<?php
/**
 * Setup wizard.
 *
 * 5 lightweight steps. Auto-runs once on fresh activation; upgraders skip
 * it because their existing settings are preserved. Re-runnable from the
 * settings page ("Reconfigure with setup wizard"): every field then starts at
 * the stored value, the card matching the stored restrictions is marked
 * "Current", and the email subject, body and sender are never reset.
 *
 * @package WPCoreToolsEmailVerify
 */

defined( 'ABSPATH' ) || exit;

class WPCEV_Wizard {

	const PAGE_SLUG = 'wpcev-wizard';
	// Screen ID of the hidden page (see register_page()).
	const SCREEN_ID         = 'admin_page_wpcev-wizard';
	const COMPLETED_OPTION  = 'wpcev_wizard_completed';
	const RUN_TRANSIENT_KEY = 'wpcev_run_wizard';

	const STEP_WELCOME   = 1;
	const STEP_GATES     = 2;
	const STEP_ROLES     = 3;
	const STEP_EMAIL     = 4;
	const STEP_CONFLICTS = 5;
	const STEP_COUNT     = 5;

	/** @var WPCEV_Settings */
	private $settings;

	/** @var WPCEV_Mailer */
	private $mailer;

	/** @var WPCEV_Conflicts */
	private $conflicts;

	public function __construct( WPCEV_Settings $settings, WPCEV_Mailer $mailer, WPCEV_Conflicts $conflicts ) {
		$this->settings  = $settings;
		$this->mailer    = $mailer;
		$this->conflicts = $conflicts;

		add_action( 'admin_menu', array( $this, 'register_page' ) );
		add_action( 'admin_init', array( $this, 'maybe_redirect_after_activate' ) );
		add_action( 'admin_post_wpcev_wizard_step', array( $this, 'handle_step_submit' ) );
		add_action( 'admin_post_wpcev_wizard_skip', array( $this, 'handle_skip' ) );
	}

	/**
	 * Register the wizard as a page with no menu entry (empty parent slug), so
	 * it is only reachable by its URL or the buttons that link to it.
	 *
	 * It used to be registered under Dashboard and then removed from the menu
	 * with remove_submenu_page(). WordPress decides whether a user may open an
	 * admin page by looking the page up in the menu, so a page removed from it
	 * answers "Sorry, you are not allowed to access this page" and the wizard
	 * could not be opened at all, neither on activation nor from the settings
	 * page. A page registered without a parent is allowed and stays hidden.
	 */
	public function register_page() {
		$hook = add_submenu_page(
			'',
			__( 'Email Verify Setup', 'wpcoretools-email-verify' ),
			__( 'Email Verify Setup', 'wpcoretools-email-verify' ),
			'manage_options',
			self::PAGE_SLUG,
			array( $this, 'render' )
		);
		if ( $hook ) {
			add_action( 'load-' . $hook, array( $this, 'set_page_title' ) );
		}
	}

	/**
	 * Give the page its title. WordPress looks a page's title up in the menu
	 * and only finds it for a page that has a parent; for this one the global
	 * stays null, which makes admin-header.php call strip_tags( null ) (a PHP 8.1+
	 * deprecation on every load) and leaves the browser tab without a title.
	 */
	public function set_page_title() {
		global $title;
		// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- the page title, set before admin-header.php reads it.
		$title = __( 'Email Verify Setup', 'wpcoretools-email-verify' );
	}

	public function maybe_redirect_after_activate() {
		if ( ! get_transient( self::RUN_TRANSIENT_KEY ) ) {
			return;
		}
		if ( get_option( self::COMPLETED_OPTION ) ) {
			delete_transient( self::RUN_TRANSIENT_KEY );
			return;
		}

		/*
		 * Every bail-out below is "not now", not "never": an AJAX call, a cron
		 * tick, or a request from a user without manage_options can all happen
		 * before the admin's own first pageload. Consuming the transient there
		 * would swallow the redirect and the wizard would never appear. It is
		 * only deleted once it has actually been acted on, or once the wizard
		 * is known to be complete. The 5-minute TTL cleans up on its own.
		 */
		if ( wp_doing_ajax() || ( defined( 'DOING_CRON' ) && DOING_CRON ) || wp_doing_cron() ) {
			return;
		}
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		// Skip when bulk-activating (multiple plugins activated together) —
		// redirecting would strand the other activations.
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( isset( $_GET['activate-multi'] ) ) {
			delete_transient( self::RUN_TRANSIENT_KEY );
			return;
		}

		delete_transient( self::RUN_TRANSIENT_KEY );
		wp_safe_redirect( $this->base_url() );
		exit;
	}

