<?php
/** Capability- and nonce-protected admin workflow; one expiring report per user. */
namespace AdParityLite;

defined( 'ABSPATH' ) || exit;

final class Admin {
	private const CAP = 'manage_woocommerce';
	private const TTL = DAY_IN_SECONDS;

	public function register(): void {
		add_action( 'admin_menu', array( $this, 'menu' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'assets' ) );
		foreach ( array( 'upload', 'step', 'clear' ) as $action ) {
			add_action( 'admin_post_adparitylite_' . $action, array( $this, $action ) );
		}
		add_action( 'wp_ajax_adparitylite_step', array( $this, 'ajax_step' ) );
	}

	public function menu(): void {
		add_submenu_page( 'woocommerce', 'AdParity Lite', 'AdParity Lite', self::CAP, 'adparity-lite', array( $this, 'page' ) );
	}

	public function assets( string $hook ): void {
		if ( 'woocommerce_page_adparity-lite' !== $hook ) {
			return;
		}
		wp_enqueue_style( 'adparity-lite', plugins_url( 'assets/admin.css', FILE ), array(), VERSION );
		wp_enqueue_script( 'adparity-lite', plugins_url( 'assets/admin.js', FILE ), array(), VERSION, true );
		wp_localize_script(
			'adparity-lite',
			'adparityLiteAdmin',
			array(
				'url'     => admin_url( 'admin-ajax.php' ),
				'nonce'   => wp_create_nonce( 'adparity-lite' ),
				'working' => __( 'Checking…', 'adparity-lite' ),
				'failed'  => __( 'The batch stopped. Reload the page to resume; completed rows are saved.', 'adparity-lite' ),
			)
		);
	}

	private static function key(): string {
		return 'adparitylite_report_' . get_current_user_id();
	}

	private static function guard(): void {
		if ( ! current_user_can( self::CAP ) ) {
			wp_die( esc_html__( 'You cannot manage this store.', 'adparity-lite' ), '', array( 'response' => 403 ) );
		}
		if ( 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) && is_string( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '' ) ) {
			wp_die( esc_html__( 'Use a POST request for this action.', 'adparity-lite' ), '', array( 'response' => 405 ) );
		}
		check_admin_referer( 'adparity-lite' );
	}

	private static function ready(): bool {
		return ! is_multisite() && defined( 'WC_VERSION' ) && version_compare( WC_VERSION, '11.0', '>=' ) && function_exists( 'wc_get_product' );
	}

	private static function redirect(): void {
		wp_safe_redirect( admin_url( 'admin.php?page=adparity-lite' ) );
		exit;
	}

	private static function locked( callable $operation ) {
		$key      = 'adparitylite_lock_' . get_current_user_id();
		$existing = (int) get_option( $key, 0 );
		if ( $existing && $existing < time() - 60 ) {
			delete_option( $key );
		}
		if ( ! add_option( $key, time(), '', false ) ) {
			throw new \DomainException( __( 'Another batch is running. Wait a moment and reload.', 'adparity-lite' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception data is escaped at the admin HTML/JSON boundary.
		}
		try {
			return $operation();
		} finally {
			delete_option( $key );
		}
	}

