<?php
namespace ABILITY;

if (!defined('ABSPATH')) exit;

/**
 * Accessibility scanner for ABILITY plugin.
 * Pure PHP static/heuristic scanner for site pages.
 */
class Scanner {
    public function scan(string $path): array {
        $real_path = realpath($path);
        $wp_path   = realpath(ABSPATH);

        if (!$real_path || !$wp_path) {
            return $this->emptyResult(__('Invalid scan path. Could not resolve path.', 'ability'));
        }
        $wp_root = rtrim($wp_path, DIRECTORY_SEPARATOR);
        if ($real_path !== $wp_root && strpos($real_path, $wp_root . DIRECTORY_SEPARATOR) !== 0) {
            return $this->emptyResult(__('Invalid scan path. Path must be within WordPress installation.', 'ability'));
        }

        if (!class_exists('\DOMDocument') || !class_exists('\DOMXPath')) {
            return $this->emptyResult(__('ABILITY scanning requires the PHP DOM extension. Ask the site host to enable the standard DOM/XML extension, then retry the scan.', 'ability'));
        }

        $is_pro   = function_exists('ability_is_pro') ? ability_is_pro() : false;
        $settings = class_exists('ABILITY\Config') ? \ABILITY\Config::get_settings() : [];
        $tier_limit = class_exists('ABILITY\Config') ? \ABILITY\Config::get_scan_limit() : ($is_pro ? 999 : 5);
        $requested_limit = isset($settings['max_files_per_scan']) ? absint($settings['max_files_per_scan']) : $tier_limit;
        $max_files = max(1, min($tier_limit, $requested_limit ?: $tier_limit));
        $daily_limit = class_exists('ABILITY\Config') ? \ABILITY\Config::get_free_scan_limit() : 5;
        $daily_scans = 0;
        $daily_key = '';

        if (!$is_pro) {
            $today       = function_exists('wp_date') ? wp_date('Y-m-d') : date('Y-m-d');
            $daily_key   = 'ability_daily_scans_' . $today;
            $daily_scans = get_transient($daily_key);
            if ($daily_scans === false) $daily_scans = 0;
            $daily_scans = max(0, absint($daily_scans));
            if ($daily_scans >= $daily_limit) {
                return [
                    'total' => 0,
                    'errors' => 0,
                    'warnings' => 0,
                    'results' => [],
                    'files_scanned' => 0,
                    'max_files' => $max_files,
                    'daily_limit' => $daily_limit,
                    'daily_remaining' => 0,
                    'error' => sprintf(
                        __('Daily scan limit reached (%d pages/day).', 'ability'),
                        $daily_limit
                    ),
                ];
            }

            // Do not allow a single request to exceed the remaining daily quota.
            $max_files = min($max_files, max(0, $daily_limit - $daily_scans));
        }

        // Run pure PHP scan against published pages/posts (rendered HTML).
        $scan_results = $this->scan_pages($max_files, $is_pro);
        $results      = $scan_results['results'];
        $tool_version = $scan_results['tool_version'];
        $ruleset_version = $scan_results['ruleset_version'];

        $this->save_results($results, $tool_version, $ruleset_version);

        $files_scanned = isset($scan_results['files_scanned']) ? absint($scan_results['files_scanned']) : 0;
        $daily_remaining = null;

        if (!$is_pro) {
            set_transient($daily_key, min($daily_limit, $daily_scans + $files_scanned), DAY_IN_SECONDS);
            $daily_remaining = max(0, $daily_limit - ($daily_scans + $files_scanned));
        }

        return [
            'total'          => count($results),
            'errors'         => count(array_filter($results, fn($r) => ($r['severity'] ?? '') === 'ERROR')),
            'warnings'       => count(array_filter($results, fn($r) => ($r['severity'] ?? '') === 'WARNING')),
            'results'        => $results,
            'tool_version'   => $tool_version,
            'ruleset_version'=> $ruleset_version,
            'tier'           => $is_pro ? 'pro' : 'basic',
            'files_scanned'  => $files_scanned,
            'max_files'      => $max_files,
            'daily_limit'    => $is_pro ? null : $daily_limit,
            'daily_remaining'=> $daily_remaining,
        ];
    }

    private function emptyResult(string $error): array {
        return [
            'total' => 0,
            'errors' => 0,
            'warnings' => 0,
            'results' => [],
            'error' => $error,
        ];
    }

    private function scan_basic(string $path, int $limit, bool $is_pro): array {
        // Deprecated – kept only for backward-compatibility signature.
        // Delegate to page-based scanner.
        $scan_results = $this->scan_pages($limit, $is_pro);
        return [
            'total'          => $scan_results['total'],
            'errors'         => $scan_results['errors'],
            'warnings'       => $scan_results['warnings'],
            'results'        => $scan_results['results'],
            'tier'           => $is_pro ? 'pro' : 'basic',
            'files_scanned'  => $scan_results['files_scanned'],
            'max_files'      => $limit,
            'tool_version'   => $scan_results['tool_version'],
            'ruleset_version'=> $scan_results['ruleset_version'],
        ];
    }

