<?php
/**
 * The settings screen.
 *
 * One top-level page, one card per feature. Server-rendered PHP with vanilla JS — nothing here
 * needs a build step, and a plain settings page passes wordpress.org review with far less
 * friction than a bundled artifact.
 *
 * This is not a Feature: it must load even when every feature is switched off, or there would be
 * no way to switch one on. It is also the escape hatch from Installation Lockdown, which is why
 * it is guarded by manage_options and nothing else.
 *
 * @package Adminkeep
 */

namespace Adminkeep\Admin;

use Adminkeep\Admin\RestController;
use Adminkeep\FeatureRegistry;
use Adminkeep\Settings;

defined( 'ABSPATH' ) || exit;

/**
 * Renders and saves the plugin's settings.
 */
class SettingsPage {

	/**
	 * Menu slug.
	 */
	const SLUG = 'adminkeep';

	/**
	 * Nonce action.
	 */
	const NONCE = 'adminkeep_save_settings';

	/**
	 * Nonce action for running a destructive feature action.
	 */
	const ACTION_NONCE = 'adminkeep_run_action';

	/**
	 * Capability required to see or change anything here.
	 */
	const CAPABILITY = 'manage_options';

	/**
	 * User meta key: this user hides the features they do not use from the nav.
	 */
	const HIDE_UNUSED_META = 'adminkeep_hide_unused';

	/**
	 * Feature registry.
	 *
	 * @var FeatureRegistry
	 */
	private $registry;

	/**
	 * Settings writer.
	 *
	 * @var \Adminkeep\Service\SettingsWriter
	 */
	private $writer;

	/**
	 * The page hook suffix, once registered.
	 *
	 * @var string
	 */
	private $hook = '';

	/**
	 * Constructor.
	 *
	 * @param FeatureRegistry $registry Feature registry.
	 */
	public function __construct( FeatureRegistry $registry ) {
		$this->registry = $registry;
		$this->writer   = new \Adminkeep\Service\SettingsWriter( $registry );
	}

	/**
	 * Register hooks.
	 *
	 * @return void
	 */
	public function boot() {
		add_action( 'admin_menu', array( $this, 'register_page' ) );
		add_action( 'admin_init', array( $this, 'maybe_run_action' ) );
		add_action( 'admin_init', array( $this, 'maybe_save' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_assets' ) );
	}

	/**
	 * Add the top-level menu page.
	 *
	 * @return void
	 */
	public function register_page() {
		$this->hook = add_menu_page(
			__( 'Adminkeep', 'adminkeep' ),
			__( 'Adminkeep', 'adminkeep' ),
			self::CAPABILITY,
			self::SLUG,
			array( $this, 'render' ),
			'dashicons-lock',
			80
		);
	}

	/**
	 * Asset cache-busting version for one file.
	 *
	 * Three tiers, because the plugin version alone silently serves stale assets during
	 * development — it does not change while you are editing:
	 *
	 * - SCRIPT_DEBUG on  → time(), so every single request is fresh.
	 * - otherwise        → the file's mtime, so an edited asset busts on its own.
	 * - unreadable file  → the plugin version.
	 *
	 * @param string $relative_path Path under the plugin root, e.g. 'assets/js/settings.js'.
	 * @return string
	 */
	public function asset_version( $relative_path = '' ) {
		return \Adminkeep\Assets::version( $relative_path );
	}

	/**
	 * Load assets on this screen only. Never globally.
	 *
	 * @param string $hook_suffix Current admin page.
	 * @return void
	 */
	public function enqueue_assets( $hook_suffix ) {
		if ( ! $this->hook || $hook_suffix !== $this->hook ) {
			return;
		}

		wp_enqueue_style(
			'adminkeep-settings',
			ADMINKEEP_URL . 'assets/css/settings.css',
			array(),
			$this->asset_version( 'assets/css/settings.css' )
		);

		wp_enqueue_script(
			'adminkeep-settings',
			ADMINKEEP_URL . 'assets/js/settings.js',
			array(),
			$this->asset_version( 'assets/js/settings.js' ),
			true
		);

		wp_localize_script(
			'adminkeep-settings',
			'adminkeepConfig',
			array(
				'root'  => esc_url_raw( rest_url( RestController::NAMESPACE_V1 ) ),
				'nonce' => wp_create_nonce( 'wp_rest' ),
				'i18n'  => array(
					'saved'      => __( 'Changes saved', 'adminkeep' ),
					'saveFailed' => __( 'Changes could not be saved. Nothing was changed.', 'adminkeep' ),
					'saving'     => __( 'Saving', 'adminkeep' ),
					'deleting'   => __( 'Deleting comments', 'adminkeep' ),
					/* translators: %s: number of comments deleted. */
					'deleted'    => __( '%s comments deleted', 'adminkeep' ),
					'purgeFailed'=> __( 'Deletion stopped. Nothing further was removed.', 'adminkeep' ),
					'dismiss'    => __( 'Dismiss', 'adminkeep' ),
					'nothingToDo'=> __( 'Nothing to delete', 'adminkeep' ),
					'hiddenOne'  => __( '1 unused feature hidden', 'adminkeep' ),
					/* translators: %d: number of features. */
					'hiddenMany' => __( '%d unused features hidden', 'adminkeep' ),
				),
			)
		);
	}

