<?php

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

class ASBFG_Logger {

    private static $instance = null;
    private $table_name;

    public static function get_instance() {
        if ( null === self::$instance ) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    private function __construct() {
        global $wpdb;
        $this->table_name = $wpdb->prefix . 'asbfg_blocked_logs';
        
        add_action( 'admin_menu', [ $this, 'add_logs_page' ], 20 );
        add_action( 'admin_post_asbfg_clear_logs', [ $this, 'handle_clear_logs' ] );
        add_action( 'admin_enqueue_scripts', [ $this, 'enqueue_log_styles' ] );
        
        // Schedule automatic log cleanup
        if ( ! wp_next_scheduled( 'asbfg_cleanup_old_logs' ) ) {
            wp_schedule_event( time(), 'daily', 'asbfg_cleanup_old_logs' );
        }
        add_action( 'asbfg_cleanup_old_logs', [ $this, 'cleanup_old_logs' ] );
    }

    public function enqueue_log_styles( $hook ) {
        // Only load on our logs page
        if ( strpos( $hook, 'asbfg_blocked_logs' ) === false ) {
            return;
        }
        
        wp_enqueue_style( 'asbfg-admin-styles', plugin_dir_url( dirname( __FILE__ ) ) . 'assets/admin-styles.css', [], '1.6.5' );
    }

    public function create_table() {
        global $wpdb;
        $charset_collate = $wpdb->get_charset_collate();

        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.SchemaChange -- Custom table creation required for logging functionality
        $sql = "CREATE TABLE IF NOT EXISTS {$this->table_name} (
            id bigint(20) NOT NULL AUTO_INCREMENT,
            form_id bigint(20) NOT NULL,
            block_type varchar(50) NOT NULL,
            blocked_value varchar(255) NOT NULL,
            ip_address varchar(100) NOT NULL,
            email varchar(255) DEFAULT NULL,
            user_agent text DEFAULT NULL,
            blocked_at datetime DEFAULT CURRENT_TIMESTAMP,
            PRIMARY KEY (id),
            KEY form_id (form_id),
            KEY block_type (block_type),
            KEY blocked_at (blocked_at)
        ) $charset_collate;";

        require_once ABSPATH . 'wp-admin/includes/upgrade.php';
        dbDelta( $sql );
    }

    public function log_blocked_submission( $form_id, $block_type, $blocked_value, $ip_address, $email = '' ) {
        global $wpdb;

        $user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';

        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Custom table requires direct query
        $wpdb->insert(
            $this->table_name,
            [
                'form_id'       => $form_id,
                'block_type'    => $block_type,
                'blocked_value' => $blocked_value,
                'ip_address'    => $ip_address,
                'email'         => $email,
                'user_agent'    => $user_agent,
                'blocked_at'    => current_time( 'mysql' ),
            ],
            [ '%d', '%s', '%s', '%s', '%s', '%s', '%s' ]
        );

        // Invalidate stats cache
        wp_cache_delete( 'asbfg_stats_cache', 'asbfg' );
    }

    public function get_logs( $limit = 100, $offset = 0 ) {
        global $wpdb;
        
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table requires direct query, caching not needed for admin display
        return $wpdb->get_results(
            $wpdb->prepare(
                // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name is safe, set in constructor with wpdb prefix
                "SELECT * FROM {$this->table_name} ORDER BY blocked_at DESC LIMIT %d OFFSET %d",
                $limit,
                $offset
            )
        );
    }

    public function get_total_logs() {
        global $wpdb;
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Custom table requires direct query, caching not needed for admin display, table name is safe
        return $wpdb->get_var( "SELECT COUNT(*) FROM {$this->table_name}" );
    }

    public function get_stats() {
        global $wpdb;
        
        // Try to get cached stats (cache for 5 minutes)
        $cache_key = 'asbfg_stats_cache';
        $cached_stats = wp_cache_get( $cache_key, 'asbfg' );
        
        if ( false !== $cached_stats ) {
            return $cached_stats;
        }
        
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Custom table requires direct query, caching not needed for admin display, table name is safe
        $total = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$this->table_name}" );
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table requires direct query, caching not needed for admin display
        $today = (int) $wpdb->get_var( 
            $wpdb->prepare(
                // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name is safe, set in constructor with wpdb prefix
                "SELECT COUNT(*) FROM {$this->table_name} WHERE DATE(blocked_at) = %s",
                current_time( 'Y-m-d' )
            )
        );
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table requires direct query, caching not needed for admin display
        $this_week = (int) $wpdb->get_var(
            $wpdb->prepare(
                // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name is safe, set in constructor with wpdb prefix
                "SELECT COUNT(*) FROM {$this->table_name} WHERE blocked_at >= %s",
                gmdate( 'Y-m-d', strtotime( '-7 days' ) )
            )
        );
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table requires direct query, caching not needed for admin display
        $this_month = (int) $wpdb->get_var(
            $wpdb->prepare(
                // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name is safe, set in constructor with wpdb prefix
                "SELECT COUNT(*) FROM {$this->table_name} WHERE blocked_at >= %s",
                gmdate( 'Y-m-d', strtotime( '-30 days' ) )
            )
        );

