<?php
/**
 * Settings submenu: schedule, retention, alert email, uninstall.
 *
 * @package BRVerify
 */

declare(strict_types=1);

namespace BRVerify\Admin;

use BRVerify\Jobs\Scheduler;
use BRVerify\Plugin;
use BRVerify\Support\Settings;

/**
 * Settings_Page — configuration UI only (no dashboard nags).
 */
final class Settings_Page {

	public const MENU_SLUG = 'brverify-settings';

	/**
	 * Hook suffix returned by add_submenu_page().
	 *
	 * @var string
	 */
	private $hook_suffix = '';

	/**
	 * Wire hooks.
	 */
	public function hooks(): void {
		add_action( 'admin_menu', array( $this, 'register_menu' ) );
		add_action( 'admin_init', array( $this, 'handle_post' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue' ) );
	}

	/**
	 * Submenu under 007AJ Backup Restore Verifier.
	 */
	public function register_menu(): void {
		$hook = add_submenu_page(
			Admin::MENU_SLUG,
			__( '007AJ Backup Restore Verifier Settings', '007aj-backup-restore-verifier' ),
			__( 'Settings', '007aj-backup-restore-verifier' ),
			'manage_brverify',
			self::MENU_SLUG,
			array( $this, 'render' )
		);
		$this->hook_suffix = is_string( $hook ) ? $hook : '';
	}

	/**
	 * Enqueue on settings page only.
	 *
	 * @param string $hook_suffix Hook.
	 */
	public function enqueue( string $hook_suffix ): void {
		if ( '' === $this->hook_suffix || $this->hook_suffix !== $hook_suffix ) {
			return;
		}

		wp_enqueue_style(
			'brverify-admin',
			BRVERIFY_URL . 'assets/css/admin.css',
			array(),
			BRVERIFY_VERSION
		);
	}

	/**
	 * Handle settings save (POST + nonce + capability).
	 */
	public function handle_post(): void {
		if ( ! is_admin() || ! current_user_can( 'manage_brverify' ) ) {
			return;
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$page = isset( $_REQUEST['page'] ) ? sanitize_key( wp_unslash( (string) $_REQUEST['page'] ) ) : '';
		if ( self::MENU_SLUG !== $page ) {
			return;
		}

		if ( empty( $_POST['brverify_settings_action'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
			return;
		}

		$action = sanitize_key( wp_unslash( (string) $_POST['brverify_settings_action'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing

		if ( 'save' === $action ) {
			check_admin_referer( 'brverify_save_settings' );

			$interval  = isset( $_POST['schedule_interval'] ) ? sanitize_key( wp_unslash( (string) $_POST['schedule_interval'] ) ) : 'daily';
			$retention = isset( $_POST['retention_count'] ) ? absint( $_POST['retention_count'] ) : 3;
			$email     = isset( $_POST['alert_email'] ) ? sanitize_email( wp_unslash( (string) $_POST['alert_email'] ) ) : '';

			$delete_data     = ! empty( $_POST['delete_data_on_uninstall'] );
			$pre_update_on   = ! empty( $_POST['pre_update_enabled'] );
			$pre_update_keep = isset( $_POST['pre_update_retention_count'] ) ? absint( $_POST['pre_update_retention_count'] ) : 3;

			$destinations = array( 'local' );
			if ( isset( $_POST['destinations'] ) && is_array( $_POST['destinations'] ) ) {
				$destinations = array();
				foreach ( wp_unslash( $_POST['destinations'] ) as $raw_id ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
					$id = sanitize_key( (string) $raw_id );
					if ( '' !== $id ) {
						$destinations[] = $id;
					}
				}
				$destinations = array_values( array_unique( $destinations ) );
				if ( empty( $destinations ) ) {
					$destinations = array( 'local' );
				}
			}

			Settings::update(
				array(
					'schedule_interval'          => $interval,
					'retention_count'            => max( 1, min( 100, $retention ) ),
					'alert_email'                => $email,
					'delete_data_on_uninstall'   => $delete_data,
					'destinations'               => $destinations,
					'pre_update_enabled'         => $pre_update_on,
					'pre_update_retention_count' => max( 1, min( 50, $pre_update_keep ) ),
				)
			);

			( new Scheduler() )->reschedule();

			wp_safe_redirect(
				add_query_arg(
					array(
						'page'      => self::MENU_SLUG,
						'rp_notice' => 'saved',
					),
					admin_url( 'admin.php' )
				)
			);
			exit;
		}
	}

	/**
	 * Render settings page.
	 */
	public function render(): void {
		if ( ! current_user_can( 'manage_brverify' ) ) {
			wp_die( esc_html__( 'You do not have permission to manage 007AJ Backup Restore Verifier.', '007aj-backup-restore-verifier' ) );
		}

		$settings  = Settings::all();
		$scheduler = new Scheduler();
		$labels    = Settings::interval_labels();
		$notice    = isset( $_GET['rp_notice'] ) ? sanitize_key( wp_unslash( (string) $_GET['rp_notice'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended

		$cron_disabled = defined( 'DISABLE_WP_CRON' ) && DISABLE_WP_CRON;