	/**
	 * Canonical wizard URL — uses `menu_page_url()` so it stays correct
	 * regardless of which admin parent we registered under.
	 */
	private function base_url() {
		$url = function_exists( 'menu_page_url' ) ? menu_page_url( self::PAGE_SLUG, false ) : '';
		if ( ! $url ) {
			$url = admin_url( 'admin.php?page=' . self::PAGE_SLUG );
		}
		return $url;
	}

	/* ─── Render ─────────────────────────────────────────────────────────── */

	public function render() {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only step indicator.
		$step = isset( $_GET['step'] ) ? max( 1, min( self::STEP_COUNT, (int) $_GET['step'] ) ) : self::STEP_WELCOME;

		?>
		<div class="wrap wpcev-wizard">
			<header class="wpcev-wizard__header">
				<h1><?php esc_html_e( 'WPCoreTools Email Verify — Setup', 'wpcoretools-email-verify' ); ?></h1>
				<?php $this->render_progress( $step ); ?>
			</header>

			<?php $this->render_step_post_notices(); ?>

			<div class="wpcev-wizard__body">
				<?php
				switch ( $step ) {
					case self::STEP_GATES:
						$this->step_gates();
						break;
					case self::STEP_ROLES:
						$this->step_roles();
						break;
					case self::STEP_EMAIL:
						$this->step_email();
						break;
					case self::STEP_CONFLICTS:
						$this->step_conflicts();
						break;
					case self::STEP_WELCOME:
					default:
						$this->step_welcome();
				}
				?>
			</div>
		</div>
		<?php
	}

	private function render_progress( $step ) {
		$labels = array(
			self::STEP_WELCOME   => __( 'Welcome', 'wpcoretools-email-verify' ),
			self::STEP_GATES     => __( 'Restrictions', 'wpcoretools-email-verify' ),
			self::STEP_ROLES     => __( 'Exempt roles', 'wpcoretools-email-verify' ),
			self::STEP_EMAIL     => __( 'Email', 'wpcoretools-email-verify' ),
			self::STEP_CONFLICTS => __( 'Safety check', 'wpcoretools-email-verify' ),
		);
		echo '<ol class="wpcev-wizard__steps">';
		foreach ( $labels as $i => $label ) {
			$state = $i < $step ? 'done' : ( $i === $step ? 'active' : 'pending' );
			echo '<li class="wpcev-wizard__step wpcev-wizard__step--' . esc_attr( $state ) . '">';
			echo '<span class="wpcev-wizard__step-num">' . (int) $i . '</span>';
			echo '<span class="wpcev-wizard__step-label">' . esc_html( $label ) . '</span>';
			echo '</li>';
		}
		echo '</ol>';
	}

	private function render_step_post_notices() {
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- read-only flag.
		if ( ! empty( $_GET['wpcev_test'] ) ) {
			$res = sanitize_key( wp_unslash( $_GET['wpcev_test'] ) );
			if ( 'sent' === $res ) {
				echo '<div class="notice notice-success is-dismissible"><p>' . esc_html__( 'Test email sent — check your inbox.', 'wpcoretools-email-verify' ) . '</p></div>';
			} else {
				echo '<div class="notice notice-error is-dismissible"><p>' . esc_html__( 'Test email failed to send. Check your wp_mail / SMTP setup.', 'wpcoretools-email-verify' ) . '</p></div>';
			}
		}
		if ( ! empty( $_GET['wpcev_preset'] ) ) {
			$slug  = sanitize_key( wp_unslash( $_GET['wpcev_preset'] ) );
			$cards = WPCEV_Presets::cards( class_exists( 'WooCommerce' ) );
			if ( isset( $cards[ $slug ] ) && null !== $cards[ $slug ]['values'] ) {
				echo '<div class="notice notice-success is-dismissible"><p>' . esc_html(
					sprintf(
						/* translators: %s: preset name, for example Shop */
						__( '%s applied. The switches below show what it set; change any of them if you like, then continue.', 'wpcoretools-email-verify' ),
						$cards[ $slug ]['title']
					)
				) . '</p></div>';
			}
		}
		if ( ! empty( $_GET['wpcev_scanned'] ) ) {
			echo '<div class="notice notice-success is-dismissible"><p>' . esc_html__( 'Code scan finished. The results are in the list below.', 'wpcoretools-email-verify' ) . '</p></div>';
		}
		// phpcs:enable WordPress.Security.NonceVerification.Recommended
	}

