<?php
/**
 * SMTP Email module: routes outgoing mail through a configured SMTP provider.
 *
 * @package admin-optimizer
 */

namespace Yipresser\AdminOptimizer\Modules;

use Yipresser\AdminOptimizer\Base_Module;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

require_once __DIR__ . '/includes/functions.php';

/**
 * SMTP_Email class
 */
class SMTP_Email extends Base_Module {

	const MODULE_URL = ADMINOPTIMIZER_MODULES_URI . 'smtp-email/';

	const MODULE_PATH = ADMINOPTIMIZER_MODULES_PATH . 'smtp-email/';

	const MENU_SLUG = 'adminoptimizer-smtp-email';

	const OPTION_NAME = 'adminoptim_smtp';
	const MODULE_ID   = 'smtp_mail';
	const MODULE_SLUG = 'smtp-mail';

	/**
	 * Password encryption prefix
	 */
	const PASSWORD_PREFIX = 'enc:';

	/**
	 * Build the encryption key from WP salts.
	 *
	 * @return string
	 */
	private static function get_encryption_key() {
		$salt = wp_salt( 'auth' );
		return hash( 'sha256', $salt, true );
	}

	/**
	 * Build a fingerprint for the current auth salt.
	 *
	 * @return string
	 */
	public static function auth_fingerprint() {
		$pepper = 'adminoptim_smtp_auth_fingerprint';
		return substr( hash_hmac( 'sha256', wp_salt( 'auth' ), $pepper ), 0, 12 );
	}

	/**
	 * Check whether stored fingerprint differs from current auth salt.
	 *
	 * @param array $options Stored options.
	 *
	 * @return bool
	 */
	public static function has_auth_changed( $options ) {
		if ( ! is_array( $options ) ) {
			return false;
		}

		$enabled = ! empty( $options['auth_change_check'] );
		if ( ! $enabled ) {
			return false;
		}

		$stored = $options['auth_fingerprint'] ?? '';
		if ( '' === $stored ) {
			return false;
		}

		return self::auth_fingerprint() !== $stored;
	}

	/**
	 * Whether SMTP has been configured with a non-default provider and
	 * connection details, as opposed to merely being enabled with its
	 * out-of-the-box defaults.
	 *
	 * @return bool
	 */
	public static function is_configured(): bool {
		$options = get_option( self::OPTION_NAME, [] );

		if ( ! is_array( $options ) ) {
			return false;
		}

		$provider = $options['smtp_provider'] ?? 'default_wp_mail';

		if ( 'default_wp_mail' === $provider ) {
			return false;
		}

		return ! empty( $options['smtp_server'] ) && ! empty( $options['smtp_username'] );
	}

	/**
	 * Encrypt SMTP password for storage.
	 *
	 * @param string $password Plain-text password.
	 *
	 * @return string
	 */
	public static function encrypt_password( $password ) {
		if ( '' === $password ) {
			return '';
		}

		if ( str_starts_with( $password, self::PASSWORD_PREFIX ) ) {
			return $password;
		}

		if ( ! function_exists( 'openssl_encrypt' ) ) {
			return $password;
		}

		$cipher = 'aes-256-cbc';
		$iv_len = openssl_cipher_iv_length( $cipher );
		if ( false === $iv_len ) {
			return $password;
		}

		$iv        = random_bytes( $iv_len );
		$key       = self::get_encryption_key();
		$encrypted = openssl_encrypt( $password, $cipher, $key, OPENSSL_RAW_DATA, $iv );
		if ( false === $encrypted ) {
			return $password;
		}

		return self::PASSWORD_PREFIX . base64_encode( $iv . $encrypted );
	}

	/**
	 * Decrypt SMTP password from storage.
	 *
	 * @param string $stored Encrypted password or legacy plain-text.
	 *
	 * @return string
	 */
	public static function decrypt_password( $stored ) {
		if ( ! is_string( $stored ) || '' === $stored ) {
			return '';
		}

		if ( ! str_starts_with( $stored, self::PASSWORD_PREFIX ) ) {
			return $stored;
		}

		if ( ! function_exists( 'openssl_decrypt' ) ) {
			return '';
		}

		$payload = base64_decode( substr( $stored, strlen( self::PASSWORD_PREFIX ) ), true );
		if ( false === $payload ) {
			return '';
		}

