<?php
if (!defined('ABSPATH')) exit;

class ADLHPTI_Admin
{

    public function __construct()
    {
        add_action('admin_menu', [$this, 'add_settings_page']);
        add_action('admin_init', [$this, 'adlhpti_register_settings']);
        add_action('init', [$this, 'adlhpti_custom_login_redirect']);
        add_action('admin_enqueue_scripts', [$this, 'adlhpti_admin_enqueue_assets']);
        add_action('wp_enqueue_scripts', [$this, 'adlhpti_frontend_enqueue_assets'], 99999);
        add_action('wp_print_styles', [$this, 'adlhpti_isolate_login_styles'], 1);
        add_action('wp_print_scripts', [$this, 'adlhpti_isolate_login_scripts'], 1);
        add_action('wp_print_footer_scripts', [$this, 'adlhpti_isolate_login_scripts'], 1);
        add_filter('lostpassword_url', [$this, 'adlhpti_custom_lostpassword_url'], 99, 2);
        add_filter('retrieve_password_message', [$this, 'adlhpti_custom_retrieve_password_message'], 10, 4);
        add_filter('login_url', [$this, 'adlhpti_custom_login_url'], 10, 3);
        add_filter('logout_redirect', [$this, 'adlhpti_custom_logout_redirect'], 10, 3);
        add_filter('login_redirect', [$this, 'adlhpti_custom_login_redirect_filter'], 99, 3);
        add_filter('admin_email_check_interval', [$this, 'adlhpti_disable_admin_email_check'], 10, 1);
        add_action('wp_ajax_adlhpti_save_settings', [$this, 'adlhpti_ajax_save_settings']);
    }

    public function is_custom_login_page()
    {
        $is_enabled = get_option('adlhpti_enabled', false);
        if (!$is_enabled) {
            return false;
        }

        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');
        $request_uri_raw = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '';
        $parsed_request_uri = wp_parse_url($request_uri_raw);
        $request_path = isset($parsed_request_uri['path']) ? trim($parsed_request_uri['path'], '/') : '';

        $parsed_site_url = wp_parse_url(site_url());
        $site_path = isset($parsed_site_url['path']) ? trim($parsed_site_url['path'], '/') : '';

        if (!empty($site_path) && strpos($request_path, $site_path) === 0) {
            $request_path = trim(substr($request_path, strlen($site_path)), '/');
        }

        return ($request_path === $custom_slug);
    }

    public function adlhpti_disable_admin_email_check($interval)
    {
        $is_enabled = get_option('adlhpti_enabled', false);
        if (!$is_enabled) {
            return $interval;
        }
        return 0;
    }

    public function adlhpti_custom_login_redirect_filter($redirect_to, $requested_redirect_to, $user)
    {
        $is_enabled = get_option('adlhpti_enabled', false);
        if (!$is_enabled) {
            return $redirect_to;
        }

        if (!is_wp_error($user) && $user instanceof WP_User) {
            $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');
            // If redirect_to points to wp-login.php or the custom login slug itself, redirect to admin_url or requested
            if (empty($redirect_to) || strpos($redirect_to, 'wp-login.php') !== false || strpos($redirect_to, '/' . $custom_slug) !== false) {
                if (!empty($requested_redirect_to) && strpos($requested_redirect_to, 'wp-login.php') === false && strpos($requested_redirect_to, '/' . $custom_slug) === false) {
                    return wp_validate_redirect($requested_redirect_to, admin_url());
                }
                return admin_url();
            }
        }

        return $redirect_to;
    }

    public function adlhpti_frontend_enqueue_assets()
    {
        if (!$this->is_custom_login_page()) {
            return;
        }

        $css_path = plugin_dir_path(__FILE__) . '../assets/css/frontend.css';
        $css_url = plugin_dir_url(__FILE__) . '../assets/css/frontend.css';
        wp_enqueue_style(
            'adlhpti-frontend-css',
            $css_url,
            [],
            file_exists($css_path) ? filemtime($css_path) : null
        );

        wp_enqueue_style(
            'adlhpti-google-fonts',
            'https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap',
            [],
            '1.0.5'
        );

