<?php
/**
 * Custom Login URL safe-save state machine.
 *
 * Changing the login slug from the settings screen starts a "pending" state
 * stored in a `pending` key of the module's existing option (already loaded, so
 * no query is added). The new URL must be opened once (a verification link) or
 * kept by hand; otherwise the previous slug is restored automatically, from a
 * lazy check at plugins_loaded and from one WP-Cron event.
 *
 *   saved with a new slug ──► PENDING(confirmed_slug, new_slug, expires)
 *      PENDING ── verification link / "Keep" ─────────► confirmed (pending removed)
 *      PENDING ── "Revert now" ───────────────────────► previous slug, no email
 *      PENDING ── expires (lazy check or cron) ───────► previous slug + one email
 *      PENDING ── CLI change, module disabled, constant ► pending removed, slug untouched
 *      PENDING ── slug changed again ─────────────────► PENDING with the ORIGINAL confirmed_slug
 *
 * No UI dependency: everything here is plain functions over the option so it
 * can be unit tested.
 *
 * @package admin-optimizer
 */

namespace Yipresser\AdminOptimizer\Modules;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

// The cron callback and the CLI run while the module file may not have loaded.
require_once __DIR__ . '/custom-login-url-functions.php';

/**
 * Custom_Login_Url_Safe_Save class
 */
class Custom_Login_Url_Safe_Save {

	const PENDING_KEY     = 'pending';
	const CRON_HOOK       = 'ao_login_url_safe_save_expire';
	const DEFAULT_TIMEOUT = 600;

	/**
	 * One-shot outcome shown once on the settings screen (a short-lived transient,
	 * so it is not autoloaded): confirmed, kept, reverted, restored or noop.
	 */
	const STATUS_TRANSIENT = 'ao_clu_status';
	const STATUS_VALUES    = [ 'confirmed', 'kept', 'reverted', 'restored', 'noop' ];
	const MIN_TIMEOUT      = 60;
	const MAX_TIMEOUT      = 3600;

	/**
	 * True while this class writes the option itself, so the settings sanitizer
	 * and the "login URL changed" email hook leave that write alone.
	 *
	 * @var bool
	 */
	private static $internal_write = false;

	/**
	 * How long a new slug has to be confirmed, in seconds (60 to 3600).
	 *
	 * @return int
	 */
	public static function get_timeout(): int {
		/**
		 * Filters how many seconds a changed login URL has to be confirmed
		 * before the previous one is restored. Clamped to 60-3600.
		 *
		 * @param int $seconds Timeout in seconds. Default 600.
		 */
		$timeout = (int) apply_filters( 'ao_login_url_safe_save_timeout', self::DEFAULT_TIMEOUT );

		return max( self::MIN_TIMEOUT, min( self::MAX_TIMEOUT, $timeout ) );
	}

	/**
	 * Record the outcome of a safe-save for the next view of the settings screen.
	 *
	 * @param string $state One of STATUS_VALUES.
	 *
	 * @return void
	 */
	public static function set_status( string $state ): void {
		if ( in_array( $state, self::STATUS_VALUES, true ) ) {
			set_transient( self::STATUS_TRANSIENT, $state, 10 * MINUTE_IN_SECONDS );
		}
	}

	/**
	 * Forget a recorded outcome without showing it.
	 *
	 * @return void
	 */
	public static function discard_status(): void {
		delete_transient( self::STATUS_TRANSIENT );
	}

	/**
	 * Read and consume the recorded outcome: it is shown once, then gone.
	 *
	 * @return string One of STATUS_VALUES, or ''.
	 */
	public static function take_status(): string {
		$state = get_transient( self::STATUS_TRANSIENT );
		self::discard_status();

		return is_string( $state ) && in_array( $state, self::STATUS_VALUES, true ) ? $state : '';
	}

	/**
	 * The one state the settings screen's status block shows. Mutually exclusive
	 * by construction: a pending safe-save is always `waiting` and beats any
	 * leftover one-shot outcome; then a one-shot outcome; then `saved` (the
	 * plain "your login URL" notice after a save); otherwise `none`.
	 *
	 * @param array|null $pending    Pending state, or null.
	 * @param string     $flag       One-shot outcome that was taken, or ''.
	 * @param bool       $just_saved Whether the screen was just saved without error.
	 *
	 * @return string 'waiting', 'confirmed', 'kept', 'reverted', 'restored', 'noop', 'saved' or 'none'.
	 */
	public static function select_status( ?array $pending, string $flag, bool $just_saved ): string {
		if ( null !== $pending ) {
			return 'waiting';
		}
		if ( in_array( $flag, self::STATUS_VALUES, true ) ) {
			return $flag;
		}

		return $just_saved ? 'saved' : 'none';
	}

	/**
	 * Whether this class is currently writing the option.
	 *
	 * @return bool
	 */
	public static function is_internal_write(): bool {
		return self::$internal_write;
	}

