<?php
/** Lazy admin view and nonce-protected 404 actions. */
defined( 'ABSPATH' ) || exit;

class ATKAI_404_Admin {
    const GROUP_FIELDS = [ 'target_hash', 'user_id', 'request_method', 'user_agent', 'user_ip_address', 'referrer_url', 'location', 'country_code' ];

    private function should_group() {
        $options = \ATKAI_OPTIONS\Option::get( 'options' );
        return defined( 'ATKAI_PRO_PLUGIN_ACTIVE' ) && ATKAI_PRO_PLUGIN_ACTIVE && ! empty( $options['atk_pro_group_logs'] );
    }
    private function group_by() {
        // Hash full values so long URLs and case-sensitive request details stay distinct.
        return implode( ', ', array_map( static function( $field ) { return "SHA2($field, 256)"; }, self::GROUP_FIELDS ) );
    }
    public function __construct() {
        add_action( 'atkai_404_activity', [ $this, 'render' ] );
        add_action( 'admin_post_atk_404_delete', [ $this, 'delete' ] );
        add_action( 'admin_post_atk_404_export', [ $this, 'export' ] );
        add_action( 'admin_post_atk_404_recording', [ $this, 'recording' ] );
        add_action( 'admin_enqueue_scripts', [ $this, 'scripts' ] );
    }
    public function scripts( $hook ) {
        if ( 'toplevel_page_activity-track-ai' !== $hook || ! ATKAI_404_Events::selected() ) return;
        wp_enqueue_script( 'atk-404-overview', plugins_url( 'assets/admin/js/atk.404.js', ATKAI_PLUGIN_FILE ), [], filemtime( ATKAI_ABSPATH . 'assets/admin/js/atk.404.js' ), false );
        wp_localize_script( 'atk-404-overview', 'atk404Overview', [
            'key' => 'atk-404-overview-' . get_current_blog_id() . '-' . get_current_user_id(),
            'show' => __( 'Show overview', 'activity-track' ),
            'hide' => __( 'Hide overview', 'activity-track' ),
        ] );
    }
    private function authorize() {
        if ( ! current_user_can( 'manage_options' ) || ! ATKAI_404_Events::enabled() ) wp_die( esc_html__( 'You cannot access 404 logs.', 'activity-track' ) );
    }
    private function input( $key, $source = null ) {
        $source = $source ?? $_GET;
        return isset( $source[ $key ] ) && is_string( $source[ $key ] ) ? sanitize_text_field( wp_unslash( $source[ $key ] ) ) : '';
    }
    private function filters( $source = null ) {
        $search = substr( $this->input( 's', $source ), 0, 200 );
        $days = absint( $this->input( 'days', $source ) );
        $bots = $this->input( 'bots', $source );
        return [ 's' => $search, 'days' => in_array( $days, [ 1, 7, 30 ], true ) ? $days : 0, 'bots' => in_array( $bots, [ 'exclude', 'only' ], true ) ? $bots : 'all' ];
    }
    private function where( $filters ) {
        global $wpdb;
        $where = '1=1';
        if ( $filters['days'] ) $where .= $wpdb->prepare( ' AND captured_at >= %s', gmdate( 'Y-m-d H:i:s', time() - $filters['days'] * DAY_IN_SECONDS ) );
        if ( $filters['s'] ) $where .= $wpdb->prepare( ' AND target_url LIKE %s', '%' . $wpdb->esc_like( $filters['s'] ) . '%' );
        if ( 'all' !== $filters['bots'] ) {
            $bot_pattern = implode( '|', ATKAI_404_Events::BOT_CLIENTS ) . '|' . ATKAI_404_Events::GENERIC_BOT_PATTERN;
            $bot_condition = $wpdb->prepare(
                '(LOWER(user_agent) REGEXP %s OR (NOT (LOWER(user_agent) REGEXP %s) AND LOWER(SUBSTRING_INDEX(target_url, \'?\', 1)) REGEXP %s))',
                strtolower( $bot_pattern ), strtolower( ATKAI_404_Events::BROWSER_PATTERN ), ATKAI_404_Events::SCANNER_PATH_PATTERN
            );
            $where .= ' AND ' . ( 'exclude' === $filters['bots'] ? 'NOT ' : '' ) . $bot_condition;
        }
        return $where;
    }
    private function url( $args = [] ) {
        return add_query_arg( array_merge( [ 'page' => 'activity-track-ai', 'tab' => '404' ], $args ), admin_url( 'admin.php' ) );
    }
