<?php
/**
 * AddOnBoss: a single, earned request for a WordPress.org review.
 *
 * Nothing annoys plugin users more than a review nag, so this is deliberately
 * quiet:
 *   - never in the Pro build (Pro arrives via Freemius; wp.org reviews are the
 *     free listing),
 *   - only after real use (options attached to a product, and a week lived
 *     with it),
 *   - only on AddOnBoss's own admin screens, never store-wide,
 *   - retired forever the moment the merchant interacts with it, and it
 *     auto-retires after a few quiet showings even if ignored,
 *   - unhappy users are pointed at the support forum, not the review form, so
 *     problems get fixed instead of becoming one-star reviews.
 *
 * @package AddOnBoss
 */

defined( 'ABSPATH' ) || exit;

/**
 * Stamp when the merchant first attaches options to a product: the "real use"
 * clock.
 *
 * Attaching options to a product is AddOnBoss's own job, which is why the clock
 * hangs off that and not off saving an option set. The set library is SHARED
 * with BundleBoss (one store, `ADDON_BOSS_OPTION_SETS_STORE`), so a set can
 * exist on a store that has only ever used BundleBoss, and asking those
 * merchants to review AddOnBoss would be asking about something they have not
 * used.
 *
 * Hooked on core's meta actions rather than inside the engine's save function,
 * because the engine is byte-identical across both plugins and must not carry
 * anything that belongs to only one of them.
 */
function addon_boss_stamp_first_attach( $meta_id, $object_id, $meta_key ): void {
	if ( ADDON_BOSS_PRODUCT_OPTIONS_META !== $meta_key ) {
		return;
	}
	if ( ! get_option( 'addon_boss_first_attach_time' ) ) {
		add_option( 'addon_boss_first_attach_time', time(), '', false );
	}
}
add_action( 'added_post_meta', 'addon_boss_stamp_first_attach', 10, 3 );
add_action( 'updated_post_meta', 'addon_boss_stamp_first_attach', 10, 3 );

/**
 * Whether to make the (single) review request now: free build only, not already
 * settled, options attached to something, and a week passed since that landed.
 */
function addon_boss_should_request_review(): bool {
	// The paid build silences the ask by answering this filter, and that is why
	// this file does not simply test the plan. No file that ships to
	// WordPress.org may ask a plan question at all, with no exemptions
	// (FreeBuildSurfaceTest); an exemption is how the last finding of this kind
	// got in. So the question lives in a __premium_only module that is absent
	// from the free build, exactly as the engine's paid modules work: a module
	// either exists on disk or it does not.
	if ( ! apply_filters( 'addon_boss_review_request_allowed', true ) ) {
		return false;
	}
	if ( 'done' === get_option( 'addon_boss_review_state', 'new' ) ) {
		return false;
	}
	$first = (int) get_option( 'addon_boss_first_attach_time', 0 );
	return $first > 0 && ( time() - $first ) >= WEEK_IN_SECONDS;
}

/**
 * True only on AddOnBoss's own pages: its landing and the Option Sets library
 * under the BossMage menu, or the product editor when that product actually
 * carries AddOnBoss options.
 *
 * Deliberately NOT the whole products list or every product's editor.
 * WordPress.org asks that notices stay contextual to the plugin rather than
 * being sprayed across the admin, and a merchant editing an unrelated product
 * is not being asked about AddOnBoss.
 */
function addon_boss_is_own_admin_screen(): bool {
	$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
	if ( ! $screen ) {
		return false;
	}
	$id = (string) $screen->id;
	if ( false !== strpos( $id, 'addon-boss' ) || false !== strpos( $id, 'bossmage' ) ) {
		return true;
	}
	if ( 'product' === $screen->id ) {
		global $post;
		if ( ! $post || ! function_exists( 'wc_get_product' ) ) {
			return false;
		}
		$product = wc_get_product( $post->ID );
		return $product instanceof WC_Product
			&& (bool) addon_boss_product_option_config( $product );
	}
	return false;
}

// Let the review/support redirects reach wordpress.org via wp_safe_redirect.
add_filter(
	'allowed_redirect_hosts',
	function ( $hosts ) {
		$hosts[] = 'wordpress.org';
		return $hosts;
	}
);

