<?php
if ( !defined( 'ABSPATH' ) ) exit; // Exit if accessed directly

function mobile_api_load_more_vehicles() {
	if ( empty( $_REQUEST['mobile_api_nonce'] ) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['mobile_api_nonce'] ) ), 'mobile_api-ajax-nonce' ) )
		wp_die( esc_html__( 'Your session has expired. Please reload page and try again.', 'ad-integration-for-mobile-de-api' ) );

	$category = isset( $_REQUEST['category'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['category'] ) ) : '';
	$posts = isset( $_REQUEST['posts'] ) ? intval( $_REQUEST['posts'] ) : 0;
	$page = isset( $_REQUEST['page'] ) ? intval( $_REQUEST['page'] ) : 0;
	$limit = isset( $_REQUEST['limit'] ) ? intval( $_REQUEST['limit'] ) : 0;
	// Filter attributes of the shortcode as JSON. jQuery parses the data attribute and sends it as an array,
	// so both forms are accepted. Never unserialize request data: that allows PHP object injection.
	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized per entry below
	$meta = isset( $_REQUEST['meta'] ) ? wp_unslash( $_REQUEST['meta'] ) : array();
	if ( is_string( $meta ) )
		$meta = json_decode( $meta, true );

	// Only plain values, they become meta query conditions in the shortcode
	$atts = array();
	if ( is_array( $meta ) ) :
		foreach ( $meta AS $key => $value ) {
			if ( is_scalar( $value ) )
				$atts[sanitize_key( $key )] = sanitize_text_field( (string) $value );
		}
	endif;

	// Set last, so the filter attributes cannot override them
	$atts['category'] = $category;
	$atts['posts'] = $posts;
	$atts['page'] = $page;
	$atts['limit'] = $limit;
	$atts['ajax'] = true;

	echo wp_kses_post( mobile_api_shortcode_vehicle_archive( $atts ) );

	wp_die();
}
add_action( 'wp_ajax_mobile_api_load_more_vehicles', 'mobile_api_load_more_vehicles' );
add_action( 'wp_ajax_nopriv_mobile_api_load_more_vehicles', 'mobile_api_load_more_vehicles' );

function mobile_api_import_vehicles() {
	if ( empty( $_REQUEST['mobile_api_nonce'] ) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['mobile_api_nonce'] ) ), 'mobile_api-ajax-nonce' ) )
		wp_die( esc_html__( 'Your session has expired. Please reload page and try again.', 'ad-integration-for-mobile-de-api' ) );

	// The nonce is also printed on public pages for loading more vehicles, so it does not restrict who may import
	if ( !current_user_can( 'manage_options' ) )
		wp_die( esc_html__( 'You are not allowed to import vehicles.', 'ad-integration-for-mobile-de-api' ), 403 );

	$page = isset( $_REQUEST['page'] ) ? intval( $_REQUEST['page'] ) : 0;
	$total = isset( $_REQUEST['total'] ) ? intval( $_REQUEST['total'] ) : 0;
	$limit = isset( $_REQUEST['limit'] ) ? intval( $_REQUEST['limit'] ) : 0;

	// Each page is a separate request, so failures are remembered until the last page.
	if ( $page == 1 )
		delete_transient( 'mobile_api_import_incomplete' );

	// Small pages, because every vehicle downloads all of its images. The settings page uses the same page size for the progress.
	$url = 'https://services.mobile.de/search-api/search?page.size=5&page.number='.$page;
	$json = mobile_api_request( $url );

	if ( !is_object( $json ) || !property_exists( $json, 'ads' ) ) :
		set_transient( 'mobile_api_import_incomplete', true, DAY_IN_SECONDS );
	elseif ( !empty( $json->ads ) ) :
		$total = $json->total;
		$limit = $json->maxPages;

		foreach ( $json->ads AS $ad ) :
			$url = 'https://services.mobile.de/search-api/ad/'.$ad->mobileAdId;
			$ad_json = mobile_api_request( $url );

			// Request failed or returned no JSON: the import has to be repeated
			if ( !is_object( $ad_json ) ) {
				set_transient( 'mobile_api_import_incomplete', true, DAY_IN_SECONDS );
				continue;
			}

			// API error instead of an ad, e.g. deleted in the meantime
			if ( !property_exists( $ad_json, 'mobileAdId' ) )
				continue;

			$args = array(
				// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
				'meta_key' => 'mobile_api_mobileAdId',
				// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value
				'meta_value' => $ad->mobileAdId,
				'post_type' => 'mobile-api-vehicle',
				'posts_per_page' => 1
			);
			$posts = get_posts( $args );

			if ( $posts )
				mobile_api_update_vehicle( $ad_json, $posts[0]->ID );
			else
				mobile_api_create_vehicle( $ad_json );
		endforeach;
	endif;

	if ( $page == $limit ) :
		if ( get_transient( 'mobile_api_import_incomplete' ) ) :
			delete_transient( 'mobile_api_import_incomplete' );

			// Without a last sync the settings page starts the import again on reload
			echo esc_html__( 'Import incomplete: Some vehicles could not be retrieved from mobile.de. Please reload this page to repeat the import.', 'ad-integration-for-mobile-de-api' ).'<style>#ajax-progress{ display: none; }</style>';
		else :
			$date_format = get_option( 'date_format' );
			$time_format = get_option( 'time_format' );

			$now = new DateTime( 'now', new DateTimeZone( 'UTC' ) );
			update_option( 'mobile_api_last_sync', $now->format( 'Y-m-d\TH:i:s.0\Z' ) ); // ISO-8601
			echo esc_html__( 'Import complete:', 'ad-integration-for-mobile-de-api' ).' '.esc_html( date_i18n( $date_format.', '.$time_format, strtotime( $now->format('Y-m-d\TH:i:s.0\Z') ) ) ).'<br><a href="'.esc_url( admin_url( 'edit.php?post_type=mobile-api-vehicle' ) ).'">» '.esc_html__( 'Go to vehicles', 'ad-integration-for-mobile-de-api' ).'</a><style>#ajax-progress{ display: none; }</style>';
		endif;
	endif;

	wp_die();
}
add_action( 'wp_ajax_mobile_api_import_vehicles', 'mobile_api_import_vehicles' );