    public function recording() {
        $this->authorize();
        check_admin_referer( 'atk_404_recording' );
        $state = $this->input( 'recording', $_POST );
        if ( ! in_array( $state, [ 'pause', 'resume' ], true ) ) wp_die( esc_html__( 'Invalid recording action.', 'activity-track' ) );
        update_option( 'atk_404_paused', 'pause' === $state, false );
        wp_safe_redirect( $this->url( $this->filters( $_POST ) ) );
        exit;
    }
    public function delete() {
        $this->authorize();
        check_admin_referer( 'atk_404_delete' );
        global $wpdb;
        $ids = isset( $_POST['logs'] ) && is_array( $_POST['logs'] ) ? array_slice( array_filter( array_map( 'absint', $_POST['logs'] ) ), 0, 50 ) : [];
        if ( $ids && $this->should_group() ) {
            $rows = $wpdb->get_results( $wpdb->prepare( 'SELECT * FROM %i WHERE log_id IN (' . implode( ',', array_fill( 0, count( $ids ), '%d' ) ) . ')', array_merge( [ ATKAI_404_Events::table() ], $ids ) ) );
            $where = $this->where( $this->filters( $_POST ) );
            foreach ( $rows as $row ) {
                $matches = [];
                $values = [ ATKAI_404_Events::table(), $row->log_id ];
                foreach ( self::GROUP_FIELDS as $field ) {
                    $matches[] = "SHA2($field, 256) = %s";
                    $values[] = hash( 'sha256', (string) $row->$field );
                }
                // Keep later arrivals and records outside the displayed filters.
                // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber -- GROUP_FIELDS is a fixed column allowlist; each hash uses a bound %s, and where() prepares filter values.
                $wpdb->query( $wpdb->prepare( "DELETE FROM %i WHERE $where AND log_id <= %d AND " . implode( ' AND ', $matches ), $values ) );
            }
        } elseif ( $ids ) {
            $where = $this->where( $this->filters( $_POST ) );
            $wpdb->query( $wpdb->prepare( "DELETE FROM %i WHERE $where AND log_id IN (" . implode( ',', array_fill( 0, count( $ids ), '%d' ) ) . ')', array_merge( [ ATKAI_404_Events::table() ], $ids ) ) );
        }
        wp_safe_redirect( $this->url( $this->filters( $_POST ) ) );
        exit;
    }
    public function export() {
        $this->authorize();
        check_admin_referer( 'atk_404_export' );
        global $wpdb;
        $where = $this->where( $this->filters() );
        $snapshot = absint( $wpdb->get_var( $wpdb->prepare( 'SELECT MAX(log_id) FROM %i', ATKAI_404_Events::table() ) ) );
        nocache_headers();
        header( 'Content-Type: text/csv; charset=utf-8' );
        header( 'Content-Disposition: attachment; filename=activity-track-404.csv' );
        $out = fopen( 'php://output', 'w' );
        fputcsv( $out, [ 'Date & Time (UTC)', 'Target URL', 'User Device', 'User Location', 'IP Address', 'Referrer URL', 'Source', 'Method', 'User Agent', 'User ID', 'Daily Visitor Fingerprint' ] );
        $last = $snapshot + 1;
        for ( $batch = 0; $batch < 20; $batch++ ) {
            $rows = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM %i WHERE $where AND log_id < %d ORDER BY log_id DESC LIMIT 500", ATKAI_404_Events::table(), $last ) );
            foreach ( $rows as $row ) {
                $cells = [ $row->captured_at, $row->target_url, ATKAI_404_Events::device( $row->user_agent, $row->target_url ), $row->location, empty( \ATKAI_OPTIONS\Option::get( 'options' )['atk_no_ip'] ) ? $row->user_ip_address : '', $row->referrer_url, ATKAI_404_Events::source( $row->referrer_url, $row->target_url, ATKAI_404_Events::device( $row->user_agent, $row->target_url ) )['label'], $row->request_method, $row->user_agent, $row->user_id, $row->visitor_hash ];
                // Prevent request-derived values from becoming spreadsheet formulas.
