<?php

if (!defined('ABSPATH')) {
    exit;
}

// The mini page is always admin.php?page=abc-integrity-mini, whether it is a
// top-level page or nested under the Direct edition's menu.
define('ABC_INTEGRITY_MINI_ADMIN_PAGE_SLUG', 'abc-integrity-mini');

// Mini v1.0.3's page slug. Direct v0.3 owns it, so it is only redirected when
// that edition isn't active.
define('ABC_INTEGRITY_MINI_LEGACY_ADMIN_PAGE_SLUG', 'abc-integrity');

// Before WordPress rejects unregistered pages at the end of menu building.
add_action('admin_menu', 'abc_integrity_mini_maybe_redirect_legacy_admin_page', 0);
// After Direct registers its menu at the default priority.
add_action('admin_menu', 'abc_integrity_mini_register_admin_page', 20);
add_action('admin_enqueue_scripts', 'abc_integrity_mini_enqueue_assets');
add_action('admin_notices', 'abc_integrity_mini_render_rescan_notice');
add_filter(
    'plugin_action_links_' . plugin_basename(ABC_INTEGRITY_MINI_PLUGIN_FILE),
    'abc_integrity_mini_add_plugin_action_links'
);

function abc_integrity_mini_get_admin_page_url(): string {
    return admin_url('admin.php?page=' . ABC_INTEGRITY_MINI_ADMIN_PAGE_SLUG);
}

/**
 * The hook suffix WordPress returned when the mini page was registered, or ''
 * before registration (or when registration was refused).
 */
function abc_integrity_mini_get_page_hook(): string {
    $hook = $GLOBALS['abc_integrity_mini_page_hook'] ?? '';
    return is_string($hook) ? $hook : '';
}

/**
 * The Direct edition's main menu slug when its full single-site UI is running
 * and has registered that menu, or null when mini should stay top-level.
 *
 * Direct v0.3 names its slug with abc_integrity_get_admin_page_slug(); it is
 * checked first because v0.3 still declares abc_integrity_add_admin_page().
 * Direct v0.2.2 has no slug helper and always used abc-integrity-scanner.
 * Multisite (abc-integrity-unsupported) and unrecognized builds return null.
 */
function abc_integrity_mini_get_direct_parent_slug(): ?string {
    if (!function_exists('abc_integrity_should_boot_full_plugin') || !abc_integrity_should_boot_full_plugin()) {
        return null;
    }

    if (function_exists('abc_integrity_get_admin_page_slug')) {
        $parent = abc_integrity_get_admin_page_slug();
    } elseif (function_exists('abc_integrity_add_admin_page')) {
        $parent = 'abc-integrity-scanner';
    } else {
        return null;
    }

    // Only attach to a parent Direct has actually registered this request.
    if (!is_string($parent) || $parent === ABC_INTEGRITY_MINI_ADMIN_PAGE_SLUG || !isset($GLOBALS['admin_page_hooks'][$parent])) {
        return null;
    }

    return $parent;
}

/**
 * Whether the Direct edition owns mini's legacy abc-integrity route. Direct
 * v0.3 and later declare abc_integrity_get_admin_page_slug(); while one is
 * active, the route is left to it even if its full UI didn't boot.
 */
function abc_integrity_mini_direct_owns_legacy_route(): bool {
    return function_exists('abc_integrity_get_admin_page_slug');
}