	/**
	 * Handle a settings save.
	 *
	 * @return void
	 */
	public function maybe_save() {
		if ( ! isset( $_POST['adminkeep_save'] ) ) {
			return;
		}

		// The destructive-action buttons live inside this same form; they are not a settings save.
		if ( isset( $_POST['adminkeep_action'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
			return;
		}

		if ( ! current_user_can( self::CAPABILITY ) ) {
			wp_die( esc_html__( 'You are not allowed to change these settings.', 'adminkeep' ), '', array( 'response' => 403 ) );
		}

		check_admin_referer( self::NONCE );

		// The payload is a nested array of per-feature panels. It is not sanitized here because it
		// cannot be sanitized generically: save_values() walks each feature's settings_schema() and
		// runs SettingsWriter::sanitize_field() per key, which is the only place the expected type
		// is known. Keys absent from a schema are dropped rather than stored.
		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce checked above; sanitized per-field in save_values().
		$posted = isset( $_POST['adminkeep'] ) && is_array( $_POST['adminkeep'] ) ? wp_unslash( $_POST['adminkeep'] ) : array();

		$this->save_values( $posted );

		wp_safe_redirect(
			add_query_arg(
				array(
					'page'    => self::SLUG,
					'updated' => 'true',
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	/**
	 * Run a destructive feature action, in confirmed batches.
	 *
	 * Two steps on purpose. The first click only asks; nothing is destroyed until a second,
	 * separately nonced confirmation comes back. Deletion then runs a batch at a time, redirecting
	 * between batches, so a site with a very large number of comments cannot time out.
	 *
	 * @return void
	 */
	public function maybe_run_action() {
		if ( ! isset( $_POST['adminkeep_action'] ) ) {
			return;
		}

		if ( ! current_user_can( self::CAPABILITY ) || ! current_user_can( 'moderate_comments' ) ) {
			wp_die( esc_html__( 'You are not allowed to delete comments.', 'adminkeep' ), '', array( 'response' => 403 ) );
		}

		$action           = sanitize_key( wp_unslash( $_POST['adminkeep_action'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
		$include_approved = ! empty( $_POST['adminkeep_include_approved'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
		$include_woo      = ! empty( $_POST['adminkeep_include_woo'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
		$confirmed        = ! empty( $_POST['adminkeep_confirmed'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing

		if ( \Adminkeep\Feature\DisableComments::PURGE_ARG !== $action ) {
			return;
		}

		check_admin_referer( $confirmed ? self::ACTION_NONCE : self::NONCE );

		if ( ! $confirmed ) {
			// Step one: bounce back and ask.
			wp_safe_redirect(
				add_query_arg(
					array(
						'page'         => self::SLUG,
						'adminkeep_confirm' => $action,
						'approved'     => $include_approved ? '1' : '0',
						'woo'          => $include_woo ? '1' : '0',
					),
					admin_url( 'admin.php' )
				)
			);
			exit;
		}

		// Step two: confirmed. Delete one batch, then come back for the rest.
		$deleted   = \Adminkeep\Service\CommentPurger::delete_batch( \Adminkeep\Service\CommentPurger::BATCH_SIZE, $include_approved, $include_woo );
		$remaining = \Adminkeep\Service\CommentPurger::count( $include_approved, $include_woo );

		$args = array( 'page' => self::SLUG );

		if ( $remaining > 0 && $deleted > 0 ) {
			$args['adminkeep_confirm'] = $action;
			$args['approved']     = $include_approved ? '1' : '0';
			$args['woo']          = $include_woo ? '1' : '0';
			$args['resume']       = '1';
		} else {
			$args['adminkeep_purged'] = '1';
		}

		wp_safe_redirect( add_query_arg( $args, admin_url( 'admin.php' ) ) );
		exit;
	}

	/**
	 * Whether a feature offers any actions.
	 *
	 * @param \Adminkeep\Feature $feature Feature.
	 * @return bool
	 */
	private function has_actions( $feature ) {
		return method_exists( $feature, 'actions' ) && ! empty( $feature->actions() );
	}

	/**
	 * Render a feature's actions.
	 *
	 * @param \Adminkeep\Feature $feature Feature.
	 * @return void
	 */
	private function render_actions( $feature ) {
		if ( ! $this->has_actions( $feature ) ) {
			return;
		}

		foreach ( $feature->actions() as $action ) {
			echo '<div class="adminkeep-field adminkeep-action">';

			if ( ! empty( $action['description'] ) ) {
				echo '<p class="description">' . esc_html( $action['description'] ) . '</p>';
			}

			foreach ( ( isset( $action['toggles'] ) ? $action['toggles'] : array() ) as $toggle ) {
				printf(
					'<label class="adminkeep-action__toggle"><input type="checkbox" name="%s" value="1" /> %s</label>',
					esc_attr( $toggle['name'] ),
					esc_html( $toggle['label'] )
				);
			}

