<?php
/**
 * The batch list, the new-batch form, and batch deletion.
 */

if (!defined('ABSPATH')) exit;

/**
 * Start Batch: create the batch, then send the browser to its Upload step.
 *
 * HOOKED TO `load-{page}`, NOT CALLED FROM THE RENDER FUNCTION, and the reason is the whole
 * point of this function. WordPress runs `load-{page}`, then prints the admin header, and only
 * then calls the page's render callback. A redirect is an HTTP header, and a header cannot be
 * sent once any output has begun. This used to run inside the render callback, so the batch was
 * created and then `wp_safe_redirect()` was silently dropped: the person was left on a screen with
 * an empty content area. It only "worked" where PHP buffered the whole page (`output_buffering`
 * unlimited); with PHP's default (0) or `php.ini-production`'s 4096 the admin header alone is
 * larger than the buffer. Here nothing has been printed yet, so the redirect always works.
 *
 * Do not paper over this with `ob_start()`: that hides the ordering problem on one server
 * configuration and leaves it on every other. tests/integration/StartBatchRedirectTest.php and
 * tests/RedirectBeforeOutputTest.php hold the line.
 */
function wpbr_handle_new_batch_post() {
    if (!current_user_can('manage_options')) return;

    // wpbr_handle_create_batch() verifies its own nonce before it reads the form.
    if (wpbr_posted_form() === 'create_batch') {
        $batch_id = wpbr_handle_create_batch();
        wp_safe_redirect(wpbr_step_url($batch_id, 'upload'));
        exit;
    }
}

/**
 * The post type and field a link asks the new-batch form to start with.
 *
 * Read from the address, so there is no nonce to check: the first-run screen's
 * "Start a batch" links carry these to pre-fill a form, which only chooses what
 * the form shows. Nothing is changed by reading them, and the form that is
 * submitted afterwards carries its own nonce, checked by
 * wpbr_handle_create_batch(), which also validates the post type again.
 *
 * @return array{post_type:string,field:string}
 */
function wpbr_requested_preset() {
    // phpcs:disable WordPress.Security.NonceVerification.Recommended -- Pre-fills a form from the link that opened it; nothing is changed or revealed, and the submission carries its own nonce.
    $post_type = isset($_GET['wpbr_post_type']) ? sanitize_key(wp_unslash($_GET['wpbr_post_type']))
        : (isset($_GET['post_type']) ? sanitize_key(wp_unslash($_GET['post_type'])) : '');
    $meta_key  = isset($_GET['wpbr_meta_key']) ? sanitize_text_field(wp_unslash($_GET['wpbr_meta_key']))
        : (isset($_GET['meta_key']) ? sanitize_text_field(wp_unslash($_GET['meta_key'])) : '');
    // phpcs:enable WordPress.Security.NonceVerification.Recommended
    return array('post_type' => $post_type, 'field' => $meta_key);
}

function wpbr_render_new_batch_page() {
    if (!current_user_can('manage_options')) return;

    // Creating a batch is wpbr_handle_new_batch_post(), on `load-{page}`. It must not live here:
    // by the time this function runs the admin header has been printed and a redirect is impossible.

    // The first-run screen offers to start a batch already pointed at a field it
    // found. Carried as hidden fields rather than kept in the session, so the
    // form still says everything it is about to do.
    //
    // THE ARGUMENTS ARE NAMESPACED BECAUSE `post_type` BELONGS TO CORE. wp-admin/admin.php reads it while it resolves an admin screen, and
    // when it names a registered post type core looks the plugin page up under `admin.php?post_type=...` instead of `admin.php`, finds no
    // page there and ends the request with "Cannot load wpbr-new-batch." before this function runs. The first-run screen's "Start a
    // batch" links carried exactly that and were a dead end on a real site for every post type that exists (reproduced on WordPress 7).
    // The old names are still read, for a link made before the change whose post type core does not know.
    $preset = wpbr_requested_preset();
    $preset_type = $preset['post_type'];
    $preset_key  = $preset['field'];
    if ($preset_type !== '' && !post_type_exists($preset_type)) {
        $preset_type = '';
        $preset_key  = '';
    }