        $this->adlhpti_isolate_login_styles();
        $this->adlhpti_isolate_login_scripts();
    }

    public function adlhpti_isolate_login_styles()
    {
        if (!$this->is_custom_login_page()) {
            return;
        }

        global $wp_styles;
        if (!($wp_styles instanceof WP_Styles)) {
            return;
        }

        $allowed_styles = [
            'adlhpti-frontend-css',
            'adlhpti-google-fonts',
            'dashicons',
        ];

        foreach ($wp_styles->queue as $handle) {
            if (!in_array($handle, $allowed_styles, true)) {
                wp_dequeue_style($handle);
            }
        }
    }

    public function adlhpti_isolate_login_scripts()
    {
        if (!$this->is_custom_login_page()) {
            return;
        }

        global $wp_scripts;
        if (!($wp_scripts instanceof WP_Scripts)) {
            return;
        }

        $allowed_scripts = [
            'jquery',
            'jquery-core',
            'jquery-migrate',
        ];

        foreach ($wp_scripts->queue as $handle) {
            if (!in_array($handle, $allowed_scripts, true)) {
                wp_dequeue_script($handle);
            }
        }
    }


    public function add_settings_page()
    {
        add_options_page(
            'Admin Login Hide PTI',
            'Admin Login Hide PTI',
            'manage_options',
            'adlhpti-settings',
            [$this, 'adlhpti_render_settings_page']
        );
    }

    public function adlhpti_register_settings()
    {
        register_setting(
            'adlhpti_settings_group',
            'adlhpti_custom_login_slug',
            [
                'type' => 'string',
                'sanitize_callback' => 'sanitize_title',
                'default' => 'secure-login',
            ]
        );

        register_setting(
            'adlhpti_settings_group',
            'adlhpti_enabled',
            [
                'type' => 'boolean',
                'sanitize_callback' => 'rest_sanitize_boolean',
                'default' => false,
            ]
        );
    }

    public function adlhpti_render_settings_page()
    {
        $slug = get_option('adlhpti_custom_login_slug', 'secure-login');
        $custom_login_url = site_url($slug); // No nonce for public URL

        $template = plugin_dir_path(__FILE__) . '../templates/admin-template.php';
        if (file_exists($template)) {
            include $template;
        } else {
            echo '<p>' . esc_html__('Settings page template not found.', 'admin-login-hide-pti') . '</p>';
        }
    }

    public function adlhpti_admin_enqueue_assets($hook)
    {
        if ($hook !== 'settings_page_adlhpti-settings') {
            return;
        }

        $base_url = plugin_dir_url(__FILE__) . '../assets/';
        $base_path = plugin_dir_path(__FILE__) . '../assets/';

        $css_path = $base_path . 'css/admin.css';
        if (file_exists($css_path)) {
            wp_enqueue_style(
                'adlhpti-admin-css',
                $base_url . 'css/admin.css',
                [],
                filemtime($css_path)
            );
        }
        $js_path = $base_path . 'js/admin.js';
        if (file_exists($js_path)) {
            wp_enqueue_script(
                'adlhpti-admin-js',
                $base_url . 'js/admin.js',
                ['jquery'],
                filemtime($js_path),
                true
            );

            wp_localize_script('adlhpti-admin-js', 'adlhptiData', [
                'siteUrl'   => trailingslashit(site_url()),
                'ajaxUrl'   => admin_url('admin-ajax.php'),
                'nonce'     => wp_create_nonce('adlhpti_admin_nonce'),
                'saving'    => __('Saving...', 'admin-login-hide-pti'),
                'saved'     => __('Settings saved in real-time!', 'admin-login-hide-pti'),
                'error'     => __('Failed to save settings. Please try again.', 'admin-login-hide-pti'),
                'copied'    => __('Copied!', 'admin-login-hide-pti'),
            ]);
        }
    }

    public function adlhpti_ajax_save_settings()
    {
        if (!check_ajax_referer('adlhpti_admin_nonce', 'nonce', false)) {
            wp_send_json_error(['message' => __('Invalid security token. Please refresh the page.', 'admin-login-hide-pti')]);
        }

        if (!current_user_can('manage_options')) {
            wp_send_json_error(['message' => __('You do not have permission to manage options.', 'admin-login-hide-pti')]);
        }