                $cells = array_map( static function( $cell ) { return preg_match( '/^[=+@\-\t\r\n]/', (string) $cell ) ? "'" . $cell : $cell; }, $cells );
                fputcsv( $out, $cells );
                $last = $row->log_id;
            }
            if ( count( $rows ) < 500 ) break;
        }
        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Closes php://output CSV response stream, not a filesystem file.
        fclose( $out );
        exit;
    }
    /** Short, recognisable IP label: 203.0.113.x, 2001:db8:… or "Hashed IP". The full value stays in the tooltip. */
    public static function masked_ip( $ip ) {
        $ip = (string) $ip;
        if ( in_array( $ip, [ 'localhost', '127.0.0.1', '::1' ], true ) ) return 'localhost';
        if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) return preg_replace( '/\.\d+$/', '.x', $ip );
        if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 ) ) return implode( ':', array_slice( explode( ':', $ip ), 0, 2 ) ) . ':…';
        return 0 === strpos( $ip, '#' ) ? __( 'Hashed IP', 'activity-track' ) : __( 'Unknown', 'activity-track' );
    }
    private function location_cell( $row ) {
        $options = \ATKAI_OPTIONS\Option::get( 'options' );
        if ( ! empty( $options['atk_no_ip'] ) ) {
            echo esc_html__( 'IP Log', 'activity-track' ) . ' <a href="' . esc_url( admin_url( 'admin.php?page=atk-settings' ) ) . '">' . esc_html__( 'Disabled', 'activity-track' ) . '</a>';
            return;
        }
        $ip = $row->user_ip_address ?? '';
        $label = $row->location ?: ( $ip ? self::masked_ip( $ip ) : __( 'Unknown', 'activity-track' ) );
        $tooltip = $ip ? apply_filters( 'atkai_modify_user_ip_address', $ip ) : __( 'IP address was not recorded for this entry.', 'activity-track' );
        if ( $row->location ) $tooltip .= ' · ' . $row->location;
        echo '<span class="atk-ipv4-tooltip-wrap">';
        if ( $ip && defined( 'ATKAI_PRO_PLUGIN_ACTIVE' ) && has_action( 'atkai_address_pro' ) ) {
            do_action( 'atkai_address_pro', $ip, $label, $row->country_code ?? '' );
        } else {
            echo '<a href="#" class="atk-ipv4-tooltip-trigger" aria-describedby="atk-404-ip-' . absint( $row->log_id ) . '">' . esc_html( $label ?: __( 'Unknown', 'activity-track' ) ) . '</a>';
        }
        echo '<span id="atk-404-ip-' . absint( $row->log_id ) . '" role="tooltip" class="atk-ipv4-tooltip">' . esc_html( $tooltip ) . '<span class="atk-ipv4-tooltip-arrow"></span></span></span>';
        $code = $row->country_code ?? '';
        if ( ! defined( 'ATKAI_PRO_PLUGIN_ACTIVE' ) && preg_match( '/^[a-z]{2}$/', $code ) ) {
            echo '<span class="atk-country-tooltip-wrap"> | <img class="atk-404-country-flag" src="' . esc_url( plugins_url( 'assets/img/flags/' . $code . '.png', ATKAI_PLUGIN_FILE ) ) . '" alt="' . esc_attr( $row->location ) . '" tabindex="0"><span role="tooltip" class="atk-country-tooltip">' . esc_html( $row->location ) . '<span class="atk-country-tooltip-arrow"></span></span></span>';
        }
    }
    public function render() {
        $this->authorize();
        $recording_status = ATKAI_404_Events::recording_status();
        ?>
        <div class="atk-404-view">
            <section class="atk-404-overview" aria-labelledby="atk-404-title">
                <div class="atk-404-heading">
                    <div>
                        <h2 id="atk-404-title"><span class="dashicons dashicons-search" aria-hidden="true"></span><?php esc_html_e( '404 Errors', 'activity-track' ); ?></h2>
                    </div>
                    <div class="atk-404-heading-actions">
                        <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
                            <input type="hidden" name="action" value="atk_404_recording">
                            <input type="hidden" name="recording" value="<?php echo ATKAI_404_Events::paused() ? 'resume' : 'pause'; ?>">
                            <?php foreach ( $this->filters() as $key => $value ) : ?><input type="hidden" name="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $value ); ?>"><?php endforeach; ?>
                            <?php wp_nonce_field( 'atk_404_recording' ); ?>
