<?php
/**
 * Controller: Traffic Endpoint - admin side.
 *
 * What administrators see of the fast collector: a panel in the Traffic
 * Analytics settings (status, address, times, the reason it failed, a test
 * from their own browser, a re-check for all visitors, and which caches have
 * to be purged for a change to reach pages already built), and an admin
 * notice when it does not work.
 *
 * @package advan
 *
 * @since 5.4.0
 */

declare(strict_types=1);

namespace ADVAN\Controllers;

use ADVAN\Helpers\Settings;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( '\ADVAN\Controllers\Traffic_Endpoint_Admin' ) ) {
	/**
	 * Settings panel, actions and notice for the fast collector.
	 *
	 * @since 5.4.0
	 */
	class Traffic_Endpoint_Admin {

		/**
		 * admin-post action: forget the stored verdict so browsers verify again.
		 *
		 * @var string
		 */
		public const RECHECK_ACTION = 'advan_fast_collect_recheck';

		/**
		 * admin-post action: hide the notice about the current failure.
		 *
		 * @var string
		 */
		public const DISMISS_ACTION = 'advan_fast_collect_dismiss';

		/**
		 * User meta: the failure (its time) whose notice the user dismissed.
		 *
		 * @var string
		 */
		private const DISMISSED_META = 'advan_fast_collect_dismissed';

		/**
		 * Registers the actions and the notice. Admin requests, while JavaScript tracking is on.
		 *
		 * @return void
		 *
		 * @since 5.4.0
		 */
		public static function init(): void {
			\add_action( 'admin_post_' . self::RECHECK_ACTION, array( __CLASS__, 'recheck' ) );
			\add_action( 'admin_post_' . self::DISMISS_ACTION, array( __CLASS__, 'dismiss' ) );
			\add_action( 'admin_notices', array( __CLASS__, 'notice' ) );
			\add_action( 'network_admin_notices', array( __CLASS__, 'notice' ) );
		}

		/**
		 * The Traffic Analytics tab of the settings page.
		 *
		 * @return string
		 *
		 * @since 5.4.0
		 */
		public static function settings_url(): string {
			return \add_query_arg( array( 'page' => Settings::SETTINGS_MENU_SLUG ), \admin_url( 'admin.php' ) ) . '#aadvana-options-tab-traffic-analytics';
		}

		/**
		 * Handles "Check again for all visitors".
		 *
		 * @return void
		 *
		 * @since 5.4.0
		 */
		public static function recheck(): void {
			if ( ! \current_user_can( 'manage_options' ) ) {
				\wp_die( \esc_html__( 'Sorry, you are not allowed to do that.', '0-day-analytics' ), 403 );
			}
			\check_admin_referer( self::RECHECK_ACTION );

			Traffic_Endpoint::disable();
			// Writes a fresh, unverified config - the next visitors' browsers verify it.
			Traffic_Endpoint::url();

			\wp_safe_redirect( \add_query_arg( array( 'page' => Settings::SETTINGS_MENU_SLUG, 'advan_fast_collect' => 'rechecked' ), \admin_url( 'admin.php' ) ) . '#aadvana-options-tab-traffic-analytics' );
			exit;
		}

		/**
		 * Handles "Dismiss" on the notice.
		 *
		 * @return void
		 *
		 * @since 5.4.0
		 */
		public static function dismiss(): void {
			if ( ! \current_user_can( 'manage_options' ) ) {
				\wp_die( \esc_html__( 'Sorry, you are not allowed to do that.', '0-day-analytics' ), 403 );
			}
			\check_admin_referer( self::DISMISS_ACTION );

			\update_user_meta( \get_current_user_id(), self::DISMISSED_META, Traffic_Endpoint::status()['checked'] );

			\wp_safe_redirect( \wp_get_referer() ? \wp_get_referer() : \admin_url() );
			exit;
		}

		/**
		 * Admin notice while the fast collector does not work - until dismissed for that failure.
		 *
		 * Not on the settings page, where the panel says the same and more.
		 *
		 * @return void
		 *
		 * @since 5.4.0
		 */
		public static function notice(): void {
			if ( ! \current_user_can( 'manage_options' ) || Settings::SETTINGS_MENU_SLUG === ( $_GET['page'] ?? '' ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only picks the screen.
				return;
			}

			$status = Traffic_Endpoint::status();
			if ( 'failed' !== $status['state'] || (int) \get_user_meta( \get_current_user_id(), self::DISMISSED_META, true ) === $status['checked'] ) {
				return;
			}