    echo "<div class=\"wrap wpbr-admin\">";
    wpbr_admin_header_print(__('Add New Batch', 'wpbr-bulk-replace'));
    echo "<p>";
    wpbr_help_link_echo('core.batches.create', __('Starting a batch', 'wpbr-bulk-replace'));
    echo "</p>";
    echo "<form method=\"post\">";
    wp_nonce_field('wpbr_create_batch');
    echo "<input type=\"hidden\" name=\"wpbr_action\" value=\"create_batch\">";
    if ($preset_type !== '') {
        echo "<input type=\"hidden\" name=\"preset_post_type\" value=\"".esc_attr($preset_type)."\">";
        echo "<input type=\"hidden\" name=\"preset_meta_key\" value=\"".esc_attr($preset_key)."\">";
        echo "<p class=\"description\" style=\"max-width:560px;\">" . esc_html(sprintf(
            /* translators: 1: a post type name, e.g. "Program", 2: a meta field name. */
            __('This batch will start out matching %1$s on the field %2$s. You can change both at the Match step.', 'wpbr-bulk-replace'),
            wpbr_post_type_label_title($preset_type),
            $preset_key
        )) . "</p>";
    }

    /* translators: %s is today's date, used as a default batch name. */
    $default_label = sprintf(__('New batch %s', 'wpbr-bulk-replace'), date_i18n('Y-m-d'));

    echo "<p><label for=\"wpbr_batch_label\">" . esc_html__('Batch label', 'wpbr-bulk-replace') . "</label><br>";
    echo "<input type=\"text\" id=\"wpbr_batch_label\" name=\"batch_label\" value=\"".esc_attr($default_label)."\" style=\"width:300px;\"></p>";
    echo "<p><button type=\"submit\" class=\"button button-primary\">" . esc_html__('Start Batch', 'wpbr-bulk-replace') . " &rarr;</button></p>";
    echo "</form>";
    echo "<p class=\"description\">" . esc_html__('You will upload files and set up matching on the next screen.', 'wpbr-bulk-replace') . "</p>";
    echo "</div>";
}

function wpbr_render_batches_page() {
    if (!current_user_can('manage_options')) return;

    global $wpdb;

    if (wpbr_posted_form() === 'delete_batch') {
        wpbr_handle_delete_batch();
    } elseif (isset($_GET['wpbr_delete'])) {
        $bid = intval($_GET['wpbr_delete']);
        if (!isset($_GET['wpbr_del_nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['wpbr_del_nonce'])), 'wpbr_delete_batch_'.$bid)) {
            wp_die(esc_html__('Invalid or missing security token.', 'wpbr-bulk-replace'));
        }
        wpbr_render_delete_batch_confirm($bid);
        return;
    }

    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin-owned table with no WordPress API; the screen shows live state, and a cached copy would lag the write the person just made.
    $batches = $wpdb->get_results(
        "SELECT b.*,
                COUNT(i.id) AS item_count,
                SUM(CASE WHEN i.status IN ('matched','confirmed_new_attach') THEN 1 ELSE 0 END) AS to_do,
                SUM(CASE WHEN i.status IN ('replaced','verified','cleaned_up') THEN 1 ELSE 0 END) AS done,
                SUM(CASE WHEN i.status = 'needs_review' THEN 1 ELSE 0 END) AS needs_review,
                SUM(CASE WHEN i.status = 'needs_attention' THEN 1 ELSE 0 END) AS needs_attention,
                SUM(CASE WHEN i.status = 'skip' THEN 1 ELSE 0 END) AS skipped,
                SUM(CASE WHEN i.status = 'combined' THEN 1 ELSE 0 END) AS combined,
                SUM(CASE WHEN i.status = 'new_page_needed' THEN 1 ELSE 0 END) AS new_page
         FROM {$wpdb->prefix}wpbr_batches b
         LEFT JOIN {$wpdb->prefix}wpbr_batch_items i ON i.batch_id = b.id
         GROUP BY b.id ORDER BY b.id DESC"
    );

    echo "<div class=\"wrap wpbr-admin\">";
    wpbr_admin_header_print(__('Batches', 'wpbr-bulk-replace'));
    echo "<p>";
    wpbr_help_link_echo('core.batches.overview', __('What a batch is', 'wpbr-bulk-replace'));
    echo "</p>";

    if (!$batches) {
        wpbr_render_first_run();
        echo "</div>";
        return;
    }

    echo "<p><a href=\"".esc_url(admin_url('admin.php?page=wpbr-new-batch'))."\" class=\"button button-primary\">" . esc_html__('Add New Batch', 'wpbr-bulk-replace') . "</a></p>";

    echo "<table class=\"widefat striped\"><thead><tr>";
    echo "<th scope=\"col\">" . esc_html__('ID', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Label', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Post type', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Meta field', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Files', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Progress', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Created', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('By', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\"><span class=\"screen-reader-text\">" . esc_html__('Actions', 'wpbr-bulk-replace') . "</span></th>";
    echo "</tr></thead><tbody>";