/**
 * Where a legacy mini page request should be redirected, or null when it
 * shouldn't be. Pure, so it can be tested without sending headers.
 *
 * Only a GET request to admin.php?page=abc-integrity, outside AJAX, by a user
 * who can manage options, is redirected, and only while Direct doesn't own the
 * route. The target is always the bare mini page: the mini page has no detail
 * views, so no other query argument is read or kept.
 *
 * @param string $page   Sanitized page slug, or '' when absent or not a string
 * @param string $method Sanitized request method, or '' when unavailable
 */
function abc_integrity_mini_get_legacy_admin_redirect_url(string $page, string $script, string $method, bool $isAjax, bool $canManage, bool $directOwnsRoute): ?string {
    if ($directOwnsRoute || $script !== 'admin.php' || strtoupper($method) !== 'GET' || $isAjax || !$canManage) {
        return null;
    }
    if ($page !== ABC_INTEGRITY_MINI_LEGACY_ADMIN_PAGE_SLUG) {
        return null;
    }

    return abc_integrity_mini_get_admin_page_url();
}

function abc_integrity_mini_maybe_redirect_legacy_admin_page(): void {
    // Only the page slug is read, to decide a read-only redirect; there is no
    // form submission to verify.
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only redirect decision.
    $page = isset($_GET['page']) && is_string($_GET['page']) ? sanitize_key(wp_unslash($_GET['page'])) : '';
    $method = isset($_SERVER['REQUEST_METHOD']) && is_string($_SERVER['REQUEST_METHOD'])
        ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_METHOD']))
        : '';

    $target = abc_integrity_mini_get_legacy_admin_redirect_url(
        $page,
        (string) ($GLOBALS['pagenow'] ?? ''),
        $method,
        wp_doing_ajax(),
        current_user_can('manage_options'),
        abc_integrity_mini_direct_owns_legacy_route()
    );

    if ($target !== null && wp_safe_redirect($target)) {
        exit;
    }
}

function abc_integrity_mini_add_plugin_action_links(array $links): array {
    if (!current_user_can('manage_options')) {
        return $links;
    }

    $scanLink = sprintf(
        '<a href="%s">%s</a>',
        esc_url(abc_integrity_mini_get_admin_page_url()),
        esc_html__('Run core scan', 'abc-integrity')
    );

    return ['abc-integrity-mini-run-core-scan' => $scanLink] + $links;
}

function abc_integrity_mini_render_rescan_notice(): void {
    if (!current_user_can('manage_options')) {
        return;
    }

    $pageHook = abc_integrity_mini_get_page_hook();
    $screen   = get_current_screen();
    if ($pageHook !== '' && is_object($screen) && ($screen->id ?? '') === $pageHook) {
        return;
    }

    $version       = (string) get_bloginfo('version');
    $rescanContext = abc_integrity_mini_get_rescan_context(abc_integrity_mini_get_scan_results(), $version);
    if ($rescanContext === null) {
        return;
    }

    $previousVersion = $rescanContext['previous_version'];
    $currentVersion  = $rescanContext['current_version'];

    if ($previousVersion !== '' && $previousVersion === $currentVersion) {
        $message = sprintf(
            /* translators: %s: Current WordPress version. */
            __('WordPress core was reinstalled. ABC Integrity needs a new scan for WordPress %s.', 'abc-integrity'),
            $currentVersion
        );
    } elseif ($previousVersion !== '') {
        $message = sprintf(
            /* translators: 1: Previous WordPress version, 2: current WordPress version. */
            __('WordPress was updated from version %1$s to %2$s. ABC Integrity needs a new core scan.', 'abc-integrity'),
            $previousVersion,
            $currentVersion
        );
    } else {
        $message = sprintf(
            /* translators: %s: Current WordPress version. */
            __('WordPress core was updated. ABC Integrity needs a new scan for WordPress %s.', 'abc-integrity'),
            $currentVersion
        );
    }

    printf(
        '<div class="notice notice-warning abc-integrity-mini-rescan-notice"><p>%1$s <a href="%2$s">%3$s</a></p></div>',
        esc_html($message),
        esc_url(abc_integrity_mini_get_admin_page_url()),
        esc_html__('Run core scan', 'abc-integrity')
    );
}

