<?php
/**
 * Class: Settings Sanitizer.
 *
 * Validates and sanitizes plugin settings from form submissions or imports.
 *
 * @package advanced-analytics
 *
 * @since 3.4.0
 */

declare(strict_types=1);

namespace ADVAN\Settings;

use ADVAN\Helpers\Settings;
use ADVAN\Helpers\Crons_Helper;
use ADVAN\Helpers\Secure_Store;
use ADVAN\Controllers\Slack;
use ADVAN\Controllers\Telegram;
use ADVAN\Controllers\Slack_API;
use ADVAN\Controllers\Telegram_API;
use ADVAN\Controllers\Traffic_Endpoint;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( '\ADVAN\Settings\Settings_Sanitizer' ) ) {
	/**
	 * Handles validation and sanitization of plugin settings.
	 *
	 * @since 3.4.0
	 */
	class Settings_Sanitizer {

		/**
		 * Collects the passed options, validates them and returns sanitized array.
		 *
		 * @param array $post_array - The collected settings array.
		 * @param bool  $import - The settings store comes from the imported file.
		 *
		 * @return array Sanitized options (encrypted for storage).
		 *
		 * @since 3.4.0
		 */
		public static function collect_and_sanitize( array $post_array, bool $import = false ): array {
			if ( ! \current_user_can( 'manage_options' ) ) {
				\wp_die( \esc_html__( 'You do not have sufficient permissions to access this page.', '0-day-analytics' ) );
			}

			$advanced_options = array();

			$advanced_options = self::sanitize_general_options( $advanced_options, $post_array );
			$advanced_options = self::sanitize_severity_options( $advanced_options, $post_array );
			$advanced_options = self::sanitize_smtp_options( $advanced_options, $post_array );
			$advanced_options = self::sanitize_notification_options( $advanced_options, $post_array );
			$advanced_options = self::sanitize_logging_options( $advanced_options, $post_array );
			$advanced_options = self::sanitize_module_options( $advanced_options, $post_array );
			$advanced_options = self::sanitize_cron_options( $advanced_options, $post_array );
			$advanced_options = self::sanitize_security_options( $advanced_options, $post_array );

			if ( ! $import ) {
				Config_Transformer_Handler::process( $post_array, $advanced_options );
			}

			// Before returning (WordPress will persist), encrypt sensitive fields.
			$to_store = $advanced_options;
			Secure_Store::encrypt_sensitive_fields( $to_store );
			Settings::set_current_options( $advanced_options ); // Keep plaintext in-memory.

			return $to_store;
		}

		/**
		 * Sanitize general boolean/integer options.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_general_options( array $options, array $post_array ): array {
			$options['live_notifications_admin_bar'] = ( array_key_exists( 'live_notifications_admin_bar', $post_array ) ) ? filter_var( $post_array['live_notifications_admin_bar'], FILTER_VALIDATE_BOOLEAN ) : false;

			$options['environment_type_admin_bar'] = ( array_key_exists( 'environment_type_admin_bar', $post_array ) ) ? filter_var( $post_array['environment_type_admin_bar'], FILTER_VALIDATE_BOOLEAN ) : false;

			$options['protected_config_source'] = ( array_key_exists( 'protected_config_source', $post_array ) ) ? filter_var( $post_array['protected_config_source'], FILTER_VALIDATE_BOOLEAN ) : false;

			$options['browser_notifications_not_send'] = ( array_key_exists( 'browser_notifications_not_send', $post_array ) ) ? filter_var( $post_array['browser_notifications_not_send'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['browser_notifications_seconds'] = ( array_key_exists( 'browser_notifications_seconds', $post_array ) ) ? filter_var(
				$post_array['browser_notifications_seconds'],
				\FILTER_VALIDATE_INT,
				array(
					'options' => array(
						'min_range' => 1,
						'max_range' => 100,
					),
				)
			) : 10;
			// Clamp to minimum 5 seconds server-side to avoid rapid polling.
			if ( $options['browser_notifications_seconds'] < 5 ) {
				$options['browser_notifications_seconds'] = 5;
			}

			$options['keep_error_log_records_truncate'] = ( array_key_exists( 'keep_error_log_records_truncate', $post_array ) ) ? filter_var(
				$post_array['keep_error_log_records_truncate'],
				\FILTER_VALIDATE_INT,
				array(
					'options' => array(
						'min_range' => 1,
						'max_range' => 100,
					),
				)
			) : 10;