	/* ─── Step 1: Welcome ────────────────────────────────────────────────── */

	private function step_welcome() {
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="wpcev_wizard_step" />
			<input type="hidden" name="step" value="<?php echo (int) self::STEP_WELCOME; ?>" />
			<?php wp_nonce_field( 'wpcev_wizard' ); ?>

			<h2><?php esc_html_e( 'Welcome', 'wpcoretools-email-verify' ); ?></h2>
			<?php if ( get_option( self::COMPLETED_OPTION ) ) : ?>
				<p><?php esc_html_e( 'You are reconfiguring email verification. Every field starts at what is set now, and the email subject, text and sender are left exactly as they are unless you change them.', 'wpcoretools-email-verify' ); ?></p>
			<?php else : ?>
				<p><?php esc_html_e( 'This 2-minute wizard will configure email verification for your site. After it runs, every new registration will be asked to click a link in their email, and what they cannot do until they have is up to you.', 'wpcoretools-email-verify' ); ?></p>
			<?php endif; ?>

			<div class="wpcev-callout">
				<strong><?php esc_html_e( 'Existing users are safe.', 'wpcoretools-email-verify' ); ?></strong>
				<?php esc_html_e( 'Anyone who registered before you activated this plugin is automatically grandfathered — they can log in normally without verification. Only new sign-ups are required to confirm their email.', 'wpcoretools-email-verify' ); ?>
			</div>

			<p><?php esc_html_e( 'You can skip this wizard and use safe defaults, or re-run it later from Settings → Email Verify.', 'wpcoretools-email-verify' ); ?></p>

			<?php $this->render_nav( self::STEP_WELCOME, false, true ); ?>
		</form>
		<?php
	}

	/* ─── Step 2: Restrictions ───────────────────────────────────────────── */

	private function step_gates() {
		$s           = $this->settings->all();
		$wc          = class_exists( 'WooCommerce' );
		$cards       = WPCEV_Presets::cards( $wc );
		$current     = WPCEV_Presets::match( $s );
		$recommended = WPCEV_Presets::recommended( $wc );
		$descriptors = WPCEV_Presets::descriptors( $wc );
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="wpcev_wizard_step" />
			<input type="hidden" name="step" value="<?php echo (int) self::STEP_GATES; ?>" />
			<?php wp_nonce_field( 'wpcev_wizard' ); ?>
			<?php /* Enter must save and continue, not press the first card's button. */ ?>
			<button type="submit" name="wpcev_next" value="save" class="screen-reader-text" tabindex="-1" aria-hidden="true"><?php esc_html_e( 'Save & continue', 'wpcoretools-email-verify' ); ?></button>
			<input type="hidden" name="wpcev[__present][]" value="block_login" />
			<input type="hidden" name="wpcev[__present][]" value="block_comments" />
			<input type="hidden" name="wpcev[__present][]" value="block_admin_area" />
			<input type="hidden" name="wpcev[__present][]" value="block_profile_email_change" />
			<input type="hidden" name="wpcev[__present][]" value="restrict_capabilities" />
			<input type="hidden" name="wpcev[__present][]" value="allow_logged_out_resend" />
			<?php if ( $wc ) : ?>
				<input type="hidden" name="wpcev[__present][]" value="block_checkout" />
				<input type="hidden" name="wpcev[__present][]" value="block_registration_at_checkout" />
			<?php endif; ?>

			<h2><?php esc_html_e( 'What should happen until a customer confirms their email?', 'wpcoretools-email-verify' ); ?></h2>
			<p class="description"><?php esc_html_e( 'Pick the closest description. It sets the switches below, which you can still change one by one.', 'wpcoretools-email-verify' ); ?></p>