/**
 * Register the mini page: nested as "Integrity Mini" under a running Direct
 * edition's menu, otherwise as the top-level "ABC Integrity" page. The two
 * calls return different hook suffixes, so the one returned is saved for the
 * asset and notice checks.
 */
function abc_integrity_mini_register_admin_page(): void {
    $parent = abc_integrity_mini_get_direct_parent_slug();

    if ($parent !== null) {
        $hook = add_submenu_page(
            $parent,
            'Integrity Mini',
            'Integrity Mini',
            'manage_options',
            ABC_INTEGRITY_MINI_ADMIN_PAGE_SLUG,
            'abc_integrity_mini_render_admin_page'
        );
    } else {
        $hook = add_menu_page(
            'ABC Integrity',
            'ABC Integrity',
            'manage_options',
            ABC_INTEGRITY_MINI_ADMIN_PAGE_SLUG,
            'abc_integrity_mini_render_admin_page',
            'dashicons-flag',
            80
        );
    }

    $GLOBALS['abc_integrity_mini_page_hook'] = is_string($hook) ? $hook : '';
}

function abc_integrity_mini_enqueue_assets(string $hook): void {
    $pageHook = abc_integrity_mini_get_page_hook();
    if ($pageHook === '' || $hook !== $pageHook) {
        return;
    }

    wp_enqueue_style(
        'abc-integrity-mini-admin',
        plugin_dir_url(__FILE__) . 'assets/admin.css',
        [],
        ABC_INTEGRITY_MINI_VERSION
    );

    wp_enqueue_script(
        'abc-integrity-mini-admin',
        plugin_dir_url(__FILE__) . 'assets/admin.js',
        [],
        ABC_INTEGRITY_MINI_VERSION,
        true
    );

    wp_localize_script('abc-integrity-mini-admin', 'ABCIntegrityMini', [
        'ajaxUrl' => admin_url('admin-ajax.php'),
        'nonce'   => wp_create_nonce('abc_integrity_mini_scan'),
    ]);
}

function abc_integrity_mini_time_ago(int $timestamp): string {
    $diff = time() - $timestamp;

    if ($diff < 60) {
        return 'just now';
    }
    if ($diff < 3600) {
        $mins = (int) round($diff / 60);
        return $mins === 1 ? '1 minute ago' : "{$mins} minutes ago";
    }
    if ($diff < 86400) {
        $hours = (int) round($diff / 3600);
        return $hours === 1 ? '1 hour ago' : "{$hours} hours ago";
    }
    $days = (int) round($diff / 86400);
    return $days === 1 ? 'yesterday' : "{$days} days ago";
}

function abc_integrity_mini_render_admin_page(): void {
    if (!current_user_can('manage_options')) {
        wp_die('Forbidden');
    }

    $manifest      = abc_integrity_mini_get_manifest();
    $results       = abc_integrity_mini_get_scan_results();
    $version       = (string) get_bloginfo('version');
    $locale        = get_locale() ?: 'en_US';
    $rescanContext = abc_integrity_mini_get_rescan_context($results, $version);

    $hasResults = is_array($results)
        && ($results['version'] ?? '') === $version
        && ($results['locale'] ?? '') === $locale
        && $manifest !== null
        && ($results['manifest_fetched_at'] ?? 0) === (int) ($manifest['fetched_at'] ?? -1);

    $isStale = $hasResults && (time() - (int) ($results['scanned_at'] ?? 0)) > 4 * HOUR_IN_SECONDS;

    $dateFormat = get_option('date_format') . ' \a\t ' . get_option('time_format');
    ?>
    <div class="wrap abc-integrity-wrap">

        <div class="page-header">
            <h1>ABC Integrity</h1>
            <p>Verify your WordPress core files against the official checksums from WordPress.org.</p>
        </div>

        <div class="abc-card">
            <div id="abc-scan-status" class="screen-reader-text" role="status" aria-live="polite" aria-atomic="true"></div>