                            <button type="submit" class="button atk-404-recording-button"><svg width="14" height="14" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true" focusable="false"><?php if ( ATKAI_404_Events::paused() ) : ?><path d="M4 2.5v11L13 8z"/><?php else : ?><path d="M3 3h3v10H3zm7 0h3v10h-3z"/><?php endif; ?></svg><span><?php echo esc_html( ATKAI_404_Events::paused() ? __( 'Resume recording', 'activity-track' ) : __( 'Pause recording', 'activity-track' ) ); ?></span></button>
                        </form>
                        <span class="atk-404-recording-status atk-404-recording-<?php echo esc_attr( $recording_status ); ?>" role="status"><?php echo esc_html( 'paused' === $recording_status ? __( 'Recording paused', 'activity-track' ) : ( 'limit' === $recording_status ? __( 'Capture limit reached', 'activity-track' ) : __( 'Recording active', 'activity-track' ) ) ); ?></span>
                        <button type="button" id="atk-404-overview-toggle" class="button" aria-expanded="true" aria-controls="atk-404-overview-content" hidden><?php esc_html_e( 'Hide overview', 'activity-track' ); ?></button>
                    </div>
                </div>
                <?php if ( in_array( $recording_status, [ 'paused', 'limit' ], true ) ) : ?>
                    <div class="atk-404-recording-notice" role="status">
                        <span class="dashicons dashicons-info-outline" aria-hidden="true"></span>
                        <div>
                            <strong><?php echo esc_html( 'paused' === $recording_status ? __( 'Recording is paused', 'activity-track' ) : __( 'Capture limit reached', 'activity-track' ) ); ?></strong>
                            <p><?php echo esc_html( 'paused' === $recording_status ? __( 'New 404 responses are not recorded. Existing records remain available; retention cleanup still applies.', 'activity-track' ) : __( 'Some 404 responses are being skipped because a capture limit or storage safeguard was reached. Recording resumes automatically when capacity is available. Skipped responses are not backfilled.', 'activity-track' ) ); ?></p>
                        </div>
                    </div>
                <?php endif; ?>
                <?php if ( class_exists( 'ATKAI_Incidents' ) ) : $scans = ATKAI_Incidents::scanner_summary(); ?>
                    <p class="atk-404-scan-summary" role="status"><span class="dashicons dashicons-shield" aria-hidden="true"></span><?php
                        echo esc_html( $scans['week'] ? sprintf( /* translators: 1: scanners today, 2: scanners in the last 7 days. */ __( 'Scanners today: %1$d · last 7 days: %2$d. Their requests returned "not found", so nothing was exposed and no incident was opened.', 'activity-track' ), $scans['today'], $scans['week'] ) : __( 'No vulnerability scanners counted in the last 7 days.', 'activity-track' ) );
                    ?></p>
                <?php endif; ?>
                <div id="atk-404-overview-content">
                <p class="atk-404-intro"><?php esc_html_e( 'Track missing pages and understand how visitors reached them.', 'activity-track' ); ?></p>
                <div class="atk-404-info-grid">
                    <div class="atk-404-info-card">
                        <h3><span class="dashicons dashicons-performance" aria-hidden="true"></span><?php esc_html_e( 'Capture limits', 'activity-track' ); ?></h3>
                        <strong><?php echo esc_html( sprintf( /* translators: 1: maximum requests per minute, 2: maximum requests per day. */ __( '%1$s / minute · %2$s / day', 'activity-track' ), number_format_i18n( ATKAI_404_Events::MINUTE_LIMIT ), number_format_i18n( ATKAI_404_Events::DAY_LIMIT ) ) ); ?></strong>
                        <p><?php esc_html_e( 'Daily limits reset at midnight UTC. Additional requests are skipped when a limit is reached.', 'activity-track' ); ?></p>
                    </div>
                    <div class="atk-404-info-card">
                        <h3><span class="dashicons dashicons-shield" aria-hidden="true"></span><?php esc_html_e( 'Privacy', 'activity-track' ); ?></h3>
