<?php
/**
 * Core: Data Export Engine (CSV)
 *
 * This class fulfills the "Data Ownership" promise by allowing administrators
 * to securely export their form submissions to a portable CSV file.
 * UPDATED: Now supports smart label translation and dynamic filtering (Form ID, Dates).
 *
 * @package    24TT_Unrestricted_Forms
 * @subpackage 24TT_Unrestricted_Forms/includes
 * @since      1.1.0
 * Contributors: 24techtime, johniouspatriot
 */

// SECURITY FIRST: Prevent Direct Access
if ( ! defined( 'ABSPATH' ) ) {
    exit( 'Direct script access denied.' );
}

/**
 * TT24_Export Class
 * Handles the extraction and formatting of custom database entries into a CSV file.
 */
class TT24_Export {

    /**
     * Initialize the export hooks.
     * @since 1.0.0
     * @return void
     */
    public function init() {
        // Hook into admin_init to listen for our custom export query parameters.
        add_action( 'admin_init', array( $this, 'process_export' ) );
    }

    /**
     * Process the CSV export request.
     * @since 1.1.0
     * @return void
     */
    public function process_export() {
        // 1. Check if an export was requested via the URL parameter
        if ( ! isset( $_GET['tt24_action'] ) || $_GET['tt24_action'] !== 'export_csv' ) {
            return; 
        }

        // 2. WALL 1: Security & Capability Check
        if ( ! current_user_can( 'view_tt24_entries' ) ) {
            wp_die( esc_html__( 'You do not have permission to export entries.', '24tt-unrestricted-forms' ) );
        }

        // 3. WALL 2: Nonce Verification
        // FIX: Added sanitize_text_field( wp_unslash() ) around the nonce per WP Review Team.
        if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'tt24_export_secure' ) ) {
            wp_die( esc_html__( 'Security check failed. Please refresh the dashboard and try again.', '24tt-unrestricted-forms' ) );
        }

        global $wpdb;

        $table_entries      = $wpdb->prefix . 'tt24_entries';
        $table_entry_fields = $wpdb->prefix . 'tt24_entry_fields';
        $table_forms        = $wpdb->prefix . 'tt24_forms';

        // 4. SMART FILTERS: Build the dynamic WHERE clause
        $where_clauses = array("1=1");
        $query_args = array();

        // Filter by Form ID
        if ( isset( $_GET['filter_form_id'] ) && absint( $_GET['filter_form_id'] ) > 0 ) {
            $where_clauses[] = "e.form_id = %d";
            $query_args[] = absint( $_GET['filter_form_id'] );
        }

        // Filter by Start Date
        if ( ! empty( $_GET['start_date'] ) ) {
            $where_clauses[] = "e.created_at >= %s";
            $query_args[] = sanitize_text_field( $_GET['start_date'] ) . ' 00:00:00';
        }

        // Filter by End Date
        if ( ! empty( $_GET['end_date'] ) ) {
            $where_clauses[] = "e.created_at <= %s";
            $query_args[] = sanitize_text_field( $_GET['end_date'] ) . ' 23:59:59';
        }

        $where_sql = implode(' AND ', $where_clauses);

        // 5. Fetch the Parent Entries (now pulling form_settings for translation)
        $sql = "
            SELECT e.id, e.form_id, e.ip_address, e.created_at, f.title as form_name, f.form_settings 
            FROM {$table_entries} e
            LEFT JOIN {$table_forms} f ON e.form_id = f.id
            WHERE {$where_sql}
            ORDER BY e.created_at DESC
        ";

        // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared
        // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
        // phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
        if ( ! empty( $query_args ) ) {
            $entries = $wpdb->get_results( $wpdb->prepare( $sql, ...$query_args ), ARRAY_A );
        } else {
            $entries = $wpdb->get_results( $sql, ARRAY_A );
        }
        // phpcs:enable

        if ( empty( $entries ) ) {
            wp_safe_redirect( admin_url( 'admin.php?page=tt24-forms-entries&error=no_data' ) );
            exit;
        }

        // 6. Build the Translation Dictionary from the fetched entries
        $field_dictionary = array();
        $entry_ids = array();

        foreach ( $entries as $entry ) {
            $entry_ids[] = $entry['id']; // Collect IDs for the child query

            if ( ! empty( $entry['form_settings'] ) ) {
                $parsed = json_decode( $entry['form_settings'], true );
                $layout = array();
                
                if ( is_array( $parsed ) ) {
                    $layout = isset( $parsed['layout'] ) ? (is_array( $parsed['layout']) ? $parsed['layout'] : array()) : $parsed;
                }

                foreach ( $layout as $field ) {
                    if ( isset( $field['name'] ) && isset( $field['label'] ) ) {
                        $field_dictionary[ $field['name'] ] = $field['label'];
                    }
                }
            }
        }

        // 7. Fetch Child Field Data ONLY for the filtered entries
        $in_ids = implode( ',', array_map( 'absint', $entry_ids ) );
        
        // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
        // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
        // phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
        $fields_data = $wpdb->get_results( "SELECT entry_id, field_name, field_value FROM {$table_entry_fields} WHERE entry_id IN ({$in_ids})", ARRAY_A );
        // phpcs:enable
        
        $mapped_fields = array();
        $unique_headers = array();

        foreach ( $fields_data as $field ) {
            $e_id = $field['entry_id'];
            $f_name = $field['field_name'];
            
            $mapped_fields[ $e_id ][ $f_name ] = $field['field_value'];
            
            if ( ! in_array( $f_name, $unique_headers, true ) ) {
                $unique_headers[] = $f_name;
            }
        }

        // 8. Prepare the HTTP Headers for Download
        $site_name = sanitize_title( get_bloginfo( 'name' ) );
        $filename  = sprintf( '24tt-export-%s-%s.csv', $site_name, gmdate( 'Y-m-d' ) );

        if ( ob_get_length() ) {
            ob_clean();
        }

        header( 'Content-Type: text/csv; charset=UTF-8' );
        header( 'Content-Disposition: attachment; filename="' . $filename . '"' );
        header( 'Pragma: no-cache' );
        header( 'Expires: 0' );

        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
        $output = fopen( 'php://output', 'w' );

        // Add UTF-8 BOM so Excel reads special characters correctly
        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fputs
        fputs( $output, "\xEF\xBB\xBF" );

        // 9. Write the CSV Column Headers (WITH TRANSLATION)
        $csv_headers = array( 'Entry ID', 'Form Name', 'Date Submitted', 'IP Address' );
        
        foreach ( $unique_headers as $header ) {
            if ( isset( $field_dictionary[ $header ] ) ) {
                $csv_headers[] = $field_dictionary[ $header ]; // Use beautiful label!
            } else {
                $csv_headers[] = ucwords( str_replace( array( '_', '-' ), ' ', $header ) ); // Smart fallback
            }
        }
        
        fputcsv( $output, $csv_headers );

        // 10. Write the Rows of Data
        foreach ( $entries as $entry ) {
            $row = array(
                $entry['id'],
                $entry['form_name'],
                $entry['created_at'],
                $entry['ip_address']
            );

            foreach ( $unique_headers as $header ) {
                if ( isset( $mapped_fields[ $entry['id'] ][ $header ] ) ) {
                    $row[] = $mapped_fields[ $entry['id'] ][ $header ];
                } else {
                    $row[] = '';
                }
            }

            fputcsv( $output, $row );
        }

        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
        fclose( $output );
        exit;
    }
}

// Instantiate and initialize the export class securely
$tt24_export = new TT24_Export();
$tt24_export->init();