<?php
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Lightweight, free-tier analytics: view count + add-to-cart count per
 * video, stored as postmeta. No dashboard charts here — just numbers on
 * the video list table (see ADDOSHVI_Admin::render_columns). Deeper analytics
 * (watch time, unique visitors, top performers) is a Pro-tier feature.
 */
class ADDOSHVI_Analytics {

	private static $instance = null;

	public static function instance() {
		if ( null === self::$instance ) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	private function __construct() {
		add_action( 'wp_ajax_addoshvi_track_event', array( __CLASS__, 'ajax_track_event' ) );
		add_action( 'wp_ajax_nopriv_addoshvi_track_event', array( __CLASS__, 'ajax_track_event' ) );
	}

	public static function ajax_track_event() {
		check_ajax_referer( 'addoshvi_frontend_nonce', 'nonce' );

		$video_id = isset( $_POST['video_id'] ) ? absint( $_POST['video_id'] ) : 0;
		$event    = isset( $_POST['event'] ) ? sanitize_key( $_POST['event'] ) : '';

		// Without confirming this is a real, published addoshvi_video post, any
		// visitor could send an arbitrary post ID (or one that doesn't exist
		// at all) and freely inflate/create analytics postmeta on it — this
		// endpoint has no other access control beyond the nonce, which every
		// visitor gets just by loading the page.
		if (
			! $video_id
			|| ! in_array( $event, array( 'view', 'whatsapp' ), true )
			|| ADDOSHVI_POST_TYPE !== get_post_type( $video_id )
			|| 'publish' !== get_post_status( $video_id )
		) {
			wp_send_json_error();
		}

		self::increment( $video_id, $event );
		wp_send_json_success();
	}

	/**
	 * @param int    $video_id
	 * @param string $type view|cart|whatsapp
	 */
	public static function increment( $video_id, $type ) {
		global $wpdb;
		$meta_key = '_addoshvi_' . $type . '_count';

		// A single atomic UPDATE instead of get_post_meta() + update_post_meta()
		// — the read-then-write pattern loses increments under concurrent
		// requests (two requests can read the same stale value and both
		// write current+1). Falls back to inserting a starting row of 1 the
		// first time (add_post_meta with unique=true also guards against a
		// race creating duplicate rows here).
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Atomic increment; WordPress has no core API for this, and the get_post_meta()+update_post_meta() alternative loses increments under concurrent requests (see comment above).
		$updated = $wpdb->query( $wpdb->prepare(
			"UPDATE {$wpdb->postmeta} SET meta_value = meta_value + 1 WHERE post_id = %d AND meta_key = %s",
			$video_id,
			$meta_key
		) );

		if ( ! $updated ) {
			add_post_meta( $video_id, $meta_key, 1, true );
		} else {
			// The direct UPDATE above bypasses WordPress's object cache, so a
			// cached get_post_meta() read for this post would still return
			// the pre-increment value. Clear it so the next read (e.g. the
			// admin video list's Views/Add-to-cart column) reflects the new
			// count immediately instead of a stale one.
			wp_cache_delete( $video_id, 'post_meta' );
		}
	}
}