                        <strong><?php esc_html_e( 'Query values redacted', 'activity-track' ); ?></strong>
                        <p><?php esc_html_e( 'IP logging follows your Settings. Location uses cached data; anonymous visitor fingerprints rotate daily.', 'activity-track' ); ?></p>
                    </div>
                    <div class="atk-404-info-card">
                        <h3><span class="dashicons dashicons-clock" aria-hidden="true"></span><?php esc_html_e( 'Retention', 'activity-track' ); ?></h3>
                        <strong><?php esc_html_e( 'Automatic cleanup', 'activity-track' ); ?></strong>
                        <p><?php esc_html_e( 'At 10,000 records, the oldest 1,000 are deleted in a batch before new records are added. Age-based cleanup also follows the Delete Logs After setting. Suspected bots are still recorded within capture limits.', 'activity-track' ); ?> <a href="<?php echo esc_url( admin_url( 'admin.php?page=atk-settings' ) ); ?>"><?php esc_html_e( 'View settings', 'activity-track' ); ?></a></p>
                    </div>
                </div>
                <details class="atk-404-coverage">
                    <summary><?php esc_html_e( 'What this log captures', 'activity-track' ); ?></summary>
                    <p><?php esc_html_e( 'Final front-end 404 responses that reach WordPress. Server/CDN-only responses and REST requests are not included. Device and referrer headers can be missing or spoofed. Bot labels identify automation signals in the User-Agent; Suspected bot labels indicate an unrecognized client probing PHP files in common scanner targets. These labels do not verify identity or block recording.', 'activity-track' ); ?></p>
                </details>
                </div>
            </section>
        <?php
        if ( ATKAI_404_Events::VERSION !== get_option( 'atk_404_db_version' ) ) {
            echo '<div class="notice notice-error"><p>' . esc_html__( '404 storage is unavailable. Visit Settings to retry installation.', 'activity-track' ) . '</p></div></div>';
            return;
        }
        global $wpdb;
        $filters = $this->filters();
        $page = max( 1, absint( $this->input( 'paged' ) ) );
        $where = $this->where( $filters );
        $grouped = $this->should_group();
        $group_by = $grouped ? $this->group_by() : '';
        $count_query = $grouped
            ? "SELECT COUNT(*) FROM (SELECT MAX(log_id) FROM %i WHERE $where GROUP BY $group_by) AS grouped_logs"
            : "SELECT COUNT(*) FROM %i WHERE $where";
        // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- Both query templates are internal, where() binds filter values, and group_by() uses only GROUP_FIELDS.
        $total_items = (int) $wpdb->get_var( $wpdb->prepare( $count_query, ATKAI_404_Events::table() ) );
        $total_pages = max( 1, (int) ceil( $total_items / 50 ) );
        $page = min( $page, $total_pages );
        if ( $grouped ) {
            $rows = $wpdb->get_results( $wpdb->prepare( "SELECT logs.*, grouped_logs.event_count FROM %i AS logs INNER JOIN (SELECT MAX(log_id) AS log_id, COUNT(*) AS event_count FROM %i WHERE $where GROUP BY $group_by ORDER BY log_id DESC LIMIT 50 OFFSET %d) AS grouped_logs ON logs.log_id = grouped_logs.log_id ORDER BY logs.log_id DESC", ATKAI_404_Events::table(), ATKAI_404_Events::table(), ( $page - 1 ) * 50 ) );
        } else {
            $rows = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM %i WHERE $where ORDER BY log_id DESC LIMIT 50 OFFSET %d", ATKAI_404_Events::table(), ( $page - 1 ) * 50 ) );
        }
        ?>
        <form method="get" class="tablenav top">
            <input type="hidden" name="page" value="activity-track-ai"><input type="hidden" name="tab" value="404">
            <div class="alignleft actions">
                <label class="screen-reader-text" for="atk-404-days"><?php esc_html_e( 'Date range', 'activity-track' ); ?></label>
                <select id="atk-404-days" name="days"><?php foreach ( [ 0 => __( 'All dates', 'activity-track' ), 1 => __( 'Last 24 hours', 'activity-track' ), 7 => __( 'Last 7 days', 'activity-track' ), 30 => __( 'Last 30 days', 'activity-track' ) ] as $days => $label ) : ?>