			$options['advana_server_info_admin_bar_refresh_interval'] = ( array_key_exists( 'advana_server_info_admin_bar_refresh_interval', $post_array ) ) ? filter_var(
				$post_array['advana_server_info_admin_bar_refresh_interval'],
				\FILTER_VALIDATE_INT,
				array(
					'options' => array(
						'min_range' => 1,
						'max_range' => 100,
					),
				)
			) : 10;

			$options['plugin_version_switch_count'] = ( array_key_exists( 'plugin_version_switch_count', $post_array ) ) ? filter_var(
				$post_array['plugin_version_switch_count'],
				\FILTER_VALIDATE_INT,
				array(
					'options' => array(
						'min_range' => 1,
						'max_range' => 10,
					),
				)
			) : 3;

			$options['show_active_plugins_first'] = ( array_key_exists( 'show_active_plugins_first', $post_array ) ) ? filter_var( $post_array['show_active_plugins_first'], \FILTER_VALIDATE_BOOLEAN ) : false;

			return $options;
		}

		/**
		 * Sanitize severity settings.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_severity_options( array $options, array $post_array ): array {
			foreach ( Settings::get_option( 'severities' ) as $name => $severity ) {
				$options['severities'][ $name ]['color'] = ( array_key_exists( 'severity_colors_' . $name . '_color', $post_array ) && ! empty( $post_array[ 'severity_colors_' . $name . '_color' ] ) ) ? \sanitize_text_field( $post_array[ 'severity_colors_' . $name . '_color' ] ) : ( ( isset( $post_array['severities'][ $name ]['color'] ) ) ? \sanitize_text_field( $post_array['severities'][ $name ]['color'] ) : $severity['color'] );

				$options['severities'][ $name ]['display'] = ( array_key_exists( 'severity_show_' . $name . '_display', $post_array ) && ! empty( $post_array[ 'severity_show_' . $name . '_display' ] ) ) ? true : ( ( isset( $post_array['severities'][ $name ]['display'] ) ) ? (bool) $post_array['severities'][ $name ]['display'] : false );

				$options['severities'][ $name ]['name'] = Settings::get_option( 'severities' )[ $name ]['name'];
			}

			return $options;
		}

		/**
		 * Sanitize SMTP settings.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_smtp_options( array $options, array $post_array ): array {
			$options['smtp_host'] = ( array_key_exists( 'smtp_host', $post_array ) && ! empty( $post_array['smtp_host'] ) ) ? \sanitize_text_field( $post_array['smtp_host'] ) : '';

			$options['from_email'] = ( array_key_exists( 'from_email', $post_array ) && ! empty( $post_array['from_email'] ) ) ? \sanitize_text_field( $post_array['from_email'] ) : '';

			$options['from_email_name'] = ( array_key_exists( 'from_email_name', $post_array ) && ! empty( $post_array['from_email_name'] ) ) ? \sanitize_text_field( $post_array['from_email_name'] ) : '';

			$options['smtp_port'] = ( array_key_exists( 'smtp_port', $post_array ) && ! empty( $post_array['smtp_port'] ) ) ? filter_var(
				$post_array['smtp_port'],
				\FILTER_VALIDATE_INT,
				array(
					'options' => array(
						'min_range' => 1,
						'max_range' => 65535,
					),
				)
			) : '';

			$options['encryption_type'] = ( array_key_exists( 'encryption_type', $post_array ) && ! empty( $post_array['encryption_type'] ) ) ? ( in_array( $post_array['encryption_type'], array( 'none', 'ssl', 'tls' ) ) ? $post_array['encryption_type'] : Settings::get_option( 'encryption_type' ) ) : 'none';

			$options['smtp_username'] = ( array_key_exists( 'smtp_username', $post_array ) && ! empty( $post_array['smtp_username'] ) ) ? \sanitize_text_field( $post_array['smtp_username'] ) : '';

			$options['smtp_password'] = ( array_key_exists( 'smtp_password', $post_array ) && ! empty( $post_array['smtp_password'] ) ) ? \sanitize_text_field( $post_array['smtp_password'] ) : '';