        $raw_slug = isset($_POST['adlhpti_custom_login_slug']) ? sanitize_text_field(wp_unslash($_POST['adlhpti_custom_login_slug'])) : 'secure-login';
        $slug = sanitize_title($raw_slug);
        if (empty($slug)) {
            $slug = 'secure-login';
        }

        $enabled = isset($_POST['adlhpti_enabled']) && ($_POST['adlhpti_enabled'] === '1' || $_POST['adlhpti_enabled'] === 'true' || $_POST['adlhpti_enabled'] == 1);

        update_option('adlhpti_custom_login_slug', $slug);
        update_option('adlhpti_enabled', $enabled ? 1 : 0);

        $new_url = site_url('/' . $slug);

        wp_send_json_success([
            'message'  => __('Settings saved in real-time!', 'admin-login-hide-pti'),
            'slug'     => $slug,
            'url'      => $new_url,
            'enabled'  => $enabled,
        ]);
    }

    public function adlhpti_custom_login_redirect()
    {
        $is_enabled = get_option('adlhpti_enabled', false);
        if (!$is_enabled) {
            return;
        }

        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');

        $request_uri_raw = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '';
        $parsed_request_uri = wp_parse_url($request_uri_raw);
        $request_path = isset($parsed_request_uri['path']) ? trim($parsed_request_uri['path'], '/') : '';

        $parsed_site_url = wp_parse_url(site_url());
        $site_path = isset($parsed_site_url['path']) ? trim($parsed_site_url['path'], '/') : '';

        if (!empty($site_path) && strpos($request_path, $site_path) === 0) {
            $request_path = trim(substr($request_path, strlen($site_path)), '/');
        }

        // Prevent direct wp-login.php unless POST or valid action
        if (strpos($request_path, 'wp-login.php') === 0) {
            $allowed_actions = ['logout', 'lostpassword', 'rp', 'resetpass', 'register', 'postpass'];
            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic, not modifying data
            $action = isset($_GET['action']) ? sanitize_text_field(wp_unslash($_GET['action'])) : '';
            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic
            $logged_out = isset($_GET['loggedout']) ? sanitize_text_field(wp_unslash($_GET['loggedout'])) : '';
            $method = strtoupper(sanitize_text_field(wp_unslash($_SERVER['REQUEST_METHOD'] ?? '')));

            if ($method !== 'POST' && !in_array($action, $allowed_actions, true) && !$logged_out) {
                wp_die(
                    esc_html__('Access denied. Please use the custom login URL.', 'admin-login-hide-pti'),
                    '',
                    ['response' => 403]
                );
            }

            if ($method === 'GET' && in_array($action, ['lostpassword', 'rp', 'resetpass'], true)) {
                $redirect_url = site_url($custom_slug);
                // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for redirection logic.
                $redirect_url = add_query_arg($_GET, $redirect_url);
                wp_safe_redirect($redirect_url);
                exit;
            }
        }

        if ($request_path === $custom_slug) {
            if ($_SERVER['REQUEST_METHOD'] === 'POST') {
                // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce is verified for custom actions (lostpassword, resetpass) below; default login is handled by WordPress core.
                $post_action = isset($_GET['action']) ? sanitize_text_field(wp_unslash($_GET['action'])) : 'login';

                if ($post_action === 'lostpassword' || $post_action === 'retrievepassword') {
                    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce(sanitize_key(wp_unslash($_POST['_wpnonce'])), 'adlhpti_lostpassword_nonce')) {
                        wp_die(esc_html__('Nonce verification failed.', 'admin-login-hide-pti'));
                    }
                    $errors = retrieve_password();
                    if (is_wp_error($errors)) {
                        wp_safe_redirect(add_query_arg('error', $errors->get_error_code(), site_url($custom_slug . '?action=lostpassword')));
                        exit;
                    } else {
                        wp_safe_redirect(site_url($custom_slug . '?checkemail=confirm'));
                        exit;
                    }
                }
                if ($post_action === 'resetpass' || $post_action === 'rp') {
                    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce(sanitize_key(wp_unslash($_POST['_wpnonce'])), 'adlhpti_resetpass_nonce')) {
                        wp_die(esc_html__('Nonce verification failed.', 'admin-login-hide-pti'));
                    }