			<div class="wpcev-cards">
				<?php foreach ( $cards as $slug => $card ) : ?>
					<?php
					$is_current = ( $slug === $current );
					$classes    = 'wpcev-card' . ( $is_current ? ' wpcev-card--current' : '' ) . ( $slug === $recommended ? ' wpcev-card--recommended' : '' );
					?>
					<div class="<?php echo esc_attr( $classes ); ?>">
						<h3 class="wpcev-card__title">
							<?php echo esc_html( $card['title'] ); ?>
							<?php if ( $slug === $recommended ) : ?>
								<span class="wpcev-card__recommended"><?php esc_html_e( '(recommended)', 'wpcoretools-email-verify' ); ?></span>
							<?php endif; ?>
							<?php if ( $is_current ) : ?>
								<span class="wpcev-card__badge"><?php esc_html_e( 'Current', 'wpcoretools-email-verify' ); ?></span>
							<?php endif; ?>
						</h3>
						<p class="wpcev-card__tagline"><?php echo esc_html( $card['tagline'] ); ?></p>
						<?php if ( ! empty( $card['bullets'] ) ) : ?>
							<ul class="wpcev-card__bullets">
								<?php foreach ( $card['bullets'] as $bullet ) : ?>
									<li><?php echo esc_html( $bullet ); ?></li>
								<?php endforeach; ?>
							</ul>
						<?php endif; ?>
						<?php if ( null !== $card['values'] ) : ?>
							<button type="submit" class="button<?php echo $is_current ? '' : ' button-primary'; ?>" name="wpcev[preset]" value="<?php echo esc_attr( $slug ); ?>" formnovalidate>
								<?php
								echo esc_html(
									sprintf(
										/* translators: %s: preset name, for example Shop */
										__( 'Use %s', 'wpcoretools-email-verify' ),
										$card['title']
									)
								);
								?>
							</button>
						<?php endif; ?>
					</div>
				<?php endforeach; ?>
			</div>

			<h3 style="margin-top:24px;"><?php esc_html_e( 'The switches', 'wpcoretools-email-verify' ); ?></h3>
			<p class="description">
				<?php
				echo esc_html(
					( WPCEV_Presets::CUSTOM === $current )
						? __( 'These are not exactly one of the cards above, so the current setup counts as Custom.', 'wpcoretools-email-verify' )
						: __( 'Changing any switch afterwards makes the setup Custom.', 'wpcoretools-email-verify' )
				);
				?>
			</p>
			<table class="form-table" role="presentation">
				<?php foreach ( $descriptors as $key => $descriptor ) : ?>
					<?php
					if ( $descriptor['wc_only'] && ! $wc ) {
						continue;
					}
					?>
					<tr>
						<th scope="row"><?php echo esc_html( $descriptor['label'] ); ?></th>
						<td>
							<label>
								<input type="checkbox" name="wpcev[<?php echo esc_attr( $key ); ?>]" value="1" <?php checked( ! empty( $s[ $key ] ) ); ?> />
								<?php echo esc_html( $descriptor['explain'] ); ?>
							</label>
						</td>
					</tr>
				<?php endforeach; ?>
			</table>

			<h3 style="margin-top:24px;"><?php esc_html_e( 'Recovery flow', 'wpcoretools-email-verify' ); ?></h3>
			<table class="form-table" role="presentation">
				<tr>
					<th scope="row"><?php esc_html_e( 'Allow logged-out resend', 'wpcoretools-email-verify' ); ?></th>
					<td>
						<label>
							<input type="checkbox" name="wpcev[allow_logged_out_resend]" value="1" <?php checked( $s['allow_logged_out_resend'] ); ?> />
							<?php esc_html_e( 'Show a "Resend verification email" form on the login page so locked-out users can recover without admin help.', 'wpcoretools-email-verify' ); ?>
						</label>
						<p class="description"><?php esc_html_e( 'Rate-limited per IP to prevent abuse. The response is identical whether the email matches a real account or not, so it cannot be used to enumerate users.', 'wpcoretools-email-verify' ); ?></p>
					</td>
				</tr>
			</table>

			<?php $this->render_nav( self::STEP_GATES ); ?>
		</form>
		<?php
	}

	/* ─── Step 3: Roles + expiry ─────────────────────────────────────────── */

	private function step_roles() {
		$s     = $this->settings->all();
		$roles = wp_roles()->roles;
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="wpcev_wizard_step" />
			<input type="hidden" name="step" value="<?php echo (int) self::STEP_ROLES; ?>" />
			<?php wp_nonce_field( 'wpcev_wizard' ); ?>
			<input type="hidden" name="wpcev[__present][]" value="exempt_roles" />