			$options['bypass_ssl_verification'] = ( array_key_exists( 'bypass_ssl_verification', $post_array ) ) ? filter_var( $post_array['bypass_ssl_verification'], FILTER_VALIDATE_BOOLEAN ) : false;

			return $options;
		}

		/**
		 * Sanitize Slack and Telegram notification settings.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_notification_options( array $options, array $post_array ): array {
			// Slack.
			$options['slack_notifications']['all'] = array();

			if ( array_key_exists( 'slack_notification_auth_token', $post_array ) ) {

				$slack_token = ( array_key_exists( 'slack_notification_auth_token', $post_array ) && ! empty( $post_array['slack_notification_auth_token'] ) ) ? \sanitize_text_field( \wp_unslash( $post_array['slack_notification_auth_token'] ) ) : '';

				if ( ! empty( $slack_token ) ) {

					if ( 'REMOVE' === $slack_token ) {
						$options['slack_notifications']['all']['auth_token'] = '';
					} elseif ( preg_match( '/^xox[aboprsl]-[A-Za-z0-9-]{10,}$/', $slack_token ) && Slack_API::verify_slack_token( $slack_token ) ) {
						$options['slack_notifications']['all']['auth_token'] = $slack_token;
					}
				} elseif ( Slack::is_set() ) {
					$options['slack_notifications']['all']['auth_token'] = Slack::get_slack_auth_key();
				}
			} elseif ( Slack::is_set() ) {
				$options['slack_notifications']['all']['auth_token'] = Slack::get_slack_auth_key();
			}

			$options['slack_notifications']['all']['channel'] = ( array_key_exists( 'notification_default_slack_channel', $post_array ) ) ? \sanitize_text_field( \wp_unslash( $post_array['notification_default_slack_channel'] ) ) : '';

			// Telegram.
			$options['telegram_notifications']['all'] = array();

			if ( array_key_exists( 'telegram_notification_auth_token', $post_array ) ) {

				$telegram_token = ( array_key_exists( 'telegram_notification_auth_token', $post_array ) && ! empty( $post_array['telegram_notification_auth_token'] ) ) ? \sanitize_text_field( \wp_unslash( $post_array['telegram_notification_auth_token'] ) ) : '';

				if ( ! empty( $telegram_token ) ) {

					if ( 'REMOVE' === $telegram_token ) {
						$options['telegram_notifications']['all']['auth_token'] = '';
					} elseif ( preg_match( '/^\d{5,}:[A-Za-z0-9_-]{30,}$/', $telegram_token ) && Telegram_API::verify_telegram_token( $telegram_token ) ) {
						$options['telegram_notifications']['all']['auth_token'] = $telegram_token;
					}
				} elseif ( Telegram::is_set() ) {
					$options['telegram_notifications']['all']['auth_token'] = Telegram::get_telegram_auth_key();
				}
			} elseif ( Telegram::is_set() ) {
				$options['telegram_notifications']['all']['auth_token'] = Telegram::get_telegram_auth_key();
			}

			$options['telegram_notifications']['all']['channel'] = ( array_key_exists( 'notification_default_telegram_channel', $post_array ) ) ? \sanitize_text_field( \wp_unslash( $post_array['notification_default_telegram_channel'] ) ) : '';

			return $options;
		}

		/**
		 * Sanitize logging/debug related options.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_logging_options( array $options, array $post_array ): array {
			$options['keep_reading_error_log'] = ( array_key_exists( 'keep_reading_error_log', $post_array ) ) ? filter_var( $post_array['keep_reading_error_log'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['plugin_debug_enable'] = ( array_key_exists( 'plugin_debug_enable', $post_array ) ) ? filter_var( $post_array['plugin_debug_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['plugin_exception_handler_disable'] = ( array_key_exists( 'plugin_exception_handler_disable', $post_array ) ) ? filter_var( $post_array['plugin_exception_handler_disable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			// If keep reading error log is disabled, plugin debug must be disabled too.
			if ( false === $options['keep_reading_error_log'] ) {
				$options['plugin_debug_enable'] = false;
			}

			$options['advana_requests_enable'] = ( array_key_exists( 'advana_requests_enable', $post_array ) ) ? filter_var( $post_array['advana_requests_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['advana_http_requests_disable'] = ( array_key_exists( 'advana_http_requests_disable', $post_array ) ) ? filter_var( $post_array['advana_http_requests_disable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['advana_rest_requests_disable'] = ( array_key_exists( 'advana_rest_requests_disable', $post_array ) ) ? filter_var( $post_array['advana_rest_requests_disable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['no_rest_api_monitor'] = ( array_key_exists( 'no_rest_api_monitor', $post_array ) ) ? filter_var( $post_array['no_rest_api_monitor'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['no_wp_die_monitor'] = ( array_key_exists( 'no_wp_die_monitor', $post_array ) ) ? filter_var( $post_array['no_wp_die_monitor'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['advana_server_info_cpu_enable'] = ( array_key_exists( 'advana_server_info_cpu_enable', $post_array ) ) ? filter_var( $post_array['advana_server_info_cpu_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['advana_server_info_mem_enable'] = ( array_key_exists( 'advana_server_info_mem_enable', $post_array ) ) ? filter_var( $post_array['advana_server_info_mem_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['advana_server_info_hdd_enable'] = ( array_key_exists( 'advana_server_info_hdd_enable', $post_array ) ) ? filter_var( $post_array['advana_server_info_hdd_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;

