<?php
namespace AccessNow\SimpleLMS;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Quiz_Meta {

	public static function init() {
		add_action( 'save_post_slms_quiz', array( __CLASS__, 'save' ), 10, 2 );
	}

	public static function save( $post_id, $post ) {
		if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
			return;
		}
		if ( ! current_user_can( 'edit_post', $post_id ) ) {
			return;
		}
		if ( ! isset( $_POST['accessnow_slms_quiz_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['accessnow_slms_quiz_nonce'] ) ), 'accessnow_slms_save_quiz' ) ) {
			return;
		}

		if ( isset( $_POST['_slms_parent_lesson'] ) ) {
			$parent = absint( $_POST['_slms_parent_lesson'] );
			// A new parent must be one the user can edit (an instructor can't move work into another's course).
			if ( Capabilities::can_use_parent( $parent, get_post_meta( $post_id, '_slms_parent_lesson', true ) ) ) {
				update_post_meta( $post_id, '_slms_parent_lesson', $parent );
			}
		}

		if ( isset( $_POST['_slms_pass_threshold'] ) ) {
			$threshold = absint( $_POST['_slms_pass_threshold'] );
			$threshold = min( 100, max( 0, $threshold ) );
			update_post_meta( $post_id, '_slms_pass_threshold', $threshold );
		}

		if ( isset( $_POST['_slms_max_retries'] ) ) {
			update_post_meta( $post_id, '_slms_max_retries', intval( $_POST['_slms_max_retries'] ) );
		}

		if ( isset( $_POST['_slms_time_limit'] ) ) {
			update_post_meta( $post_id, '_slms_time_limit', absint( $_POST['_slms_time_limit'] ) );
		}

		$randomize_questions = isset( $_POST['_slms_randomize_questions'] ) ? 1 : 0;
		update_post_meta( $post_id, '_slms_randomize_questions', $randomize_questions );

		$randomize_options = isset( $_POST['_slms_randomize_options'] ) ? 1 : 0;
		update_post_meta( $post_id, '_slms_randomize_options', $randomize_options );

		if ( isset( $_POST['_slms_show_answers'] ) ) {
			$show = sanitize_key( wp_unslash( $_POST['_slms_show_answers'] ) );
			update_post_meta( $post_id, '_slms_show_answers', in_array( $show, Quiz_Engine::SHOW_ANSWERS, true ) ? $show : 'never' );
		}

		if ( isset( $_POST['_slms_questions'] ) ) {
			// Sanitised where it is read, and again field by field in sanitize_questions(); re-slash because update_post_meta() unslashes.
			$questions = self::sanitize_questions( map_deep( wp_unslash( $_POST['_slms_questions'] ), 'sanitize_textarea_field' ) );
			update_post_meta( $post_id, '_slms_questions', wp_slash( $questions ) );
		}
	}

	public static function sanitize_questions( $raw ) {
		if ( ! is_array( $raw ) ) {
			return array();
		}

		$sanitized = array();
		foreach ( $raw as $q ) {
			if ( ! is_array( $q ) ) {
				continue;
			}
			// A question whose type's plugin is off comes back from the editor as it was stored, with
			// only its text, points, video and explanation editable.
			if ( isset( $q['_raw'] ) && is_string( $q['_raw'] ) ) {
				$stored = json_decode( $q['_raw'], true );
				if ( is_array( $stored ) ) {
					$q = array_merge( $stored, array_intersect_key( $q, array_flip( array( 'id', 'type', 'text', 'points', 'video_url', 'explanation' ) ) ) );
				}
			}
			unset( $q['_raw'] );
			if ( empty( $q['text'] ) || ! is_string( $q['text'] ) ) {
				continue;
			}

			// A type the plugin doesn't grade itself (an add-on's) keeps its name, even while that add-on
			// is switched off: turning it into multiple choice would lose the question.
			$type     = isset( $q['type'] ) && is_string( $q['type'] ) ? sanitize_key( $q['type'] ) : '';
			$question = array(
				'id'        => ! empty( $q['id'] ) && is_scalar( $q['id'] ) ? sanitize_text_field( $q['id'] ) : 'q_' . wp_generate_password( 8, false ),
				'type'      => '' !== $type ? $type : 'multiple_choice',
				'text'      => sanitize_textarea_field( $q['text'] ),
				'options'   => array(),
				'correct'   => '',
				'points'    => isset( $q['points'] ) ? absint( $q['points'] ) : 1,
				'video_url' => '',
			);

			if ( 'multiple_choice' === $question['type'] && ! empty( $q['options'] ) ) {
				$question['options'] = array_map( 'sanitize_text_field', array_filter( (array) $q['options'], 'is_scalar' ) );
				$question['correct'] = isset( $q['correct'] ) ? absint( $q['correct'] ) : 0;
			} elseif ( 'true_false' === $question['type'] ) {
				$question['options'] = array( __( 'True', 'accessnow-lms' ), __( 'False', 'accessnow-lms' ) );
				$question['correct'] = isset( $q['correct'] ) ? absint( $q['correct'] ) : 0;
			} elseif ( 'fill_blank' === $question['type'] ) {
				$question['correct'] = isset( $q['correct'] ) && is_scalar( $q['correct'] ) ? sanitize_text_field( $q['correct'] ) : '';
			}

			$question['video_url']   = ! empty( $q['video_url'] ) && is_string( $q['video_url'] ) ? esc_url_raw( $q['video_url'] ) : '';
			$question['explanation'] = ! empty( $q['explanation'] ) && is_string( $q['explanation'] ) ? sanitize_textarea_field( $q['explanation'] ) : '';

			if ( ! in_array( $question['type'], Quiz_Engine::BUILTIN_TYPES, true ) ) {
				// Its own fields (options, pairs, a model answer...), kept as plain text by default.
				foreach ( $q as $key => $value ) {
					$key = sanitize_key( $key );
					if ( '' !== $key && ! array_key_exists( $key, $question ) ) {
						$question[ $key ] = map_deep( $value, 'sanitize_text_field' );
					}
				}
				if ( isset( $q['options'] ) && is_array( $q['options'] ) ) {
					$question['options'] = map_deep( $q['options'], 'sanitize_text_field' );
				}
				if ( isset( $q['correct'] ) ) {
					$question['correct'] = map_deep( $q['correct'], 'sanitize_text_field' );
				}
				/**
				 * A question of an added type, after the plugin's own sanitising: sanitise its own fields
				 * more strictly here. Return null to drop the question.
				 *
				 * @since 1.1.0
				 *
				 * @param array|null $question Sanitised question.
				 * @param array      $raw      As submitted (or imported): untrusted.
				 */
				$question = apply_filters( 'accessnow_slms_sanitize_question', $question, $q );
				if ( ! is_array( $question ) ) {
					continue;
				}
			}

			$sanitized[] = $question;
		}

		return $sanitized;
	}

	public static function get( $post_id, $key, $fallback = '' ) {
		$value = get_post_meta( $post_id, $key, true );
		return '' !== $value ? $value : $fallback;
	}
}