			<h2><?php esc_html_e( 'Who is exempt?', 'wpcoretools-email-verify' ); ?></h2>

			<table class="form-table" role="presentation">
				<tr>
					<th scope="row"><?php esc_html_e( 'Exempt roles', 'wpcoretools-email-verify' ); ?></th>
					<td>
						<?php foreach ( $roles as $role_key => $role ) : ?>
							<label style="display:block;margin-bottom:4px;">
								<input type="checkbox" name="wpcev[exempt_roles][]" value="<?php echo esc_attr( $role_key ); ?>" <?php checked( in_array( $role_key, (array) $s['exempt_roles'], true ) ); ?> />
								<?php echo esc_html( translate_user_role( $role['name'] ) ); ?>
							</label>
						<?php endforeach; ?>
						<p class="description"><?php esc_html_e( 'Users with these roles are auto-marked verified at registration and keep that status across email changes. Defaults are typically what you want — staff bypasses verification, customers do not.', 'wpcoretools-email-verify' ); ?></p>
					</td>
				</tr>
			</table>

			<?php $this->render_nav( self::STEP_ROLES ); ?>
		</form>
		<?php
	}

	/* ─── Step 4: Email ──────────────────────────────────────────────────── */

	private function step_email() {
		$s = $this->settings->all();
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="wpcev_wizard_step" />
			<input type="hidden" name="step" value="<?php echo (int) self::STEP_EMAIL; ?>" />
			<?php wp_nonce_field( 'wpcev_wizard' ); ?>

			<h2><?php esc_html_e( 'How does the verification email look, and how often can it be sent?', 'wpcoretools-email-verify' ); ?></h2>

			<table class="form-table" role="presentation">
				<tr>
					<th scope="row"><label for="wpcev-expiry-days"><?php esc_html_e( 'Link valid for', 'wpcoretools-email-verify' ); ?></label></th>
					<td>
						<input type="number" id="wpcev-expiry-days" name="wpcev[expiry_days]" value="<?php echo esc_attr( $s['expiry_days'] ); ?>" min="1" max="90" />
						<?php esc_html_e( 'days', 'wpcoretools-email-verify' ); ?>
						<p class="description"><?php esc_html_e( 'After this, the link stops working. Customers can ask for a fresh one from the notice on My Account or from the login page.', 'wpcoretools-email-verify' ); ?></p>
					</td>
				</tr>
				<tr>
					<th scope="row"><label for="wpcev-resend-wait"><?php esc_html_e( 'Resend wait', 'wpcoretools-email-verify' ); ?></label></th>
					<td>
						<input type="number" id="wpcev-resend-wait" name="wpcev[resend_cooldown_seconds]" value="<?php echo esc_attr( $s['resend_cooldown_seconds'] ); ?>" min="<?php echo (int) WPCEV_Settings::RESEND_WAIT_MIN; ?>" max="<?php echo (int) WPCEV_Settings::RESEND_WAIT_MAX; ?>" />
						<?php esc_html_e( 'seconds', 'wpcoretools-email-verify' ); ?>
						<p class="description"><?php esc_html_e( 'How long a customer must wait between two verification emails. Resend links count down ("Resend available in 0:42") and unlock when the time is up; the server enforces the wait either way. 30 to 3600 seconds.', 'wpcoretools-email-verify' ); ?></p>
					</td>
				</tr>
				<tr>
					<th scope="row"><label for="wpcev-from-name"><?php esc_html_e( 'From name', 'wpcoretools-email-verify' ); ?></label></th>
					<td>
						<input type="text" id="wpcev-from-name" name="wpcev[from_name]" value="<?php echo esc_attr( $s['from_name'] ); ?>" class="regular-text" placeholder="<?php echo esc_attr( wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ) ); ?>" />
					</td>
				</tr>
				<tr>
					<th scope="row"><label for="wpcev-from-email"><?php esc_html_e( 'From address', 'wpcoretools-email-verify' ); ?></label></th>
					<td>
						<input type="email" id="wpcev-from-email" name="wpcev[from_email]" value="<?php echo esc_attr( $s['from_email'] ); ?>" class="regular-text" placeholder="<?php echo esc_attr( get_option( 'admin_email' ) ); ?>" />
					</td>
				</tr>
				<tr>
					<th scope="row"><label for="wpcev-email-subject"><?php esc_html_e( 'Subject', 'wpcoretools-email-verify' ); ?></label></th>
					<td>
						<input type="text" id="wpcev-email-subject" name="wpcev[email_subject]" value="<?php echo esc_attr( $s['email_subject'] ); ?>" class="large-text" />
					</td>
				</tr>
				<tr>
					<th scope="row"><label for="wpcev-email-body"><?php esc_html_e( 'Body', 'wpcoretools-email-verify' ); ?></label></th>
					<td>
						<textarea id="wpcev-email-body" name="wpcev[email_body]" rows="10" class="large-text code"><?php echo esc_textarea( $s['email_body'] ); ?></textarea>
						<p class="description">
							<?php esc_html_e( 'Available placeholders:', 'wpcoretools-email-verify' ); ?>
							<code>%name%</code> <code>%url%</code> <code>%site%</code>
							<code>%expiry%</code> <code>%expiry_date%</code> <code>%email%</code>
							<code>%username%</code> <code>%first_name%</code> <code>%last_name%</code>
						</p>
					</td>
				</tr>
			</table>