			$counts = isset( $action['counts'] ) ? $action['counts'] : \Adminkeep\Service\CommentPurger::counts();

			printf(
				'<button type="submit" name="adminkeep_action" value="%1$s" class="button adminkeep-action__button" data-role="purge" data-counts="%2$s"%3$s>%4$s</button>',
				esc_attr( $action['id'] ),
				esc_attr( wp_json_encode( $counts ) ),
				empty( $action['disabled'] ) ? '' : ' disabled',
				esc_html( $action['label'] )
			);

			echo '</div>';
		}
	}

	/**
	 * Render the confirmation panel for a pending destructive action.
	 *
	 * @return void
	 */
	private function render_confirmation() {
		// phpcs:disable WordPress.Security.NonceVerification.Recommended
		if ( ! isset( $_GET['adminkeep_confirm'] ) ) {
			return;
		}

		$include_approved = isset( $_GET['approved'] ) && '1' === $_GET['approved'];
		$include_woo      = isset( $_GET['woo'] ) && '1' === $_GET['woo'];
		$resuming         = isset( $_GET['resume'] );
		$action           = sanitize_key( wp_unslash( $_GET['adminkeep_confirm'] ) );
		// phpcs:enable WordPress.Security.NonceVerification.Recommended

		$count = \Adminkeep\Service\CommentPurger::count( $include_approved, $include_woo );

		if ( $count < 1 ) {
			return;
		}
		?>
		<div class="notice notice-warning adminkeep-confirm">
			<h2><?php esc_html_e( 'Confirm permanent deletion', 'adminkeep' ); ?></h2>
			<p>
				<?php
				printf(
					/* translators: %s: number of comments. */
					esc_html__( 'This will permanently delete %s comments. It cannot be undone.', 'adminkeep' ),
					'<strong>' . esc_html( number_format_i18n( $count ) ) . '</strong>'
				);
				?>
			</p>
			<p>
				<?php if ( $include_approved ) : ?>
					<strong><?php esc_html_e( 'This includes approved and pending comments — real comments left by real people.', 'adminkeep' ); ?></strong>
				<?php else : ?>
					<?php esc_html_e( 'Only spam and trashed comments are affected. Approved and pending comments are left alone.', 'adminkeep' ); ?>
				<?php endif; ?>
			</p>
			<?php if ( $resuming ) : ?>
				<p class="description"><?php esc_html_e( 'Deleting in batches so the request cannot time out. Continue until none remain.', 'adminkeep' ); ?></p>
			<?php endif; ?>
			<form method="post" action="">
				<?php wp_nonce_field( self::ACTION_NONCE ); ?>
				<input type="hidden" name="adminkeep_confirmed" value="1" />
				<input type="hidden" name="adminkeep_include_approved" value="<?php echo $include_approved ? '1' : '0'; ?>" />
				<input type="hidden" name="adminkeep_include_woo" value="<?php echo $include_woo ? '1' : '0'; ?>" />
				<button type="submit" name="adminkeep_action" value="<?php echo esc_attr( $action ); ?>" class="button button-primary">
					<?php echo $resuming ? esc_html__( 'Continue deleting', 'adminkeep' ) : esc_html__( 'Yes, delete them permanently', 'adminkeep' ); ?>
				</button>
				<a href="<?php echo esc_url( admin_url( 'admin.php?page=' . self::SLUG ) ); ?>" class="button"><?php esc_html_e( 'Cancel', 'adminkeep' ); ?></a>
			</form>
		</div>
		<?php
	}

	/**
	 * Persist a submitted settings payload.
	 *
	 * Shared by the form POST and the REST route so both behave identically.
	 *
	 * @param array $posted Payload keyed by feature id.
	 * @return void
	 */
	public function save_values( array $posted ) {
		$this->writer->save_values( $posted );
	}

	/**
	 * A terse word for what a feature is currently doing.
	 *
	 * Content-derived, not an On/Off badge: "Closed", "No installs", "3 blocked". Features opt in by
	 * declaring state_label(); anything that does not gets no chip rather than filler.
	 *
	 * @param \Adminkeep\Feature $feature Feature.
	 * @return string
	 */
	public function state_label( $feature ) {
		if ( ! Settings::is_enabled( $feature->id() ) || ! method_exists( $feature, 'state_label' ) ) {
			return '';
		}

		return (string) $feature->state_label();
	}

	/**
	 * The link to a feature's own screen, when it has one this user can open.
	 *
	 * @param \Adminkeep\Feature $feature         Feature.
	 * @param bool               $require_enabled False to get the link of a feature that is off,
	 *                                            for the slot the panel keeps ready.
	 * @return array{url: string, label: string}|null
	 */
	public function panel_link_for( $feature, $require_enabled = true ) {
		if ( ! method_exists( $feature, 'panel_link' ) ) {
			return null;
		}

		if ( $require_enabled && ! Settings::is_enabled( $feature->id() ) ) {
			return null;
		}

		$link = (array) $feature->panel_link();

		if ( empty( $link['url'] ) || empty( $link['label'] ) ) {
			return null;
		}

		return array(
			'url'   => (string) $link['url'],
			'label' => (string) $link['label'],
		);
	}