    $not_set = __('(not set)', 'wpbr-bulk-replace');

    foreach ($batches as $b) {
        $detail_url = admin_url('admin.php?page=wpbr-batch-detail&batch_id='.$b->id);
        echo "<tr>";
        echo "<td>".esc_html(number_format_i18n($b->id))."</td>";
        echo "<th scope=\"row\">".esc_html($b->label)."</th>";
        echo "<td>".esc_html($b->post_type ? wpbr_post_type_display($b->post_type) : $not_set)."</td>";
        echo "<td>".esc_html($b->meta_key_name ? $b->meta_key_name : $not_set)."</td>";
        echo "<td>".esc_html(number_format_i18n($b->item_count))."</td>";

        $done = (int) $b->done;
        $todo = (int) $b->to_do;
        $review = (int) $b->needs_review;
        $total = $done + $todo;
        echo "<td style=\"min-width:170px;\">";
        if ($total > 0) {
            $pct = (int) round(($done / $total) * 100);
            // The bar is a picture of the sentence beneath it, so it is hidden
            // rather than announced twice.
            echo "<div style=\"height:8px;background:#f0f0f1;border-radius:4px;overflow:hidden;\" aria-hidden=\"true\">";
            echo "<div style=\"height:100%;width:".esc_attr($pct)."%;background:#2271b1;\"></div></div>";
            echo "<span style=\"font-size:11px;color:#50575e;\">";
            echo esc_html(sprintf(
                /* translators: 1: number of files processed, 2: total number of files. */
                __('%1$s of %2$s done', 'wpbr-bulk-replace'),
                number_format_i18n($done), number_format_i18n($total)
            ));
            if ($review) {
                echo " &middot; " . esc_html(sprintf(
                    /* translators: %s is a number of files. */
                    _n('%s needs review', '%s need review', $review, 'wpbr-bulk-replace'),
                    number_format_i18n($review)
                ));
            }
            $aside = array();
            if ((int) $b->skipped) {
                /* translators: %s is a number of files. */
                $aside[] = sprintf(_n('%s skipped', '%s skipped', (int) $b->skipped, 'wpbr-bulk-replace'), number_format_i18n($b->skipped));
            }
            if ((int) $b->combined) {
                /* translators: %s is a number of files merged into another file. */
                $aside[] = sprintf(_n('%s merged', '%s merged', (int) $b->combined, 'wpbr-bulk-replace'), number_format_i18n($b->combined));
            }
            if ((int) $b->new_page) {
                /* translators: %s is a number of files with no post to attach to yet. */
                $aside[] = sprintf(_n('%s needs a page', '%s need a page', (int) $b->new_page, 'wpbr-bulk-replace'), number_format_i18n($b->new_page));
            }
            if ($aside) echo "<br>".esc_html(implode(', ', $aside));
            echo "</span>";
        } elseif ($review) {
            echo "<span style=\"font-size:11px;color:#8a6116;\">" . esc_html(sprintf(
                /* translators: %s is a number of files. */
                _n('%s needs review', '%s need review', $review, 'wpbr-bulk-replace'),
                number_format_i18n($review)
            )) . "</span>";
        } else {
            echo "<span style=\"font-size:11px;color:#787c82;\">" . esc_html__('Not started', 'wpbr-bulk-replace') . "</span>";
        }
        if ((int) $b->needs_attention) {
            // A file that could not be put back after a failed replacement. Stated plainly and in words, not colour alone.
            echo "<br><strong style=\"font-size:11px;color:#b32d2e;\">" . esc_html(sprintf(
                /* translators: %s is a number of files. */
                _n('%s file needs attention', '%s files need attention', (int) $b->needs_attention, 'wpbr-bulk-replace'),
                number_format_i18n((int) $b->needs_attention)
            )) . "</strong>";
        }
        echo "</td>";

        echo "<td style=\"font-size:12px;white-space:nowrap;\">"
            . esc_html(mysql2date(get_option('date_format', 'M j, Y'), $b->created_at))
            . "<br><span style=\"color:#787c82;\">"
            . esc_html(mysql2date(get_option('time_format', 'g:i a'), $b->created_at))
            . "</span></td>";