		$cipher = 'aes-256-cbc';
		$iv_len = openssl_cipher_iv_length( $cipher );
		if ( false === $iv_len || strlen( $payload ) <= $iv_len ) {
			return '';
		}

		$iv         = substr( $payload, 0, $iv_len );
		$ciphertext = substr( $payload, $iv_len );
		$key        = self::get_encryption_key();
		$decrypted  = openssl_decrypt( $ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv );

		return false === $decrypted ? '' : $decrypted;
	}

	/**
	 * Start the engine running
	 *
	 * @return void
	 */
	protected function init(): void {
		$this->settings = new SMTP_Email_Settings( $this->options );

		add_action( 'phpmailer_init', [ $this, 'phpmailer_smtp_setup' ] );

		$from_priority = ! empty( $this->options['force_from'] ) ? PHP_INT_MAX : 1;
		add_filter( 'wp_mail_from', [ $this, 'default_mail_from' ], $from_priority );
		add_filter( 'wp_mail_from_name', [ $this, 'default_mail_from_name' ], $from_priority );
	}

	/**
	 * Default from-address filter — overridable by other plugins at priority >= 1.
	 *
	 * @param string $from Current from address.
	 * @return string
	 */
	public function default_mail_from( $from ) {
		if ( apply_filters( 'adminoptim_smtp_bypass_transport', false ) ) {
			return $from;
		}

		/**
		 * Filters the resolved From address for the current send.
		 *
		 * Free only ever has one profile (its own options); Pro hooks this
		 * to resolve routing rules / delivery chains to a specific SMTP
		 * profile and return that profile's From address outright. Return
		 * a non-string (default null) to defer to Free's own single-profile
		 * logic below.
		 *
		 * @param string|null $routed  Resolved From address, or null to defer to Free.
		 * @param string      $from    Current From address.
		 * @param array       $options Free's own SMTP options.
		 */
		$routed = apply_filters( 'adminoptim_smtp_route_mail_from', null, $from, $this->options );
		if ( is_string( $routed ) ) {
			return $routed;
		}

		if ( empty( $this->options['email_from'] ) ) {
			return $from;
		}

		if ( ! empty( $this->options['force_from'] ) ) {
			return $this->options['email_from'];
		}

		// Default mode: only replace the WordPress-generated default; honour explicit From: headers.
		$sitename = wp_parse_url( network_home_url(), PHP_URL_HOST );
		$sitename = preg_replace( '#^www\.#', '', strtolower( $sitename ) );

		return ( 'wordpress@' . $sitename === $from ) ? $this->options['email_from'] : $from;
	}

	/**
	 * Default from-name filter — overridable by other plugins at priority >= 1.
	 *
	 * @param string $name Current from name.
	 * @return string
	 */
	public function default_mail_from_name( $name ) {
		if ( apply_filters( 'adminoptim_smtp_bypass_transport', false ) ) {
			return $name;
		}

		/**
		 * Filters the resolved From name for the current send. Mirrors
		 * `adminoptim_smtp_route_mail_from` — see that filter's docs.
		 *
		 * @param string|null $routed  Resolved From name, or null to defer to Free.
		 * @param string      $name    Current From name.
		 * @param array       $options Free's own SMTP options.
		 */
		$routed = apply_filters( 'adminoptim_smtp_route_mail_from_name', null, $name, $this->options );
		if ( is_string( $routed ) ) {
			return $routed;
		}

		if ( empty( $this->options['send_from'] ) ) {
			return $name;
		}

		if ( ! empty( $this->options['force_from'] ) ) {
			return $this->options['send_from'];
		}