	/**
	 * Whether a user hides unused features from the nav.
	 *
	 * Per user rather than per site: two administrators can want different views of one screen.
	 *
	 * @param int $user_id User id; the current user when 0.
	 * @return bool
	 */
	public static function hides_unused( $user_id = 0 ) {
		$user_id = $user_id ? (int) $user_id : get_current_user_id();

		return $user_id && '1' === get_user_meta( $user_id, self::HIDE_UNUSED_META, true );
	}

	/**
	 * Render the screen.
	 *
	 * A nav of features on the left, one panel each on the right. Panels are all rendered and
	 * hidden with the `hidden` attribute rather than fetched, because there are three of them and
	 * a round trip to swap a panel would be slower and worse. Without JavaScript every panel is
	 * simply visible in sequence and each one saves itself.
	 *
	 * @return void
	 */
	public function render() {
		if ( ! current_user_can( self::CAPABILITY ) ) {
			return;
		}

		$features     = $this->registry->all();
		$hide_unused  = self::hides_unused();
		$hidden_count = 0;

		foreach ( array_keys( $features ) as $feature_id ) {
			$hidden_count += Settings::is_enabled( $feature_id ) ? 0 : 1;
		}
		?>
		<div class="wrap adminkeep-wrap">
			<?php // Where core's common.js puts other plugins' notices. Without it they land after the first heading, which is inside the masthead. ?>
			<hr class="wp-header-end" />

			<?php $this->render_confirmation(); ?>

			<div class="adminkeep-shell">
				<header class="adminkeep-masthead">
					<h1 class="adminkeep-masthead__title">
						<?php echo Brand::mark( 28 ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Static SVG. ?>
						<?php esc_html_e( 'Adminkeep', 'adminkeep' ); ?>
					</h1>
					<p class="adminkeep-masthead__version">v<?php echo esc_html( ADMINKEEP_VERSION ); ?></p>
				</header>

				<div class="adminkeep-app">
					<nav class="adminkeep-nav" aria-label="<?php esc_attr_e( 'Settings sections', 'adminkeep' ); ?>">
						<?php // Needs the script to save, so it is shown only once the script has marked the wrap. ?>
						<?php // The same switch as a panel's "Enable this feature", one size down; it carries no name because it is a preference, not a form field. ?>
						<label class="adminkeep-switch adminkeep-switch--small adminkeep-nav__toggle">
							<input type="checkbox" class="adminkeep-switch__input" role="switch" data-role="hide-unused"<?php checked( $hide_unused ); ?> />
							<span class="adminkeep-switch__track" aria-hidden="true"><span class="adminkeep-switch__knob"></span></span>
							<span class="adminkeep-switch__label"><?php esc_html_e( 'Hide unused features', 'adminkeep' ); ?></span>
						</label>

						<div class="adminkeep-nav__filter">
							<label class="screen-reader-text" for="adminkeep-filter"><?php esc_html_e( 'Filter settings', 'adminkeep' ); ?></label>
							<input type="search" id="adminkeep-filter" data-role="filter" placeholder="<?php esc_attr_e( 'Filter settings…', 'adminkeep' ); ?>" autocomplete="off" />
						</div>

						<ul class="adminkeep-nav__list">
							<li>
								<a class="adminkeep-nav__item is-current" href="#overview" data-panel="overview">
									<?php esc_html_e( 'Overview', 'adminkeep' ); ?>
								</a>
							</li>
						</ul>

						<?php foreach ( $this->registry->grouped() as $group => $group_features ) : ?>
							<?php
							// While the preference is on, a group is worth a heading only if at
							// least one of its features is switched on: otherwise the heading would
							// sit above an empty list, so it is printed hidden along with the list.
							$group_shows = ! $hide_unused;

							foreach ( array_keys( $group_features ) as $feature_id ) {
								$group_shows = $group_shows || Settings::is_enabled( $feature_id );
							}
							?>
							<p class="adminkeep-nav__group"<?php echo $group_shows ? '' : ' hidden'; ?>>
								<?php echo esc_html( $this->group_label( $group ) ); ?>
							</p>

							<ul class="adminkeep-nav__list" data-role="filterable"<?php echo $group_shows ? '' : ' hidden'; ?>>
								<?php foreach ( $group_features as $id => $feature ) : ?>
									<?php $is_on = Settings::is_enabled( $id ); ?>
									<li data-enabled="<?php echo $is_on ? '1' : '0'; ?>"<?php echo ( $hide_unused && ! $is_on ) ? ' hidden' : ''; ?>>
										<a class="adminkeep-nav__item" href="#<?php echo esc_attr( $id ); ?>" data-panel="<?php echo esc_attr( $id ); ?>">
											<span class="adminkeep-dot<?php echo $is_on ? ' is-on' : ''; ?>" data-role="dot" aria-hidden="true"></span>
											<span class="adminkeep-nav__text"><?php echo esc_html( $feature->label() ); ?></span>
										</a>
									</li>
								<?php endforeach; ?>
							</ul>
						<?php endforeach; ?>