        echo "<td style=\"font-size:12px;\">";
        if (!empty($b->actor) && wpbr_actor_label($b->actor) !== '') {
            echo "<span title=\"".esc_attr(wpbr_user_title($b->created_by))."\">".esc_html(wpbr_actor_label($b->actor))."</span>";
        } elseif ($b->created_by) {
            echo "<span title=\"".esc_attr(wpbr_user_title($b->created_by))."\">".esc_html(wpbr_user_label($b->created_by))."</span>";
        } else {
            echo "<span style=\"color:#787c82;\" aria-hidden=\"true\">&mdash;</span><span class=\"screen-reader-text\">" . esc_html__('Unknown', 'wpbr-bulk-replace') . "</span>";
        }
        echo "</td>";

        $del_url = wp_nonce_url(
            admin_url('admin.php?page=wpbr-batches&wpbr_delete='.$b->id),
            'wpbr_delete_batch_'.$b->id, 'wpbr_del_nonce'
        );
        echo "<td style=\"white-space:nowrap;\">";
        // Both controls name the batch: in a list of twelve, "Open" and
        // "Delete this batch" twelve times over identify nothing.
        echo "<a href=\"".esc_url($detail_url)."\" class=\"button\" style=\"display:inline-flex;align-items:center;gap:4px;\" aria-label=\""
            . esc_attr(sprintf(
                /* translators: %s is a batch label. */
                __('Open %s', 'wpbr-bulk-replace'), $b->label
            )) . "\">" . esc_html__('Open', 'wpbr-bulk-replace') . "</a> ";
        echo "<a href=\"".esc_url($del_url)."\" class=\"button\" style=\"display:inline-flex;align-items:center;gap:4px;\" aria-label=\""
            . esc_attr(sprintf(
                /* translators: %s is a batch label. */
                __('Delete %s', 'wpbr-bulk-replace'), $b->label
            )) . "\"><span class=\"dashicons dashicons-trash\" style=\"font-size:16px;width:16px;height:16px;line-height:16px;\" aria-hidden=\"true\"></span></a>";
        echo "</td>";
        echo "</tr>";
    }
    echo "</tbody></table>";
    echo "</div>";
}

/**
 * What a site with no batches sees.
 *
 * An empty table teaches nothing, and neither does an empty state that only
 * describes the plugin. The question a new user actually has is "will this work
 * on my site", and that question has an answer that can be looked up rather than
 * guessed at - so this screen looks, and says what it found.
 *
 * Three outcomes, and the second two are the point:
 *
 * - Fields found: they are listed, with how many posts have one and an example
 *   of what is in it, each starting a batch already pointed at that field.
 * - Nothing found, but the site has content: say so plainly, and say what the
 *   plugin needs, so the reader can decide whether it is for them without
 *   uploading two hundred files first.
 * - No content at all: a different problem, and saying "no file fields found"
 *   to somebody with an empty site would be a misleading answer to a question
 *   they did not ask.
 */
function wpbr_render_first_run() {
    $scan = wpbr_scan_site_for_file_fields();

    // `wpbr-first-run` is how the review ask's card knows this is onboarding,
    // and stays out of it (assets/wpbr-advocacy.js).
    echo "<div class=\"wpbr-first-run\" style=\"background:#fff;border:1px solid #dcdcde;padding:28px;margin-top:16px;max-width:860px;\">";
    echo "<span class=\"dashicons dashicons-media-document\" style=\"font-size:36px;width:36px;height:36px;color:#c3c4c7;\" aria-hidden=\"true\"></span>";
    echo "<h2 style=\"margin:10px 0 6px;\">" . esc_html__('No batches yet', 'wpbr-bulk-replace') . "</h2>";
    echo "<p class=\"description\" style=\"max-width:560px;\">" . esc_html__('A batch is one set of files you want matched to existing content and swapped in. Start one, upload your files, and the wizard takes it from there.', 'wpbr-bulk-replace') . "</p>";

    if (!empty($scan['fields'])) {
        wpbr_render_first_run_fields($scan);
    } elseif ($scan['posts'] > 0) {
        wpbr_render_first_run_nothing_found($scan);
    } else {
        wpbr_render_first_run_empty_site();
    }

    echo "<p style=\"margin-bottom:0;\"><a href=\"".esc_url(admin_url('admin.php?page=wpbr-new-batch'))."\" class=\"button button-primary button-hero\">" . esc_html__('Add New Batch', 'wpbr-bulk-replace') . "</a> ";
    echo "<a href=\"".esc_url(admin_url('admin.php?page=wpbr-help'))."\" style=\"margin-left:8px;\">" . esc_html__('Read how it works first', 'wpbr-bulk-replace') . "</a></p>";
    echo "</div>";
}