			return $options;
		}

		/**
		 * Sanitize module enabled/disabled flags.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_module_options( array $options, array $post_array ): array {
			$options['cron_module_enabled']        = ( array_key_exists( 'cron_module_enabled', $post_array ) ) ? filter_var( $post_array['cron_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['performance_module_enabled'] = ( array_key_exists( 'performance_module_enabled', $post_array ) ) ? filter_var( $post_array['performance_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['pagespeed_api_key']          = ( array_key_exists( 'pagespeed_api_key', $post_array ) ) ? \sanitize_text_field( $post_array['pagespeed_api_key'] ) : '';
			$options['urls_module_enabled']        = ( array_key_exists( 'urls_module_enabled', $post_array ) ) ? filter_var( $post_array['urls_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_urls_enable']         = ( array_key_exists( 'advana_urls_enable', $post_array ) ) ? filter_var( $post_array['advana_urls_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['file_editor_module_enabled'] = ( array_key_exists( 'file_editor_module_enabled', $post_array ) ) ? filter_var( $post_array['file_editor_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['requests_module_enabled']    = ( array_key_exists( 'requests_module_enabled', $post_array ) ) ? filter_var( $post_array['requests_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['server_info_module_enabled'] = ( array_key_exists( 'server_info_module_enabled', $post_array ) ) ? filter_var( $post_array['server_info_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['fatals_module_enabled']      = ( array_key_exists( 'fatals_module_enabled', $post_array ) ) ? filter_var( $post_array['fatals_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['wp_mail_module_enabled']     = ( array_key_exists( 'wp_mail_module_enabled', $post_array ) ) ? filter_var( $post_array['wp_mail_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['transients_module_enabled']  = ( array_key_exists( 'transients_module_enabled', $post_array ) ) ? filter_var( $post_array['transients_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['tables_module_enabled']      = ( array_key_exists( 'tables_module_enabled', $post_array ) ) ? filter_var( $post_array['tables_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['snippets_module_enabled']    = ( array_key_exists( 'snippets_module_enabled', $post_array ) ) ? filter_var( $post_array['snippets_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;

			$options['snippets_temp_storage'] = ( array_key_exists( 'snippets_temp_storage', $post_array ) && ! empty( $post_array['snippets_temp_storage'] ) ) ? ( in_array( $post_array['snippets_temp_storage'], array( 'uploads', 'php_temp' ), true ) ? $post_array['snippets_temp_storage'] : Settings::get_option( 'snippets_temp_storage' ) ) : Settings::get_option( 'snippets_temp_storage' );

			$options['hooks_capture_module_enabled'] = ( array_key_exists( 'hooks_capture_module_enabled', $post_array ) ) ? filter_var( $post_array['hooks_capture_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['rest_api_module_enabled']      = ( array_key_exists( 'rest_api_module_enabled', $post_array ) ) ? filter_var( $post_array['rest_api_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['wp_panel_module_enabled']      = ( array_key_exists( 'wp_panel_module_enabled', $post_array ) ) ? filter_var( $post_array['wp_panel_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;

			// Traffic Analytics.
			$options['traffic_analytics_module_enabled'] = ( array_key_exists( 'traffic_analytics_module_enabled', $post_array ) ) ? filter_var( $post_array['traffic_analytics_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['traffic_tracking_method']          = ( array_key_exists( 'traffic_tracking_method', $post_array ) && in_array( $post_array['traffic_tracking_method'], array( 'server', 'js' ), true ) ) ? $post_array['traffic_tracking_method'] : 'server';
			$options['traffic_exclude_admins']           = ( array_key_exists( 'traffic_exclude_admins', $post_array ) ) ? filter_var( $post_array['traffic_exclude_admins'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['traffic_retention_days']           = ( array_key_exists( 'traffic_retention_days', $post_array ) ) ? max( 30, absint( $post_array['traffic_retention_days'] ) ) : 365;

			// Saving the settings re-checks the fast collector: its stored verdict is dropped and the next visitors' browsers verify it again.
			Traffic_Endpoint::disable();