						<p class="adminkeep-nav__empty" data-role="filter-empty" hidden><?php esc_html_e( 'Nothing matches that.', 'adminkeep' ); ?></p>

						<?php // The live region is the text, not this <p>: the <p> is toggled with `hidden` and also holds the button, and a region that disappears as the toggle goes off announces nothing. ?>
						<p class="adminkeep-nav__hidden-count" data-role="hidden-count"<?php echo ( $hide_unused && $hidden_count ) ? '' : ' hidden'; ?>>
							<span data-role="hidden-count-text" aria-live="polite"><?php echo esc_html( sprintf( /* translators: %d: number of features. */ _n( '%d unused feature hidden', '%d unused features hidden', $hidden_count, 'adminkeep' ), $hidden_count ) ); ?></span>
							<button type="button" class="button-link" data-role="show-all"><?php esc_html_e( 'Show all', 'adminkeep' ); ?></button>
						</p>
					</nav>

					<div class="adminkeep-panels">
						<?php $this->render_overview( $features ); ?>

						<?php foreach ( $features as $id => $feature ) : ?>
							<?php $this->render_panel( $id, $feature ); ?>
						<?php endforeach; ?>
					</div>
				</div>
			</div>

			<div class="adminkeep-toasts" data-role="toasts" role="status" aria-live="polite" aria-atomic="false"></div>
		</div>

		<dialog class="adminkeep-dialog" data-role="confirm-dialog" aria-labelledby="adminkeep-dialog-title">
			<form method="dialog" class="adminkeep-dialog__inner">
				<h2 class="adminkeep-dialog__title" id="adminkeep-dialog-title"><?php esc_html_e( 'Delete comments permanently', 'adminkeep' ); ?></h2>

				<p class="adminkeep-dialog__body" data-role="confirm-body"></p>

				<label class="adminkeep-dialog__opt">
					<input type="checkbox" data-role="confirm-approved" />
					<span><?php esc_html_e( 'Also delete approved and pending comments', 'adminkeep' ); ?></span>
				</label>

				<?php if ( \Adminkeep\Service\CommentPurger::woocommerce_active() ) : ?>
					<label class="adminkeep-dialog__opt adminkeep-dialog__opt--warn">
						<input type="checkbox" data-role="confirm-woo" />
						<span><?php esc_html_e( 'Also delete WooCommerce order notes, webhook logs and product reviews. Order notes are order history.', 'adminkeep' ); ?></span>
					</label>
				<?php endif; ?>

				<div class="adminkeep-progress" data-role="progress" hidden>
					<div class="adminkeep-progress__bar"><span class="adminkeep-progress__fill" data-role="progress-fill"></span></div>
					<p class="adminkeep-progress__label" data-role="progress-label"></p>
				</div>

				<div class="adminkeep-dialog__actions">
					<button type="button" class="button" data-role="confirm-cancel"><?php esc_html_e( 'Cancel', 'adminkeep' ); ?></button>
					<button type="button" class="button button-primary adminkeep-dialog__go" data-role="confirm-go"><?php esc_html_e( 'Delete them', 'adminkeep' ); ?></button>
				</div>
			</form>
		</dialog>
		<?php
	}

	/**
	 * Heading for a feature group.
	 *
	 * An unknown group key falls back to the key itself rather than rendering an empty heading,
	 * so a feature registered under a group nobody labelled is still visibly grouped.
	 *
	 * @param string $group Group key.
	 * @return string
	 */
	private function group_label( $group ) {
		$labels = \Adminkeep\Plugin::group_labels();

		return isset( $labels[ $group ] ) ? $labels[ $group ] : $group;
	}

	/**
	 * The landing panel: what is on, what is off, at a glance.
	 *
	 * @param \Adminkeep\Feature[] $features Registered features.
	 * @return void
	 */
	private function render_overview( array $features ) {
		$on = 0;

		foreach ( array_keys( $features ) as $id ) {
			$on += Settings::is_enabled( $id ) ? 1 : 0;
		}

		// Enabled first, so the list opens with what this site actually uses. Registry order is
		// kept inside each half. Done here only, never by the script after a save: rows that
		// move under the pointer are worse than a list that is one reload behind.
		$ordered = array();

		foreach ( array( true, false ) as $wanted ) {
			foreach ( $features as $id => $feature ) {
				if ( Settings::is_enabled( $id ) === $wanted ) {
					$ordered[ $id ] = $feature;
				}
			}
		}
		?>
		<section class="adminkeep-panel" data-panel="overview">
			<h2 class="adminkeep-panel__title"><?php esc_html_e( 'Overview', 'adminkeep' ); ?></h2>

			<p class="adminkeep-panel__lead">
				<?php esc_html_e( 'You decide what changes on this site. Site Lock stops things changing behind your back — no new comment, no new plugin, no new user. Content makes the changes you do want safe to make. Switching a feature off never leaves you repair work: a lock simply stops, and anything already written — a copy, an order you saved, a redirect already recorded — stays where you put it.', 'adminkeep' ); ?>
			</p>