			$dismiss = \wp_nonce_url( \admin_url( 'admin-post.php?action=' . self::DISMISS_ACTION ), self::DISMISS_ACTION );
			?>
			<div class="notice notice-warning">
				<p>
					<strong><?php \esc_html_e( '0 Day Analytics: the fast traffic collector does not work on this site.', '0-day-analytics' ); ?></strong>
					<?php \esc_html_e( 'Pageviews are still recorded - through admin-ajax.php, which loads all of WordPress for each one and is slower.', '0-day-analytics' ); ?>
					<?php if ( '' !== $status['error'] ) { ?>
						<?php echo \esc_html( $status['error'] ); ?>
					<?php } ?>
				</p>
				<p>
					<a class="button button-primary" href="<?php echo \esc_url( self::settings_url() ); ?>"><?php \esc_html_e( 'Details and test', '0-day-analytics' ); ?></a>
					<a class="button" href="<?php echo \esc_url( $dismiss ); ?>"><?php \esc_html_e( 'Dismiss', '0-day-analytics' ); ?></a>
				</p>
			</div>
			<?php
		}

		/**
		 * The Fast collector panel, printed inside the Traffic Analytics settings tab.
		 *
		 * @return void
		 *
		 * @since 5.4.0
		 */
		public static function render_panel(): void {
			// Makes sure there is a config for the test to use, and brings it up to date.
			Traffic_Endpoint::url();

			$status  = Traffic_Endpoint::status();
			$url     = Traffic_Endpoint::endpoint_url();
			$site    = \get_current_blog_id();
			$recheck = \wp_nonce_url( \admin_url( 'admin-post.php?action=' . self::RECHECK_ACTION ), self::RECHECK_ACTION );
			$caches  = self::detected_caches();
			$when    = static function ( int $time ): string {
				return $time > 0
					/* translators: 1: date and time, 2: how long ago, e.g. "5 mins" */
					? sprintf( \__( '%1$s (%2$s ago)', '0-day-analytics' ), \wp_date( \get_option( 'date_format' ) . ' ' . \get_option( 'time_format' ), $time ), \human_time_diff( $time ) )
					: '';
			};

			$boxes = array(
				'ok'       => array( 'success', \__( 'In use. Pageviews are stored through the fast collector.', '0-day-analytics' ) ),
				'failed'   => array( 'error', \__( 'Not working on this site. Pageviews are stored through admin-ajax.php instead - nothing is lost, it is only slower.', '0-day-analytics' ) ),
				'untested' => array( 'info', \__( 'Being verified. Pages offer the fast collector; the first visitor\'s browser that gets through marks it as working. Any pageview it cannot take goes through admin-ajax.php.', '0-day-analytics' ) ),
				'off'      => array( 'info', \__( 'Turned off. Pageviews are stored through admin-ajax.php.', '0-day-analytics' ) ),
			);
			list( $box_type, $box_text ) = $boxes[ $status['state'] ];

			$messages = array(
				/* translators: %d: milliseconds */
				'ok'      => \__( 'Works from this browser: the collector answered in %d ms. It is marked as working now.', '0-day-analytics' ),
				'c400'    => \__( 'The collector refused the request as malformed (HTTP 400). Reload this page and test again.', '0-day-analytics' ),
				'c403'    => \__( 'The collector refused the request (HTTP 403): either the signature - reload this page and test again; if it persists, AUTH_KEY or AUTH_SALT differ between the collector and WordPress - or this admin is on another domain than the site, and the collector only takes requests from the site\'s own pages.', '0-day-analytics' ),
				'c503'    => \__( 'The collector ran, but has no configuration or cannot write to the traffic buffer directory in uploads (HTTP 503).', '0-day-analytics' ),
				/* translators: %d: HTTP status code */
				'refused' => \__( 'The collector answered with HTTP status %d.', '0-day-analytics' ),
				/* translators: %d: HTTP status code */
				'blocked' => \__( 'Blocked before reaching the collector: HTTP status %d came from the web server, a firewall or a CDN, not from the collector. Allow POST requests to the collector URL above - for example an nginx location for exactly that path, or an exception in the firewall / security plugin.', '0-day-analytics' ),
				'network' => \__( 'The request did not complete: a browser extension blocked it, the network failed, or the collector URL is on another domain than this admin.', '0-day-analytics' ),
				'testing' => \__( 'Testing…', '0-day-analytics' ),
			);
			?>
			<div class="aadvana-fast-collector" style="margin:20px 0;max-width:960px">
				<h3><?php \esc_html_e( 'Fast collector', '0-day-analytics' ); ?></h3>
				<p>
					<?php \esc_html_e( 'In JavaScript mode each pageview is sent to a small file of this plugin, traffic-collect.php, which loads only the database part of WordPress - a few milliseconds. The alternative, admin-ajax.php, loads every plugin and the theme for each pageview.', '0-day-analytics' ); ?>
				</p>