			// Login Audit.
			$options['login_auditor_module_enabled'] = ( array_key_exists( 'login_auditor_module_enabled', $post_array ) ) ? filter_var( $post_array['login_auditor_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_login_auditor_enable']  = ( array_key_exists( 'advana_login_auditor_enable', $post_array ) ) ? filter_var( $post_array['advana_login_auditor_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['login_audit_retention_days']   = ( array_key_exists( 'login_audit_retention_days', $post_array ) ) ? max( 7, min( 365, absint( $post_array['login_audit_retention_days'] ) ) ) : 90;

			return $options;
		}

		/**
		 * Sanitize cron schedule options.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_cron_options( array $options, array $post_array ): array {
			$options['advana_hooks_capture_clear'] = ( array_key_exists( 'advana_hooks_capture_clear', $post_array ) ) ? ( in_array( $post_array['advana_hooks_capture_clear'], array_merge( array( '-1' ), \array_keys( \wp_get_schedules() ) ), true ) ? $post_array['advana_hooks_capture_clear'] : Settings::get_option( 'advana_hooks_capture_clear' ) ) : Settings::get_option( 'advana_hooks_capture_clear' );

			$options['advana_rest_requests_clear'] = ( array_key_exists( 'advana_rest_requests_clear', $post_array ) ) ? ( in_array( $post_array['advana_rest_requests_clear'], \array_keys( \wp_get_schedules(), true ) ) ? $post_array['advana_rest_requests_clear'] : Settings::get_option( 'advana_rest_requests_clear' ) ) : Settings::get_option( 'advana_rest_requests_clear' );

			$options['advana_urls_clear'] = ( array_key_exists( 'advana_urls_clear', $post_array ) ) ? ( in_array( $post_array['advana_urls_clear'], \array_keys( \wp_get_schedules(), true ) ) ? $post_array['advana_urls_clear'] : Settings::get_option( 'advana_urls_clear' ) ) : Settings::get_option( 'advana_urls_clear' );

			$options['advana_mail_logging_clear'] = ( array_key_exists( 'advana_mail_logging_clear', $post_array ) ) ? ( in_array( $post_array['advana_mail_logging_clear'], \array_keys( \wp_get_schedules(), true ) ) ? $post_array['advana_mail_logging_clear'] : Settings::get_option( 'advana_mail_logging_clear' ) ) : Settings::get_option( 'advana_mail_logging_clear' );

			$options['advana_error_log_clear'] = ( array_key_exists( 'advana_error_log_clear', $post_array ) ) ? ( in_array( $post_array['advana_error_log_clear'], \array_keys( \wp_get_schedules(), true ) ) ? $post_array['advana_error_log_clear'] : Settings::get_option( 'advana_error_log_clear' ) ) : Settings::get_option( 'advana_error_log_clear' );

			if ( array_key_exists( 'advana_rest_requests_clear', $post_array ) ) {
				if ( -1 === (int) $post_array['advana_rest_requests_clear'] ) {
					Crons_Helper::clear_events( ADVAN_PREFIX . 'request_table_clear' );
					$options['advana_rest_requests_clear'] = '-1';
				}
			}

			if ( array_key_exists( 'advana_urls_clear', $post_array ) ) {
				if ( -1 === (int) $post_array['advana_urls_clear'] ) {
					Crons_Helper::clear_events( ADVAN_PREFIX . 'urls_table_clear' );
					$options['advana_urls_clear'] = '-1';
				}
			}

			if ( array_key_exists( 'advana_hooks_capture_clear', $post_array ) ) {
				if ( -1 === (int) $post_array['advana_hooks_capture_clear'] ) {
					Crons_Helper::clear_events( ADVAN_PREFIX . 'hooks_capture_clear' );
					$options['advana_hooks_capture_clear'] = '-1';
				}
			}

			if ( array_key_exists( 'advana_mail_logging_clear', $post_array ) ) {
				if ( -1 === (int) $post_array['advana_mail_logging_clear'] ) {
					Crons_Helper::clear_events( ADVAN_PREFIX . 'mail_logging_clear' );
					$options['advana_mail_logging_clear'] = '-1';
				}
			}

			if ( array_key_exists( 'advana_error_log_clear', $post_array ) ) {
				if ( -1 === (int) $post_array['advana_error_log_clear'] ) {
					Crons_Helper::clear_events( ADVAN_PREFIX . 'error_log_clear' );
					$options['advana_error_log_clear'] = '-1';
				}
			}