/** The good case: fields that hold files, and how much is behind each one. */
function wpbr_render_first_run_fields($scan) {
    echo "<h3 style=\"margin:22px 0 4px;\">" . esc_html__('What is on your site', 'wpbr-bulk-replace') . "</h3>";
    // One sentence per count. Splicing a second number into a sentence whose
    // plural form is chosen by the first gives "across 1 post types" on a site
    // with one post type, and worse in languages with more than two forms.
    echo "<p class=\"description\" style=\"max-width:560px;margin-top:0;\">" . esc_html(sprintf(
        /* translators: %s is a number of meta fields. */
        _n(
            '%s field looks like it holds files. Start a batch from it, or add one yourself.',
            '%s fields look like they hold files. Start a batch from one, or add one yourself.',
            count($scan['fields']),
            'wpbr-bulk-replace'
        ),
        number_format_i18n(count($scan['fields']))
    )) . "</p>";

    echo "<table class=\"widefat striped\" style=\"margin:10px 0 18px;\"><thead><tr>";
    echo "<th scope=\"col\">" . esc_html__('Content', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Field', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('Has a file', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\">" . esc_html__('For example', 'wpbr-bulk-replace') . "</th>";
    echo "<th scope=\"col\"><span class=\"screen-reader-text\">" . esc_html__('Start a batch', 'wpbr-bulk-replace') . "</span></th>";
    echo "</tr></thead><tbody>";

    foreach ($scan['fields'] as $field) {
        $start = add_query_arg(
            array(
                'page'           => 'wpbr-new-batch',
                'wpbr_post_type' => $field['post_type'],
                'wpbr_meta_key'  => $field['meta_key'],
            ),
            admin_url('admin.php')
        );

        echo "<tr>";
        echo "<td>" . esc_html(wpbr_post_type_label_title($field['post_type'])) . "</td>";
        echo "<td><code>" . esc_html($field['meta_key']) . "</code></td>";
        echo "<td>" . esc_html(sprintf(
            /* translators: %s is a number of posts. */
            _n('%s post', '%s posts', $field['posts'], 'wpbr-bulk-replace'),
            number_format_i18n($field['posts'])
        )) . "</td>";
        echo "<td>" . ($field['sample'] !== ''
            ? "<code style=\"font-size:11px;\">" . esc_html($field['sample']) . "</code>"
            : "<span class=\"description\">&mdash;</span>") . "</td>";
        echo "<td style=\"text-align:right;\"><a class=\"button\" href=\"".esc_url($start)."\">" . esc_html__('Start a batch', 'wpbr-bulk-replace') . "</a></td>";
        echo "</tr>";
    }
    echo "</tbody></table>";

    echo "<p class=\"description\" style=\"max-width:560px;\">" . esc_html__('This is a guess from what the values look like, not a promise. You can pick any field at the Match step, including one that is not listed here.', 'wpbr-bulk-replace') . "</p>";

    wpbr_render_first_run_sample_note($scan);
}

/**
 * Say so when the counts are a sample rather than a survey.
 *
 * On a large site the scan looks at the most recent posts rather than all of
 * them, because the alternative is a screen that does not open. A count that is
 * quietly of something narrower than the reader assumes is worse than no count,
 * so the narrowing is stated wherever the numbers are shown.
 */
function wpbr_render_first_run_sample_note($scan) {
    if (empty($scan['sampled'])) return;

    echo "<p class=\"description\" style=\"max-width:560px;\">" . esc_html(sprintf(
        /* translators: 1: a number of posts looked at, 2: the total number of published posts. */
        __('Counted across the %1$s most recently published posts, of %2$s on the site. Looking at all of them would mean reading every custom field on the site each time this screen opens.', 'wpbr-bulk-replace'),
        number_format_i18n($scan['limit']),
        number_format_i18n($scan['posts'])
    )) . "</p>";
}