                    <option value="<?php echo esc_attr( $days ); ?>" <?php selected( $filters['days'], $days ); ?>><?php echo esc_html( $label ); ?></option>
                <?php endforeach; ?></select>
                <label class="screen-reader-text" for="atk-404-bots"><?php esc_html_e( 'Request type', 'activity-track' ); ?></label>
                <select id="atk-404-bots" name="bots"><?php foreach ( [ 'all' => __( 'All requests', 'activity-track' ), 'exclude' => __( 'Exclude bots', 'activity-track' ), 'only' => __( 'Bots only', 'activity-track' ) ] as $value => $label ) : ?>
                    <option value="<?php echo esc_attr( $value ); ?>" <?php selected( $filters['bots'], $value ); ?>><?php echo esc_html( $label ); ?></option>
                <?php endforeach; ?></select>
                <button class="button"><?php esc_html_e( 'Filter', 'activity-track' ); ?></button>
                <a class="button atk-reset-filters" href="<?php echo esc_url( $this->url() ); ?>"><span class="dashicons dashicons-no" aria-hidden="true"></span> <?php esc_html_e( 'Reset Filters', 'activity-track' ); ?></a>
            </div>
            <p class="search-box"><label class="screen-reader-text" for="atk-404-search"><?php esc_html_e( 'Search target URL', 'activity-track' ); ?></label><input id="atk-404-search" type="search" name="s" value="<?php echo esc_attr( $filters['s'] ); ?>"><button class="button"><?php esc_html_e( 'Search URL', 'activity-track' ); ?></button></p>
        </form>
        <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
            <input type="hidden" name="action" value="atk_404_delete">
            <input type="hidden" name="s" value="<?php echo esc_attr( $filters['s'] ); ?>"><input type="hidden" name="days" value="<?php echo esc_attr( $filters['days'] ); ?>">
            <input type="hidden" name="bots" value="<?php echo esc_attr( $filters['bots'] ); ?>">
            <?php wp_nonce_field( 'atk_404_delete' ); ?>
            <table class="widefat striped"><thead><tr><td class="check-column"><input id="atk-404-select-all" type="checkbox"><label class="screen-reader-text" for="atk-404-select-all"><?php esc_html_e( 'Select All', 'activity-track' ); ?></label></td><?php foreach ( [ __( 'Date & Time', 'activity-track' ), __( 'Target URL', 'activity-track' ), __( 'User Device', 'activity-track' ), __( 'User Location', 'activity-track' ), __( 'Source', 'activity-track' ) ] as $label ) echo '<th scope="col">' . esc_html( $label ) . '</th>'; ?></tr></thead><tbody>
            <?php if ( ! $rows ) echo '<tr><td colspan="6">' . esc_html__( 'No 404 records in this view. New errors appear after tracking is enabled.', 'activity-track' ) . '</td></tr>'; ?>
            <?php
            $incident_of = [];
            if ( $rows && class_exists( 'ATKAI_Incidents' ) && ATKAI_Incidents::ready_404() && current_user_can( 'manage_options' ) ) {
                global $wpdb;
                $ids = array_map( 'absint', array_column( $rows, 'log_id' ) );
                $links = $wpdb->get_results( $wpdb->prepare( 'SELECT log_id, MAX(incident_id) AS incident_id FROM %i WHERE log_id IN (' . implode( ',', array_fill( 0, count( $ids ), '%d' ) ) . ') GROUP BY log_id', array_merge( [ ATKAI_Incidents::scans() ], $ids ) ) );
                foreach ( (array) $links as $link ) $incident_of[ (int) $link->log_id ] = (int) $link->incident_id;
            }
            $rapid_of = [];
            $hashes = array_values( array_unique( array_filter( array_column( $rows, 'visitor_hash' ) ) ) );
            if ( $hashes ) {
                global $wpdb;
                $bursts = $wpdb->get_results( $wpdb->prepare( 'SELECT visitor_hash, COUNT(*) AS requests, MIN(captured_at) AS first_at, MAX(captured_at) AS last_at FROM %i WHERE visitor_hash IN (' . implode( ',', array_fill( 0, count( $hashes ), '%s' ) ) . ') GROUP BY visitor_hash', array_merge( [ ATKAI_404_Events::table() ], $hashes ) ) );
                foreach ( (array) $bursts as $burst ) {
                    $span = strtotime( $burst->last_at . ' UTC' ) - strtotime( $burst->first_at . ' UTC' );
                    // People do not hit 20+ missing pages a few seconds apart; crawlers do, whatever their user agent says.
