<?php

namespace Yipresser\AdminOptimizer\Modules;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * SMTP_Email class
 */
class SMTP_Email {

	const MODULE_URL = ADMINOPTIMIZER_MODULES_URI . 'smtp-email/';

	const MODULE_PATH = ADMINOPTIMIZER_MODULES_PATH . 'smtp-email/';

	const MENU_SLUG = 'adminoptimizer-smtp-email';

	const OPTION_NAME = 'adminoptim_smtp';

	/**
	 * Password encryption prefix
	 */
	const PASSWORD_PREFIX = 'enc:';

	/**
	 * User Options
	 *
	 * @var false|mixed|null
	 */
	protected $options;

	/**
	 * Settings class
	 *
	 * @var SMTP_Email_Settings
	 */
	protected $settings;

	/**
	 * Build the encryption key from WP salts.
	 *
	 * @return string
	 */
	private static function get_encryption_key() {
		$salt = wp_salt( 'auth' );
		return hash( 'sha256', $salt, true );
	}

	/**
	 * Build a fingerprint for the current auth salt.
	 *
	 * @return string
	 */
	public static function auth_fingerprint() {
		$pepper = 'adminoptim_smtp_auth_fingerprint';
		return substr( hash_hmac( 'sha256', wp_salt( 'auth' ), $pepper ), 0, 12 );
	}

	/**
	 * Check whether stored fingerprint differs from current auth salt.
	 *
	 * @param array $options Stored options.
	 *
	 * @return bool
	 */
	public static function has_auth_changed( $options ) {
		if ( ! is_array( $options ) ) {
			return false;
		}

		$enabled = ! empty( $options['auth_change_check'] );
		if ( ! $enabled ) {
			return false;
		}

		$stored = $options['auth_fingerprint'] ?? '';
		if ( '' === $stored ) {
			return false;
		}

		return $stored !== self::auth_fingerprint();
	}

	/**
	 * Encrypt SMTP password for storage.
	 *
	 * @param string $password Plain-text password.
	 *
	 * @return string
	 */
	public static function encrypt_password( $password ) {
		if ( '' === $password ) {
			return '';
		}

		if ( str_starts_with( $password, self::PASSWORD_PREFIX ) ) {
			return $password;
		}

		if ( ! function_exists( 'openssl_encrypt' ) ) {
			return $password;
		}

		$cipher = 'aes-256-cbc';
		$iv_len = openssl_cipher_iv_length( $cipher );
		if ( false === $iv_len ) {
			return $password;
		}

		$iv        = random_bytes( $iv_len );
		$key       = self::get_encryption_key();
		$encrypted = openssl_encrypt( $password, $cipher, $key, OPENSSL_RAW_DATA, $iv );
		if ( false === $encrypted ) {
			return $password;
		}

		return self::PASSWORD_PREFIX . base64_encode( $iv . $encrypted );
	}

	/**
	 * Decrypt SMTP password from storage.
	 *
	 * @param string $stored Encrypted password or legacy plain-text.
	 *
	 * @return string
	 */
	public static function decrypt_password( $stored ) {
		if ( ! is_string( $stored ) || '' === $stored ) {
			return '';
		}

		if ( ! str_starts_with( $stored, self::PASSWORD_PREFIX ) ) {
			return $stored;
		}

		if ( ! function_exists( 'openssl_decrypt' ) ) {
			return '';
		}

		$payload = base64_decode( substr( $stored, strlen( self::PASSWORD_PREFIX ) ), true );
		if ( false === $payload ) {
			return '';
		}

		$cipher = 'aes-256-cbc';
		$iv_len = openssl_cipher_iv_length( $cipher );
		if ( false === $iv_len || strlen( $payload ) <= $iv_len ) {
			return '';
		}

		$iv         = substr( $payload, 0, $iv_len );
		$ciphertext = substr( $payload, $iv_len );
		$key        = self::get_encryption_key();
		$decrypted  = openssl_decrypt( $ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv );

		return false === $decrypted ? '' : $decrypted;
	}

	/**
	 * Constructor
	 */
	public function __construct() {
		$this->options = get_option( self::OPTION_NAME, [] );
		$this->init();
	}