        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table requires direct query, caching not needed for admin display
        $by_type = $wpdb->get_results(
            // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name is safe, set in constructor with wpdb prefix
            "SELECT block_type, COUNT(*) as count FROM {$this->table_name} GROUP BY block_type"
        );

        if ( ! $by_type ) {
            $by_type = [];
        }

        $stats = [
            'total'      => $total,
            'today'      => $today,
            'this_week'  => $this_week,
            'this_month' => $this_month,
            'by_type'    => $by_type,
        ];

        // Cache stats for 5 minutes
        wp_cache_set( $cache_key, $stats, 'asbfg', 300 );

        return $stats;
    }

    public function add_logs_page() {
        if ( ! class_exists( 'GFForms' ) ) {
            return;
        }

        add_submenu_page(
            'gf_edit_forms',
            __( 'Blocked Submissions Log', 'addon-submission-blocker-for-gravityforms' ),
            __( 'Blocked Log', 'addon-submission-blocker-for-gravityforms' ),
            'gform_full_access',
            'asbfg_blocked_logs',
            [ $this, 'render_logs_page' ]
        );
    }

    public function render_logs_page() {
        // Ensure table exists
        $this->create_table();
        
        $stats = $this->get_stats();
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Pagination parameter, not form processing
        $page = isset( $_GET['paged'] ) ? max( 1, absint( $_GET['paged'] ) ) : 1;
        $per_page = 20;
        $offset = ( $page - 1 ) * $per_page;
        $logs = $this->get_logs( $per_page, $offset );
        $total = $this->get_total_logs();
        $total_pages = ceil( $total / $per_page );

        ?>
        <div class="wrap gform-settings-wrap">
            <h1 class="gform-settings__title"><?php esc_html_e( 'Blocked Submissions Log', 'addon-submission-blocker-for-gravityforms' ); ?></h1>

            <div class="asbfg-stats-grid">
                <div class="asbfg-stat-card">
                    <div class="asbfg-stat-content">
                        <div class="asbfg-stat-icon">📊</div>
                        <h3><?php esc_html_e( 'Total Blocked', 'addon-submission-blocker-for-gravityforms' ); ?></h3>
                        <p class="asbfg-stat-number"><?php echo esc_html( number_format_i18n( $stats['total'] ) ); ?></p>
                    </div>
                </div>
                <div class="asbfg-stat-card">
                    <div class="asbfg-stat-content">
                        <div class="asbfg-stat-icon">📅</div>
                        <h3><?php esc_html_e( 'Today', 'addon-submission-blocker-for-gravityforms' ); ?></h3>
                        <p class="asbfg-stat-number"><?php echo esc_html( number_format_i18n( $stats['today'] ) ); ?></p>
                    </div>
                </div>
                <div class="asbfg-stat-card">
                    <div class="asbfg-stat-content">
                        <div class="asbfg-stat-icon">📈</div>
                        <h3><?php esc_html_e( 'This Week', 'addon-submission-blocker-for-gravityforms' ); ?></h3>
                        <p class="asbfg-stat-number"><?php echo esc_html( number_format_i18n( $stats['this_week'] ) ); ?></p>
                    </div>
                </div>
                <div class="asbfg-stat-card">
                    <div class="asbfg-stat-content">
                        <div class="asbfg-stat-icon">📆</div>
                        <h3><?php esc_html_e( 'This Month', 'addon-submission-blocker-for-gravityforms' ); ?></h3>
                        <p class="asbfg-stat-number"><?php echo esc_html( number_format_i18n( $stats['this_month'] ) ); ?></p>
                    </div>
                </div>
            </div>