			return $options;
		}

		/**
		 * Sanitize security module options.
		 *
		 * @param array $options - The options array to populate.
		 * @param array $post_array - The raw POST data.
		 *
		 * @return array
		 *
		 * @since 3.4.0
		 */
		private static function sanitize_security_options( array $options, array $post_array ): array {
			$options['security_module_enabled']                = ( array_key_exists( 'security_module_enabled', $post_array ) ) ? filter_var( $post_array['security_module_enabled'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_security_rate_limit_enable']      = ( array_key_exists( 'advana_security_rate_limit_enable', $post_array ) ) ? filter_var( $post_array['advana_security_rate_limit_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_security_priv_guard_enable']      = ( array_key_exists( 'advana_security_priv_guard_enable', $post_array ) ) ? filter_var( $post_array['advana_security_priv_guard_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_security_incident_detect_enable'] = ( array_key_exists( 'advana_security_incident_detect_enable', $post_array ) ) ? filter_var( $post_array['advana_security_incident_detect_enable'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_security_block_user_enum']        = ( array_key_exists( 'advana_security_block_user_enum', $post_array ) ) ? filter_var( $post_array['advana_security_block_user_enum'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_security_auto_lockdown']          = ( array_key_exists( 'advana_security_auto_lockdown', $post_array ) ) ? filter_var( $post_array['advana_security_auto_lockdown'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['advana_security_email_alerts']           = ( array_key_exists( 'advana_security_email_alerts', $post_array ) ) ? filter_var( $post_array['advana_security_email_alerts'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['security_trust_proxy_headers']           = ( array_key_exists( 'security_trust_proxy_headers', $post_array ) ) ? filter_var( $post_array['security_trust_proxy_headers'], \FILTER_VALIDATE_BOOLEAN ) : false;
			$options['security_rate_limit_per_minute']         = ( array_key_exists( 'security_rate_limit_per_minute', $post_array ) ) ? max( 10, min( 3000, absint( $post_array['security_rate_limit_per_minute'] ) ) ) : 1200;
			$options['security_burst_limit']                    = ( array_key_exists( 'security_burst_limit', $post_array ) ) ? max( 5, min( 100, absint( $post_array['security_burst_limit'] ) ) ) : 15;
			$options['security_login_rate_limit']              = ( array_key_exists( 'security_login_rate_limit', $post_array ) ) ? max( 1, min( 50, absint( $post_array['security_login_rate_limit'] ) ) ) : 5;
			$options['security_block_duration']                = ( array_key_exists( 'security_block_duration', $post_array ) ) ? max( 60, min( 86400, absint( $post_array['security_block_duration'] ) ) ) : 300;
			$options['security_event_retention_days']          = ( array_key_exists( 'security_event_retention_days', $post_array ) ) ? max( 7, min( 365, absint( $post_array['security_event_retention_days'] ) ) ) : 90;
			$options['security_ddos_ip_threshold']             = ( array_key_exists( 'security_ddos_ip_threshold', $post_array ) ) ? max( 10, min( 500, absint( $post_array['security_ddos_ip_threshold'] ) ) ) : 50;
			$options['security_ddos_window_minutes']           = ( array_key_exists( 'security_ddos_window_minutes', $post_array ) ) ? max( 1, min( 60, absint( $post_array['security_ddos_window_minutes'] ) ) ) : 5;
			$options['security_brute_force_threshold']         = ( array_key_exists( 'security_brute_force_threshold', $post_array ) ) ? max( 5, min( 200, absint( $post_array['security_brute_force_threshold'] ) ) ) : 20;
			$options['security_brute_force_window_minutes']    = ( array_key_exists( 'security_brute_force_window_minutes', $post_array ) ) ? max( 1, min( 60, absint( $post_array['security_brute_force_window_minutes'] ) ) ) : 10;
			$options['security_escalation_threshold']          = ( array_key_exists( 'security_escalation_threshold', $post_array ) ) ? max( 1, min( 50, absint( $post_array['security_escalation_threshold'] ) ) ) : 3;
			$options['security_escalation_window_minutes']     = ( array_key_exists( 'security_escalation_window_minutes', $post_array ) ) ? max( 5, min( 1440, absint( $post_array['security_escalation_window_minutes'] ) ) ) : 30;
			$options['security_lockdown_duration_minutes']     = ( array_key_exists( 'security_lockdown_duration_minutes', $post_array ) ) ? max( 5, min( 1440, absint( $post_array['security_lockdown_duration_minutes'] ) ) ) : 30;

			return $options;
		}
	}
}