<?php
/**
 * Decides which pages to look at, fetches them as a real visitor would, and
 * hands the HTML to the analyzer.
 *
 * We fetch the rendered front end over HTTP rather than reading post_content,
 * because the accessibility failures that matter are produced by the *theme* —
 * the nav, the header, the cart drawer, the cookie banner — and none of that is
 * in post_content.
 *
 * @package AdinavAccessibilityAuditEAA
 */

defined( 'ABSPATH' ) || exit;

class ADNVAA_Scanner {

	/**
	 * Build the list of URLs to audit, most-important first.
	 *
	 * The ordering matters: with a limited free-tier budget, the pages that decide
	 * whether the business is compliant are the home page, the shop, and — above
	 * all — the checkout, because that is where an inaccessible form stops being an
	 * inconvenience and starts being a lost sale and a legal exposure.
	 */
	public static function candidate_urls( $limit = 0 ) {
		$urls = array();

		$urls[] = home_url( '/' );

		// WooCommerce: the pages an EAA regulator would look at first.
		if ( function_exists( 'wc_get_page_id' ) ) {
			foreach ( array( 'shop', 'cart', 'checkout', 'myaccount' ) as $wc_page ) {
				$id = wc_get_page_id( $wc_page );
				if ( $id > 0 ) {
					$url = get_permalink( $id );
					if ( $url ) {
						$urls[] = $url;
					}
				}
			}

			$products = get_posts(
				array(
					'post_type'      => 'product',
					'posts_per_page' => 3,
					'post_status'    => 'publish',
					'fields'         => 'ids',
				)
			);
			foreach ( $products as $pid ) {
				$urls[] = get_permalink( $pid );
			}
		}

		// Contact / legal pages: forms and long text, both high-risk.
		$pages = get_posts(
			array(
				'post_type'      => 'page',
				'posts_per_page' => 10,
				'post_status'    => 'publish',
				'orderby'        => 'menu_order',
				'order'          => 'ASC',
				'fields'         => 'ids',
			)
		);
		foreach ( $pages as $pid ) {
			$urls[] = get_permalink( $pid );
		}

		$posts = get_posts(
			array(
				'post_type'      => 'post',
				'posts_per_page' => 3,
				'post_status'    => 'publish',
				'fields'         => 'ids',
			)
		);
		foreach ( $posts as $pid ) {
			$urls[] = get_permalink( $pid );
		}

		$urls = array_values( array_unique( array_filter( $urls ) ) );

		if ( $limit > 0 ) {
			$urls = array_slice( $urls, 0, $limit );
		}

		return $urls;
	}

	/**
	 * Fetch one URL and analyze it.
	 *
	 * @return array{issues:array,error:string}
	 */
	public static function scan_url( $url ) {
		$response = wp_remote_get(
			$url,
			array(
				'timeout'     => 20,
				'redirection' => 3,
				/**
				 * Certificates are verified by default. Local and staging sites often
				 * run on a self-signed certificate, so this can be relaxed — but only
				 * deliberately, by the site owner, and never silently by us.
				 *
				 * add_filter( 'adnvaa_sslverify', '__return_false' );
				 */
				'sslverify'   => (bool) apply_filters( 'adnvaa_sslverify', true ),
				'user-agent'  => 'AdinavAccessibilityAuditEAA/' . ADNVAA_VERSION . '; ' . home_url( '/' ),
				'headers'     => array( 'Accept' => 'text/html' ),
			)
		);

		if ( is_wp_error( $response ) ) {
			return array(
				'issues' => array(),
				'error'  => $response->get_error_message(),
			);
		}

		$code = wp_remote_retrieve_response_code( $response );
		if ( $code < 200 || $code >= 400 ) {
			return array(
				'issues' => array(),
				'error'  => sprintf(
					/* translators: %d: HTTP status code */
					__( 'The server returned HTTP %d for this URL.', 'adinav-accessibility-audit-eaa' ),
					$code
				),
			);
		}

		$html = wp_remote_retrieve_body( $response );
		if ( '' === trim( $html ) ) {
			return array(
				'issues' => array(),
				'error'  => __( 'The page returned an empty body.', 'adinav-accessibility-audit-eaa' ),
			);
		}

		$analyzer = new ADNVAA_Analyzer();
		$issues   = $analyzer->analyze( $html );

		if ( is_wp_error( $issues ) ) {
			return array(
				'issues' => array(),
				'error'  => $issues->get_error_message(),
			);
		}

		return array(
			'issues' => $issues,
			'error'  => '',
		);
	}

	/**
	 * Run a full scan.
	 *
	 * @param int $limit Max pages. ADNVAA_FREE_PAGE_LIMIT in the free tier.
	 */
	public static function run( $limit = ADNVAA_FREE_PAGE_LIMIT ) {
		// Deliberately no set_time_limit(): the free tier fetches at most a handful
		// of pages, and silently overriding a host's execution limit is exactly the
		// kind of thing that takes a shared server down.
		$all_urls = self::candidate_urls();
		$urls     = array_slice( $all_urls, 0, $limit );

		$scan_id = ADNVAA_Store::start_scan();
		$errors  = array();
		$scanned = 0;

		foreach ( $urls as $url ) {
			$result = self::scan_url( $url );

			if ( $result['error'] ) {
				$errors[ $url ] = $result['error'];
				continue;
			}

			ADNVAA_Store::add_issues( $scan_id, $url, $result['issues'] );
			$scanned++;
		}

		$meta = array(
			'scan_id'        => $scan_id,
			'finished_at'    => current_time( 'mysql' ),
			'pages_scanned'  => $scanned,
			'pages_found'    => count( $all_urls ),
			'page_limit'     => $limit,
			'urls'           => $urls,
			'errors'         => $errors,
		);

		ADNVAA_Store::save_scan_meta( $meta );

		return $meta;
	}
}