			<p class="adminkeep-summary">
				<?php
				printf(
					/* translators: 1: number of enabled features, 2: total features. */
					esc_html__( '%1$s of %2$s features enabled.', 'adminkeep' ),
					// The script rewrites this number after an in-place save (#19); the sentence
					// around it stays server-rendered so it is translated as one string.
					'<strong data-role="enabled-count">' . esc_html( number_format_i18n( $on ) ) . '</strong>',
					esc_html( number_format_i18n( count( $features ) ) )
				);
				?>
			</p>

			<ul class="adminkeep-overview">
				<?php foreach ( $ordered as $id => $feature ) : ?>
					<li class="adminkeep-overview__row">
						<span class="adminkeep-dot<?php echo Settings::is_enabled( $id ) ? ' is-on' : ''; ?>" data-role="dot" aria-hidden="true"></span>
						<a class="adminkeep-overview__name" href="#<?php echo esc_attr( $id ); ?>" data-panel="<?php echo esc_attr( $id ); ?>"><?php echo esc_html( $feature->label() ); ?></a>
						<span class="adminkeep-overview__state" data-role="state"><?php echo esc_html( $this->state_label( $feature ) ); ?></span>
					</li>
				<?php endforeach; ?>
			</ul>
		</section>
		<?php
	}

	/**
	 * Render one feature panel, with its own form and its own save button.
	 *
	 * @param string              $id      Feature id.
	 * @param \Adminkeep\Feature $feature Feature.
	 * @return void
	 */
	private function render_panel( $id, $feature ) {
		$enabled  = Settings::is_enabled( $id );
		$resolved = $this->registry->resolve_settings( $feature );
		$schema   = $feature->settings_schema();
		$steps    = method_exists( $feature, 'how_it_works' ) ? (array) $feature->how_it_works() : array();
		?>
		<section class="adminkeep-panel" data-panel="<?php echo esc_attr( $id ); ?>" data-feature="<?php echo esc_attr( $id ); ?>" hidden>
			<form method="post" action="" class="adminkeep-form" data-role="panel-form">
				<?php wp_nonce_field( self::NONCE ); ?>
				<input type="hidden" name="adminkeep_save" value="1" />
				<input type="hidden" name="adminkeep[<?php echo esc_attr( $id ); ?>][_present]" value="1" />

				<div class="adminkeep-panel__head">
					<h2 class="adminkeep-panel__title"><?php echo esc_html( $feature->label() ); ?></h2>
					<span class="adminkeep-chip" data-role="state"><?php echo esc_html( $this->state_label( $feature ) ); ?></span>
				</div>

				<div class="adminkeep-enable">
					<label class="adminkeep-switch">
						<input
							type="checkbox"
							class="adminkeep-switch__input"
							name="adminkeep[<?php echo esc_attr( $id ); ?>][enabled]"
							value="1"
							<?php checked( $enabled ); ?>
						/>
						<span class="adminkeep-switch__track" aria-hidden="true"><span class="adminkeep-switch__knob"></span></span>
						<span class="adminkeep-switch__label"><?php esc_html_e( 'Enable this feature', 'adminkeep' ); ?></span>
					</label>

					<p class="adminkeep-enable__desc"><?php echo esc_html( $feature->description() ); ?></p>
				</div>

				<?php if ( $steps ) : ?>
					<div class="adminkeep-explainer">
						<p class="adminkeep-explainer__title"><?php esc_html_e( 'What this does', 'adminkeep' ); ?></p>
						<ul>
							<?php foreach ( $steps as $step ) : ?>
								<li><?php echo esc_html( $step ); ?></li>
							<?php endforeach; ?>
						</ul>
					</div>
				<?php endif; ?>

				<?php $link = $this->panel_link_for( $feature, false ); ?>
				<?php if ( $link ) : ?>
					<?php // Always printed, hidden until the feature is saved as on: the screen it points at does not exist before that, and the script needs a slot to reveal after a save. ?>
					<p class="adminkeep-panel__link" data-role="panel-link"<?php echo $enabled ? '' : ' hidden'; ?>><a class="button" href="<?php echo esc_url( $link['url'] ); ?>"><?php echo esc_html( $link['label'] ); ?></a></p>
				<?php endif; ?>

				<?php if ( $schema ) : ?>
					<div class="adminkeep-settings" data-role="subsettings"<?php echo $enabled ? '' : ' hidden'; ?>>
						<h3 class="adminkeep-settings__title"><?php esc_html_e( 'Settings', 'adminkeep' ); ?></h3>

						<?php foreach ( $schema as $key => $spec ) : ?>
							<?php $this->render_field( $id, $key, $spec, isset( $resolved[ $key ] ) ? $resolved[ $key ] : null, $feature ); ?>
						<?php endforeach; ?>
					</div>
				<?php endif; ?>

				<?php if ( $this->has_actions( $feature ) ) : ?>
					<?php
					/*
					 * Maintenance actions are deliberately outside the enable-gated block.
					 * Clearing out spam is housekeeping you may want whether or not comments are
					 * switched off — gating it behind the feature would hide a tool from exactly
					 * the person still running comments and drowning in spam.
					 */
					?>
					<div class="adminkeep-tools">
						<h3 class="adminkeep-settings__title"><?php esc_html_e( 'Maintenance', 'adminkeep' ); ?></h3>
						<?php $this->render_actions( $feature ); ?>
					</div>
				<?php endif; ?>