/**
 * The site has content, and none of it has a file in a meta field.
 *
 * The most useful thing this screen can do is say so, because the alternative is
 * the reader finding out at the Match step after uploading their files.
 */
function wpbr_render_first_run_nothing_found($scan) {
    echo "<div class=\"notice notice-warning inline\" style=\"margin:20px 0;padding:12px 14px;max-width:640px;\">";
    echo "<p style=\"margin:0 0 8px;\"><strong>" . esc_html__('Nothing on this site looks like a file field yet.', 'wpbr-bulk-replace') . "</strong> ";
    $looked_at = empty($scan['sampled']) ? (int) $scan['posts'] : (int) $scan['limit'];
    echo esc_html(sprintf(
        /* translators: %s is a number of published posts. */
        _n(
            'That is after looking at %s published post.',
            'That is after looking at %s published posts.',
            $looked_at,
            'wpbr-bulk-replace'
        ),
        number_format_i18n($looked_at)
    )) . " ";
    echo esc_html(sprintf(
        /* translators: %s is a number of post types. */
        _n(
            'Your site has %s post type.',
            'Your site has %s post types.',
            $scan['types'],
            'wpbr-bulk-replace'
        ),
        number_format_i18n($scan['types'])
    )) . "</p>";
    echo "<p style=\"margin:0 0 8px;\">" . esc_html__('This plugin replaces files that your posts point at through a custom field holding a URL or a path. If your files are attached through the Media Library alone, or stored as an attachment ID rather than a URL, there is nothing here for it to match against.', 'wpbr-bulk-replace') . "</p>";
    echo "<p style=\"margin:0;\">" . esc_html__('You can still start a batch and choose any field by hand at the Match step — this is a guess, not a verdict.', 'wpbr-bulk-replace') . "</p>";
    wpbr_render_first_run_sample_note($scan);
    echo "</div>";
}

/** No published content at all, which is a different problem to describe. */
function wpbr_render_first_run_empty_site() {
    echo "<div class=\"notice notice-info inline\" style=\"margin:20px 0;padding:12px 14px;max-width:640px;\">";
    echo "<p style=\"margin:0;\">" . esc_html__('There is no published content to match files against yet. Publish the posts or pages the files belong to first, then come back — matching works by comparing filenames to the titles of published content.', 'wpbr-bulk-replace') . "</p>";
    echo "</div>";
}

function wpbr_handle_create_batch() {
    check_admin_referer('wpbr_create_batch');
    if (!current_user_can('manage_options')) wp_die(esc_html__('You are not allowed to do that.', 'wpbr-bulk-replace'), '', array('response' => 403));
    $label = isset($_POST['batch_label']) ? sanitize_text_field(wp_unslash($_POST['batch_label'])) : '';

    // A preset from the first-run screen, validated again here: the form is the
    // only thing that carried it, and a form field is the user's to edit.
    $preset_type = isset($_POST['preset_post_type']) ? sanitize_key(wp_unslash($_POST['preset_post_type'])) : '';
    $preset_key  = isset($_POST['preset_meta_key']) ? sanitize_text_field(wp_unslash($_POST['preset_meta_key'])) : '';

    return wpbr_create_batch($label, $preset_type, $preset_key, get_current_user_id());
}

function wpbr_handle_scan_folder($batch_id) {
    check_admin_referer('wpbr_scan_into_batch');
    if (!current_user_can('manage_options')) wp_die(esc_html__('You are not allowed to do that.', 'wpbr-bulk-replace'), '', array('response' => 403));
    global $wpdb;
    $items_table = wpbr_table_items();
    $staging_dir = wpbr_staging_dir();

    $files = array_merge(
        glob($staging_dir . '/*.pdf'),
        glob($staging_dir . '/*.doc'),
        glob($staging_dir . '/*.docx')
    );
    if (!$files) $files = array();

    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin-owned table with no WordPress API; this read decides what the next write does, so it is never cached (docs/PLUGIN-CHECK.md).
    $already_registered = $wpdb->get_col("SELECT staged_path FROM {$wpdb->prefix}wpbr_batch_items");
    $already_registered = array_flip($already_registered);