    /**
     * Scan rendered pages (posts/pages/front page) for basic accessibility issues.
     *
     * @param int  $limit  Maximum number of pages to scan.
     * @param bool $is_pro Whether Pro tier is active.
     */
    private function scan_pages(int $limit, bool $is_pro): array {
        $results = [];

        // Collect URLs: front page + published posts/pages, limited by $limit.
        $urls = [];

        // Always include the homepage if possible.
        $home_url = home_url('/');
        if ($home_url) {
            $urls[] = $home_url;
        }

        // Query published posts and pages.
        if (class_exists('\WP_Query')) {
            $q = new \WP_Query([
                'post_type'      => ['post', 'page'],
                'post_status'    => 'publish',
                'posts_per_page' => max(1, $limit - count($urls)),
                'fields'         => 'ids',
                'no_found_rows'  => true,
            ]);
            if ($q->have_posts()) {
                foreach ($q->posts as $post_id) {
                    $url = get_permalink($post_id);
                    if ($url && !in_array($url, $urls, true)) {
                        $urls[] = $url;
                        if (count($urls) >= $limit) {
                            break;
                        }
                    }
                }
            }
            wp_reset_postdata();
        }

        $urls = array_slice(array_unique($urls), 0, $limit);

        foreach ($urls as $url) {
            $response = wp_remote_get($url, [
                'timeout'     => 10,
                'redirection' => 3,
            ]);

            if (is_wp_error($response)) {
                $results[] = [
                    'rule'     => 'a11y-page-unreachable',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'WARNING',
                    'message'  => sprintf(
                        /* translators: 1: URL 2: error message */
                        __('Unable to retrieve page %1$s: %2$s', 'ability'),
                        $url,
                        $response->get_error_message()
                    ),
                ];
                continue;
            }

            $code = wp_remote_retrieve_response_code($response);
            $body = wp_remote_retrieve_body($response);

            if ($code >= 400 || empty($body)) {
                $results[] = [
                    'rule'     => 'a11y-page-error-status',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'WARNING',
                    'message'  => sprintf(
                        /* translators: 1: URL 2: HTTP status code */
                        __('Page %1$s responded with status code %2$d.', 'ability'),
                        $url,
                        $code
                    ),
                ];
                continue;
            }

            $results = array_merge(
                $results,
                $this->analyze_html($url, $body)
            );
        }

        $total   = count($results);
        $errors  = count(array_filter($results, fn($r) => ($r['severity'] ?? '') === 'ERROR'));
        $warnings = count(array_filter($results, fn($r) => ($r['severity'] ?? '') === 'WARNING'));

        return [
            'total'          => $total,
            'errors'         => $errors,
            'warnings'       => $warnings,
            'results'        => $results,
            'tool_version'   => 'ability-php-scanner',
            'ruleset_version'=> 'php-heuristics-1',
            'files_scanned'  => count($urls),
        ];
    }

    /**
     * Analyze a single HTML document and extract accessibility issues.
     *
     * @param string $url
     * @param string $html
     * @return array<int,array<string,mixed>>
     */
    private function analyze_html(string $url, string $html): array {
        $results = [];

        if ('' === trim($html)) {
            return $results;
        }

        $dom = new \DOMDocument();
        $previous_libxml_state = libxml_use_internal_errors(true);
        @$dom->loadHTML($html);
        libxml_clear_errors();
        libxml_use_internal_errors($previous_libxml_state);

        // 1) Images missing an alt attribute. An explicitly empty alt value can be
        // correct for decorative images, so this heuristic must not flag it by itself.
        $images = $dom->getElementsByTagName('img');
        foreach ($images as $img) {
            if (!$img->hasAttribute('alt')) {
                $results[] = [
                    'rule'     => 'a11y-img-alt-missing',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'ERROR',
                    'message'  => __('Image is missing an alt attribute. Review whether it needs a text alternative or an intentionally empty alt value.', 'ability'),
                ];
            }
        }