				<div class="adminkeep-panel__foot">
					<button type="submit" class="button button-primary adminkeep-save" data-role="save">
						<span class="adminkeep-save__label"><?php esc_html_e( 'Save changes', 'adminkeep' ); ?></span>
						<span class="adminkeep-save__spinner" aria-hidden="true"></span>
					</button>
					<span class="adminkeep-dirty" data-role="dirty" hidden><?php esc_html_e( 'Unsaved changes', 'adminkeep' ); ?></span>
				</div>
			</form>
		</section>
		<?php
	}

	/**
	 * Render one field.
	 *
	 * @param string              $feature_id Feature id.
	 * @param string              $key        Field key.
	 * @param array               $spec       Schema entry.
	 * @param mixed               $value      Current value.
	 * @param \Adminkeep\Feature $feature    Feature.
	 * @return void
	 */
	private function render_field( $feature_id, $key, array $spec, $value, $feature ) {
		$ui    = isset( $spec['ui'] ) ? $spec['ui'] : '';
		$label = $feature->field_label( $key );
		$name  = sprintf( 'adminkeep[%s][%s]', $feature_id, $key );

		if ( '' === $label ) {
			$label = $key;
		}

		if ( 'status' === $ui ) {
			$this->render_status( $feature, $label );
			return;
		}

		echo '<div class="adminkeep-field">';

		switch ( $ui ) {

			case 'post_types':
				$this->render_choices_field( $name, $label, $value, $this->public_post_types() );
				break;

			case 'taxonomies':
				$this->render_choices_field( $name, $label, $value, $this->public_taxonomies() );
				break;

			case 'post_types_flat':
				$this->render_choices_field( $name, $label, $value, $this->flat_post_types() );
				break;

			case 'taxonomies_flat':
				$this->render_choices_field( $name, $label, $value, $this->flat_taxonomies() );
				break;

			case 'radio':
				$this->render_radio_field( $name, $label, $value, $spec, $key, $feature );
				break;

			default:
				if ( isset( $spec['type'] ) && 'bool' === $spec['type'] ) {
					printf(
						'<label><input type="checkbox" name="%s" value="1" %s /> %s</label>',
						esc_attr( $name ),
						checked( (bool) $value, true, false ),
						esc_html( $label )
					);
				} else {
					printf(
						'<label class="adminkeep-field__label" for="%1$s">%2$s</label><input type="text" id="%1$s" name="%3$s" value="%4$s" class="regular-text" />',
						esc_attr( $feature_id . '-' . $key ),
						esc_html( $label ),
						esc_attr( $name ),
						esc_attr( is_scalar( $value ) ? (string) $value : '' )
					);
				}
		}

		echo '</div>';
	}


	/**
	 * Public post types, as slug => label.
	 *
	 * Resolved here rather than in settings_schema(): that runs on plugins_loaded and post types
	 * are not registered until init. Same reason field labels are resolved at render time.
	 *
	 * @return array
	 */
	private function public_post_types() {
		$choices = array();

		$public_types = get_post_types(
			array(
				'public'  => true,
				'show_ui' => true,
			),
			'objects'
		);

		foreach ( $public_types as $type ) {
			if ( 'attachment' === $type->name ) {
				continue;
			}

			$choices[ $type->name ] = $type->labels->name;
		}

		return $choices;
	}

	/**
	 * Public taxonomies, as slug => label.
	 *
	 * @return array
	 */
	private function public_taxonomies() {
		$choices = array();

		$public_taxonomies = get_taxonomies(
			array(
				'public'  => true,
				'show_ui' => true,
			),
			'objects'
		);

		foreach ( $public_taxonomies as $taxonomy ) {
			$choices[ $taxonomy->name ] = $taxonomy->labels->name;
		}

		return $choices;
	}

	/**
	 * Non-hierarchical public post types, as slug => label.
	 *
	 * Order-only. Duplicate keeps public_post_types(), because duplicating a Page is meaningful
	 * while flat-ordering one is not.
	 *
	 * @return array
	 */
	private function flat_post_types() {
		$choices = array();

		$types = get_post_types(
			array(
				'public'       => true,
				'show_ui'      => true,
				'hierarchical' => false,
			),
			'objects'
		);

		foreach ( $types as $type ) {
			if ( 'attachment' === $type->name ) {
				continue;
			}

			$choices[ $type->name ] = $type->labels->name;
		}

		return $choices;
	}

	/**
	 * Non-hierarchical public taxonomies, as slug => label.
	 *
	 * @return array
	 */
	private function flat_taxonomies() {
		$choices = array();