            <?php if ( ! empty( $stats['by_type'] ) ) : ?>
            <div class="asbfg-stats-by-type">
                <h3><?php esc_html_e( 'Breakdown by Block Type', 'addon-submission-blocker-for-gravityforms' ); ?></h3>
                <div class="asbfg-type-stats-grid">
                    <?php foreach ( $stats['by_type'] as $type_stat ) : 
                        $type_label = ucfirst( str_replace( '_', ' ', $type_stat->block_type ) );
                        // Fix IP capitalization
                        $type_label = str_replace( 'Ip', 'IP', $type_label );
                        
                        // Get icon for each type
                        $icons = [
                            'ip'      => '🌐',
                            'email'   => '📧',
                            'domain'  => '🏢',
                            'country' => '🌍',
                            'text'    => '📝',
                        ];
                        $icon = isset( $icons[ $type_stat->block_type ] ) ? $icons[ $type_stat->block_type ] : '🚫';
                    ?>
                        <div class="asbfg-type-stat-card">
                            <div class="asbfg-type-icon"><?php echo esc_html( $icon ); ?></div>
                            <div class="asbfg-type-info">
                                <span class="asbfg-type-label"><?php echo esc_html( $type_label ); ?></span>
                                <span class="asbfg-type-count"><?php echo esc_html( number_format_i18n( $type_stat->count ) ); ?></span>
                            </div>
                        </div>
                    <?php endforeach; ?>
                </div>
            </div>
            <?php endif; ?>

            <div class="asbfg-logs-header">
                <h2><?php esc_html_e( 'Recent Blocked Attempts', 'addon-submission-blocker-for-gravityforms' ); ?></h2>
                <div class="asbfg-header-actions">
                    <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
                        <input type="hidden" name="action" value="asbfg_clear_logs">
                        <?php wp_nonce_field( 'asbfg_clear_logs_action', 'asbfg_clear_logs_nonce' ); ?>
                        <button type="submit" class="button" onclick="return confirm('<?php esc_attr_e( 'Are you sure you want to clear all logs?', 'addon-submission-blocker-for-gravityforms' ); ?>')">
                            <?php esc_html_e( 'Clear All Logs', 'addon-submission-blocker-for-gravityforms' ); ?>
                        </button>
                    </form>
                </div>
            </div>

            <?php if ( $total_pages > 1 ) : ?>
                <div class="tablenav top">
                    <div class="tablenav-pages">
                        <span class="displaying-num">
                            <?php
                            /* translators: %s: Number of items */
                            printf( esc_html__( '%s items', 'addon-submission-blocker-for-gravityforms' ), esc_html( number_format_i18n( $total ) ) );
                            ?>
                        </span>
                        <?php
                        $page_links = paginate_links( [
                            'base'      => add_query_arg( 'paged', '%#%' ),
                            'format'    => '',
                            'prev_text' => '&lsaquo;',
                            'next_text' => '&rsaquo;',
                            'total'     => $total_pages,
                            'current'   => $page,
                            'type'      => 'plain',
                        ] );
                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- paginate_links output is safe
                        echo $page_links;
                        ?>
                    </div>
                </div>
            <?php endif; ?>

