<?php

namespace Yipresser\AdminOptimizer\Modules;

use Yipresser\AdminOptimizer\Base_Module;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

require_once __DIR__ . '/includes/functions.php';

/**
 * SMTP_Email class
 */
class SMTP_Email extends Base_Module {

	const MODULE_URL = ADMINOPTIMIZER_MODULES_URI . 'smtp-email/';

	const MODULE_PATH = ADMINOPTIMIZER_MODULES_PATH . 'smtp-email/';

	const MENU_SLUG = 'adminoptimizer-smtp-email';

	const OPTION_NAME = 'adminoptim_smtp';
	const MODULE_ID   = 'smtp_mail';
	const MODULE_SLUG = 'smtp-mail';

	/**
	 * Password encryption prefix
	 */
	const PASSWORD_PREFIX = 'enc:';

	/**
	 * Build the encryption key from WP salts.
	 *
	 * @return string
	 */
	private static function get_encryption_key() {
		$salt = wp_salt( 'auth' );
		return hash( 'sha256', $salt, true );
	}

	/**
	 * Build a fingerprint for the current auth salt.
	 *
	 * @return string
	 */
	public static function auth_fingerprint() {
		$pepper = 'adminoptim_smtp_auth_fingerprint';
		return substr( hash_hmac( 'sha256', wp_salt( 'auth' ), $pepper ), 0, 12 );
	}

	/**
	 * Check whether stored fingerprint differs from current auth salt.
	 *
	 * @param array $options Stored options.
	 *
	 * @return bool
	 */
	public static function has_auth_changed( $options ) {
		if ( ! is_array( $options ) ) {
			return false;
		}

		$enabled = ! empty( $options['auth_change_check'] );
		if ( ! $enabled ) {
			return false;
		}

		$stored = $options['auth_fingerprint'] ?? '';
		if ( '' === $stored ) {
			return false;
		}

		return self::auth_fingerprint() !== $stored;
	}

	/**
	 * Encrypt SMTP password for storage.
	 *
	 * @param string $password Plain-text password.
	 *
	 * @return string
	 */
	public static function encrypt_password( $password ) {
		if ( '' === $password ) {
			return '';
		}

		if ( str_starts_with( $password, self::PASSWORD_PREFIX ) ) {
			return $password;
		}

		if ( ! function_exists( 'openssl_encrypt' ) ) {
			return $password;
		}

		$cipher = 'aes-256-cbc';
		$iv_len = openssl_cipher_iv_length( $cipher );
		if ( false === $iv_len ) {
			return $password;
		}

		$iv        = random_bytes( $iv_len );
		$key       = self::get_encryption_key();
		$encrypted = openssl_encrypt( $password, $cipher, $key, OPENSSL_RAW_DATA, $iv );
		if ( false === $encrypted ) {
			return $password;
		}

		return self::PASSWORD_PREFIX . base64_encode( $iv . $encrypted );
	}

	/**
	 * Decrypt SMTP password from storage.
	 *
	 * @param string $stored Encrypted password or legacy plain-text.
	 *
	 * @return string
	 */
	public static function decrypt_password( $stored ) {
		if ( ! is_string( $stored ) || '' === $stored ) {
			return '';
		}

		if ( ! str_starts_with( $stored, self::PASSWORD_PREFIX ) ) {
			return $stored;
		}

		if ( ! function_exists( 'openssl_decrypt' ) ) {
			return '';
		}

		$payload = base64_decode( substr( $stored, strlen( self::PASSWORD_PREFIX ) ), true );
		if ( false === $payload ) {
			return '';
		}

		$cipher = 'aes-256-cbc';
		$iv_len = openssl_cipher_iv_length( $cipher );
		if ( false === $iv_len || strlen( $payload ) <= $iv_len ) {
			return '';
		}

		$iv         = substr( $payload, 0, $iv_len );
		$ciphertext = substr( $payload, $iv_len );
		$key        = self::get_encryption_key();
		$decrypted  = openssl_decrypt( $ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv );

		return false === $decrypted ? '' : $decrypted;
	}

	/**
	 * Start the engine running
	 *
	 * @return void
	 */
	protected function init(): void {
		$this->settings = new SMTP_Email_Settings( $this->options );

		add_action( 'phpmailer_init', [ $this, 'phpmailer_smtp_setup' ] );

		$from_priority = ! empty( $this->options['force_from'] ) ? PHP_INT_MAX : 1;
		add_filter( 'wp_mail_from', [ $this, 'default_mail_from' ], $from_priority );
		add_filter( 'wp_mail_from_name', [ $this, 'default_mail_from_name' ], $from_priority );
		add_filter(
			'adminoptim_notification_message_' . self::MODULE_SLUG,
			static function ( string $message, string $display ): string {
				if ( 'banner' === $display ) {
					return sprintf(
						/* translators: 1: Opening strong tag, 2: Closing strong tag. */
						__(
							'%1$sEnjoying reliable email delivery?%2$s Leave a ★★★★★ review on WordPress.org and help more users discover Admin Optimizer.',
							'admin-optimizer'
						),
						'<strong>',
						'</strong>'
					);
				} else {
					return sprintf(
						/* translators: 1: Opening strong tag, 2: Closing strong tag. */
						__(
							'%1$sEnjoying reliable email delivery?%2$s Route emails through multiple SMTP providers with automatic failover in Admin Optimizer Pro.',
							'admin-optimizer'
						),
						'<strong>',
						'</strong>'
					);
				}
			},
			10,
			2
		);
	}

