<?php
/**
 * Export the latest scan results as CSV or a printable HTML report.
 *
 * A true binary PDF would require bundling a heavy PDF library. Instead we
 * generate a clean, print-styled HTML report the browser can "Save as PDF"
 * with one keystroke — no third-party dependency, identical end result.
 *
 * @package AardwolfSecurityScanner
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Class Aardwolf_Export.
 */
class Aardwolf_Export {

	/**
	 * Register the admin-post handler.
	 */
	public function __construct() {
		add_action( 'admin_post_aardwolf_sc_export', array( $this, 'handle' ) );
	}

	/**
	 * URL for an export link of the given format.
	 *
	 * @param string $format 'csv' or 'pdf'.
	 * @return string
	 */
	public static function url( $format ) {
		return wp_nonce_url(
			add_query_arg(
				array(
					'action' => 'aardwolf_sc_export',
					'format' => $format,
				),
				admin_url( 'admin-post.php' )
			),
			'aardwolf_sc_export',
			'_aardwolf_nonce'
		);
	}

	/**
	 * Handle the export request.
	 */
	public function handle() {
		if ( ! current_user_can( AARDWOLF_SC_CAPABILITY ) ) {
			wp_die( esc_html__( 'You do not have permission to export results.', 'aardwolf-security-scanner' ), '', array( 'response' => 403 ) );
		}

		check_admin_referer( 'aardwolf_sc_export', '_aardwolf_nonce' );

		$payload = Aardwolf_Scanner::get_last_scan();
		if ( empty( $payload ) || empty( $payload['results'] ) ) {
			wp_die( esc_html__( 'There is no scan to export yet. Run a scan first.', 'aardwolf-security-scanner' ) );
		}

		$format = isset( $_GET['format'] ) ? sanitize_key( wp_unslash( $_GET['format'] ) ) : 'csv';

		if ( 'pdf' === $format || 'html' === $format ) {
			$this->render_html_report( $payload );
		} else {
			$this->render_csv( $payload );
		}
		exit;
	}

	/**
	 * Stream the results as a CSV download.
	 *
	 * @param array $payload Scan payload.
	 */
	protected function render_csv( $payload ) {
		$filename = 'aardwolf-security-scan-' . gmdate( 'Y-m-d', (int) ( $payload['timestamp'] ?? time() ) ) . '.csv';

		nocache_headers();
		header( 'Content-Type: text/csv; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename="' . $filename . '"' );

		$rows = array(
			array( 'Category', 'Check', 'Status', 'Severity', 'Summary', 'Recommended fix', 'Reference' ),
		);

		foreach ( $payload['results'] as $r ) {
			$rows[] = array(
				$r['category'],
				$r['label'],
				Aardwolf_Admin::status_label( $r['status'] ),
				Aardwolf_Admin::severity_label( $r['severity'] ),
				$this->clean( $r['summary'] ),
				$this->clean( $r['remediation'] ),
				$r['reference'],
			);
		}

		$lines = array();
		foreach ( $rows as $row ) {
			$lines[] = implode( ',', array_map( array( $this, 'csv_field' ), $row ) );
		}

		// UTF-8 BOM so spreadsheet apps read accented characters correctly,
		// then CRLF-separated rows per RFC 4180. This is a file download, not
		// HTML, so the payload is not HTML-escaped.
		echo "\xEF\xBB\xBF" . implode( "\r\n", $lines ) . "\r\n"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CSV file download (text/csv), not HTML; fields are CSV-quoted via csv_field(). HTML escaping would corrupt the data.
	}

	/**
	 * Quote and escape a single CSV field per RFC 4180.
	 *
	 * @param string $value Raw field value.
	 * @return string
	 */
	protected function csv_field( $value ) {
		return '"' . str_replace( '"', '""', (string) $value ) . '"';
	}

	/**
	 * Output a self-contained, print-ready HTML report.
	 *
	 * @param array $payload Scan payload.
	 */
	protected function render_html_report( $payload ) {
		$summary    = isset( $payload['summary'] ) ? $payload['summary'] : array();
		$score      = isset( $summary['score'] ) ? (int) $summary['score'] : 0;
		$grade      = isset( $summary['grade'] ) ? $summary['grade'] : '';
		$site_name  = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
		$site_url   = home_url( '/' );
		$scanned_at = isset( $payload['timestamp'] )
			? wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $payload['timestamp'] )
			: '';

		// Group by category.
		$grouped = array();
		foreach ( $payload['results'] as $r ) {
			$grouped[ $r['category'] ][] = $r;
		}

		nocache_headers();
		header( 'Content-Type: text/html; charset=utf-8' );

		// Register the report stylesheet and let WordPress print the tag, so the
		// asset goes through wp_enqueue_style() rather than a hard-coded <link>.
		wp_register_style( 'aardwolf-sc-report', AARDWOLF_SC_URL . 'assets/css/report.css', array(), AARDWOLF_SC_VERSION );
		wp_enqueue_style( 'aardwolf-sc-report' );