	/**
	 * Start the engine running
	 *
	 * @return void
	 */
	public function init() {
		$this->settings = new SMTP_Email_Settings( $this->options);

		add_action( 'adminoptimizer_add_submenu_page', [ $this, 'add_submenu_page' ] );
		add_action( 'phpmailer_init', [ $this, 'phpmailer_smtp_setup' ] );

		$from_priority = ! empty( $this->options['force_from'] ) ? PHP_INT_MAX : 1;
		add_filter( 'wp_mail_from', [ $this, 'default_mail_from' ], $from_priority );
		add_filter( 'wp_mail_from_name', [ $this, 'default_mail_from_name' ], $from_priority );
	}

	/**
	 * Add submenu to WP Menu page
	 *
	 * @return void
	 */
	public function add_submenu_page() {
		add_submenu_page(
			ADMINOPTIMIZER_MODULES_MENU_SLUG,
			__( 'SMTP Email', 'admin-optimizer' ),
			__( 'SMTP Email', 'admin-optimizer' ),
			'manage_options',
			self::MENU_SLUG,
			[ $this->settings, 'render_settings_page' ]
		);
	}

	/**
	 * Default from-address filter — overridable by other plugins at priority >= 1.
	 *
	 * @param string $from Current from address.
	 * @return string
	 */
	public function default_mail_from( $from ) {
		if ( empty( $this->options['email_from'] ) ) {
			return $from;
		}

		if ( ! empty( $this->options['force_from'] ) ) {
			return $this->options['email_from'];
		}

		// Default mode: only replace the WordPress-generated default; honour explicit From: headers.
		$sitename = wp_parse_url( network_home_url(), PHP_URL_HOST );
		$sitename = preg_replace( '#^www\.#', '', strtolower( $sitename ) );

		return ( 'wordpress@' . $sitename === $from ) ? $this->options['email_from'] : $from;
	}

	/**
	 * Default from-name filter — overridable by other plugins at priority >= 1.
	 *
	 * @param string $name Current from name.
	 * @return string
	 */
	public function default_mail_from_name( $name ) {
		if ( empty( $this->options['send_from'] ) ) {
			return $name;
		}

		if ( ! empty( $this->options['force_from'] ) ) {
			return $this->options['send_from'];
		}

		// Default mode: only replace the WordPress-generated default; honour explicit From: headers.
		return ( 'WordPress' === $name ) ? $this->options['send_from'] : $name;
	}

	/**
	 * Phpmailer smtp setup
	 *
	 * @param \PHPMailer $phpmailer phpmailer class.
	 *
	 * @return void
	 */
	public function phpmailer_smtp_setup( $phpmailer ) {
		if ( ! empty( $this->options ) ) {
			$phpmailer->isSMTP();
			if ( isset( $this->options['smtp_server'] ) ) {
				$phpmailer->Host = $this->options['smtp_server'];
			}

			// For SES, always derive the host from the stored region so it stays correct if the region changes.
			if ( isset( $this->options['smtp_provider'], $this->options['smtp_ses_region'] ) && 'ses' === $this->options['smtp_provider'] ) {
				$phpmailer->Host = 'email-smtp.' . sanitize_key( $this->options['smtp_ses_region'] ) . '.amazonaws.com';
			}

			if ( isset( $this->options['smtp_auth'] ) ) {
				$phpmailer->SMTPAuth = true;
			}

			if ( isset( $this->options['smtp_port'] ) ) {
				$phpmailer->Port = $this->options['smtp_port'];
			}

			if ( isset( $this->options['smtp_username'] ) ) {
				$phpmailer->Username = $this->options['smtp_username'];
			}

			if ( isset( $this->options['smtp_password'] ) ) {
				$phpmailer->Password = self::decrypt_password( $this->options['smtp_password'] );
			}

			if ( isset( $this->options['smtp_secure'] ) ) {
				$phpmailer->SMTPSecure = $this->options['smtp_secure'];
			}

			if ( ! empty( $this->options['email_from'] ) && empty( $phpmailer->Sender ) ) {
				$phpmailer->Sender = $this->options['email_from'];
			}
		}
	}
}