                    // Logic from wp-login.php for resetpass
                    $rp_key = isset($_POST['rp_key']) ? sanitize_text_field(wp_unslash($_POST['rp_key'])) : '';
                    $rp_login = isset($_POST['rp_login']) ? sanitize_text_field(wp_unslash($_POST['rp_login'])) : '';

                    $user = check_password_reset_key($rp_key, $rp_login);

                    if (!is_wp_error($user)) {
                        if (isset($_POST['pass1'], $_POST['pass2']) && $_POST['pass1'] !== $_POST['pass2']) {
                            wp_safe_redirect(add_query_arg(['action' => 'rp', 'key' => $rp_key, 'login' => $rp_login, 'error' => 'password_reset_mismatch'], site_url($custom_slug)));
                            exit;
                        }

                        if (isset($_POST['pass1']) && !empty($_POST['pass1'])) {
                            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Passwords should not be sanitized as they can contain special characters.
                            reset_password($user, wp_unslash($_POST['pass1']));
                            wp_safe_redirect(site_url($custom_slug . '?resetpass=complete'));
                            exit;
                        }
                    } else {
                        wp_safe_redirect(add_query_arg('error', $user->get_error_code(), site_url($custom_slug . '?action=lostpassword')));
                        exit;
                    }
                }
            }

            if (is_user_logged_in()) {
                $current_action = isset($_GET['action']) ? sanitize_text_field(wp_unslash($_GET['action'])) : '';
                if ($current_action !== 'logout') {
                    $target_redirect = !empty($_REQUEST['redirect_to']) ? wp_validate_redirect(esc_url_raw(wp_unslash($_REQUEST['redirect_to'])), admin_url()) : admin_url();
                    wp_safe_redirect($target_redirect);
                    exit;
                }
            }

            $action = isset($_GET['action']) ? sanitize_text_field(wp_unslash($_GET['action'])) : 'login';
            $errors = new WP_Error();

?>
            <!DOCTYPE html>
            <html <?php language_attributes(); ?>>

            <head>
                <meta charset="<?php bloginfo('charset'); ?>">
                <meta name="viewport" content="width=device-width, initial-scale=1">
                <title><?php
                if ($action === 'lostpassword' || $action === 'retrievepassword') {
                    echo esc_html__('Lost Password', 'admin-login-hide-pti');
                } elseif ($action === 'rp' || $action === 'resetpass') {
                    echo esc_html__('Reset Password', 'admin-login-hide-pti');
                } else {
                    echo esc_html__('Log In', 'admin-login-hide-pti');
                }
                echo ' &lsaquo; ' . esc_html(get_bloginfo('name'));
                ?></title>
                <link rel="preconnect" href="https://fonts.googleapis.com">
                <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
                <?php wp_head(); ?>
            </head>

            <body <?php body_class('adl-login-body'); ?>>
                <?php
                echo '<div class="adl-login-page-wrapper"><div class="adl-login-card">';

                if ($action === 'lostpassword' || $action === 'retrievepassword') {
                    $this->adlhpti_render_lostpassword_form();
                } elseif ($action === 'rp' || $action === 'resetpass') {
                    $this->adlhpti_render_resetpassword_form();
                } else {
                ?>
                <div class="adl-logo">
                    <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="adl-shield-icon"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg>
                </div>
                <h2>Login</h2>
                <?php
                    if (
                        isset($_GET['login'], $_GET['_adlhpti_nonce'])
                        && sanitize_text_field(wp_unslash($_GET['login'])) === 'failed'
                    ) {
                        $adlhpti_nonce = sanitize_key(wp_unslash($_GET['_adlhpti_nonce']));
                        if (wp_verify_nonce($adlhpti_nonce, 'adlhpti_login_notice')) {
                            $reason = isset($_GET['reason']) ? sanitize_text_field(wp_unslash($_GET['reason'])) : '';
                            if ($reason === 'empty') {
                                echo '<p class="login-error">' . esc_html__('Please enter your username and password.', 'admin-login-hide-pti') . '</p>';
                            } else {
                                echo '<p class="login-error">' . esc_html__('Check your username / email address or password.', 'admin-login-hide-pti') . '</p>';
                            }
                        }
                    }