    $added = 0;
    foreach ($files as $filepath) {
        if (isset($already_registered[$filepath])) continue;
        $filename = basename($filepath);
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Plugin-owned table with no WordPress API; an insert, so there is no cached read to invalidate.
        $wpdb->insert($items_table, array(
            'batch_id' => $batch_id,
            'staged_filename' => $filename,
            'staged_path' => $filepath,
            'status' => 'staged',
        ));
        $added++;
    }

    echo "<div class=\"notice notice-success\"><p>" . esc_html(sprintf(
        /* translators: %s is a number of files. */
        _n('Picked up %s new file from the staging folder. Files already registered to a batch were skipped.',
           'Picked up %s new files from the staging folder. Files already registered to a batch were skipped.',
           $added, 'wpbr-bulk-replace'),
        number_format_i18n($added)
    )) . "</p></div>";
}

function wpbr_render_delete_batch_confirm($batch_id) {
    global $wpdb;
    $batch = wpbr_get_batch($batch_id);
    if (!$batch) {
        echo "<div class=\"wrap wpbr-admin\"><h1>" . esc_html__('Delete batch', 'wpbr-bulk-replace') . "</h1><p>"
            . esc_html__('That batch no longer exists.', 'wpbr-bulk-replace') . "</p></div>";
        return;
    }

    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin-owned table with no WordPress API; the screen shows live state, and a cached copy would lag the write the person just made.
    $counts = $wpdb->get_row($wpdb->prepare(
        "SELECT COUNT(*) AS total,
                SUM(CASE WHEN status IN ('replaced','verified','cleaned_up') THEN 1 ELSE 0 END) AS processed,
                SUM(CASE WHEN backup_path IS NOT NULL AND backup_path != '' THEN 1 ELSE 0 END) AS with_backup
         FROM {$wpdb->prefix}wpbr_batch_items WHERE batch_id = %d", $batch_id
    ));

    echo "<div class=\"wrap wpbr-admin\">";
    wpbr_admin_header_print(sprintf(
        /* translators: %s is a batch label. */
        __('Delete “%s”?', 'wpbr-bulk-replace'), $batch->label
    ));

    echo "<p>" . wp_kses_post(sprintf(
        /* translators: %s is a number of file records. */
        _n('This removes the batch and its %s file record from the tool. <strong>It does not undo anything already done to your site</strong> &mdash; replaced files stay replaced and created attachments stay in place.',
           'This removes the batch and its %s file records from the tool. <strong>It does not undo anything already done to your site</strong> &mdash; replaced files stay replaced and created attachments stay in place.',
           (int) $counts->total, 'wpbr-bulk-replace'),
        number_format_i18n($counts->total)
    )) . "</p>";

    if ((int) $counts->processed > 0) {
        echo "<div class=\"notice notice-warning\" style=\"padding:12px 16px;\">";
        echo "<p style=\"margin:0;\">" . wp_kses_post(sprintf(
            /* translators: %s is a number of files. */
            _n('<strong>%s file in this batch has already been processed.</strong> Once the batch is gone you lose the ability to roll it back from here, even if its backup remains on disk. If you might want to undo it, do that first.',
               '<strong>%s files in this batch have already been processed.</strong> Once the batch is gone you lose the ability to roll them back from here, even if their backups remain on disk. If you might want to undo any of them, do that first.',
               (int) $counts->processed, 'wpbr-bulk-replace'),
            number_format_i18n($counts->processed)
        )) . "</p>";
        echo "</div>";
    }

    echo "<form method=\"post\">";
    wp_nonce_field('wpbr_delete_batch_confirm');
    echo "<input type=\"hidden\" name=\"wpbr_action\" value=\"delete_batch\">";
    echo "<input type=\"hidden\" name=\"batch_id\" value=\"".esc_attr($batch_id)."\">";

    echo "<h2 style=\"font-size:14px;margin-bottom:6px;\">" . esc_html__('Also delete from the server?', 'wpbr-bulk-replace') . "</h2>";

    echo "<p><label><input type=\"checkbox\" name=\"drop_staged\" value=\"1\" checked> "
        . esc_html__('The staged copies of the uploaded files', 'wpbr-bulk-replace') . "</label><br>";
    echo "<span class=\"description\" style=\"margin-left:24px;\">" . esc_html__('These are the working copies in the staging folder. Safe to remove — anything already published to the site is a separate file.', 'wpbr-bulk-replace') . "</span></p>";

    echo "<p><label><input type=\"checkbox\" name=\"drop_backups\" value=\"1\"> " . esc_html(sprintf(
        /* translators: %s is a number of backup files. */
        _n('The %s backup file of the version this batch replaced',
           'The %s backup files of the versions this batch replaced',
           (int) $counts->with_backup, 'wpbr-bulk-replace'),
        number_format_i18n($counts->with_backup)
    )) . "</label><br>";
    echo "<span class=\"description\" style=\"margin-left:24px;\">" . esc_html__('Leave this unticked to keep the old versions on disk. They are the only copies of what was there before.', 'wpbr-bulk-replace') . "</span></p>";