		?>
		<div class="wrap brverify-admin brverify-settings">
			<h1><?php echo esc_html__( '007AJ Backup Restore Verifier Settings', '007aj-backup-restore-verifier' ); ?></h1>
			<?php do_action( 'brverify_settings_after_title' ); ?>

			<?php if ( 'saved' === $notice ) : ?>
				<div class="notice notice-success is-dismissible"><p><?php echo esc_html__( 'Settings saved. Schedule updated.', '007aj-backup-restore-verifier' ); ?></p></div>
			<?php endif; ?>


			<form method="post" action="" class="brverify-settings-form">
				<?php wp_nonce_field( 'brverify_save_settings' ); ?>
				<input type="hidden" name="brverify_settings_action" value="save" />

				<div class="brverify-settings-card">
					<h2><?php echo esc_html__( 'Backup schedule', '007aj-backup-restore-verifier' ); ?></h2>
					<p class="description">
						<?php echo esc_html__( 'Scheduled backups run on one cadence and include the database and files.', '007aj-backup-restore-verifier' ); ?>
					</p>
					<table class="form-table" role="presentation">
						<tr>
							<th scope="row"><label for="schedule_interval"><?php echo esc_html__( 'Interval', '007aj-backup-restore-verifier' ); ?></label></th>
							<td>
								<select name="schedule_interval" id="schedule_interval">
									<?php foreach ( $labels as $key => $label ) : ?>
										<option value="<?php echo esc_attr( $key ); ?>" <?php selected( Settings::schedule_interval(), $key ); ?>>
											<?php echo esc_html( $label ); ?>
										</option>
									<?php endforeach; ?>
								</select>
								<p class="description">
									<?php
									printf(
										/* translators: %s: next run label */
										esc_html__( 'Next scheduled run: %s', '007aj-backup-restore-verifier' ),
										esc_html( $scheduler->next_run_label() )
									);
									?>
								</p>
								<?php if ( $cron_disabled ) : ?>
									<p class="notice notice-warning inline">
										<?php echo esc_html__( 'DISABLE_WP_CRON is true. Use real system cron to hit wp-cron.php so schedules and job resume ticks fire reliably.', '007aj-backup-restore-verifier' ); ?>
									</p>
								<?php else : ?>
									<p class="description">
										<?php echo esc_html__( 'Tip: on production hosts, prefer system cron hitting wp-cron.php even when WP-Cron spawn is enabled.', '007aj-backup-restore-verifier' ); ?>
									</p>
								<?php endif; ?>
							</td>
						</tr>
					</table>
				</div>


				<div class="brverify-settings-card">
					<h2><?php echo esc_html__( 'Backup destinations', '007aj-backup-restore-verifier' ); ?></h2>
					<?php
					$adapters     = Plugin::instance()->adapters()->all();
					$selected     = Settings::backup_destinations();
					$remote_count = 0;
					foreach ( $adapters as $aid => $_adapter ) {
						if ( 'local' !== $aid ) {
							++$remote_count;
						}
					}
					?>
					<p class="description">
						<?php if ( $remote_count > 0 ) : ?>
							<?php echo esc_html__( 'Select one or more destinations. Keeping Local selected is recommended so a remote failure cannot erase a completed local backup.', '007aj-backup-restore-verifier' ); ?>
						<?php else : ?>
							<?php echo esc_html__( 'Backups are stored locally in a protected folder under wp-content.', '007aj-backup-restore-verifier' ); ?>
						<?php endif; ?>
					</p>
					<table class="form-table" role="presentation">
						<tr>
							<th scope="row"><?php echo esc_html__( 'Destinations', '007aj-backup-restore-verifier' ); ?></th>
							<td>
								<?php foreach ( $adapters as $aid => $adapter ) : ?>
									<?php
									$checked = in_array( $aid, $selected, true );
									$locked  = ( 'local' === $aid && 0 === $remote_count );
									?>
									<label class="brverify-block">
										<input type="checkbox"
											name="destinations[]"
											value="<?php echo esc_attr( $aid ); ?>"
											<?php checked( $checked || $locked ); ?>
											<?php disabled( $locked ); ?> />
										<?php echo esc_html( $adapter->label() ); ?>
										<code><?php echo esc_html( $aid ); ?></code>
									</label>
								<?php endforeach; ?>
								<?php if ( 0 === $remote_count ) : ?>
									<input type="hidden" name="destinations[]" value="local" />
								<?php endif; ?>
							</td>
						</tr>
					</table>
				</div>

				<div class="brverify-settings-card">
					<h2><?php echo esc_html__( 'Retention', '007aj-backup-restore-verifier' ); ?></h2>
					<table class="form-table" role="presentation">
						<tr>
							<th scope="row"><label for="retention_count"><?php echo esc_html__( 'Keep last N local backups', '007aj-backup-restore-verifier' ); ?></label></th>
							<td>
								<input type="number" name="retention_count" id="retention_count" min="1" max="100" step="1"
									value="<?php echo esc_attr( (string) (int) $settings['retention_count'] ); ?>" class="small-text" />
								<p class="description"><?php echo esc_html__( 'Oldest local artifacts beyond N are pruned after each successful backup. When incremental chains are present, parents still required by a kept child are never pruned.', '007aj-backup-restore-verifier' ); ?></p>
								<p class="description">
									<?php echo esc_html__( 'After each successful backup, oldest local artifacts beyond N are deleted (disk + database rows). Default 3.', '007aj-backup-restore-verifier' ); ?>
								</p>
							</td>
						</tr>
					</table>
				</div>