        // 2) Form inputs without labels (very simple heuristic).
        $inputs = $dom->getElementsByTagName('input');
        foreach ($inputs as $input) {
            $type = strtolower($input->getAttribute('type'));
            if (in_array($type, ['hidden', 'submit', 'button', 'image'], true)) {
                continue;
            }

            $has_label = false;
            $id = $input->getAttribute('id');

            // aria-label / aria-labelledby can provide a programmatic name even
            // when no HTML <label> element is present.
            if (trim($input->getAttribute('aria-label')) !== '' || trim($input->getAttribute('aria-labelledby')) !== '') {
                $has_label = true;
            }

            if (!$has_label && $id) {
                $labels = $dom->getElementsByTagName('label');
                foreach ($labels as $label) {
                    if ($label->getAttribute('for') === $id) {
                        $has_label = true;
                        break;
                    }
                }
            }

            if (!$has_label) {
                $parent = $input->parentNode;
                while ($parent) {
                    if ($parent->nodeName === 'label') {
                        $has_label = true;
                        break;
                    }
                    $parent = $parent->parentNode;
                }
            }

            if (!$has_label) {
                $results[] = [
                    'rule'     => 'a11y-form-control-no-label',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'ERROR',
                    'message'  => __('Form control appears to have no associated label.', 'ability'),
                ];
            }
        }

        // 3) Links with very generic text.
        $links = $dom->getElementsByTagName('a');
        foreach ($links as $link) {
            $text = trim($link->textContent);
            $aria_name = trim($link->getAttribute('aria-label'));
            if ($aria_name === '') {
                $aria_name = trim($link->getAttribute('aria-labelledby'));
            }
            $effective_text = $aria_name !== '' ? $aria_name : $text;
            if ($effective_text === '') {
                $results[] = [
                    'rule'     => 'a11y-link-empty-text',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'ERROR',
                    'message'  => __('Link has no readable text.', 'ability'),
                ];
                continue;
            }

            $lower = strtolower($effective_text);
            $generic = ['click here', 'read more', 'learn more', 'more'];
            if (in_array($lower, $generic, true)) {
                $results[] = [
                    'rule'     => 'a11y-link-generic-text',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'WARNING',
                    'message'  => sprintf(
                        /* translators: 1: link text */
                        __('Link text "%s" may be too generic. Consider making it more descriptive.', 'ability'),
                        $effective_text
                    ),
                ];
            }
        }

        // 4) Buttons without an accessible name.
        $buttons = $dom->getElementsByTagName('button');
        foreach ($buttons as $button) {
            $label = trim($button->textContent);
            if ($button->hasAttribute('aria-label')) {
                $label = trim($button->getAttribute('aria-label'));
            }
            if ($label === '' && $button->hasAttribute('aria-labelledby')) {
                $label = trim($button->getAttribute('aria-labelledby'));
            }
            if ($label === '') {
                $results[] = [
                    'rule'     => 'a11y-button-empty-text',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'ERROR',
                    'message'  => __('Button appears to have no accessible name (text or aria-label).', 'ability'),
                ];
            }
        }

        // 5) Basic heading structure checks (missing H1, multiple H1, skipped levels).
        $heading_nodes = [];
        foreach (['h1','h2','h3','h4','h5','h6'] as $tag) {
            $nodeList = $dom->getElementsByTagName($tag);
            foreach ($nodeList as $node) {
                $heading_nodes[] = $node;
            }
        }

        usort($heading_nodes, function($a, $b) {
            // Preserve document order using line attribute if available, fallback to 0.
            $la = $a->getLineNo();
            $lb = $b->getLineNo();
            if ($la === $lb) return 0;
            return ($la < $lb) ? -1 : 1;
        });

        $h1_count = 0;
        $prev_level = null;
        foreach ($heading_nodes as $node) {
            $tag = strtolower($node->nodeName);
            $level = (int) substr($tag, 1);
            if ($level === 1) {
                $h1_count++;
            }
            if ($prev_level !== null && $level > $prev_level + 1) {
                $results[] = [
                    'rule'     => 'a11y-heading-skip-level',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'WARNING',
                    'message'  => __('Heading levels appear to skip (e.g., H2 directly to H4).', 'ability'),
                ];
            }
            $prev_level = $level;
        }

        if ($h1_count === 0) {
            $results[] = [
                'rule'     => 'a11y-heading-missing-h1',
                'file'     => $url,
                'line'     => null,
                'severity' => 'WARNING',
                'message'  => __('No H1 heading was found on this page.', 'ability'),
            ];
        } elseif ($h1_count > 1) {
            $results[] = [
                'rule'     => 'a11y-heading-multiple-h1',
                'file'     => $url,
                'line'     => null,
                'severity' => 'WARNING',
                'message'  => __('Multiple H1 headings were found on this page.', 'ability'),
            ];
        }