                    if (isset($_GET['loggedout']) && sanitize_text_field(wp_unslash($_GET['loggedout'])) === 'true') {
                        echo '<p class="login-message">' . esc_html__('You are now logged out.', 'admin-login-hide-pti') . '</p>';
                    }

                    if (isset($_GET['checkemail']) && sanitize_text_field(wp_unslash($_GET['checkemail'])) === 'confirm') {
                        echo '<p class="login-message">' . esc_html__('Check your email for the confirmation link.', 'admin-login-hide-pti') . '</p>';
                    }

                    if (isset($_GET['resetpass']) && sanitize_text_field(wp_unslash($_GET['resetpass'])) === 'complete') {
                        echo '<p class="login-message">' . esc_html__('Your password has been reset. You can now log in.', 'admin-login-hide-pti') . '</p>';
                    }

                    $target_redirect = !empty($_REQUEST['redirect_to']) ? wp_validate_redirect(esc_url_raw(wp_unslash($_REQUEST['redirect_to'])), admin_url()) : admin_url();
                    $adlhpti_form = wp_login_form([
                        'redirect' => $target_redirect,
                        'echo'     => false,
                    ]);
                    // Theme/other plugins can inject their own "Lost your password?" link into the form - remove it, we print ours below.
                    $adlhpti_form = preg_replace('#<a\b[^>]*>\s*Lost your password\?\s*</a>#i', '', $adlhpti_form);
                    $adlhpti_form = preg_replace('#<a\b[^>]*href=[^>]*lostpassword[^>]*>.*?</a>#is', '', $adlhpti_form);
                    $adlhpti_form = preg_replace('#<(p|div|span)\b[^>]*>\s*</\1>#i', '', $adlhpti_form);
                    echo $adlhpti_form; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output of wp_login_form().
                    echo '<p class="adl-lost-password-link"><a href="' . esc_url(wp_lostpassword_url()) . '">' . esc_html__('Lost your password?', 'admin-login-hide-pti') . '</a></p>';
                }

                echo '</div></div>';
                wp_footer();
                ?>
            </body>

            </html>
        <?php
            exit;
        }


        // Restrict wp-admin access for not-logged-in users
        if (strpos($request_path, 'wp-admin') === 0 && !is_user_logged_in()) {
            if (!defined('DOING_AJAX') || !DOING_AJAX) {
                wp_die(
                    esc_html__('Access denied. Please use the custom login URL.', 'admin-login-hide-pti'),
                    '',
                    ['response' => 403]
                );
            }
        }
    }

    public function adlhpti_custom_logout_redirect($redirect_to, $requested_redirect_to, $user)
    {
        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');
        return site_url($custom_slug . '?loggedout=true');
    }

    public function adlhpti_custom_lostpassword_url($lostpassword_url, $redirect)
    {
        $is_enabled = get_option('adlhpti_enabled', false);
        if (!$is_enabled) {
            return $lostpassword_url;
        }
        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');
        $url = site_url($custom_slug . '?action=lostpassword');
        if (!empty($redirect)) {
            $url = add_query_arg('redirect_to', urlencode($redirect), $url);
        }
        return $url;
    }

    public function adlhpti_custom_retrieve_password_message($message, $key, $user_login, $user_data)
    {
        $is_enabled = get_option('adlhpti_enabled', false);
        if (!$is_enabled) {
            return $message;
        }

        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');

        // Match any link that looks like a password reset link
        $pattern = '/(https?:\/\/[^\s]+wp-login\.php\?action=(?:rp|resetpass)[^\s]+)/';

        $message = preg_replace_callback($pattern, function ($matches) use ($custom_slug) {
            $url = $matches[1];
            return str_replace('wp-login.php', $custom_slug, $url);
        }, $message);

        return $message;
    }

    public function adlhpti_custom_login_url($login_url, $redirect, $force_reauth)
    {
        $is_enabled = get_option('adlhpti_enabled', false);
        if (!$is_enabled) {
            return $login_url;
        }
        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');
        $url = site_url($custom_slug);
        if (!empty($redirect)) {
            $url = add_query_arg('redirect_to', urlencode($redirect), $url);
        }
        return $url;
    }

