->user_login,
				'type' => $type,
				'slug' => $slug,
			)
		);

		update_option( self::OPT_LOG, array_slice( $log, 0, self::MAX_LOG ), false );
	}

	/* ------------------------------------------------------------------ */
	/* Settings page                                                      */
	/* ------------------------------------------------------------------ */

	public function add_settings_link( $links ) {
		$settings_link = sprintf(
			'<a href="%s">%s</a>',
			esc_url( admin_url( 'options-general.php?page=wlock' ) ),
			esc_html__( 'Settings', 'wlock' )
		);
		array_unshift( $links, $settings_link );
		return $links;
	}

	public function add_settings_page() {
		add_options_page(
			__( 'WLock', 'wlock' ),
			__( 'WLock', 'wlock' ),
			'manage_options',
			'wlock',
			array( $this, 'render_settings_page' )
		);
	}

	public function register_settings() {
		register_setting(
			self::OPTION_GROUP,
			self::OPT_ENABLED,
			array(
				'type'              => 'string',
				'sanitize_callback' => array( $this, 'sanitize_checkbox' ),
				'default'           => '0',
			)
		);
		register_setting(
			self::OPTION_GROUP,
			self::OPT_PLUGINS,
			array(
				'type'              => 'array',
				'sanitize_callback' => array( $this, 'sanitize_slug_list' ),
				'default'           => array(),
			)
		);
		register_setting(
			self::OPTION_GROUP,
			self::OPT_THEMES,
			array(
				'type'              => 'array',
				'sanitize_callback' => array( $this, 'sanitize_slug_list' ),
				'default'           => array(),
			)
		);
	}

	public function sanitize_checkbox( $value ) {
		return ( '1' === $value ) ? '1' : '0';
	}

	/**
	 * Accepts either a newline-separated string (from the textarea) or an
	 * array, and returns a clean array of unique, lower-cased slugs.
	 */
	public function sanitize_slug_list( $value ) {
		if ( is_string( $value ) ) {
			$value = preg_split( '/[\r\n,]+/', $value );
		}
		if ( ! is_array( $value ) ) {
			return array();
		}

		$clean = array();
		foreach ( $value as $item ) {
			$item = sanitize_title( trim( (string) $item ) );
			$item = substr( $item, 0, 100 );
			if ( '' !== $item ) {
				$clean[] = $item;
			}
		}

		return array_values( array_unique( $clean ) );
	}

	public function render_settings_page() {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}

		$enabled = get_option( self::OPT_ENABLED, '0' );
		$plugins = get_option( self::OPT_PLUGINS, array() );
		$themes  = get_option( self::OPT_THEMES, array() );
		$log     = get_option( self::OPT_LOG, array() );
		?>
		<div class="wrap">
			<h1><?php esc_html_e( 'WLock', 'wlock' ); ?></h1>
			<p><?php esc_html_e( 'Only plugins and themes listed below can be installed on this site. Activating, deactivating, deleting, or updating anything already installed is not affected.', 'wlock' ); ?></p>

			<form method="post" action="options.php">
				<?php settings_fields( self::OPTION_GROUP ); ?>

				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><?php esc_html_e( 'Enforcement', 'wlock' ); ?></th>
						<td>
							<label>
								<input type="checkbox" name="<?php echo esc_attr( self::OPT_ENABLED ); ?>" value="1" <?php checked( '1', $enabled ); ?> />
								<?php esc_html_e( 'Block installation of anything not on the approved lists below', 'wlock' ); ?>
							</label>
						</td>
					</tr>
					<tr>
						<th scope="row">
							<label for="wlock_plugins_field"><?php esc_html_e( 'Approved plugins', 'wlock' ); ?></label>
						</th>
						<td>
							<textarea id="wlock_plugins_field" name="<?php echo esc_attr( self::OPT_PLUGINS ); ?>" rows="6" cols="50" class="large-text code"><?php echo esc_textarea( implode( "\n", $plugins ) ); ?></textarea>
							<p class="description">
								<?php esc_html_e( 'One plugin slug per line. The slug is the folder name it installs into, e.g. Akismet installs to wp-content/plugins/akismet, so its slug is "akismet" — also the last part of its WordPress.org URL.', 'wlock' ); ?>
							</p>
						</td>
					</tr>
					<tr>
						<th scope="row">
							<label for="wlock_themes_field"><?php esc_html_e( 'Approved themes', 'wlock' ); ?></label>
						</th>
						<td>
							<textarea id="wlock_themes_field" name="<?php echo esc_attr( self::OPT_THEMES ); ?>" rows="6" cols="50" class="large-text code"><?php echo esc_textarea( implode( "\n", $themes ) ); ?></textarea>
							<p class="description">
								<?php esc_html_e( 'One theme slug per line, using the same convention as plugins above.', 'wlock' ); ?>
							</p>
						</td>
					</tr>
				</table>

				<?php submit_button( __( 'Save Changes', 'wlock' ) ); ?>
			</form>

			<h2><?php esc_html_e( 'Recently blocked install attempts', 'wlock' ); ?></h2>
			<?php if ( $log ) : ?>
				<table class="widefat striped" style="max-width:700px;">
					<thead>
						<tr>
							<th><?php esc_html_e( 'Time', 'wlock' ); ?></th>
							<th><?php esc_html_e( 'User', 'wlock' ); ?></th>
							<th><?php esc_html_e( 'Type', 'wlock' ); ?></th>
							<th><?php esc_html_e( 'Slug', 'wlock' ); ?></th>
						</tr>
					</thead>
					<tbody>
						<?php foreach ( $log as $entry ) : ?>
							<tr>
								<td><?php echo esc_html( $entry['time'] ); ?></td>
								<td><?php echo esc_html( $entry['user'] ); ?></td>
								<td><?php echo esc_html( $entry['type'] ); ?></td>
								<td><code><?php echo esc_html( $entry['slug'] ); ?></code></td>
							</tr>
						<?php endforeach; ?>
					</tbody>
				</table>
			<?php else : ?>
				<p><em><?php esc_html_e( 'No blocked attempts yet.', 'wlock' ); ?></em></p>
			<?php endif; ?>
		</div>
		<?php
	}
}

WLock::instance();