				<div class="brverify-settings-card" id="brverify-pre-update">
					<h2><?php echo esc_html__( 'Pre-update backups', '007aj-backup-restore-verifier' ); ?></h2>
					<p class="description">
						<?php echo esc_html__( 'Optional and OFF by default. When enabled, 007AJ Backup Restore Verifier takes one local backup (database + plugins + themes) right before WordPress installs plugin, theme, or core updates — manual, bulk, or automatic. A bulk update produces a single backup, and a backup taken in the last few minutes is reused. Backups stay on this server; nothing is sent anywhere. If the backup fails, the update still proceeds and you see a warning.', '007aj-backup-restore-verifier' ); ?>
					</p>
					<table class="form-table" role="presentation">
						<tr>
							<th scope="row"><?php echo esc_html__( 'Enable', '007aj-backup-restore-verifier' ); ?></th>
							<td>
								<label for="pre_update_enabled">
									<input type="checkbox" name="pre_update_enabled" id="pre_update_enabled" value="1"
										<?php checked( Settings::pre_update_enabled() ); ?> />
									<?php echo esc_html__( 'Back up automatically before plugin, theme, and core updates', '007aj-backup-restore-verifier' ); ?>
								</label>
								<p class="description"><?php echo esc_html__( 'This adds time and disk usage to each update run. Uploads are not included in pre-update backups to keep them fast; scheduled backups still cover them.', '007aj-backup-restore-verifier' ); ?></p>
							</td>
						</tr>
						<tr>
							<th scope="row"><label for="pre_update_retention_count"><?php echo esc_html__( 'Keep last N pre-update backups', '007aj-backup-restore-verifier' ); ?></label></th>
							<td>
								<input type="number" name="pre_update_retention_count" id="pre_update_retention_count" min="1" max="50" step="1"
									value="<?php echo esc_attr( (string) Settings::pre_update_retention_count() ); ?>" class="small-text" />
								<p class="description"><?php echo esc_html__( 'A separate cap (default 3) so pre-update backups never crowd out your scheduled backups, and scheduled retention never deletes them.', '007aj-backup-restore-verifier' ); ?></p>
							</td>
						</tr>
					</table>
					<?php if ( has_filter( 'brverify_pre_update_policy' ) ) : ?>
						<p class="description"><?php echo esc_html__( 'An add-on is adjusting pre-update options (see its settings page).', '007aj-backup-restore-verifier' ); ?></p>
					<?php endif; ?>
				</div>

				<div class="brverify-settings-card">
					<h2><?php echo esc_html__( 'Failure alerts', '007aj-backup-restore-verifier' ); ?></h2>
					<table class="form-table" role="presentation">
						<tr>
							<th scope="row"><label for="alert_email"><?php echo esc_html__( 'Alert email', '007aj-backup-restore-verifier' ); ?></label></th>
							<td>
								<input type="email" name="alert_email" id="alert_email" class="regular-text"
									value="<?php echo esc_attr( (string) $settings['alert_email'] ); ?>"
									placeholder="<?php echo esc_attr( (string) get_option( 'admin_email' ) ); ?>" />
								<p class="description">
									<?php echo esc_html__( 'Leave blank to use the site admin email. Sent via wp_mail only — no external ESP.', '007aj-backup-restore-verifier' ); ?>
								</p>
							</td>
						</tr>
					</table>
				</div>

				<div class="brverify-settings-card">
					<h2><?php echo esc_html__( 'Uninstall', '007aj-backup-restore-verifier' ); ?></h2>
					<table class="form-table" role="presentation">
						<tr>
							<th scope="row"><?php echo esc_html__( 'Data on uninstall', '007aj-backup-restore-verifier' ); ?></th>
							<td>
								<label for="delete_data_on_uninstall">
									<input type="checkbox" name="delete_data_on_uninstall" id="delete_data_on_uninstall" value="1"
										<?php checked( Settings::delete_data_on_uninstall() ); ?> />
									<?php echo esc_html__( 'Delete all data when the plugin is deleted (settings, history and the backup files)', '007aj-backup-restore-verifier' ); ?>
								</label>
								<p class="description">
									<?php echo esc_html__( 'Off by default: deleting the plugin removes its scheduled events but keeps your settings, backup history and the backup files in uploads/brverify-working/. Turn this on only if you want everything removed, including the backups, when the plugin is deleted.', '007aj-backup-restore-verifier' ); ?>
								</p>
							</td>
						</tr>
					</table>
				</div>

				<?php submit_button( __( 'Save settings', '007aj-backup-restore-verifier' ) ); ?>
			</form>
		</div>
		<?php
	}
}