	public function upload(): void {
		self::guard();
		try {
			self::locked(
				static function () {
					if ( ! self::ready() ) {
						throw new \DomainException( __( 'Use WooCommerce 11.0 or later on a single-site installation.', 'adparity-lite' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception data is escaped at the admin HTML/JSON boundary.
					}
					$file = $_FILES['feed'] ?? array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.NonceVerification.Missing -- Validated as a PHP upload; never moved to public storage.
					if ( ! is_array( $file ) || ! isset( $file['error'], $file['size'], $file['tmp_name'], $file['name'] ) || UPLOAD_ERR_OK !== $file['error'] || ! is_string( $file['tmp_name'] ) || ! is_string( $file['name'] ) || ! is_numeric( $file['size'] ) || $file['size'] > Feed::MAX_BYTES || ! is_uploaded_file( $file['tmp_name'] ) ) {
						throw new \DomainException( __( 'Upload failed. Check the 5 MiB limit and your PHP upload limits.', 'adparity-lite' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception data is escaped at the admin HTML/JSON boundary.
					}
					$extension = strtolower( pathinfo( sanitize_file_name( $file['name'] ), PATHINFO_EXTENSION ) );
					$data      = file_get_contents( $file['tmp_name'], false, null, 0, Feed::MAX_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Private PHP upload, bounded read.
					if ( false === $data ) {
						throw new \DomainException( __( 'The uploaded file could not be read.', 'adparity-lite' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception data is escaped at the admin HTML/JSON boundary.
					}
					$rows = Feed::parse( $data, $extension );
					$mode = isset( $_POST['mode'] ) && is_string( $_POST['mode'] ) ? sanitize_key( wp_unslash( $_POST['mode'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- All callers verify the nonce with guard() or check_ajax_referer() before reading input.
					if ( ! in_array( $mode, array( 'id', 'sku' ), true ) ) {
						throw new \DomainException( __( 'Choose an identifier mode.', 'adparity-lite' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception data is escaped at the admin HTML/JSON boundary.
					}
					$counts = array_count_values( array_column( $rows, 'id' ) );
					$report = array(
						'token'   => wp_generate_uuid4(),
						'created' => time(),
						'mode'    => $mode,
						'rows'    => $rows,
						'counts'  => $counts,
						'results' => array(),
						'cursor'  => 0,
					);
					set_transient( self::key(), $report, self::TTL );
				}
			);
		} catch ( \DomainException $exception ) {
			set_transient( 'adparitylite_error_' . get_current_user_id(), $exception->getMessage(), 120 );
		}
		self::redirect();
	}

	private static function process( string $token ): array {
		return self::locked(
			static function () use ( $token ) {
				$report = get_transient( self::key() );
				if ( ! self::ready() || ! $report || ! hash_equals( $report['token'], $token ) ) {
					throw new \DomainException( __( 'This audit expired or was replaced. Upload the feed again.', 'adparity-lite' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception data is escaped at the admin HTML/JSON boundary.
				}
				$audit = new Audit();
				$end   = min( count( $report['rows'] ), $report['cursor'] + 10 );
				while ( $report['cursor'] < $end ) {
					$row                 = $report['rows'][ $report['cursor'] ];
					$report['results'][] = $audit->row( $row, $report['mode'], $report['counts'][ $row['id'] ] > 1 );
					++$report['cursor'];
				}
				// Preserve the original retention deadline instead of extending it on every batch.
				set_transient( self::key(), $report, max( 1, $report['created'] + self::TTL - time() ) );
				return array(
					'done'  => $report['cursor'],
					'total' => count( $report['rows'] ),
				);
			}
		);
	}

	private static function token(): string {
		return isset( $_POST['token'] ) && is_string( $_POST['token'] ) ? sanitize_text_field( wp_unslash( $_POST['token'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- All callers verify the nonce with guard() or check_ajax_referer() before reading input.
	}

	public function ajax_step(): void {
		if ( ! current_user_can( self::CAP ) ) {
			wp_send_json_error( array( 'message' => __( 'You cannot manage this store.', 'adparity-lite' ) ), 403 );
		}
		if ( 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) && is_string( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '' ) ) {
			wp_send_json_error( array( 'message' => __( 'Use a POST request for this action.', 'adparity-lite' ) ), 405 );
		}
		check_ajax_referer( 'adparity-lite', 'nonce' );
		try {
			wp_send_json_success( self::process( self::token() ) );
		} catch ( \DomainException $exception ) {
			wp_send_json_error( array( 'message' => $exception->getMessage() ), 409 );
		}
	}

	public function step(): void {
		self::guard();
		try {
			self::process( self::token() );
		} catch ( \DomainException $exception ) {
			set_transient( 'adparitylite_error_' . get_current_user_id(), $exception->getMessage(), 120 );
		}
		self::redirect();
	}

