<?php
/**
 * Switches off the 2.6 front-end handlers that 3.0 replaces and keeps 2.6
 * links working.
 *
 *  - The 2.6 AJAX save (mortgate_application_data_save) trusted a browser-sent
 *    record ID and emailed whoever owned a typed address; it now refuses.
 *  - 2.6 edit links (?ma_mode=ma_edit&id=&token=) open the 3.0 form at the
 *    applicant's last step instead of the 2.6 popup.
 *
 * @package mortgage_application
 */

namespace Mapp\Legacy;

use Mapp\Application\Repository;
use Mapp\Application\Tokens;
use Mapp\Frontend\Shortcode;

defined( 'ABSPATH' ) || exit;

class Compat {

	/** Wire hooks. */
	public static function register() {
		add_action( 'init', array( __CLASS__, 'unhook_legacy' ), 1 );
		add_action( 'template_redirect', array( __CLASS__, 'legacy_edit_link' ) );
		add_filter( 'register_post_type_args', array( __CLASS__, 'private_post_types' ), 10, 2 );
		add_filter( 'wp_sitemaps_post_types', array( __CLASS__, 'drop_from_sitemaps' ) );
	}

	/**
	 * 2.6 registered applications as a public post type, so titles (name and
	 * email) were reachable on the front end, in site search and in
	 * wp-sitemap.xml. Keep them admin-only.
	 *
	 * @param array  $args      Post type args.
	 * @param string $post_type Post type.
	 * @return array
	 */
	public static function private_post_types( $args, $post_type ) {
		if ( in_array( $post_type, array( 'mortgage_application', 'mapp_file_uploads' ), true ) ) {
			$args['public']              = false;
			$args['publicly_queryable']  = false;
			$args['exclude_from_search'] = true;
			$args['show_in_nav_menus']   = false;
			$args['show_in_rest']        = false;
			$args['has_archive']         = false;
			$args['rewrite']             = false;
			$args['query_var']           = false;
			$args['show_ui']             = true;
		}
		if ( 'mortgage_application' === $post_type ) {
			$args['menu_icon'] = \Mapp\Admin\Icon::data_uri();
			if ( isset( $args['labels'] ) && is_array( $args['labels'] ) ) {
				$args['labels']['edit_item'] = __( 'Application', '1003-mortgage-application' );
			}
		}
		return $args;
	}

	/**
	 * @param array $post_types Sitemap post types.
	 * @return array
	 */
	public static function drop_from_sitemaps( $post_types ) {
		unset( $post_types['mortgage_application'], $post_types['mapp_file_uploads'] );
		return $post_types;
	}

	/** Remove 2.6 handlers. */
	public static function unhook_legacy() {
		remove_action( 'wp_ajax_mortgate_application_data_save', 'mapp_mortgate_application_data_save_callback' );
		remove_action( 'wp_ajax_nopriv_mortgate_application_data_save', 'mapp_mortgate_application_data_save_callback' );
		add_action( 'wp_ajax_mortgate_application_data_save', array( __CLASS__, 'legacy_save_refused' ) );
		add_action( 'wp_ajax_nopriv_mortgate_application_data_save', array( __CLASS__, 'legacy_save_refused' ) );
		remove_action( 'wp_footer', 'mapp_mortgate_application_add_edit_form' );
	}

	/** A page cached with the 2.6 form posted to the old endpoint. */
	public static function legacy_save_refused() {
		wp_send_json_error( __( 'This form has been updated. Please refresh the page and try again.', '1003-mortgage-application' ), 410 );
	}

	/**
	 * Open a 2.6 edit link in the 3.0 form.
	 */
	public static function legacy_edit_link() {
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- the HMAC token is the check.
		if ( ! isset( $_GET['ma_mode'], $_GET['id'], $_GET['token'] ) || 'ma_edit' !== $_GET['ma_mode'] ) {
			return;
		}
		$id    = (int) $_GET['id'];
		$token = sanitize_text_field( wp_unslash( $_GET['token'] ) );
		// phpcs:enable
		if ( ! function_exists( 'mapp_verify_edit_token' ) || ! Repository::exists( $id ) || ! mapp_verify_edit_token( $id, $token ) ) {
			wp_die( esc_html__( 'This link is invalid or has expired.', '1003-mortgage-application' ), 403 );
		}
		// 2.6 edit tokens never expire on their own: honor revocation, and stop
		// them once the application has been idle longer than a resume link lasts.
		$last = max( (int) get_post_meta( $id, 'mapp_updated_at', true ), (int) get_post_time( 'U', true, $id ) );
		if ( '' !== (string) get_post_meta( $id, 'mapp_links_revoked_at', true ) || $last < time() - Tokens::lifetime() ) {
			wp_die( esc_html__( 'This link is invalid or has expired. Ask your loan officer for a new one.', '1003-mortgage-application' ), 403 );
		}
		if ( Repository::STAGE_FULL_SUBMITTED === Repository::stage( $id ) ) {
			wp_die( esc_html__( 'This application has been submitted. Contact your loan officer to make changes.', '1003-mortgage-application' ), 200 );
		}
		$resume = $id . '.' . Tokens::issue( $id, 'link' );
		$page   = (int) get_post_meta( $id, 'mapp_page_id', true );
		if ( $page && get_permalink( $page ) ) {
			nocache_headers();
			wp_safe_redirect( get_permalink( $page ) . '#mapp-resume=' . rawurlencode( $resume ) );
			exit;
		}
		// 2.6 applications have no page on record: show the form in an overlay here.
		// The page now carries a resume token, so it must never be cached.
		nocache_headers();
		if ( ! defined( 'DONOTCACHEPAGE' ) ) {
			define( 'DONOTCACHEPAGE', true );
		}
		add_action(
			'wp_footer',
			function () use ( $resume ) {
				echo '<div class="mapp-overlay" role="dialog" aria-modal="true"><div class="mapp-overlay__inner">';
				echo '<a class="mapp-overlay__close" href="' . esc_url( home_url( '/' ) ) . '" aria-label="' . esc_attr__( 'Close', '1003-mortgage-application' ) . '">×</a>';
				echo Shortcode::render( array( 'resume' => $resume ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
				echo '</div></div>';
			}
		);
	}
}