<?php
/**
 * Permanently deletes comments.
 *
 * The one place in this plugin that destroys data, so it is deliberately narrow on two axes:
 *
 * 1. **Status.** Only comments already marked spam or already in the trash, unless the user
 *    explicitly opts in to approved and pending ones. 'post-trashed' is never in scope — those
 *    come back when their post is restored, so deleting them would destroy data silently.
 *
 * 2. **Type.** Only things that are actually comments. WordPress's comments table is used as
 *    general-purpose storage by plugins: WooCommerce keeps **order notes** in it, and on a real
 *    store they vastly outnumber the real comments. Deleting those would wipe order history.
 *    So the type scope is an **allowlist**, not a blocklist — an unrecognised comment type from
 *    some plugin's logging is never touched, because we cannot know what it is.
 *
 * It is never automatic, never a side effect of enabling a feature, and never runs without an
 * explicit confirmed click.
 *
 * @package Adminkeep
 */

namespace Adminkeep\Service;

defined( 'ABSPATH' ) || exit;

/**
 * Counts and batch-deletes comments, scoped by status and by type.
 */
class CommentPurger {

	/**
	 * Statuses deleted by default: junk the user has already rejected.
	 *
	 * @var string[]
	 */
	const DEFAULT_STATUSES = array( 'spam', 'trash' );

	/**
	 * Statuses added when the user explicitly ticks "include approved".
	 *
	 * Pending comments come along, because leaving them behind after asking to delete real
	 * comments would be its own surprise.
	 *
	 * @var string[]
	 */
	const APPROVED_STATUSES = array( '1', '0' );

	/**
	 * Comment types that are genuinely comments.
	 *
	 * '' is what classic WordPress stored; 'comment' is what it stores since 5.5.
	 *
	 * @var string[]
	 */
	const USER_TYPES = array( '', 'comment', 'pingback', 'trackback' );

	/**
	 * WooCommerce's own uses of the comments table, opt-in only.
	 *
	 * `order_note` is order history. `webhook_delivery` is a delivery log. `review` is a
	 * customer product review, which Woo keeps out of the Comments screen entirely.
	 *
	 * @var string[]
	 */
	const WOO_TYPES = array( 'order_note', 'webhook_delivery', 'review' );

	/**
	 * How many comments to delete per request.
	 *
	 * Small enough that a site with 200k comments does not time out; large enough that the
	 * redirect loop finishes in a sane number of round trips.
	 */
	const BATCH_SIZE = 200;

	/**
	 * Whether WooCommerce is running.
	 *
	 * @return bool
	 */
	public static function woocommerce_active() {
		return class_exists( 'WooCommerce' );
	}

	/**
	 * The statuses in scope.
	 *
	 * @param bool $include_approved Whether to include approved and pending comments.
	 * @return string[]
	 */
	public static function statuses( $include_approved = false ) {
		if ( $include_approved ) {
			return array_merge( self::DEFAULT_STATUSES, self::APPROVED_STATUSES );
		}

		return self::DEFAULT_STATUSES;
	}

	/**
	 * The comment types in scope.
	 *
	 * @param bool $include_woo Whether to include WooCommerce's entries.
	 * @return string[]
	 */
	public static function types( $include_woo = false ) {
		if ( $include_woo ) {
			return array_merge( self::USER_TYPES, self::WOO_TYPES );
		}

		return self::USER_TYPES;
	}

	/**
	 * The WHERE clause for the current scope, paired with the values it binds.
	 *
	 * The fragment comes back unprepared on purpose. Preparing it here and then interpolating it
	 * into a larger query that is prepared again runs $wpdb->prepare() over already-prepared SQL,
	 * where any surviving % is re-read as a placeholder. One prepare per query, at the call site.
	 *
	 * The scope is built from class constants, never from request data; only the generated %s
	 * slots vary, and every value is bound.
	 *
	 * @param bool $include_approved Whether to include approved and pending comments.
	 * @param bool $include_woo      Whether to include WooCommerce's entries.
	 * @return array SQL fragment first, its ordered values second.
	 */
	private static function scope_sql( $include_approved, $include_woo ) {
		$statuses = self::statuses( $include_approved );
		$types    = self::types( $include_woo );

		$status_slots = implode( ', ', array_fill( 0, count( $statuses ), '%s' ) );
		$type_slots   = implode( ', ', array_fill( 0, count( $types ), '%s' ) );

		return array(
			"comment_approved IN ( {$status_slots} ) AND comment_type IN ( {$type_slots} )",
			array_merge( $statuses, $types ),
		);
	}

	/**
	 * How many comments are in scope.
	 *
	 * A dry-run count. Mutates nothing.
	 *
	 * @param bool $include_approved Whether to include approved and pending comments.
	 * @param bool $include_woo      Whether to include WooCommerce's entries.
	 * @return int
	 */
	public static function count( $include_approved = false, $include_woo = false ) {
		global $wpdb;

		list( $where, $values ) = self::scope_sql( $include_approved, $include_woo );

		// A live count for a destructive screen: caching it would offer to delete a number that
		// is no longer true. $where carries placeholders only; $values are bound by prepare().
		// UnfinishedPrepare fires because every placeholder lives inside $where rather than in the
		// literal string, so the sniff sees values with nothing to bind to.
		// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
		return (int) $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$wpdb->comments} WHERE {$where}", $values ) );
	}

	/**
	 * Every count the settings screen needs, so the UI never has to guess.
	 *
	 * @return array
	 */
	public static function counts() {
		return array(
			'spamTrash'    => self::count( false, false ),
			'all'          => self::count( true, false ),
			'spamTrashWoo' => self::count( false, true ),
			'allWoo'       => self::count( true, true ),
			'wooActive'    => self::woocommerce_active(),
		);
	}

	/**
	 * Delete one batch, permanently.
	 *
	 * Uses wp_delete_comment() with force, so comment meta goes too and post comment counts are
	 * kept correct — deleting the rows directly would leave both behind.
	 *
	 * @param int  $limit            Maximum comments to delete.
	 * @param bool $include_approved Whether to include approved and pending comments.
	 * @param bool $include_woo      Whether to include WooCommerce's entries.
	 * @return int How many were deleted.
	 */
	public static function delete_batch( $limit = self::BATCH_SIZE, $include_approved = false, $include_woo = false ) {
		global $wpdb;

		$limit = max( 1, (int) $limit );

		list( $where, $values ) = self::scope_sql( $include_approved, $include_woo );

		$values[] = $limit;

		// Selecting the batch to hand to wp_delete_comment(); there is no cacheable result here,
		// and the rows are gone immediately after. Every value is bound by the prepare().
		// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
		$ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM {$wpdb->comments} WHERE {$where} LIMIT %d", $values ) );

		if ( ! $ids ) {
			return 0;
		}

		$deleted = 0;

		foreach ( $ids as $comment_id ) {
			if ( wp_delete_comment( (int) $comment_id, true ) ) {
				++$deleted;
			}
		}

		return $deleted;
	}
}