        // 6) Positive tabindex values, which can create confusing tab order.
        $xpath = new \DOMXPath($dom);
        $nodes_with_tabindex = $xpath->query('//*[@tabindex]');
        if ($nodes_with_tabindex instanceof \DOMNodeList) {
            foreach ($nodes_with_tabindex as $node) {
                $tabindex = (int) $node->getAttribute('tabindex');
                if ($tabindex > 0) {
                    $results[] = [
                        'rule'     => 'a11y-tabindex-positive',
                        'file'     => $url,
                        'line'     => null,
                        'severity' => 'WARNING',
                        'message'  => __('Elements with tabindex greater than 0 can cause an unexpected keyboard focus order.', 'ability'),
                    ];
                    // One warning is enough; avoid spamming.
                    break;
                }
            }
        }

        // 7) Check for missing or empty HTML lang attribute.
        $html_nodes = $dom->getElementsByTagName('html');
        if ($html_nodes->length > 0) {
            $html_el = $html_nodes->item(0);
            $lang = trim($html_el->getAttribute('lang'));
            if ($lang === '') {
                $results[] = [
                    'rule'     => 'a11y-html-lang-missing',
                    'file'     => $url,
                    'line'     => null,
                    'severity' => 'WARNING',
                    'message'  => __('The <html> element is missing a lang attribute.', 'ability'),
                ];
            }
        }

        // 8) Detect CSS that removes focus outlines (possible accessibility risk).
        $css_sources = '';
        // Collect <style> blocks.
        $style_nodes = $dom->getElementsByTagName('style');
        foreach ($style_nodes as $style_node) {
            $css_sources .= ' ' . $style_node->textContent;
        }
        // Collect inline style attributes.
        $nodes_with_style = $xpath->query('//*[@style]');
        if ($nodes_with_style instanceof \DOMNodeList) {
            foreach ($nodes_with_style as $node) {
                $css_sources .= ' ' . $node->getAttribute('style');
            }
        }
        $css_lower = strtolower($css_sources);
        if (strpos($css_lower, 'outline: none') !== false || strpos($css_lower, 'outline:none') !== false || strpos($css_lower, 'outline:0') !== false || strpos($css_lower, 'outline: 0') !== false) {
            $results[] = [
                'rule'     => 'a11y-css-outline-removed',
                'file'     => $url,
                'line'     => null,
                'severity' => 'WARNING',
                'message'  => __('Detected CSS that removes focus outlines (outline: none/0). This may make keyboard focus invisible and should be reviewed against WCAG focus-visibility requirements.', 'ability'),
            ];
        }

        // 9) Detect very small font sizes in CSS (heuristic).
        if (preg_match_all('/font-size\\s*:\\s*([0-9\\.]+)\\s*(px|rem|em)/i', $css_sources, $matches, PREG_SET_ORDER)) {
            foreach ($matches as $match) {
                $value = (float) $match[1];
                $unit  = strtolower($match[2]);
                $px    = $value;
                if ('rem' === $unit || 'em' === $unit) {
                    // Assume a 16px base for heuristic conversion.
                    $px = $value * 16.0;
                }
                if ($px > 0 && $px < 13) {
                    $results[] = [
                        'rule'     => 'a11y-font-too-small',
                        'file'     => $url,
                        'line'     => null,
                        'severity' => 'WARNING',
                        'message'  => sprintf(
                            /* translators: 1: font size in pixels */
                            __('Detected font-size of approximately %.1fpx. Very small text can be hard to read; review zoom, text-resize, reflow, and readability behavior.', 'ability'),
                            $px
                        ),
                    ];
                    break;
                }
            }
        }