            <?php if (!$hasResults): ?>

            <div class="cta-block">
                <div class="cta-shield">
                    <svg viewBox="0 0 24 24" fill="none" stroke="#2271b1" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" width="34" height="34" aria-hidden="true" focusable="false">
                        <path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/>
                    </svg>
                </div>
                <?php if ($rescanContext !== null): ?>
                    <?php $sameVersion = $rescanContext['previous_version'] !== '' && $rescanContext['previous_version'] === $rescanContext['current_version']; ?>
                    <div class="cta-title"><?php echo $sameVersion ? 'WordPress core was reinstalled' : 'WordPress was updated'; ?></div>
                    <div class="cta-desc">
                        <?php if ($sameVersion): ?>
                            Your previous scan results were cleared because WordPress core was reinstalled. Run a new scan to verify WordPress <?php echo esc_html($rescanContext['current_version']); ?>.
                        <?php elseif ($rescanContext['previous_version'] !== ''): ?>
                            Your previous scan was for WordPress <?php echo esc_html($rescanContext['previous_version']); ?>. Run a new scan to verify the core files for WordPress <?php echo esc_html($rescanContext['current_version']); ?>.
                        <?php else: ?>
                            Your previous scan results were cleared after WordPress was updated. Run a new scan to verify WordPress <?php echo esc_html($rescanContext['current_version']); ?>.
                        <?php endif; ?>
                    </div>
                <?php else: ?>
                    <div class="cta-title">No scan results yet</div>
                    <div class="cta-desc">Run your first scan to verify that your WordPress core files match the official checksums published by WordPress.org.</div>
                <?php endif; ?>
                <button type="button" class="button button-primary button-lg" id="abc-scan-btn" aria-busy="false">
                    Scan core files
                </button>
            </div>

            <div class="info-note">
                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="16" height="16" aria-hidden="true" focusable="false"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>
                <span>The scan downloads the official WordPress checksum manifest from WordPress.org and compares each core file&#8217;s MD5 hash. Plugin and theme files are not checked.</span>
            </div>

            <?php else:
                $findings = $results['findings'] ?? [];
                $stats    = $results['stats'] ?? [];
            ?>

            <div class="card-head">
                <div class="card-head-text">
                    <h2>Scan results</h2>
                    <?php
                    $scannedAt   = (int) $results['scanned_at'];
                    $relativeTime = (time() - $scannedAt) > 300
                        ? ' (' . abc_integrity_mini_time_ago($scannedAt) . ')'
                        : '';
                    ?>
                    <p>Scanned <?php echo esc_html((string) wp_date($dateFormat, $scannedAt) . $relativeTime); ?></p>
                </div>
                <button type="button" class="button <?php echo $isStale ? 'button-primary' : 'button-secondary'; ?>" id="abc-scan-btn" aria-busy="false">
                    Run scan
                </button>
            </div>

            <?php if (empty($results['has_findings'])): ?>
            <div class="summary-bar<?php echo $isStale ? ' summary-bar--stale' : ''; ?>">
                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" width="16" height="16" aria-hidden="true" focusable="false"><polyline points="20 6 9 17 4 12"/></svg>
                <div>
                    <div>All core files match the official WordPress release</div>
                    <?php if ($isStale): ?>
                    <div class="summary-bar-sub">Run a fresh scan to verify your current files.</div>
                    <?php endif; ?>
                </div>
            </div>
            <?php endif; ?>

            <?php
            abc_integrity_mini_render_check_row('Modified files',   $findings['modified']   ?? [], 'modified',   'No core files have been modified', $isStale);
            abc_integrity_mini_render_check_row('Missing files',    $findings['missing']    ?? [], 'missing',    'No core files are missing',        $isStale);
            abc_integrity_mini_render_check_row('Unreadable files', $findings['unreadable'] ?? [], 'unreadable', 'All files are readable',            $isStale);
            ?>