	/**
	 * Write the module option without the settings sanitizer or the change email running.
	 *
	 * @param array $options New option value.
	 *
	 * @return bool Whether the stored value changed.
	 */
	public static function write_options( array $options ): bool {
		self::$internal_write = true;
		try {
			return (bool) update_option( Custom_Login_Url::OPTION_NAME, $options );
		} finally {
			self::$internal_write = false;
		}
	}

	/**
	 * The stored option as an array.
	 *
	 * @return array
	 */
	private static function read_options(): array {
		$options = get_option( Custom_Login_Url::OPTION_NAME, [] );

		return is_array( $options ) ? $options : [];
	}

	/**
	 * The well-formed pending state in an option array, or null.
	 *
	 * @param array $options Module option.
	 *
	 * @return array{confirmed_slug:string,new_slug:string,expires:int}|null
	 */
	public static function get_pending( array $options ): ?array {
		$pending = $options[ self::PENDING_KEY ] ?? null;
		if ( ! is_array( $pending ) || ! isset( $pending['confirmed_slug'], $pending['new_slug'], $pending['expires'] ) ) {
			return null;
		}
		if ( ! is_string( $pending['confirmed_slug'] ) || ! is_string( $pending['new_slug'] ) || '' === $pending['new_slug'] || (int) $pending['expires'] <= 0 ) {
			return null;
		}

		return [
			'confirmed_slug' => $pending['confirmed_slug'],
			'new_slug'       => $pending['new_slug'],
			'expires'        => (int) $pending['expires'],
		];
	}

	/**
	 * Whether a pending state has run out.
	 *
	 * @param array $pending Pending state.
	 * @param int   $now     Current Unix time.
	 *
	 * @return bool
	 */
	public static function is_expired( array $pending, int $now ): bool {
		return $now >= (int) $pending['expires'];
	}

	/**
	 * Add or drop the pending state on a new option value after a slug change.
	 * Pure: the caller decides whether this is a settings-screen save, that the
	 * module is enabled and that no constant is in force.
	 *
	 * A pending state that already exists keeps its ORIGINAL confirmed_slug, so
	 * a slug that was never confirmed can never become the revert target.
	 *
	 * @param array $stored      Option as stored now.
	 * @param array $new_options Option about to be stored.
	 * @param int   $now         Current Unix time.
	 *
	 * @return array New option value.
	 */
	public static function begin( array $stored, array $new_options, int $now ): array {
		$old_slug = (string) ( $stored['custom_slug'] ?? '' );
		$new_slug = (string) ( $new_options['custom_slug'] ?? '' );

		if ( '' === $new_slug || $new_slug === $old_slug ) {
			return $new_options;
		}

		$existing  = self::get_pending( $stored );
		$confirmed = null === $existing ? $old_slug : $existing['confirmed_slug'];

		// Back to the slug that is known to work: nothing to verify.
		if ( $new_slug === $confirmed ) {
			unset( $new_options[ self::PENDING_KEY ] );
			return $new_options;
		}

		$new_options[ self::PENDING_KEY ] = [
			'confirmed_slug' => $confirmed,
			'new_slug'       => $new_slug,
			'expires'        => $now + self::get_timeout(),
		];

		return $new_options;
	}

	/**
	 * The token that proves the new URL loads: HMAC of the slug and expiry. Never stored.
	 *
	 * @param string $new_slug The unconfirmed slug.
	 * @param int    $expires  The pending expiry.
	 *
	 * @return string
	 */
	public static function get_token( string $new_slug, int $expires ): string {
		return hash_hmac( 'sha256', $new_slug . '|' . $expires, wp_salt( 'auth' ) );
	}

	/**
	 * The one-time verification link: the new login URL plus ?ao_verify=<token>.
	 *
	 * @param array $pending Pending state.
	 *
	 * @return string
	 */
	public static function get_verify_url( array $pending ): string {
		return add_query_arg( [ 'ao_verify' => self::get_token( $pending['new_slug'], $pending['expires'] ) ], Custom_Login_Url::build_url( $pending['new_slug'] ) );
	}

	/**
	 * Whether a token proves the pending state: unexpired, for the slug in
	 * force, compared in constant time. It grants no access, only "this URL loads".
	 *
	 * @param array  $options Module option.
	 * @param string $token   Token from the request.
	 * @param int    $now     Current Unix time.
	 *
	 * @return bool
	 */
	public static function is_token_valid( array $options, string $token, int $now ): bool {
		$pending = self::get_pending( $options );
		if ( null === $pending || '' === $token || self::is_expired( $pending, $now ) ) {
			return false;
		}
		if ( (string) ( $options['custom_slug'] ?? '' ) !== $pending['new_slug'] ) {
			return false;
		}

		return hash_equals( self::get_token( $pending['new_slug'], $pending['expires'] ), $token );
	}