		$taxonomies = get_taxonomies(
			array(
				'public'       => true,
				'show_ui'      => true,
				'hierarchical' => false,
			),
			'objects'
		);

		foreach ( $taxonomies as $taxonomy ) {
			$choices[ $taxonomy->name ] = $taxonomy->labels->name;
		}

		return $choices;
	}

	/**
	 * Render a checkbox per choice.
	 *
	 * @param string $name    Field name, e.g. adminkeep[duplicate][post_types].
	 * @param string $label   Field label.
	 * @param mixed  $value   Current value.
	 * @param array  $choices Available choices, slug => label.
	 * @return void
	 */
	private function render_choices_field( $name, $label, $value, array $choices ) {
		$selected = is_array( $value ) ? $value : array();

		printf( '<span class="adminkeep-field__label">%s</span>', esc_html( $label ) );

		// Unchecking every box would otherwise drop the key from the payload entirely, and an
		// absent value falls back to the schema default — making "none" impossible to save. The
		// empty entry is filtered out by the array sanitizer.
		printf( '<input type="hidden" name="%s[]" value="" />', esc_attr( $name ) );

		echo '<div class="adminkeep-field__choices">';

		foreach ( $choices as $slug => $choice_label ) {
			printf(
				'<label><input type="checkbox" name="%s[]" value="%s" %s /> %s</label>',
				esc_attr( $name ),
				esc_attr( $slug ),
				checked( in_array( (string) $slug, $selected, true ), true, false ),
				esc_html( $choice_label )
			);
		}

		echo '</div>';
	}

	/**
	 * One radio per declared choice.
	 *
	 * The allowed values come from the schema's 'choices' (which SettingsWriter::sanitize_field()
	 * also enforces); the labels come from the feature's field_choices(), which runs at render
	 * time and may translate. A choice the feature gives no label for is shown by its value.
	 *
	 * @param string              $name    Input name.
	 * @param string              $label   Field label.
	 * @param mixed               $value   Current value.
	 * @param array               $spec    Schema entry.
	 * @param string              $key     Field key.
	 * @param \Adminkeep\Feature $feature Feature.
	 * @return void
	 */
	private function render_radio_field( $name, $label, $value, array $spec, $key, $feature ) {
		$choices = isset( $spec['choices'] ) && is_array( $spec['choices'] ) ? $spec['choices'] : array();
		$labels  = method_exists( $feature, 'field_choices' ) ? (array) $feature->field_choices( $key ) : array();
		$current = is_scalar( $value ) ? (string) $value : '';

		printf( '<span class="adminkeep-field__label">%s</span>', esc_html( $label ) );

		echo '<div class="adminkeep-field__choices">';

		foreach ( $choices as $choice ) {
			$choice = (string) $choice;

			printf(
				'<label><input type="radio" name="%s" value="%s" %s /> %s</label>',
				esc_attr( $name ),
				esc_attr( $choice ),
				checked( $choice, $current, false ),
				esc_html( isset( $labels[ $choice ] ) ? $labels[ $choice ] : $choice )
			);
		}

		echo '</div>';
	}

	/**
	 * Render a feature's read-only status table.
	 *
	 * The feature declares its own columns. It used to be hardcoded to one feature's column
	 * shape, which meant another feature's rows rendered under the wrong headings and were
	 * labelled with meaning that did not apply to them. One feature's data in another's table.
	 *
	 * Expected shape:
	 *   array(
	 *     'columns' => array( 'When', 'Username' ),
	 *     'rows'    => array( array( '2026-08-06', array( 'text' => 'bob', 'tone' => 'mono' ) ) ),
	 *     'empty'   => 'Nothing yet.',
	 *   )
	 *
	 * @param \Adminkeep\Feature $feature Feature.
	 * @param string              $label   Section label.
	 * @return void
	 */
	private function render_status( $feature, $label ) {
		if ( ! method_exists( $feature, 'status' ) ) {
			return;
		}

		$status  = (array) $feature->status();
		$columns = isset( $status['columns'] ) ? (array) $status['columns'] : array();
		$rows    = isset( $status['rows'] ) ? (array) $status['rows'] : array();
		$empty   = isset( $status['empty'] ) ? (string) $status['empty'] : __( 'Nothing to show yet.', 'adminkeep' );

		echo '<div class="adminkeep-field"><span class="adminkeep-field__label">' . esc_html( $label ) . '</span>';

		if ( ! $rows || ! $columns ) {
			echo '<p class="description">' . esc_html( $empty ) . '</p></div>';
			return;
		}

		echo '<table class="widefat striped adminkeep-status"><thead><tr>';

		foreach ( $columns as $heading ) {
			echo '<th>' . esc_html( $heading ) . '</th>';
		}

		echo '</tr></thead><tbody>';

		foreach ( $rows as $row ) {
			echo '<tr>';

			foreach ( (array) $row as $cell ) {
				$text = is_array( $cell ) && isset( $cell['text'] ) ? $cell['text'] : $cell;
				$tone = is_array( $cell ) && isset( $cell['tone'] ) ? $cell['tone'] : '';

				printf(
					'<td class="%s">%s</td>',
					esc_attr( $tone ? 'adminkeep-cell--' . $tone : '' ),
					esc_html( (string) $text )
				);
			}

			echo '</tr>';
		}

		echo '</tbody></table></div>';
	}

}