        // 10) Detect fully justified text (may hinder readability).
        if (strpos($css_lower, 'text-align: justify') !== false || strpos($css_lower, 'text-align:justify') !== false) {
            $results[] = [
                'rule'     => 'a11y-text-justified',
                'file'     => $url,
                'line'     => null,
                'severity' => 'WARNING',
                'message'  => __('Detected text-align: justify in CSS. Fully justified text can reduce readability for many users.', 'ability'),
            ];
        }

        return $results;
    }

    private function save_results(array $results, string $tool_version, string $ruleset_version): void {
        global $wpdb;
        $table = $wpdb->prefix . 'ability_scans';
        foreach ($results as $result) {
            $rule = $result['rule'] ?? '';
            $map  = $this->map_rule_to_standards($rule);
            $wpdb->insert(
                $table,
                [
                    'scan_type'       => 'static',
                    'file_path'       => $result['file'] ?? '',
                    'issue_type'      => $rule,
                    'severity'        => $result['severity'] ?? 'NOTICE',
                    'message'         => $result['message'] ?? '',
                    'line_number'     => $result['line'] ?? null,
                    'status'          => 'pending',
                    'wcag_sc'         => $map['wcag_sc'] ?? null,
                    'technique'       => $map['technique'] ?? null,
                    'standard'        => $map['standard'] ?? null,
                    'section508'      => $map['section508'] ?? null,
                    'tool_version'    => $tool_version,
                    'ruleset_version' => $ruleset_version,
                ],
                ['%s','%s','%s','%s','%s','%d','%s','%s','%s','%s','%s','%s','%s']
            );
        }
    }

    private function map_rule_to_standards(string $rule): array {
        $base = [
            'a11y-img-alt-missing' => [
                'wcag_sc'     => '1.1.1',
                'technique'   => 'H37',
                'standard'    => 'WCAG 2.1',
                'section508'  => 'WCAG 2.0 A (508 Ref)',
            ],
            'a11y-form-control-no-label' => [
                'wcag_sc'     => '1.3.1',
                'technique'   => 'H44',
                'standard'    => 'WCAG 2.1',
                'section508'  => 'WCAG 2.0 A (508 Ref)',
            ],
            'a11y-link-empty-text' => [
                'wcag_sc'     => '2.4.4',
                'technique'   => 'H30',
                'standard'    => 'WCAG 2.1',
                'section508'  => 'WCAG 2.0 A (508 Ref)',
            ],
            'a11y-link-generic-text' => [
                'wcag_sc'     => '2.4.4',
                'technique'   => 'G91',
                'standard'    => 'WCAG 2.1',
                'section508'  => 'WCAG 2.0 A (508 Ref)',
            ],
            'a11y-page-unreachable' => [
                'wcag_sc'     => null,
                'technique'   => null,
                'standard'    => null,
                'section508'  => null,
            ],
            'a11y-page-error-status' => [
                'wcag_sc'     => null,
                'technique'   => null,
                'standard'    => null,
                'section508'  => null,
            ],
            'a11y-button-empty-text' => [
                'wcag_sc'     => '4.1.2',
                'technique'   => null,
                'standard'    => 'WCAG 2.1',
                'section508'  => 'WCAG 2.0 A (508 Ref)',
            ],
            'a11y-heading-missing-h1' => [
                'wcag_sc'     => null,
                'technique'   => null,
                'standard'    => null,
                'section508'  => null,
            ],
            'a11y-heading-multiple-h1' => [
                'wcag_sc'     => null,
                'technique'   => null,
                'standard'    => null,
                'section508'  => null,
            ],
            'a11y-heading-skip-level' => [
                'wcag_sc'     => null,
                'technique'   => null,
                'standard'    => null,
                'section508'  => null,
            ],
            'a11y-tabindex-positive' => [
                'wcag_sc'     => '2.4.3',
                'technique'   => null,
                'standard'    => 'WCAG 2.1',
                'section508'  => null,
            ],
            'a11y-html-lang-missing' => [
                'wcag_sc'     => '3.1.1',
                'technique'   => 'H57',
                'standard'    => 'WCAG 2.1',
                'section508'  => 'WCAG 2.0 A (508 Ref)',
            ],
            'a11y-css-outline-removed' => [
                'wcag_sc'     => '2.4.7',
                'technique'   => 'G149',
                'standard'    => 'WCAG 2.1',
                'section508'  => 'WCAG 2.0 AA (508 Ref)',
            ],
            'a11y-font-too-small' => [
                'wcag_sc'     => null,
                'technique'   => null,
                'standard'    => null,
                'section508'  => null,
            ],
            'a11y-text-justified' => [
                'wcag_sc'     => '1.4.8',
                'technique'   => 'C19',
                'standard'    => 'WCAG 2.1',
                'section508'  => null,
            ],
        ];
        $map = apply_filters('ability_rule_mapping', $base);
        return $map[$rule] ?? [
            'wcag_sc' => null,
            'technique' => null,
            'standard' => null,
            'section508' => null,
        ];
    }
}