		// Default mode: only replace the WordPress-generated default; honour explicit From: headers.
		return ( 'WordPress' === $name ) ? $this->options['send_from'] : $name;
	}

	/**
	 * Phpmailer smtp setup
	 *
	 * @param \PHPMailer $phpmailer phpmailer class.
	 *
	 * @return void
	 */
	public function phpmailer_smtp_setup( $phpmailer ) {
		if ( apply_filters( 'adminoptim_smtp_bypass_transport', false ) ) {
			return;
		}

		/**
		 * Filters whether SMTP transport for $phpmailer is already
		 * configured for this send.
		 *
		 * Free applies its own single-profile config only when this stays
		 * false; Pro's router/delivery-chain executor hooks this, mutates
		 * $phpmailer directly for whichever profile it resolved, and
		 * returns true so Free's own setup below is skipped.
		 *
		 * @param bool        $handled   Whether $phpmailer is already configured. Default false.
		 * @param \PHPMailer  $phpmailer PHPMailer instance, mutated directly by a Pro callback.
		 * @param array       $options   Free's own SMTP options.
		 */
		if ( apply_filters( 'adminoptim_smtp_route_phpmailer', false, $phpmailer, $this->options ) ) {
			return;
		}

		if ( ! empty( $this->options ) ) {
			if ( isset( $this->options['smtp_provider'] ) && 'default_wp_mail' === $this->options['smtp_provider'] ) {
				$this->apply_sender_to_phpmailer( $phpmailer );
				return;
			}

			$phpmailer->isSMTP();
			if ( isset( $this->options['smtp_server'] ) ) {
				$phpmailer->Host = $this->options['smtp_server'];
			}

			// For SES, always derive the host from the stored region so it stays correct if the region changes.
			if ( isset( $this->options['smtp_provider'], $this->options['smtp_ses_region'] ) && 'ses' === $this->options['smtp_provider'] ) {
				// phpcs:ignore PluginCheck.CodeAnalysis.Offloading.OffloadedContent -- Building the user's own configured AWS SES SMTP relay host, not offloading plugin assets to a third-party service.
				$phpmailer->Host = 'email-smtp.' . sanitize_key( $this->options['smtp_ses_region'] ) . '.amazonaws.com';
			}

			if ( isset( $this->options['smtp_auth'] ) ) {
				$phpmailer->SMTPAuth = true;
			}

			if ( isset( $this->options['smtp_port'] ) ) {
				$phpmailer->Port = $this->options['smtp_port'];
			}

			if ( isset( $this->options['smtp_username'] ) ) {
				$phpmailer->Username = $this->options['smtp_username'];
			}

			if ( isset( $this->options['smtp_password'] ) ) {
				$phpmailer->Password = self::decrypt_password( $this->options['smtp_password'] );
			}

			if ( isset( $this->options['smtp_secure'] ) ) {
				$phpmailer->SMTPSecure = $this->options['smtp_secure'];
			}

			$this->apply_sender_to_phpmailer( $phpmailer );
		}
	}

	/**
	 * Apply sender identity values without changing PHPMailer transport.
	 *
	 * @param \PHPMailer $phpmailer phpmailer class.
	 *
	 * @return void
	 */
	private function apply_sender_to_phpmailer( $phpmailer ) {
		$from_email = ! empty( $this->options['email_from'] ) && is_email( $this->options['email_from'] ) ? (string) $this->options['email_from'] : '';
		$from_name  = isset( $this->options['send_from'] ) ? (string) $this->options['send_from'] : '';
		if ( '' !== $from_email && empty( $phpmailer->Sender ) ) {
			$phpmailer->Sender = $from_email;
		}

		if ( ! empty( $this->options['reply_to'] ) && is_email( $this->options['reply_to'] ) ) {
			$phpmailer->clearReplyTos();
			try {
				$phpmailer->addReplyTo( (string) $this->options['reply_to'], $from_name );
			} catch ( \Exception $exception ) {
				unset( $exception );
			}
		}
	}
}