<?php
/**
 * Emailed one-time sign-in code, used when a user's authenticator secret can no
 * longer be read (for example after the site's encryption key changed).
 *
 * @package admin-optimizer
 */

namespace Yipresser\AdminOptimizer\Modules;

use Yipresser\AdminOptimizer\Support\AO_Request_Context;
use Yipresser\AdminOptimizer\Support\Logger;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Sends and verifies the emailed code.
 *
 * - 6 digits, valid for 5 minutes, single use; only a hash of it is stored.
 * - Sending is limited per user (a cool-down plus a fixed-window cap) and per IP.
 * - A code is invalidated after too many wrong guesses; the module's own per-token,
 *   per-user, and per-IP failure limiters also apply to every attempt.
 * - Each successful use notifies the account owner by email and is logged.
 */
final class Two_Factor_Email_Otp {
	use Logger;

	/** How long a code stays valid. */
	const TTL = 5 * MINUTE_IN_SECONDS;

	/** Transient prefix for the stored code record. */
	const CODE_PREFIX = 'adminoptim_2fa_eotp_';

	/** Transient prefix for the send-rate counters. */
	const SENDS_PREFIX = 'adminoptim_2fa_eotp_sends_';

	/** Minimum seconds between two codes for one user, whatever happened to the first. */
	const COOLDOWN = 60;

	/** Codes one user may be sent per window. */
	const MAX_SENDS_PER_USER = 3;

	/** Codes one IP address may trigger per window. */
	const MAX_SENDS_PER_IP = 10;

	/** Length of the send-rate window. */
	const SEND_WINDOW = 15 * MINUTE_IN_SECONDS;

	/** Wrong guesses after which a code is thrown away. */
	const MAX_GUESSES = 5;

	/**
	 * Whether the setting is on. It is opt-out: on unless explicitly switched off.
	 *
	 * @param mixed $options Module options.
	 *
	 * @return bool
	 */
	public static function is_enabled( $options ): bool {
		return ! is_array( $options ) || ! isset( $options['email_otp_fallback'] ) || ! empty( $options['email_otp_fallback'] );
	}

	/**
	 * Email a fresh code to the user.
	 *
	 * @param \WP_User $user User who passed the password check.
	 *
	 * @return string 'sent', 'limited' (a code went out recently or a send cap was reached), or 'failed' (the email could not be sent).
	 */
	public function send( \WP_User $user ): string {
		// --- 1. Send limits: cool-down, per-user window, per-IP window ---
		$user_key = self::SENDS_PREFIX . 'user_' . $user->ID;
		$ip       = AO_Request_Context::ip();
		$ip_key   = self::SENDS_PREFIX . 'ip_' . md5( $ip );
		$now      = time();
		$user_win = get_transient( $user_key );
		$ip_win   = '' !== $ip ? get_transient( $ip_key ) : false;

		$user_win = ( is_array( $user_win ) && $user_win['expires'] > $now ) ? $user_win : [ 'count' => 0, 'expires' => $now + self::SEND_WINDOW, 'last' => 0 ];
		$ip_win   = ( is_array( $ip_win ) && $ip_win['expires'] > $now ) ? $ip_win : [ 'count' => 0, 'expires' => $now + self::SEND_WINDOW ];

		if (
			$now - (int) ( $user_win['last'] ?? 0 ) < self::COOLDOWN
			|| $user_win['count'] >= self::MAX_SENDS_PER_USER
			|| ( '' !== $ip && $ip_win['count'] >= self::MAX_SENDS_PER_IP )
		) {
			return 'limited';
		}

		// --- 2. Create and store the code (hash only) ---
		$code = str_pad( (string) random_int( 0, 999999 ), 6, '0', STR_PAD_LEFT );
		set_transient(
			self::CODE_PREFIX . $user->ID,
			[
				'hash'    => wp_hash_password( $code ),
				'expires' => $now + self::TTL,
				'guesses' => 0,
			],
			self::TTL
		);

		// --- 3. Email it ---
		$site = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
		$sent = wp_mail(
			$user->user_email,
			/* translators: %s: site name. */
			sprintf( __( '[%s] Your one-time sign-in code', 'admin-optimizer' ), $site ),
			sprintf(
				/* translators: 1: user display name, 2: the code, 3: minutes the code is valid for. */
				__( "Hello %1\$s,\n\nYour one-time sign-in code is: %2\$s\n\nIt can be used once and expires in %3\$d minutes. We are sending it because your authenticator app could not be verified.\n\nIf you did not try to sign in, ignore this email and consider changing your password.", 'admin-optimizer' ),
				$user->display_name,
				$code,
				(int) ( self::TTL / MINUTE_IN_SECONDS )
			)
		);
		if ( ! $sent ) {
			delete_transient( self::CODE_PREFIX . $user->ID );
			$this->error( 'Email one-time code could not be sent.', [ 'user_id' => (int) $user->ID ], 'email_otp_send_failed' );
			return 'failed';
		}

		++$user_win['count'];
		$user_win['last'] = $now;
		++$ip_win['count'];
		set_transient( $user_key, $user_win, max( 1, $user_win['expires'] - $now ) );
		if ( '' !== $ip ) {
			set_transient( $ip_key, $ip_win, max( 1, $ip_win['expires'] - $now ) );
		}
		$this->warning( 'Email one-time code sent because the authenticator secret could not be read.', [ 'user_id' => (int) $user->ID ], 'email_otp_sent' );

		return 'sent';
	}

	/**
	 * Check a submitted code. A correct code is consumed; a wrong one counts as a guess.
	 *
	 * @param \WP_User $user User being signed in.
	 * @param string   $code Submitted 6-digit code.
	 *
	 * @return bool
	 */
	public function verify( \WP_User $user, string $code ): bool {
		$key    = self::CODE_PREFIX . $user->ID;
		$record = get_transient( $key );
		if ( ! is_array( $record ) || (int) ( $record['expires'] ?? 0 ) <= time() || (int) ( $record['guesses'] ?? 0 ) >= self::MAX_GUESSES ) {
			delete_transient( $key );
			return false;
		}

		if ( wp_check_password( $code, (string) $record['hash'], $user->ID ) ) {
			delete_transient( $key );
			return true;
		}

		++$record['guesses'];
		if ( $record['guesses'] >= self::MAX_GUESSES ) {
			delete_transient( $key );
		} else {
			set_transient( $key, $record, max( 1, (int) $record['expires'] - time() ) );
		}

		return false;
	}

	/**
	 * Tell the account owner their account was just signed in with an emailed code, and log it.
	 *
	 * @param \WP_User $user User who signed in.
	 *
	 * @return void
	 */
	public function notify_used( \WP_User $user ): void {
		$site = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );

		wp_mail(
			$user->user_email,
			/* translators: %s: site name. */
			sprintf( __( '[%s] Your account was signed in with an emailed code', 'admin-optimizer' ), $site ),
			sprintf(
				/* translators: 1: user display name, 2: IP address, 3: site URL. */
				__( "Hello %1\$s,\n\nYour account was just signed in using a one-time code sent to this address, because your authenticator app could not be verified. The request came from IP address %2\$s.\n\nIf this was you, sign in to %3\$s and reset your two-factor authentication from your profile page. If it was not you, change your password immediately and tell a site administrator.", 'admin-optimizer' ),
				$user->display_name,
				AO_Request_Context::ip(),
				home_url( '/' )
			)
		);

		$this->warning( 'Account signed in with an emailed one-time code.', [ 'user_id' => (int) $user->ID ], 'email_otp_used' );
	}
}