	public function clear(): void {
		self::guard();
		try {
			self::locked(
				static function () {
					delete_transient( self::key() );
				}
			);
		} catch ( \DomainException $exception ) {
			set_transient( 'adparitylite_error_' . get_current_user_id(), $exception->getMessage(), 120 );
		}
		self::redirect();
	}

	private static function action_form( string $action, string $label, string $button_class = 'button', string $token = '' ): void {
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="ap-inline" <?php echo 'step' === $action ? 'id="ap-run"' : ''; ?>>
			<input type="hidden" name="action" value="<?php echo esc_attr( 'adparitylite_' . $action ); ?>">
			<input type="hidden" name="token" value="<?php echo esc_attr( $token ); ?>">
			<?php wp_nonce_field( 'adparity-lite' ); ?>
			<button class="<?php echo esc_attr( $button_class ); ?>"><?php echo esc_html( $label ); ?></button>
		</form>
		<?php
	}

	public function page(): void {
		if ( ! current_user_can( self::CAP ) ) {
			return;
		}
		$error_key = 'adparitylite_error_' . get_current_user_id();
		$error     = get_transient( $error_key );
		delete_transient( $error_key );
		$report = get_transient( self::key() );
		?>
		<div class="wrap ap-wrap">
			<header class="ap-header"><div><span class="ap-eyebrow">ADPARITY LITE / <?php echo esc_html( VERSION ); ?></span><h1><?php esc_html_e( 'Find the mismatch before the next feed upload.', 'adparity-lite' ); ?></h1><p><?php esc_html_e( 'Compare your uploaded Merchant feed with WooCommerce simple products in one read-only audit.', 'adparity-lite' ); ?></p></div><span class="ap-local"><?php esc_html_e( 'Local feed comparison', 'adparity-lite' ); ?></span></header>
			<?php
			if ( $error ) :
				?>
				<div class="notice notice-error" role="alert"><p><?php echo esc_html( $error ); ?></p></div><?php endif; ?>
			<?php if ( ! self::ready() ) : ?>
				<div class="notice notice-error"><p><?php esc_html_e( 'Use WooCommerce 11.0 or later on a single-site installation.', 'adparity-lite' ); ?></p></div>
			<?php else : ?>
			<section class="ap-panel"><h2><?php esc_html_e( 'Start an audit', 'adparity-lite' ); ?></h2>
			<form method="post" enctype="multipart/form-data" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
				<input type="hidden" name="action" value="adparitylite_upload"><?php wp_nonce_field( 'adparity-lite' ); ?>
				<div class="ap-inputs"><div><label for="ap-feed"><?php esc_html_e( 'Merchant feed file', 'adparity-lite' ); ?></label><input id="ap-feed" type="file" name="feed" accept=".xml,.csv,.tsv" required><p class="description"><?php esc_html_e( 'UTF-8 XML / CSV / TSV · 5 MiB · 300 items maximum', 'adparity-lite' ); ?></p></div>
				<div><label for="ap-mode"><?php esc_html_e( 'Match products by', 'adparity-lite' ); ?></label><select id="ap-mode" name="mode"><option value="sku" <?php selected( $report['mode'] ?? 'sku', 'sku' ); ?>><?php esc_html_e( 'SKU (sku column, otherwise id)', 'adparity-lite' ); ?></option><option value="id" <?php selected( $report['mode'] ?? 'sku', 'id' ); ?>><?php esc_html_e( 'WooCommerce product ID', 'adparity-lite' ); ?></option></select><p class="description"><?php esc_html_e( 'Choose explicitly. Prefixed Merchant IDs are not guessed.', 'adparity-lite' ); ?></p></div></div>
				<p><button class="button button-primary"><?php esc_html_e( 'Upload and prepare audit', 'adparity-lite' ); ?></button></p>
			</form></section>
			<?php endif; ?>
			<?php
			if ( $report ) :
				$total  = count( $report['rows'] );
				$counts = array_count_values( array_column( $report['results'], 'status' ) );
				?>
				<section class="ap-results"><div class="ap-result-heading"><div><h2><?php echo $report['cursor'] === $total ? esc_html__( 'Audit complete', 'adparity-lite' ) : esc_html__( 'Audit prepared', 'adparity-lite' ); ?></h2><p><?php echo esc_html( gmdate( 'Y-m-d H:i', $report['created'] ) . ' UTC · ' . $report['mode'] ); ?> · <?php esc_html_e( 'Feed comparison', 'adparity-lite' ); ?></p></div><div><?php self::action_form( 'clear', __( 'Delete report', 'adparity-lite' ) ); ?></div></div>
				<div class="ap-summary"><div><strong><?php echo esc_html( $report['cursor'] . ' / ' . $total ); ?></strong><span><?php esc_html_e( 'Items checked', 'adparity-lite' ); ?></span></div><div><strong><?php echo esc_html( $counts['error'] ?? 0 ); ?></strong><span><?php esc_html_e( 'With discrepancies', 'adparity-lite' ); ?></span></div><div><strong><?php echo esc_html( $counts['review'] ?? 0 ); ?></strong><span><?php esc_html_e( 'Need review', 'adparity-lite' ); ?></span></div><div><strong><?php echo esc_html( $counts['checked'] ?? 0 ); ?></strong><span><?php esc_html_e( 'No discrepancy found', 'adparity-lite' ); ?></span></div></div>
				<?php if ( $report['cursor'] < $total ) : ?>
					<p id="ap-progress" role="status" aria-live="polite"></p><?php self::action_form( 'step', __( 'Run / continue audit', 'adparity-lite' ), 'button button-primary', $report['token'] ); ?><noscript><p><?php esc_html_e( 'JavaScript is disabled. Continue runs one small batch; repeat until complete.', 'adparity-lite' ); ?></p></noscript>
				<?php endif; ?>
				<p class="description"><?php esc_html_e( 'A snapshot of the uploaded feed, not Google approval. Lite checks simple products only; public pages and JSON-LD are not inspected. Reports expire after 24 hours.', 'adparity-lite' ); ?></p>
				<?php $this->results( $report ); ?>
				</section>
			<?php endif; ?>
			<section class="ap-panel ap-about"><h2><?php esc_html_e( 'Need public-page or variation checks?', 'adparity-lite' ); ?></h2><p><?php esc_html_e( 'The separate full version adds individual variation checks, public JSON-LD comparison and CSV report export. Lite keeps working without a purchase.', 'adparity-lite' ); ?></p><a class="button" href="https://payhip.com/b/zgUKd" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Compare the full version on Payhip', 'adparity-lite' ); ?></a></section>
			<footer class="ap-footer"><p><?php esc_html_e( 'Scope: simple products; store base currency and configured tax display. No order or customer data is read. Lite sends no feed or store data to AdParity or Google and makes no external network requests.', 'adparity-lite' ); ?></p></footer>
		</div>
		<?php
	}

