<?php

/**
 * AJAX-Endpunkte fuer Quickstart, Scan-Steuerung, Freigeben/Blockieren
 * externer Hosts und das Speichern der Header-Einstellungen.
 */
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Wp360_Header_Security_Ajax {

	public static function init() {
		add_action( 'wp_ajax_wp360_hs_quickstart', array( __CLASS__, 'quickstart' ) );
		add_action( 'wp_ajax_wp360_hs_save_settings', array( __CLASS__, 'save_settings' ) );
		add_action( 'wp_ajax_wp360_hs_hsts_preload_check', array( __CLASS__, 'hsts_preload_check' ) );
		add_action( 'wp_ajax_wp360_hs_htaccess_test', array( __CLASS__, 'htaccess_test' ) );
		add_action( 'wp_ajax_wp360_hs_htaccess_restore', array( __CLASS__, 'htaccess_restore' ) );
	}

	private static function check_request() {
		check_ajax_referer( 'wp360_hs_nonce', 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( array( 'message' => __( 'You do not have permission to do this.', '360-orbit-header-security' ) ), 403 );
		}
	}


	public static function quickstart() {
		self::check_request();

		$settings = Wp360_Header_Security_Settings::apply_quickstart();

		// Der Quickstart ersetzt die Frontend-Einstellungen, auch den Schalter
		// des .htaccess-Spiegels -- den geschriebenen Block deshalb mit
		// nachziehen, sonst sendet er veraltete Header weiter.
		$result = Wp360_Header_Security_Htaccess::apply( Wp360_Header_Security_Settings::get() );

		wp_send_json_success(
			array(
				'settings'      => $settings,
				'htaccess_test' => $result['test'],
			)
		);
	}


	public static function save_settings() {
		self::check_request();

		$context = isset( $_POST['context'] ) ? sanitize_key( wp_unslash( $_POST['context'] ) ) : ''; // phpcs:ignore
		if ( ! in_array( $context, Wp360_Header_Security_Settings::CONTEXTS, true ) ) {
			wp_send_json_error( array( 'message' => __( 'Unknown context.', '360-orbit-header-security' ) ), 400 );
		}


		$raw = isset( $_POST['settings'] ) ? json_decode( wp_unslash( $_POST['settings'] ), true ) : null; // phpcs:ignore
		if ( ! is_array( $raw ) ) {
			wp_send_json_error( array( 'message' => __( 'Invalid data.', '360-orbit-header-security' ) ), 400 );
		}


		$current             = Wp360_Header_Security_Settings::get();
		$current[ $context ] = $raw;
		$settings            = Wp360_Header_Security_Settings::save( $current );

		$response = array( 'settings' => $settings[ $context ] );

		// Der .htaccess-Spiegel bildet die gesamte Frontend-Konfiguration ab --
		// bei jedem Frontend-Speichern neu schreiben/testen, damit er nie von
		// den sichtbaren Einstellungen abweicht.
		if ( 'frontend' === $context ) {

			$result             = Wp360_Header_Security_Htaccess::apply( $settings );
			$response['htaccess_test'] = $result['test'];
		}

		wp_send_json_success( $response );
	}

	/** Der .htaccess-Spiegel gilt fuer alle aktivierten Header, nicht nur die PRO-CSP -- Selbsttest und Backup gehoeren deshalb zum Free-Umfang. */
	public static function htaccess_test() {
		self::check_request();

		$test = Wp360_Header_Security_Htaccess::self_test();
		update_option( Wp360_Header_Security_Htaccess::OPTION_LAST_TEST, $test, false );

		wp_send_json_success( array( 'test' => $test ) );
	}

	public static function htaccess_restore() {
		self::check_request();

		$test = Wp360_Header_Security_Htaccess::restore_backup();

		wp_send_json_success( array( 'test' => $test ) );
	}

	/** Free-Feature (wie HSTS selbst). */
	public static function hsts_preload_check() {
		self::check_request();

		wp_send_json_success( Wp360_Header_Security_Hsts_Preload::check() );
	}
}