    private function adlhpti_render_lostpassword_form()
    {
    ?>
        <div class="adl-logo">
            <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="adl-shield-icon"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg>
        </div>
        <h2>Lost Password</h2>
        <p class="lostpassword-desc">
            <?php esc_html_e('Please enter your username or email address. You will receive a link to create a new password via email.', 'admin-login-hide-pti'); ?>
        </p>
        <?php
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic
        if (isset($_GET['error'])) {
            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic
            $error_code = sanitize_text_field(wp_unslash($_GET['error']));
            $error_msg = esc_html__('An error occurred. Please try again.', 'admin-login-hide-pti');
            if ($error_code === 'empty_username') {
                $error_msg = esc_html__('Enter a username or email address.', 'admin-login-hide-pti');
            } elseif ($error_code === 'invalid_email' || $error_code === 'invalidcombo') {
                $error_msg = esc_html__('Invalid username or email.', 'admin-login-hide-pti');
            } elseif ($error_code === 'email_error') {
                $error_msg = esc_html__('The email could not be sent. Your site may not be correctly configured to send emails.', 'admin-login-hide-pti');
            }
            echo '<p class="login-error">' . esc_html($error_msg) . '</p>';
        }

        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');
        ?>
        <form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url(site_url($custom_slug . '?action=lostpassword')); ?>" method="post">
            <?php wp_nonce_field('adlhpti_lostpassword_nonce'); ?>
            <p>
                <label for="user_login"><?php esc_html_e('Username or Email Address', 'admin-login-hide-pti'); ?></label>
                <input type="text" name="user_login" id="user_login" class="input" value="" size="20" autocapitalize="off" autocomplete="username" required />
            </p>
            <input type="hidden" name="redirect_to" value="<?php echo esc_url(site_url($custom_slug . '?checkemail=confirm')); ?>" />
            <p class="submit">
                <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Get New Password', 'admin-login-hide-pti'); ?>" />
            </p>
        </form>
        <p class="adl-login-link"><a href="<?php echo esc_url(site_url($custom_slug)); ?>"><?php esc_html_e('Log in', 'admin-login-hide-pti'); ?></a></p>
    <?php
    }

    private function adlhpti_render_resetpassword_form()
    {
    ?>
        <div class="adl-logo">
            <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="adl-shield-icon"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg>
        </div>
        <h2>Reset Password</h2>
        <?php

        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic
        $rp_key = isset($_GET['key']) ? sanitize_text_field(wp_unslash($_GET['key'])) : '';
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic
        $rp_login = isset($_GET['login']) ? sanitize_text_field(wp_unslash($_GET['login'])) : '';

        $custom_slug = trim(get_option('adlhpti_custom_login_slug', 'secure-login'), '/');

        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic
        if (isset($_GET['error'])) {
            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only use of $_GET for display logic
            $error_code = sanitize_text_field(wp_unslash($_GET['error']));
            if ($error_code === 'password_reset_mismatch') {
                echo '<p class="login-error">' . esc_html__('The passwords do not match.', 'admin-login-hide-pti') . '</p>';
            }
        }
    ?>
        <form name="resetpassform" id="resetpassform" action="<?php echo esc_url(site_url($custom_slug . '?action=resetpass')); ?>" method="post" autocomplete="off">
            <?php wp_nonce_field('adlhpti_resetpass_nonce'); ?>
            <input type="hidden" id="user_login" name="rp_login" value="<?php echo esc_attr($rp_login); ?>" autocomplete="off" />
            <input type="hidden" name="rp_key" value="<?php echo esc_attr($rp_key); ?>" />

            <p>
                <label for="pass1"><?php esc_html_e('New password', 'admin-login-hide-pti'); ?></label>
                <input type="password" name="pass1" id="pass1" class="input" size="20" value="" autocomplete="new-password" required />
            </p>
            <p>
                <label for="pass2"><?php esc_html_e('Confirm new password', 'admin-login-hide-pti'); ?></label>
                <input type="password" name="pass2" id="pass2" class="input" size="20" value="" autocomplete="new-password" required />
            </p>

            <p class="submit">
                <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Save Password', 'admin-login-hide-pti'); ?>" />
            </p>
        </form>
        <p class="adl-login-link"><a href="<?php echo esc_url(site_url($custom_slug)); ?>"><?php esc_html_e('Log in', 'admin-login-hide-pti'); ?></a></p>
<?php
    }
}

new ADLHPTI_Admin();