				<?php if ( 'rechecked' === ( $_GET['advan_fast_collect'] ?? '' ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Display only. ?>
					<div class="notice notice-success inline"><p>
						<?php \esc_html_e( 'The previous result was cleared. Pages built from now on offer the fast collector, and the next visitors\' browsers verify it - or use "Test from this browser" below to verify it now.', '0-day-analytics' ); ?>
					</p></div>
				<?php } ?>

				<div class="notice notice-<?php echo \esc_attr( $box_type ); ?> inline"><p><strong><?php echo \esc_html( $box_text ); ?></strong></p></div>

				<table class="widefat striped" style="margin:12px 0">
					<tbody>
						<tr>
							<th scope="row" style="width:220px"><?php \esc_html_e( 'Collector URL', '0-day-analytics' ); ?></th>
							<td><code><?php echo \esc_html( $url ); ?></code><br><span class="description"><?php \esc_html_e( 'Takes POST requests from the tracking script only; opening it in a browser answers "405 Method Not Allowed", which is normal.', '0-day-analytics' ); ?></span></td>
						</tr>
						<?php if ( 'ok' === $status['state'] ) { ?>
							<tr>
								<th scope="row"><?php \esc_html_e( 'Verified', '0-day-analytics' ); ?></th>
								<td><?php echo \esc_html( $when( $status['checked'] ) ); ?></td>
							</tr>
						<?php } ?>
						<?php if ( 'failed' === $status['state'] ) { ?>
							<tr>
								<th scope="row"><?php \esc_html_e( 'Stopped', '0-day-analytics' ); ?></th>
								<td><?php echo \esc_html( $when( $status['checked'] ) ); ?></td>
							</tr>
							<tr>
								<th scope="row"><?php \esc_html_e( 'Reason', '0-day-analytics' ); ?></th>
								<td><?php echo \esc_html( '' !== $status['error'] ? $status['error'] : \__( 'Not recorded.', '0-day-analytics' ) ); ?></td>
							</tr>
						<?php } ?>
						<?php if ( 'untested' === $status['state'] ) { ?>
							<tr>
								<th scope="row"><?php \esc_html_e( 'Errors reported by browsers', '0-day-analytics' ); ?></th>
								<td>
									<?php
									/* translators: 1: errors so far, 2: errors that switch the collector off */
									echo \esc_html( sprintf( \__( '%1$d of %2$d - at %2$d it is paused for five minutes. Network errors (ad blockers) are not counted.', '0-day-analytics' ), $status['fails'], $status['failures_to_disable'] ) );
									?>
								</td>
							</tr>
						<?php } ?>
						<?php if ( in_array( $status['state'], array( 'ok', 'failed' ), true ) && $status['checked'] > 0 ) { ?>
							<tr>
								<th scope="row"><?php \esc_html_e( 'Next automatic check', '0-day-analytics' ); ?></th>
								<td>
									<?php
									$next = $status['checked'] + $status['retest_after'];
									echo \esc_html(
										$next > time()
											/* translators: %s: time until, e.g. "3 hours" */
											? sprintf( \__( 'in %s - by the first page built after that', '0-day-analytics' ), \human_time_diff( $next ) )
											: \__( 'with the next page built', '0-day-analytics' )
									);
									?>
								</td>
							</tr>
						<?php } ?>
						<?php if ( 'off' === $status['state'] ) { ?>
							<tr>
								<th scope="row"><?php \esc_html_e( 'Why', '0-day-analytics' ); ?></th>
								<td><?php echo \esc_html( Traffic_Endpoint::off_reason() ); ?></td>
							</tr>
						<?php } ?>
					</tbody>
				</table>

				<?php if ( 'off' !== $status['state'] ) { ?>
					<p>
						<button type="button" class="button button-primary" id="aadvana-fast-test"
							data-url="<?php echo \esc_url( $url ); ?>"
							data-token="<?php echo \esc_attr( Traffic_Endpoint::token( $site ) ); ?>"
							data-site="<?php echo \esc_attr( (string) $site ); ?>"
							data-messages="<?php echo \esc_attr( (string) \wp_json_encode( $messages ) ); ?>"><?php \esc_html_e( 'Test from this browser', '0-day-analytics' ); ?></button>
						<a class="button" href="<?php echo \esc_url( $recheck ); ?>"><?php \esc_html_e( 'Check again for all visitors', '0-day-analytics' ); ?></a>
					</p>
					<p id="aadvana-fast-test-result" role="status" style="font-weight:600"></p>
					<p class="description">
						<?php \esc_html_e( '"Test from this browser" sends a test request exactly like the tracking script does - through the same CDN, firewall and web server rules - and tells whether the collector or something in front of it answered. Nothing is recorded. "Check again for all visitors" forgets the current result, so pages offer the collector again and visitors\' browsers verify it; use it after changing a server or firewall rule.', '0-day-analytics' ); ?>
					</p>
				<?php } ?>