                    if ( (int) $burst->requests >= 20 && $span <= (int) $burst->requests * 20 ) $rapid_of[ $burst->visitor_hash ] = (int) $burst->requests;
                }
            }
            ?>
            <?php foreach ( $rows as $row ) : ?>
                <tr><th scope="row" class="check-column"><input type="checkbox" name="logs[]" value="<?php echo esc_attr( $row->log_id ); ?>" aria-label="<?php echo esc_attr( sprintf( /* translators: %d: 404 log record ID. */ __( 'Select 404 record %d', 'activity-track' ), $row->log_id ) ); ?>"></th>
                <td><?php echo esc_html( human_time_diff( strtotime( $row->captured_at . ' UTC' ), time() ) . ' ' . __( 'ago', 'activity-track' ) ); ?><br><small><?php echo esc_html( get_date_from_gmt( $row->captured_at, 'M j, Y H:i:s' ) . ' ' . wp_timezone_string() ); ?></small></td>
                <td><code><?php echo esc_html( $row->target_url ); ?></code><?php if ( (int) ( $row->event_count ?? 0 ) > 1 ) : ?> <span class="atk-event-count"><?php echo esc_html( sprintf( /* translators: %s: number of grouped events. */ _n( '%s event', '%s events', $row->event_count, 'activity-track' ), number_format_i18n( $row->event_count ) ) ); ?></span><?php endif; ?><details><summary><?php esc_html_e( 'Request details', 'activity-track' ); ?></summary><p><?php echo esc_html( $row->request_method . ' · HTTP 404 · ' . ( $row->user_id ? sprintf( /* translators: %d: WordPress user ID. */ __( 'User ID %d', 'activity-track' ), $row->user_id ) : __( 'Guest', 'activity-track' ) ) ); ?></p><p><?php echo esc_html( $row->user_agent ?: __( 'User agent not provided', 'activity-track' ) ); ?></p></details></td>
                <td><?php echo wp_kses_post( class_exists( 'ATKAI_Incidents' ) ? ATKAI_Incidents::visitor_badge( ATKAI_404_Events::device( $row->user_agent, $row->target_url ), (int) $row->user_id, '', ! empty( $rapid_of[ $row->visitor_hash ?? '' ] ) && ! $row->user_id ? __( 'Automated (rapid requests)', 'activity-track' ) : '' ) : esc_html( ATKAI_404_Events::device( $row->user_agent, $row->target_url ) ) ); // Badge escapes its parts. ?></td><td><?php $this->location_cell( $row ); ?></td>
                <td class="atk-404-event-column"><div class="atk-event-actions"><div class="atk-event-details">
                    <?php $source = ATKAI_404_Events::source( $row->referrer_url, $row->target_url, ATKAI_404_Events::device( $row->user_agent, $row->target_url ), $rapid_of[ $row->visitor_hash ?? '' ] ?? 0 ); ?>
                    <span class="atk-event-name atk-404-source atk-404-source-<?php echo esc_attr( $source['kind'] ); ?>"><?php echo esc_html( $source['label'] ); ?></span>
                    <div class="atk-event-links">
                    <?php if ( $source['url'] && esc_url( $source['url'], [ 'http', 'https' ] ) ) : ?>
                        <span class="atk-404-referrer">
                            <a class="atk-404-referrer-link" href="<?php echo esc_url( $source['url'], [ 'http', 'https' ] ); ?>" target="_blank" rel="noopener noreferrer" aria-describedby="atk-404-referrer-<?php echo absint( $row->log_id ); ?>" aria-label="<?php esc_attr_e( 'Open the linking page (opens in a new tab)', 'activity-track' ); ?>"><span class="dashicons dashicons-external" aria-hidden="true"></span><span class="atk-404-referrer-label"><?php echo esc_html( $source['detail'] ); ?></span></a>
                            <span class="atk-404-referrer-tooltip" id="atk-404-referrer-<?php echo absint( $row->log_id ); ?>" role="tooltip"><?php echo esc_html( $row->referrer_url ); ?></span>
                        </span>
                    <?php else : ?>
                        <small class="atk-404-source-detail"><?php echo esc_html( $source['detail'] ); ?></small>
                    <?php endif; ?>
                    <?php if ( ! empty( $incident_of[ (int) $row->log_id ] ) ) : ?>
                        <a class="atk-404-incident" href="<?php echo esc_url( add_query_arg( [ 'page' => 'activity-track-ai', 'tab' => 'incidents', 'incident' => $incident_of[ (int) $row->log_id ] ], admin_url( 'admin.php' ) ) ); ?>"><span class="dashicons dashicons-shield" aria-hidden="true"></span><?php echo esc_html( sprintf( /* translators: %d: incident number. */ __( 'Incident #%d', 'activity-track' ), $incident_of[ (int) $row->log_id ] ) ); ?></a>
                    <?php endif; ?>
                    </div>
                </div><div class="atk-event-analysis">
                    <span class="atk-event-name"><?php esc_html_e( 'AI Analysis', 'activity-track' ); ?></span>