	/**
	 * Return the module's submenu definition.
	 *
	 * @return array<string,mixed>
	 */
	protected function get_submenu_config(): array {
		return [
			'page_title' => __( 'Email & SMTP', 'admin-optimizer' ),
			'menu_title' => __( 'Email & SMTP', 'admin-optimizer' ),
			'menu_slug'  => self::MENU_SLUG,
			'callback'   => [ $this->settings, 'render_settings_page' ],
		];
	}

	/**
	 * Default from-address filter — overridable by other plugins at priority >= 1.
	 *
	 * @param string $from Current from address.
	 * @return string
	 */
	public function default_mail_from( $from ) {
		if ( empty( $this->options['email_from'] ) ) {
			return $from;
		}

		if ( ! empty( $this->options['force_from'] ) ) {
			return $this->options['email_from'];
		}

		// Default mode: only replace the WordPress-generated default; honour explicit From: headers.
		$sitename = wp_parse_url( network_home_url(), PHP_URL_HOST );
		$sitename = preg_replace( '#^www\.#', '', strtolower( $sitename ) );

		return ( 'wordpress@' . $sitename === $from ) ? $this->options['email_from'] : $from;
	}

	/**
	 * Default from-name filter — overridable by other plugins at priority >= 1.
	 *
	 * @param string $name Current from name.
	 * @return string
	 */
	public function default_mail_from_name( $name ) {
		if ( empty( $this->options['send_from'] ) ) {
			return $name;
		}

		if ( ! empty( $this->options['force_from'] ) ) {
			return $this->options['send_from'];
		}

		// Default mode: only replace the WordPress-generated default; honour explicit From: headers.
		return ( 'WordPress' === $name ) ? $this->options['send_from'] : $name;
	}

	/**
	 * Phpmailer smtp setup
	 *
	 * @param \PHPMailer $phpmailer phpmailer class.
	 *
	 * @return void
	 */
	public function phpmailer_smtp_setup( $phpmailer ) {
		if ( ! empty( $this->options ) ) {
			if ( isset( $this->options['smtp_provider'] ) && 'default_wp_mail' === $this->options['smtp_provider'] ) {
				$this->apply_sender_to_phpmailer( $phpmailer );
				return;
			}

			$phpmailer->isSMTP();
			if ( isset( $this->options['smtp_server'] ) ) {
				$phpmailer->Host = $this->options['smtp_server'];
			}

			// For SES, always derive the host from the stored region so it stays correct if the region changes.
			if ( isset( $this->options['smtp_provider'], $this->options['smtp_ses_region'] ) && 'ses' === $this->options['smtp_provider'] ) {
				$phpmailer->Host = 'email-smtp.' . sanitize_key( $this->options['smtp_ses_region'] ) . '.amazonaws.com';
			}

			if ( isset( $this->options['smtp_auth'] ) ) {
				$phpmailer->SMTPAuth = true;
			}

			if ( isset( $this->options['smtp_port'] ) ) {
				$phpmailer->Port = $this->options['smtp_port'];
			}

			if ( isset( $this->options['smtp_username'] ) ) {
				$phpmailer->Username = $this->options['smtp_username'];
			}

			if ( isset( $this->options['smtp_password'] ) ) {
				$phpmailer->Password = self::decrypt_password( $this->options['smtp_password'] );
			}

			if ( isset( $this->options['smtp_secure'] ) ) {
				$phpmailer->SMTPSecure = $this->options['smtp_secure'];
			}

			$this->apply_sender_to_phpmailer( $phpmailer );
		}
	}

	/**
	 * Apply sender identity values without changing PHPMailer transport.
	 *
	 * @param \PHPMailer $phpmailer phpmailer class.
	 *
	 * @return void
	 */
	private function apply_sender_to_phpmailer( $phpmailer ) {
		$from_email = ! empty( $this->options['email_from'] ) && is_email( $this->options['email_from'] ) ? (string) $this->options['email_from'] : '';
		$from_name  = isset( $this->options['send_from'] ) ? (string) $this->options['send_from'] : '';
		if ( '' !== $from_email && empty( $phpmailer->Sender ) ) {
			$phpmailer->Sender = $from_email;
		}

		if ( ! empty( $this->options['reply_to'] ) && is_email( $this->options['reply_to'] ) ) {
			$phpmailer->clearReplyTos();
			try {
				$phpmailer->addReplyTo( (string) $this->options['reply_to'], $from_name );
			} catch ( \Exception $exception ) {
				unset( $exception );
			}
		}
	}
}