<?php
/**
 * Debug Mode check.
 *
 * @package advanced-analytics
 *
 * @since 4.9.0
 */

declare(strict_types=1);

namespace ADVAN\Checks\Security;

use ADVAN\Checks\Abstract_Check;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( 'ADVAN\Checks\Security\Debug_Mode_Check' ) ) {

	/**
	 * Debug Mode check class.
	 *
	 * @since 4.9.0
	 */
	class Debug_Mode_Check extends Abstract_Check {

		/**
		 * Check identifier (slug).
		 *
		 * @var string Check identifier (slug).
		 *
		 * @since 4.9.0
		 */
		protected static string $id = 'debug-mode';

		/**
		 * Check category.
		 *
		 * @var string Check category.
		 *
		 * @since 4.9.0
		 */
		protected static string $category = 'security';

		/**
		 * Check weight (1-10).
		 *
		 * @var int Check weight (1-10).
		 *
		 * @since 4.9.0
		 */
		protected static int $weight = 8;

		/**
		 * Check title (translatable).
		 *
		 * @return string Check title.
		 *
		 * @since 4.9.0
		 */
		public static function get_title(): string {
			return __( 'Debug Mode', '0-day-analytics' );
		}

		/**
		 * Check description (translatable).
		 *
		 * @return string Check description.
		 *
		 * @since 4.9.0
		 */
		public static function get_description(): string {
			return __( 'Checks if WordPress debug mode is properly configured.', '0-day-analytics' );
		}

		/**
		 * Run the check.
		 *
		 * @return array Check result.
		 *
		 * Checks debug configuration for security issues:
		 * 1. WP_DEBUG + WP_DEBUG_DISPLAY = critical (errors visible to visitors)
		 * 2. WP_DEBUG + WP_DEBUG_LOG with default log path = fail (publicly accessible debug log)
		 * 3. SCRIPT_DEBUG = warning (unminified assets in production)
		 * 4. Otherwise = pass
		 *
		 * @since 4.9.0
		 */
		public static function run(): array {
			$wp_debug         = defined( 'WP_DEBUG' ) && WP_DEBUG;
			$wp_debug_display = defined( 'WP_DEBUG_DISPLAY' ) ? WP_DEBUG_DISPLAY : true;
			$wp_debug_log     = defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG;
			$script_debug     = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG;

			// Determine the actual log path.
			// WP_DEBUG_LOG can be true (uses default path) or a string (custom path).
			$uses_default_log_path = false;
			if ( $wp_debug_log ) {
				if ( true === WP_DEBUG_LOG ) {
					// Default path: wp-content/debug.log.
					$uses_default_log_path = true;
				} else {
					// Custom string path – check if it still points to a web-accessible default location.
					$log_path    = \wp_normalize_path( WP_DEBUG_LOG );
					$default     = \wp_normalize_path( WP_CONTENT_DIR . '/debug.log' );
					$alt_default = \wp_normalize_path( ABSPATH . 'wp-content/debug.log' );

					if ( $log_path === $default || $log_path === $alt_default ) {
						$uses_default_log_path = true;
					}
				}
			}

			$details = array(
				'WP_DEBUG'              => $wp_debug ? 'true' : 'false',
				'WP_DEBUG_DISPLAY'      => $wp_debug_display ? 'true' : 'false',
				'WP_DEBUG_LOG'          => $wp_debug_log ? ( true === WP_DEBUG_LOG ? 'true' : WP_DEBUG_LOG ) : 'false',
				'SCRIPT_DEBUG'          => $script_debug ? 'true' : 'false',
				'uses_default_log_path' => $uses_default_log_path ? 'yes' : 'no',
			);

			// Most critical: debug display enabled – errors shown to visitors.
			if ( $wp_debug && $wp_debug_display ) {
				return static::fail(
					'high',
					__( 'Debug mode is enabled and error messages are being shown to visitors. This can reveal sensitive information about your site\'s code and configuration to hackers.', '0-day-analytics' ),
					__( 'Edit your wp-config.php file and add these lines before "That\'s all, stop editing!": define(\'WP_DEBUG\', false); or if you need debugging: define(\'WP_DEBUG_DISPLAY\', false); and define(\'WP_DEBUG_LOG\', true);', '0-day-analytics' ),
					$details
				);
			}

			// Security issue: debug logging to the default web-accessible path.
			if ( $wp_debug && $wp_debug_log && $uses_default_log_path ) {
				return static::fail(
					'high',
					__( 'Debug logging is active and writing to the default wp-content/debug.log file. This file is publicly accessible and can expose sensitive application data, stack traces, and database queries to attackers.', '0-day-analytics' ),
					sprintf(
					/* translators: %s: link to settings section */
						__( 'Move the debug log outside the web root or use a custom path: define(\'WP_DEBUG_LOG\', \'/path/outside/webroot/debug.log\'); Also consider adding a server rule to block access to .log files. Or use this plugin\'s <a href="%1$s">SECURITY: Generate WP Debug Log File Name</a> to generate random and secure log file name.', '0-day-analytics' ),
						\esc_url( \admin_url( '/admin.php?page=advan_logs_settings' ) )
					),
					$details
				);
			}

			// Script debug enabled – minor concern for production.
			if ( $script_debug ) {
				return static::warning(
					__( 'Script debug mode is enabled, which loads unminified JavaScript and CSS files. This slows down your site and should only be used during development.', '0-day-analytics' ),
					__( 'Edit wp-config.php and remove or set to false: define(\'SCRIPT_DEBUG\', false);', '0-day-analytics' ),
					$details
				);
			}

			return static::pass(
				__( 'Debug mode is properly configured. Error messages are not visible to visitors and debug logs are not exposed in a default location.', '0-day-analytics' ),
				$details
			);
		}
	}
}