	private function results( array $report ): void {
		$filter  = isset( $_GET['ap_status'] ) && is_string( $_GET['ap_status'] ) ? sanitize_key( wp_unslash( $_GET['ap_status'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter.
		$results = array_values( array_filter( $report['results'], static fn( $r ) => ! in_array( $filter, array( 'error', 'review', 'checked' ), true ) || $r['status'] === $filter ) );
		$page    = isset( $_GET['ap_page'] ) && is_scalar( $_GET['ap_page'] ) ? max( 1, absint( $_GET['ap_page'] ) ) : 1; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only pagination.
		?>
		<form method="get" class="ap-filter"><input type="hidden" name="page" value="adparity-lite"><label for="ap-filter"><?php esc_html_e( 'Show', 'adparity-lite' ); ?></label> <select id="ap-filter" name="ap_status">
		<?php
		foreach ( array(
			''        => __( 'All items', 'adparity-lite' ),
			'error'   => __( 'Discrepancies', 'adparity-lite' ),
			'review'  => __( 'Need review', 'adparity-lite' ),
			'checked' => __( 'No discrepancy found', 'adparity-lite' ),
		) as $value => $label ) :
			?>
																															<option value="<?php echo esc_attr( $value ); ?>" <?php selected( $filter, $value ); ?>><?php echo esc_html( $label ); ?></option><?php endforeach; ?>
		</select> <button class="button"><?php esc_html_e( 'Filter', 'adparity-lite' ); ?></button></form>
		<?php if ( ! $results ) : ?>
		<p class="ap-empty" role="status"><?php echo $report['results'] ? esc_html__( 'No items match this filter.', 'adparity-lite' ) : esc_html__( 'Run the audit to see results.', 'adparity-lite' ); ?></p>
			<?php
			return;
endif;
		?>
		<div class="ap-table-scroll" tabindex="0" role="region" aria-label="<?php esc_attr_e( 'Audit results', 'adparity-lite' ); ?>"><table class="widefat striped ap-table"><thead><tr><th><?php esc_html_e( 'Item', 'adparity-lite' ); ?></th><th><?php esc_html_e( 'WooCommerce', 'adparity-lite' ); ?></th><th><?php esc_html_e( 'Active feed value', 'adparity-lite' ); ?></th><th><?php esc_html_e( 'Findings and next step', 'adparity-lite' ); ?></th></tr></thead><tbody>
		<?php foreach ( array_slice( $results, ( $page - 1 ) * 50, 50 ) as $row ) : ?>
		<tr><td><strong><?php echo esc_html( $row['id'] ); ?></strong><br><span class="ap-badge ap-<?php echo esc_attr( $row['status'] ); ?>"><?php echo 'error' === $row['status'] ? esc_html__( 'Discrepancy', 'adparity-lite' ) : ( 'review' === $row['status'] ? esc_html__( 'Review', 'adparity-lite' ) : esc_html__( 'Checked', 'adparity-lite' ) ); ?></span>
			<?php
			if ( $row['product_id'] ) :
				?>
			<br>#<?php echo esc_html( $row['product_id'] ); ?><?php endif; ?></td>
		<td>
			<?php
			if ( $row['woo'] ) :
				echo esc_html( $row['woo']['price'] . ' ' . $row['woo']['currency'] );
				?>
			<br><?php echo esc_html( $row['woo']['availability'] ); ?><br><small><?php echo esc_html( $row['woo']['sku'] ); ?></small><?php endif; ?></td>
		<td><?php echo esc_html( ( $row['active_price']['amount'] ?? '?' ) . ' ' . ( $row['active_price']['currency'] ?? '?' ) ); ?><br><?php echo esc_html( $row['feed']['availability'] ); ?></td>