// Settle the request. Any choice retires it forever; "Leave a review" and
// "I have feedback" also send the merchant on to the right wp.org page.
add_action(
	'admin_init',
	function () {
		if ( ! isset( $_GET['addon_boss_review'] ) ) {
			return;
		}
		if ( ! current_user_can( 'manage_woocommerce' ) ) {
			return;
		}
		check_admin_referer( 'addon_boss_review' );
		update_option( 'addon_boss_review_state', 'done', false );

		$choice = sanitize_key( wp_unslash( $_GET['addon_boss_review'] ) );
		if ( 'yes' === $choice ) {
			wp_safe_redirect( 'https://wordpress.org/support/plugin/addon-boss/reviews/#new-post' );
			exit;
		}
		if ( 'feedback' === $choice ) {
			wp_safe_redirect( 'https://wordpress.org/support/plugin/addon-boss/' );
			exit;
		}
		wp_safe_redirect( remove_query_arg( array( 'addon_boss_review', '_wpnonce' ) ) );
		exit;
	}
);

// Persist the native "x" dismissal so the ask is final, exactly like clicking a
// button. Standard practice: a dismissed review notice never returns. Registered
// unconditionally because AJAX runs as its own request.
add_action(
	'wp_ajax_addon_boss_review_dismiss',
	function () {
		if ( ! current_user_can( 'manage_woocommerce' ) ) {
			wp_die( '', '', array( 'response' => 403 ) );
		}
		check_ajax_referer( 'addon_boss_review_dismiss' );
		update_option( 'addon_boss_review_state', 'done', false );
		wp_send_json_success();
	}
);

add_action( 'admin_notices', 'addon_boss_render_review_notice' );

function addon_boss_render_review_notice(): void {
	if ( ! current_user_can( 'manage_woocommerce' ) ) {
		return;
	}
	if ( ! addon_boss_should_request_review() || ! addon_boss_is_own_admin_screen() ) {
		return;
	}

	// Seen enough? Retire it on its own, even if never clicked.
	$shown = (int) get_option( 'addon_boss_review_shown', 0 );
	if ( $shown >= 5 ) {
		update_option( 'addon_boss_review_state', 'done', false );
		return;
	}
	update_option( 'addon_boss_review_shown', $shown + 1, false );

	$review   = wp_nonce_url( add_query_arg( 'addon_boss_review', 'yes' ), 'addon_boss_review' );
	$feedback = wp_nonce_url( add_query_arg( 'addon_boss_review', 'feedback' ), 'addon_boss_review' );
	$dismiss  = wp_nonce_url( add_query_arg( 'addon_boss_review', 'no' ), 'addon_boss_review' );
	?>
	<div class="notice notice-info is-dismissible addon-boss-review-notice">
		<p><?php esc_html_e( 'Enjoying AddOnBoss? A quick review on WordPress.org genuinely helps a small plugin reach more shops. Not loving something? Tell us instead and we will help.', 'addon-boss' ); ?></p>
		<p>
			<a href="<?php echo esc_url( $review ); ?>" class="button button-primary"><?php esc_html_e( 'Leave a review', 'addon-boss' ); ?></a>
			<a href="<?php echo esc_url( $feedback ); ?>" class="button"><?php esc_html_e( 'I have feedback', 'addon-boss' ); ?></a>
			<a href="<?php echo esc_url( $dismiss ); ?>" class="button-link"><?php esc_html_e( 'No thanks', 'addon-boss' ); ?></a>
		</p>
	</div>
	<script>
	( function () {
		var n = document.querySelector( '.addon-boss-review-notice' );
		if ( ! n ) { return; }
		// Core injects the "x" after load, so listen on the notice itself.
		n.addEventListener( 'click', function ( e ) {
			if ( ! e.target.classList.contains( 'notice-dismiss' ) ) { return; }
			var body = new FormData();
			body.append( 'action', 'addon_boss_review_dismiss' );
			body.append( '_wpnonce', '<?php echo esc_js( wp_create_nonce( 'addon_boss_review_dismiss' ) ); ?>' );
			if ( navigator.sendBeacon ) {
				navigator.sendBeacon( ajaxurl, body );
			} else {
				fetch( ajaxurl, { method: 'POST', body: body, credentials: 'same-origin' } );
			}
		} );
	} )();
	</script>
	<?php
}