	/**
	 * Confirm from the verification link served on the new login URL.
	 *
	 * @param string $token Token from the request.
	 * @param int    $now   Current Unix time.
	 *
	 * @return bool Whether the pending state was confirmed.
	 */
	public static function confirm_with_token( string $token, ?int $now = null ): bool {
		if ( ! self::is_token_valid( self::read_options(), $token, $now ?? time() ) ) {
			return false;
		}

		if ( ! self::clear() ) {
			return false;
		}
		self::set_status( 'confirmed' );

		return true;
	}

	/**
	 * Remove the pending state and its cron event without touching the slug.
	 * Used to confirm ("Keep this URL"), and whenever the CLI, a disabled
	 * module or a constant takes over.
	 *
	 * @return bool Whether a pending state was removed.
	 */
	public static function clear(): bool {
		$options = self::read_options();
		self::unschedule();
		if ( ! isset( $options[ self::PENDING_KEY ] ) ) {
			return false;
		}

		unset( $options[ self::PENDING_KEY ] );

		return self::write_options( $options );
	}

	/**
	 * Restore the previous slug now. Idempotent: the pending state is removed
	 * in the same write, so a second call (or a concurrent one that loses the
	 * write) finds nothing to do and sends no email.
	 *
	 * Guard: the slug is restored only while the stored slug still equals the
	 * unconfirmed one; if someone changed it meanwhile, only the pending state
	 * is discarded.
	 *
	 * @param bool $email Send the revert notice (respecting the email_on_change setting).
	 *
	 * @return bool Whether the slug was restored by this call.
	 */
	public static function revert( bool $email ): bool {
		$options = self::read_options();
		$pending = self::get_pending( $options );
		self::unschedule();

		if ( null === $pending ) {
			if ( isset( $options[ self::PENDING_KEY ] ) ) {
				unset( $options[ self::PENDING_KEY ] );
				self::write_options( $options );
			}
			return false;
		}

		unset( $options[ self::PENDING_KEY ] );
		$restore = (string) ( $options['custom_slug'] ?? '' ) === $pending['new_slug'];
		if ( $restore ) {
			$options['custom_slug'] = $pending['confirmed_slug'];
		}

		// update_option() returns true only for the call that actually changed the value.
		if ( ! self::write_options( $options ) || ! $restore ) {
			return false;
		}

		$wants_email = ! isset( $options['email_on_change'] ) || ! empty( $options['email_on_change'] );
		if ( $email && $wants_email ) {
			$send = static function () use ( $pending ) {
				Custom_Login_Url::send_login_url_email( $pending['confirmed_slug'], 'reverted', (int) max( 1, round( self::get_timeout() / 60 ) ) );
			};
			// The lazy check runs at plugins_loaded, too early to translate the message or read the module
			// registry's localized catalogue, so the email waits for init. The slug is already restored.
			if ( did_action( 'init' ) ) {
				$send();
			} else {
				add_action( 'init', $send );
			}
		}

		return true;
	}

	/**
	 * Revert when the pending state has run out. Called by the lazy check at
	 * plugins_loaded and by the cron event. A wp-config.php constant always wins:
	 * with one in force the pending state is dropped without reverting.
	 *
	 * @param int|null $now Current Unix time.
	 *
	 * @return bool Whether the slug was restored.
	 */
	public static function maybe_expire( ?int $now = null ): bool {
		$options = self::read_options();
		$pending = self::get_pending( $options );
		if ( null === $pending ) {
			return false;
		}

		if ( 'db' !== ao_get_effective_login_slug( $options )['source'] ) {
			self::clear();
			return false;
		}
		if ( ! self::is_expired( $pending, $now ?? time() ) ) {
			return false;
		}

		if ( ! self::revert( true ) ) {
			return false;
		}
		self::set_status( 'reverted' );

		return true;
	}

	/**
	 * Keep the cron event in step with the stored pending state. Runs when the
	 * option is saved from the settings screen.
	 *
	 * @param mixed $old_value Previous option value.
	 * @param mixed $new_value New option value.
	 *
	 * @return void
	 */
	public static function sync_schedule( $old_value, $new_value ): void {
		$old = self::get_pending( is_array( $old_value ) ? $old_value : [] );
		$new = self::get_pending( is_array( $new_value ) ? $new_value : [] );

		if ( $new === $old ) {
			return;
		}

		self::unschedule();
		if ( null !== $new ) {
			// A new pending state starts clean: any stale one-shot outcome is dropped first.
			self::discard_status();
			wp_schedule_single_event( $new['expires'], self::CRON_HOOK );
		}
	}

	/**
	 * Remove the scheduled revert.
	 *
	 * @return void
	 */
	public static function unschedule(): void {
		wp_clear_scheduled_hook( self::CRON_HOOK );
	}

	/**
	 * Module toggled off while a change is waiting: restore the last confirmed
	 * slug, with no email. Turning the module back on must never bring back a
	 * slug nobody has opened. With a wp-config.php constant in force, the slug
	 * is not the stored one, so only the pending state is dropped.
	 *
	 * @param string $module_id Module that changed.
	 * @param bool   $enabled   New state.
	 *
	 * @return void
	 */
	public static function on_module_state_changed( $module_id, $enabled ): void {
		if ( Custom_Login_Url::MODULE_ID !== $module_id || $enabled ) {
			return;
		}

		if ( 'db' === ao_get_effective_login_slug( self::read_options() )['source'] ) {
			self::revert( false );
		} else {
			self::clear();
		}
	}
}