		// The report is a complete standalone document, so we echo raw markup
		// here rather than going through the admin template system. All dynamic
		// values are escaped.
		?><!DOCTYPE html>
<html lang="<?php echo esc_attr( str_replace( '_', '-', get_locale() ) ); ?>">
<head>
	<meta charset="utf-8" />
	<meta name="viewport" content="width=device-width, initial-scale=1" />
	<title><?php echo esc_html( sprintf( 'Security report — %s', $site_name ) ); ?></title>
	<?php wp_print_styles( 'aardwolf-sc-report' ); ?>
</head>
<body>
	<div class="report">
		<p class="print-hint"><?php esc_html_e( 'To save this report as a PDF, use your browser’s Print option (Ctrl/Cmd + P) and choose “Save as PDF”.', 'aardwolf-security-scanner' ); ?></p>

		<?php
		if ( $score >= 80 ) {
			$band = 'good';
		} elseif ( $score >= 50 ) {
			$band = 'warn';
		} else {
			$band = 'bad';
		}
		?>

		<div class="head">
			<div class="head-brand">
				<img class="brand-logo" src="<?php echo esc_url( Aardwolf_Admin::logo_url( 'horizontal-blue' ) ); ?>" alt="Aardwolf Security" />
				<h1><?php esc_html_e( 'Security Report', 'aardwolf-security-scanner' ); ?></h1>
				<div class="meta">
					<?php echo esc_html( $site_name ); ?> — <?php echo esc_html( $site_url ); ?><br />
					<?php
					if ( $scanned_at ) {
						/* translators: %s: date/time. */
						echo esc_html( sprintf( __( 'Scanned: %s', 'aardwolf-security-scanner' ), $scanned_at ) );
					}
					?>
				</div>
			</div>
			<div class="score">
				<div class="num <?php echo esc_attr( $band ); ?>"><?php echo esc_html( $score ); ?></div>
				<div class="grade <?php echo esc_attr( $band ); ?>"><?php echo esc_html( sprintf( 'Grade %s', $grade ) ); ?></div>
			</div>
		</div>

		<ul class="stats">
			<li><strong class="bad"><?php echo esc_html( (int) ( $summary['fail'] ?? 0 ) ); ?></strong><span><?php esc_html_e( 'Failed', 'aardwolf-security-scanner' ); ?></span></li>
			<li><strong class="warn"><?php echo esc_html( (int) ( $summary['warning'] ?? 0 ) ); ?></strong><span><?php esc_html_e( 'Warnings', 'aardwolf-security-scanner' ); ?></span></li>
			<li><strong class="good"><?php echo esc_html( (int) ( $summary['pass'] ?? 0 ) ); ?></strong><span><?php esc_html_e( 'Passed', 'aardwolf-security-scanner' ); ?></span></li>
			<li><strong><?php echo esc_html( (int) ( $summary['total'] ?? 0 ) ); ?></strong><span><?php esc_html_e( 'Checks', 'aardwolf-security-scanner' ); ?></span></li>
		</ul>

		<?php foreach ( $grouped as $category => $items ) : ?>
			<h2 class="cat"><?php echo esc_html( $category ); ?></h2>
			<?php foreach ( $items as $r ) : $status = $r['status']; ?>
				<div class="finding <?php echo esc_attr( $status ); ?>">
					<span class="title"><?php echo esc_html( $r['label'] ); ?></span>
					<span class="badge b-<?php echo esc_attr( $status ); ?>"><?php echo esc_html( Aardwolf_Admin::status_label( $status ) ); ?></span>
					<?php if ( Aardwolf_Check_Result::STATUS_PASS !== $status && Aardwolf_Check_Result::STATUS_INFO !== $status ) : ?>
						<span class="badge b-<?php echo esc_attr( $status ); ?>"><?php echo esc_html( Aardwolf_Admin::severity_label( $r['severity'] ) . ' risk' ); ?></span>
					<?php endif; ?>
					<?php if ( ! empty( $r['summary'] ) ) : ?>
						<p class="summary-text"><?php echo nl2br( esc_html( $r['summary'] ) ); ?></p>
					<?php endif; ?>
					<?php if ( ! empty( $r['remediation'] ) ) : ?>
						<div class="fix"><b><?php esc_html_e( 'Recommended fix', 'aardwolf-security-scanner' ); ?></b><br /><?php echo nl2br( esc_html( $r['remediation'] ) ); ?></div>
					<?php endif; ?>
				</div>
			<?php endforeach; ?>
		<?php endforeach; ?>

		<div class="foot">
			<?php esc_html_e( 'Generated by Aardwolf Security Scanner. Automated checks are a first line of defence, not a substitute for a manual penetration test.', 'aardwolf-security-scanner' ); ?>
			aardwolfsecurity.com
		</div>
	</div>
</body>
</html>
		<?php
	}

	/**
	 * Flatten multi-line summary/remediation text for CSV cells.
	 *
	 * @param string $text Raw text.
	 * @return string
	 */
	protected function clean( $text ) {
		return trim( preg_replace( '/\s+/', ' ', wp_strip_all_tags( (string) $text ) ) );
	}
}