		<td>
			<?php
			foreach ( $row['findings'] as $finding ) :
				?>
			<div class="ap-finding"><code><?php echo esc_html( $finding['code'] ); ?></code><p><?php echo esc_html( $finding['message'] ); ?></p><p class="ap-fix"><?php echo esc_html( $finding['fix'] ); ?></p></div><?php endforeach; ?>
			<?php
			if ( ! $row['findings'] ) :
						esc_html_e( 'No discrepancy found in the checks performed.', 'adparity-lite' );
endif;
			?>
</td></tr>
		<?php endforeach; ?>
		</tbody></table></div>
		<nav class="ap-pagination" aria-label="<?php esc_attr_e( 'Report pages', 'adparity-lite' ); ?>">
		<?php
		$page_count = (int) ceil( count( $results ) / 50 );
		for ( $i = 1; $i <= $page_count; ++$i ) :
			?>
			<a class="button" <?php echo $i === $page ? 'aria-current="page"' : ''; ?> href="
			<?php
			echo esc_url(
				add_query_arg(
					array(
						'page'      => 'adparity-lite',
						'ap_status' => $filter,
						'ap_page'   => $i,
					),
					admin_url( 'admin.php' )
				)
			);
			?>
			"><?php echo esc_html( $i ); ?></a> <?php endfor; ?></nav>
		<?php
	}
}