			<?php $this->render_nav( self::STEP_EMAIL, true, false, true ); ?>
		</form>
		<?php
	}

	/* ─── Step 5: Conflicts + finish ─────────────────────────────────────── */

	private function step_conflicts() {
		$issues       = $this->conflicts->detect( true );
		$guard_active = defined( 'WPCDEG_VERSION' );
		?>
		<h2><?php esc_html_e( 'Safety check', 'wpcoretools-email-verify' ); ?></h2>

		<?php if ( empty( $issues ) ) : ?>
			<div class="wpcev-callout wpcev-callout--ok">
				<strong><?php esc_html_e( 'All clear.', 'wpcoretools-email-verify' ); ?></strong>
				<?php esc_html_e( 'No conflicts detected — no other email-verification plugins or code, no risky WooCommerce settings, and a mail layer is in place.', 'wpcoretools-email-verify' ); ?>
			</div>
		<?php else : ?>
			<p><?php esc_html_e( 'We found some things you should know about. Each is safe to dismiss; none of them block the wizard from finishing.', 'wpcoretools-email-verify' ); ?></p>
			<ul class="wpcev-conflict-list">
				<?php foreach ( $issues as $issue ) : ?>
					<li class="wpcev-conflict wpcev-conflict--<?php echo esc_attr( $issue['severity'] ); ?>">
						<strong><?php echo esc_html( $issue['title'] ); ?></strong>
						<p><?php echo wp_kses( WPCEV_Conflicts::format_detail( $issue['detail'] ), array( 'br' => array() ) ); ?></p>
						<?php if ( ! empty( $issue['fix_url'] ) ) : ?>
							<p><a href="<?php echo esc_url( $issue['fix_url'] ); ?>" class="button" target="_blank" rel="noopener"><?php echo esc_html( $issue['fix_label'] ); ?></a></p>
						<?php endif; ?>
					</li>
				<?php endforeach; ?>
			</ul>
		<?php endif; ?>

		<?php $this->conflicts->render_scan_panel( 'wizard' ); ?>

		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="wpcev_wizard_step" />
			<input type="hidden" name="step" value="<?php echo (int) self::STEP_CONFLICTS; ?>" />
			<input type="hidden" name="finish" value="1" />
			<?php wp_nonce_field( 'wpcev_wizard' ); ?>

			<?php if ( $guard_active ) : ?>
				<div class="wpcev-callout wpcev-callout--ok">
					<strong><?php esc_html_e( 'Layered protection active.', 'wpcoretools-email-verify' ); ?></strong>
					<?php esc_html_e( 'Disposable Email Guard is active: disposable and burner addresses are rejected before the verification email is even sent.', 'wpcoretools-email-verify' ); ?>
				</div>
			<?php endif; ?>

			<p style="margin-top:24px;"><?php esc_html_e( 'You can re-run this wizard or change any setting later from Settings → Email Verify.', 'wpcoretools-email-verify' ); ?></p>

			<?php $this->render_nav( self::STEP_CONFLICTS, true, false, false, true ); ?>
		</form>
		<?php
	}

	/* ─── Nav buttons ────────────────────────────────────────────────────── */

	private function render_nav( $current_step, $show_back = true, $is_first = false, $show_test_email = false, $is_last = false ) {
		?>
		<p class="submit wpcev-wizard__nav">
			<?php if ( $show_back && ! $is_first ) : ?>
				<a href="<?php echo esc_url( $this->step_url( max( 1, $current_step - 1 ) ) ); ?>" class="button">
					<?php esc_html_e( '← Back', 'wpcoretools-email-verify' ); ?>
				</a>
			<?php endif; ?>