            <div class="asbfg-logs-table-wrapper">
                <?php if ( empty( $logs ) ) : ?>
                    <div class="asbfg-empty-state">
                        <div class="asbfg-empty-icon">🛡️</div>
                        <h3><?php esc_html_e( 'No Blocked Submissions Yet', 'addon-submission-blocker-for-gravityforms' ); ?></h3>
                        <p><?php esc_html_e( 'When submissions are blocked, they will appear here.', 'addon-submission-blocker-for-gravityforms' ); ?></p>
                    </div>
                <?php else : ?>
                    <table class="wp-list-table widefat fixed striped asbfg-logs-table">
                        <thead>
                            <tr>
                                <th class="column-date"><?php esc_html_e( 'Date/Time', 'addon-submission-blocker-for-gravityforms' ); ?></th>
                                <th class="column-form"><?php esc_html_e( 'Form', 'addon-submission-blocker-for-gravityforms' ); ?></th>
                                <th class="column-type"><?php esc_html_e( 'Block Type', 'addon-submission-blocker-for-gravityforms' ); ?></th>
                                <th class="column-value"><?php esc_html_e( 'Blocked Value', 'addon-submission-blocker-for-gravityforms' ); ?></th>
                                <th class="column-ip"><?php esc_html_e( 'IP Address', 'addon-submission-blocker-for-gravityforms' ); ?></th>
                                <th class="column-email"><?php esc_html_e( 'Email', 'addon-submission-blocker-for-gravityforms' ); ?></th>
                            </tr>
                        </thead>
                        <tbody>
                            <?php foreach ( $logs as $log ) : ?>
                                <tr>
                                    <td class="column-date">
                                        <strong><?php echo esc_html( date_i18n( get_option( 'date_format' ), strtotime( $log->blocked_at ) ) ); ?></strong><br>
                                        <span class="asbfg-time"><?php echo esc_html( date_i18n( get_option( 'time_format' ), strtotime( $log->blocked_at ) ) ); ?></span>
                                    </td>
                                    <td class="column-form">
                                        <?php
                                        if ( class_exists( 'GFAPI' ) ) {
                                            $form = GFAPI::get_form( $log->form_id );
                                            if ( $form ) {
                                                echo '<a href="' . esc_url( admin_url( 'admin.php?page=gf_entries&id=' . $log->form_id ) ) . '">';
                                                echo esc_html( $form['title'] );
                                                echo '</a>';
                                            } else {
                                                echo esc_html( $log->form_id );
                                            }
                                        } else {
                                            echo esc_html( $log->form_id );
                                        }
                                        ?>
                                    </td>
                                    <td class="column-type">
                                        <?php
                                        $type_label = ucfirst( str_replace( '_', ' ', $log->block_type ) );
                                        $type_label = str_replace( 'Ip', 'IP', $type_label );
                                        ?>
                                        <span class="asbfg-badge asbfg-badge-<?php echo esc_attr( $log->block_type ); ?>">
                                            <?php echo esc_html( $type_label ); ?>
                                        </span>
                                    </td>
                                    <td class="column-value">
                                        <code><?php echo esc_html( $log->blocked_value ); ?></code>
                                    </td>
                                    <td class="column-ip">
                                        <code><?php echo esc_html( $log->ip_address ); ?></code>
                                    </td>
                                    <td class="column-email">
                                        <?php echo $log->email ? esc_html( $log->email ) : '<span class="asbfg-na">—</span>'; ?>
                                    </td>
                                </tr>
                            <?php endforeach; ?>
                        </tbody>
                    </table>
                <?php endif; ?>
            </div>

            <?php if ( $total_pages > 1 ) : ?>
                <div class="tablenav bottom">
                    <div class="tablenav-pages">
                        <span class="displaying-num">
                            <?php
                            /* translators: %s: Number of items */
                            printf( esc_html__( '%s items', 'addon-submission-blocker-for-gravityforms' ), esc_html( number_format_i18n( $total ) ) );
                            ?>
                        </span>
                        <?php
                        $page_links = paginate_links( [
                            'base'      => add_query_arg( 'paged', '%#%' ),
                            'format'    => '',
                            'prev_text' => '&lsaquo;',
                            'next_text' => '&rsaquo;',
                            'total'     => $total_pages,
                            'current'   => $page,
                            'type'      => 'plain',
                        ] );
                        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- paginate_links output is safe
                        echo $page_links;
                        ?>
                    </div>
                </div>
            <?php endif; ?>
        </div>
        <?php
    }

    public function handle_clear_logs() {
        check_admin_referer( 'asbfg_clear_logs_action', 'asbfg_clear_logs_nonce' );

        if ( ! current_user_can( 'manage_options' ) ) {
            wp_die( esc_html__( 'Unauthorized', 'addon-submission-blocker-for-gravityforms' ) );
        }

        global $wpdb;
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Custom table requires direct query, caching not needed, table name is safe
        $wpdb->query( "TRUNCATE TABLE {$this->table_name}" );

        // Invalidate stats cache
        wp_cache_delete( 'asbfg_stats_cache', 'asbfg' );

        wp_safe_redirect( add_query_arg( 'message', 'cleared', admin_url( 'admin.php?page=asbfg_blocked_logs' ) ) );
        exit;
    }

    public function cleanup_old_logs() {
        $retention_days = (int) get_option( 'asbfg_log_retention_days', 90 );
        
        // If set to 0, keep logs forever
        if ( 0 === $retention_days ) {
            return;
        }

        global $wpdb;
        
        // Delete logs older than retention period
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Custom table requires direct query, caching not needed for cleanup
        $deleted = $wpdb->query(
            $wpdb->prepare(
                // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table name is safe, set in constructor with wpdb prefix
                "DELETE FROM {$this->table_name} WHERE blocked_at < DATE_SUB(NOW(), INTERVAL %d DAY)",
                $retention_days
            )
        );

        // Invalidate stats cache if any logs were deleted
        if ( $deleted > 0 ) {
            wp_cache_delete( 'asbfg_stats_cache', 'asbfg' );
        }
    }
}