    echo "<p><label><input type=\"checkbox\" name=\"drop_log\" value=\"1\"> "
        . esc_html__('Its entries in the Activity Log', 'wpbr-bulk-replace') . "</label><br>";
    echo "<span class=\"description\" style=\"margin-left:24px;\">" . esc_html__('Unticked keeps the record of what was done, which is usually worth having.', 'wpbr-bulk-replace') . "</span></p>";

    echo "<p style=\"margin-top:20px;\">";
    // No confirm() here: this screen is the confirmation. A second dialog asking
    // the same question in English only was noise on top of an untranslatable
    // string.
    echo "<button type=\"submit\" class=\"button button-primary\">" . esc_html__('Delete batch', 'wpbr-bulk-replace') . "</button> ";
    echo "<a href=\"".esc_url(admin_url('admin.php?page=wpbr-batches'))."\" class=\"button\">" . esc_html__('Cancel', 'wpbr-bulk-replace') . "</a>";
    echo "</p>";
    echo "</form></div>";
}

function wpbr_handle_delete_batch() {
    check_admin_referer('wpbr_delete_batch_confirm');
    if (!current_user_can('manage_options')) wp_die(esc_html__('You are not allowed to do that.', 'wpbr-bulk-replace'), '', array('response' => 403));
    global $wpdb;
    $batch_id = isset($_POST['batch_id']) ? intval($_POST['batch_id']) : 0;
    if (!$batch_id) return;

    $items_table = wpbr_table_items();
    $items = wpbr_get_batch_items($batch_id);

    $staged_removed = 0; $backups_removed = 0; $backups_kept = 0;
    foreach ($items as $item) {
        if (!empty($_POST['drop_staged']) && $item->staged_path && file_exists($item->staged_path)
            && wpbr_path_is_within(wpbr_staging_dir(), $item->staged_path)) {
            wp_delete_file(realpath($item->staged_path));
            $staged_removed++;
        }
        if (!empty($_POST['drop_backups']) && $item->backup_path && file_exists($item->backup_path)) {
            $removed = wpbr_delete_backup($item->backup_path);
            if ($removed['deleted']) {
                $backups_removed++;
            } elseif ($removed['reason'] === 'protected') {
                $backups_kept++;
            }
        }
    }

    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin-owned table with no WordPress API; a write, and nothing here is cached, so there is nothing to invalidate.
    $wpdb->delete($items_table, array('batch_id' => $batch_id));
    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin-owned table with no WordPress API; a write, and nothing here is cached, so there is nothing to invalidate.
    $wpdb->delete(wpbr_table_import_log(), array('batch_id' => $batch_id));
    if (!empty($_POST['drop_log'])) {
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin-owned table with no WordPress API; a write, and nothing here is cached, so there is nothing to invalidate.
        $wpdb->delete(wpbr_table_log(), array('batch_id' => $batch_id));
    }
    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Plugin-owned table with no WordPress API; a write, and nothing here is cached, so there is nothing to invalidate.
    $wpdb->delete(wpbr_table_batches(), array('id' => $batch_id));

    // Assembled from whole sentences rather than sentence fragments, so each
    // one can be translated as a sentence.
    $parts = array(__('Batch deleted.', 'wpbr-bulk-replace'));
    if ($staged_removed) {
        /* translators: %s is a number of files. */
        $parts[] = sprintf(_n('%s staged file removed.', '%s staged files removed.', $staged_removed, 'wpbr-bulk-replace'), number_format_i18n($staged_removed));
    }
    if ($backups_removed) {
        /* translators: %s is a number of files. */
        $parts[] = sprintf(_n('%s backup file removed.', '%s backup files removed.', $backups_removed, 'wpbr-bulk-replace'), number_format_i18n($backups_removed));
    }
    if ($backups_kept) {
        /* translators: %s is a number of files. */
        $parts[] = sprintf(_n('%s backup was kept: it is the only verified copy of a file that could not be put back.', '%s backups were kept: each is the only verified copy of a file that could not be put back.', $backups_kept, 'wpbr-bulk-replace'), number_format_i18n($backups_kept));
    }
    if (!empty($_POST['drop_backups']) && !$backups_removed && !$backups_kept) {
        $parts[] = __('No backup files were found to remove.', 'wpbr-bulk-replace');
    }
    echo "<div class=\"notice notice-success\"><p>".esc_html(implode(' ', $parts))."</p></div>";
}