			<?php if ( $show_test_email ) : ?>
				<button type="submit" class="button" name="wpcev_next" value="test">
					<?php esc_html_e( 'Save &amp; send test email to me', 'wpcoretools-email-verify' ); ?>
				</button>
			<?php endif; ?>

			<button type="submit" class="button button-primary" name="wpcev_next" value="save">
				<?php
				if ( $is_last ) {
					esc_html_e( 'Finish setup', 'wpcoretools-email-verify' );
				} elseif ( $is_first ) {
					esc_html_e( 'Get started →', 'wpcoretools-email-verify' );
				} else {
					esc_html_e( 'Save &amp; continue →', 'wpcoretools-email-verify' );
				}
				?>
			</button>

			<?php if ( ! $is_last ) : ?>
				<a href="<?php echo esc_url( $this->skip_url() ); ?>" class="button-link" style="margin-left:12px;">
					<?php esc_html_e( 'Skip wizard', 'wpcoretools-email-verify' ); ?>
				</a>
			<?php endif; ?>
		</p>
		<?php
	}

	private function step_url( $step ) {
		return add_query_arg( 'step', (int) $step, $this->base_url() );
	}

	private function skip_url() {
		return wp_nonce_url(
			add_query_arg( 'action', 'wpcev_wizard_skip', admin_url( 'admin-post.php' ) ),
			'wpcev_wizard'
		);
	}

	/* ─── Submit handlers ────────────────────────────────────────────────── */

	public function handle_step_submit() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'wpcoretools-email-verify' ) );
		}
		check_admin_referer( 'wpcev_wizard' );

		$step = isset( $_POST['step'] ) ? max( 1, min( self::STEP_COUNT, (int) $_POST['step'] ) ) : self::STEP_WELCOME;
		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- per-key sanitization in Settings::sanitize().
		$raw  = isset( $_POST['wpcev'] ) && is_array( $_POST['wpcev'] ) ? wp_unslash( $_POST['wpcev'] ) : array();
		$next = isset( $_POST['wpcev_next'] ) ? sanitize_key( wp_unslash( $_POST['wpcev_next'] ) ) : 'save';

		// A preset card was pressed: apply that card on its own and stay on the
		// step so the switches below show what it set. The posted switches are
		// ignored on purpose: picking a card replaces what was ticked by hand.
		if ( self::STEP_GATES === $step && ! empty( $raw['preset'] ) ) {
			$slug = sanitize_key( $raw['preset'] );
			$this->settings->save( array( 'preset' => $slug ), true );
			wp_safe_redirect(
				add_query_arg(
					array(
						'step'         => self::STEP_GATES,
						'wpcev_preset' => $slug,
					),
					$this->base_url()
				)
			);
			exit;
		}

		// Welcome step has no settings to save; just advance.
		if ( self::STEP_WELCOME !== $step && $raw ) {
			$this->settings->save( $raw, true );
		}

		// "Send test email" button — save current values, send to admin email,
		// stay on this step so the admin sees the result inline.
		if ( 'test' === $next ) {
			$user = wp_get_current_user();
			$res  = $this->mailer->send_test( $user->ID, $user->user_email );
			wp_safe_redirect(
				add_query_arg(
					array(
						'step'       => $step,
						'wpcev_test' => $res,
					),
					$this->base_url()
				)
			);
			exit;
		}

		$finish = ! empty( $_POST['finish'] );
		if ( $finish || self::STEP_CONFLICTS === $step ) {
			update_option( self::COMPLETED_OPTION, time(), false );
			wp_safe_redirect(
				add_query_arg(
					array(
						'page'       => WPCEV_Admin::PAGE_SLUG,
						'wpcev_done' => 1,
					),
					admin_url( 'options-general.php' )
				)
			);
			exit;
		}

		$next_step = min( self::STEP_COUNT, $step + 1 );
		wp_safe_redirect( $this->step_url( $next_step ) );
		exit;
	}

	public function handle_skip() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'wpcoretools-email-verify' ) );
		}
		check_admin_referer( 'wpcev_wizard' );
		update_option( self::COMPLETED_OPTION, time(), false );
		wp_safe_redirect( admin_url( 'options-general.php?page=' . WPCEV_Admin::PAGE_SLUG ) );
		exit;
	}
}