				<h4><?php \esc_html_e( 'Cached pages', '0-day-analytics' ); ?></h4>
				<p>
					<?php \esc_html_e( 'Each page carries the collector address when it is built. A page served from a cache keeps what it was built with until that cache expires or is purged - so after the status changes, or after "Check again for all visitors", pages already cached still behave as before.', '0-day-analytics' ); ?>
				</p>
				<?php if ( $caches ) { ?>
					<p><?php \esc_html_e( 'Found on this site - purge these for the change to apply to every page right away:', '0-day-analytics' ); ?></p>
					<ul style="list-style:disc;margin-left:20px">
						<?php foreach ( $caches as $cache ) { ?>
							<li><?php echo \esc_html( $cache ); ?></li>
						<?php } ?>
					</ul>
				<?php } else { ?>
					<p><?php \esc_html_e( 'No page cache or CDN was found from here, so there is nothing to purge as far as this plugin can tell. A cache run by your host outside WordPress cannot be seen from here.', '0-day-analytics' ); ?></p>
				<?php } ?>

				<?php if ( 'off' !== $status['state'] ) { ?>
					<h4><?php \esc_html_e( 'Checking a page yourself', '0-day-analytics' ); ?></h4>
					<p>
						<?php
						echo \esc_html(
							Settings::get_option( 'traffic_exclude_admins' )
								? \__( 'Administrators are excluded from tracking (Exclusions below), so pages you view while logged in carry no tracking script. Use a private window, logged out.', '0-day-analytics' )
								: \__( 'Open any page of the site, then the browser\'s developer tools:', '0-day-analytics' )
						);
						?>
					</p>
					<ul style="list-style:disc;margin-left:20px">
						<li><?php \esc_html_e( 'Console: type aadvana_traffic.fast_url and press Enter. The collector URL above means the page offers it; "" means the page was built while it was not working, or comes from a cache built then.', '0-day-analytics' ); ?></li>
						<li><?php \esc_html_e( 'Network: open the panel first, then reload the page, and filter by "collect". A POST to traffic-collect.php with status 204 is a pageview stored by the fast collector.', '0-day-analytics' ); ?></li>
					</ul>
				<?php } ?>
			</div>
			<?php
			if ( 'off' !== $status['state'] ) {
				echo \wp_get_inline_script_tag( self::test_script() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Static script.
			}
		}

		/**
		 * Page caches and CDNs this plugin can see: the ones to purge after a change.
		 *
		 * @return string[] Human-readable names.
		 *
		 * @since 5.4.0
		 */
		private static function detected_caches(): array {
			$caches = array();

			if ( ! empty( $_SERVER['HTTP_CF_RAY'] ) ) {
				$caches[] = \__( 'Cloudflare - this admin page came through it. Purge in the Cloudflare dashboard or through its plugin.', '0-day-analytics' );
			}

			if ( defined( 'WP_CACHE' ) && WP_CACHE && is_file( WP_CONTENT_DIR . '/advanced-cache.php' ) ) {
				$caches[] = \__( 'A page cache plugin (wp-content/advanced-cache.php is active). Purge it from that plugin.', '0-day-analytics' );
			}

			if ( \wp_using_ext_object_cache() ) {
				$caches[] = \__( 'A persistent object cache. It holds settings, not pages - it does not need purging for this.', '0-day-analytics' );
			}

			return $caches;
		}

		/**
		 * The "Test from this browser" button's script.
		 *
		 * @return string
		 *
		 * @since 5.4.0
		 */
		private static function test_script(): string {
			return <<<'JS'
(function () {
	var button = document.getElementById('aadvana-fast-test');
	var out = document.getElementById('aadvana-fast-test-result');
	if (!button || !out) {
		return;
	}
	var messages = JSON.parse(button.getAttribute('data-messages'));
	button.addEventListener('click', function () {
		var data = new FormData();
		data.append('token', button.getAttribute('data-token'));
		data.append('site', button.getAttribute('data-site'));
		data.append('probe', '1');
		out.textContent = messages.testing;
		var started = performance.now();
		fetch(button.getAttribute('data-url'), { method: 'POST', body: data, credentials: 'same-origin', cache: 'no-store' })
			.then(function (response) {
				var ms = Math.round(performance.now() - started);
				// Only the collector sends this header: anything else answered in front of it.
				var ours = response.headers.get('X-Aadvana-Collect') === '1';
				if (ours && response.status === 204) {
					out.textContent = messages.ok.replace('%d', ms);
				} else if (ours) {
					out.textContent = (messages['c' + response.status] || messages.refused).replace('%d', response.status);
				} else {
					out.textContent = messages.blocked.replace('%d', response.status);
				}
			})
			.catch(function () {
				out.textContent = messages.network;
			});
	});
})();
JS;
		}
	}
}