                    <?php if ( defined( 'ATKAI_PRO_PLUGIN_ACTIVE' ) ) : ?>
                        <?php
                        $row->atkai_log_source = '404';
                        echo wp_kses( apply_filters( 'atkai_render_logs_ai_column', '', $row ), [
                            'button' => [ 'type' => true, 'class' => true, 'data-log-id' => true, 'data-log-source' => true ],
                            'svg' => [ 'class' => true, 'width' => true, 'height' => true, 'viewbox' => true, 'fill' => true, 'xmlns' => true ],
                            'path' => [ 'd' => true, 'fill-rule' => true, 'clip-rule' => true, 'fill' => true ],
                            'span' => [ 'class' => true ],
                        ] );
                        ?>
                    <?php else : ?>
                        <a href="<?php echo esc_url( admin_url( 'admin.php?page=activity-track-ai&tab=activation' ) ); ?>"><?php esc_html_e( 'Available in PRO', 'activity-track' ); ?></a>
                    <?php endif; ?>
                </div></div></td></tr>
            <?php endforeach; ?></tbody></table>
            <div class="tablenav bottom"><button class="button" type="submit"><?php esc_html_e( 'Delete selected', 'activity-track' ); ?></button>
                <a class="button" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array_merge( [ 'action' => 'atk_404_export' ], $filters ), admin_url( 'admin-post.php' ) ), 'atk_404_export' ) ); ?>"><?php esc_html_e( 'Export latest 10,000 filtered records', 'activity-track' ); ?></a>
                <div class="tablenav-pages<?php echo $total_pages > 1 ? '' : ' one-page'; ?>">
                    <span class="displaying-num"><?php echo esc_html( sprintf( /* translators: %s: number of matching records. */ _n( '%s item', '%s items', $total_items, 'activity-track' ), number_format_i18n( $total_items ) ) ); ?></span>
                    <span class="pagination-links">
                        <?php foreach ( [
                            [ 'first-page', __( 'First page', 'activity-track' ), '«', 1, $page === 1 ],
                            [ 'prev-page', __( 'Previous page', 'activity-track' ), '‹', $page - 1, $page === 1 ],
                        ] as [ $class, $label, $symbol, $target, $disabled ] ) : ?>
                            <?php if ( $disabled ) : ?><span class="tablenav-pages-navspan button disabled" aria-hidden="true"><?php echo esc_html( $symbol ); ?></span>
                            <?php else : ?><a class="<?php echo esc_attr( $class ); ?> button" href="<?php echo esc_url( $this->url( array_merge( $filters, [ 'paged' => $target ] ) ) ); ?>"><span class="screen-reader-text"><?php echo esc_html( $label ); ?></span><span aria-hidden="true"><?php echo esc_html( $symbol ); ?></span></a><?php endif; ?>
                        <?php endforeach; ?>
                        <span class="screen-reader-text"><?php esc_html_e( 'Current Page', 'activity-track' ); ?></span>
                        <span class="paging-input"><span class="tablenav-paging-text"><?php echo esc_html( number_format_i18n( $page ) ); ?> <?php esc_html_e( 'of', 'activity-track' ); ?> <span class="total-pages"><?php echo esc_html( number_format_i18n( $total_pages ) ); ?></span></span></span>
                        <?php foreach ( [
                            [ 'next-page', __( 'Next page', 'activity-track' ), '›', $page + 1, $page === $total_pages ],
                            [ 'last-page', __( 'Last page', 'activity-track' ), '»', $total_pages, $page === $total_pages ],
                        ] as [ $class, $label, $symbol, $target, $disabled ] ) : ?>
                            <?php if ( $disabled ) : ?><span class="tablenav-pages-navspan button disabled" aria-hidden="true"><?php echo esc_html( $symbol ); ?></span>
                            <?php else : ?><a class="<?php echo esc_attr( $class ); ?> button" href="<?php echo esc_url( $this->url( array_merge( $filters, [ 'paged' => $target ] ) ) ); ?>"><span class="screen-reader-text"><?php echo esc_html( $label ); ?></span><span aria-hidden="true"><?php echo esc_html( $symbol ); ?></span></a><?php endif; ?>
                        <?php endforeach; ?>
                    </span>
                </div>
            </div>
        </form>
        <?php if ( defined( 'ATKAI_PRO_PLUGIN_ACTIVE' ) ) : ?>
            <button id="hidden-modal-trigger" data-modal-target="default-modal" data-modal-toggle="default-modal" type="button" class="hidden"></button>
            <?php do_action( 'atk_tablenav_after', 'bottom' ); ?>
        <?php endif; ?>
        </div>
        <?php
    }
}