            <div class="card-footer">
                <?php if ($manifest): ?>
                    <span>Compared against WordPress <?php echo esc_html((string) $manifest['version']); ?> (<?php echo esc_html((string) $manifest['locale']); ?>)</span>
                    <span class="sep">&middot;</span>
                    <span><?php echo esc_html(number_format((int) ($stats['verified'] ?? 0))); ?> files checked</span>
                    <span class="sep">&middot;</span>
                    <?php
                    $duration     = (float) ($results['duration'] ?? 0);
                    $durationText = $duration < 1
                        ? 'Completed in under a second'
                        : 'Completed in ' . $duration . ' seconds';
                    ?>
                    <span><?php echo esc_html($durationText); ?></span>
                <?php endif; ?>
            </div>

            <?php endif; ?>

        </div>
    </div>
    <?php
}

function abc_integrity_mini_render_check_row(string $title, array $files, string $type, string $passDesc, bool $isStale = false): void {
    $count  = count($files);
    $isPass = $count === 0;

    if (!$isPass) {
        $failDescs = [
            'modified'   => $count === 1 ? '1 file does not match its expected checksum' : "{$count} files do not match their expected checksums",
            'missing'    => $count === 1 ? '1 expected file is not present on disk' : "{$count} expected files are not present on disk",
            'unreadable' => $count === 1 ? '1 file could not be read' : "{$count} files could not be read",
        ];
        $desc = $failDescs[$type] ?? "{$count} {$type}";
    } else {
        $desc = $passDesc;
    }

    $outcome      = "{$count} {$type}";
    $outcomeClass = $isPass ? 'pass-text' : ($type === 'missing' ? 'warn-text' : 'fail-text');
    $rowClass     = $isPass ? 'check-row pass' : 'check-row fail open';
    $detailsId    = 'abc-integrity-findings-' . $type;
    ?>
    <div class="<?php echo esc_attr($rowClass); ?>">
        <div class="check-header"<?php if (!$isPass): ?> data-abc-toggle="check-row" role="button" tabindex="0" aria-expanded="true" aria-controls="<?php echo esc_attr($detailsId); ?>"<?php endif; ?>>
            <div class="check-icon <?php echo $isPass ? 'pass' . ($isStale ? ' stale' : '') : 'fail'; ?>">
                <?php if ($isPass): ?>
                <svg viewBox="0 0 24 24" fill="none" stroke="<?php echo $isStale ? '#7a6400' : '#00a32a'; ?>" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" width="14" height="14" aria-hidden="true" focusable="false">
                    <polyline points="20 6 9 17 4 12"/>
                </svg>
                <?php else: ?>
                <svg viewBox="0 0 24 24" fill="none" stroke="#d63638" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" width="14" height="14" aria-hidden="true" focusable="false">
                    <line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/>
                </svg>
                <?php endif; ?>
            </div>
            <div class="check-label">
                <div class="check-name"><?php echo esc_html($title); ?></div>
                <div class="check-desc"><?php echo esc_html($desc); ?></div>
            </div>
            <div class="check-right">
                <?php if (!$isPass): ?>
                <span class="check-outcome <?php echo esc_attr($outcomeClass); ?>"><?php echo esc_html($outcome); ?></span>
                <?php endif; ?>
                <svg class="chevron" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="14" height="14" aria-hidden="true" focusable="false">
                    <polyline points="6,3 11,8 6,13"/>
                </svg>
            </div>
        </div>
        <?php if (!$isPass): ?>
        <div class="check-body" id="<?php echo esc_attr($detailsId); ?>">
            <table class="findings-table">
                <tbody>
                    <?php foreach ($files as $file): ?>
                    <tr class="type-<?php echo esc_attr($type); ?>">
                        <td class="path-cell">
                            <div class="f-path"><?php echo esc_html((string) ($file['path'] ?? '')); ?></div>
                            <?php if (!empty($file['reason'])): ?>
                            <span class="f-reason"><?php echo esc_html((string) $file['reason']); ?></span>
                            <?php endif; ?>
                        </td>
                    </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php endif; ?>
    </div>
    <?php
}