<?php
// Standard WP check if direct
defined( 'ABSPATH' ) || exit;

// settings export file
function inspry_toolkit_process_settings_export() {
	global $toolkit_performance_options, $toolkit_security_options, $toolkit_email_notification_options, $toolkit_options;

	if ( ! isset( $_POST['agency_toolkit_export'] ) ) {
		return;
	}

	// Capability + nonce. Both forms live on the plugin settings page only.
	if ( ! current_user_can( 'manage_options' ) ) {
		return;
	}
	if ( ! isset( $_POST['agency_toolkit_export_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['agency_toolkit_export_nonce'] ) ), 'agency_toolkit_export' ) ) {
		wp_die( esc_html__( 'Security check failed. Please go back and try again.', 'agency-toolkit' ) );
	}

	$export_data = array();

	$toolkit_all_options = array_merge( $toolkit_options, $toolkit_security_options, $toolkit_performance_options, $toolkit_email_notification_options );

	// Option Sub Fields
	$sub_option_array = array(
		// General TAB
		'inspry_toolkit_limit_admins'                 => array(
			'inspry_toolkit_limit_admins_list',
		),
		'inspry_toolkit_maintenance_mode'             => array(
			'inspry_toolkit_maintenance_mode_heading',
			'inspry_toolkit_maintenance_mode_sentence',
		),
		'inspry_toolkit_backend_footer'               => array(
			'inspry_toolkit_backend_footer_agency_name',
			'inspry_toolkit_backend_footer_agency_url',
			'inspry_toolkit_backend_footer_agency_email',
		),
		'inspry_toolkit_backend_logo'                 => array(
			'inspry_toolkit_backend_logo_image',
		),
		'inspry_toolkit_manage_environment_indicator' => array(
			'inspry_toolkit_development_environment_user_list',
			'inspry_toolkit_development_environment_host_name',
			'inspry_toolkit_manage_development_environment_banner_color',
		),
		'inspry_toolkit_control_wp_core_updates'      => array(
			'inspry_toolkit_wp_core_updates_option',
		),

		// Security TAB
		'inspry_toolkit_disable_installs_and_updates' => array(
			'inspry_toolkit_disable_installs_and_updates_list',
		),
		'inspry_toolkit_remove_site_health'           => array(
			'inspry_toolkit_remove_site_health_user_list',
		),
		'inspry_toolkit_checksum_verification_for_wordpress_core_files' => array(
			'inspry_toolkit_checksum_verification_for_wordpress_core_files_email_send',
		),
		'inspry_toolkit_limit_users_modify_admin_email' => array(
			'inspry_toolkit_limit_users_modify_admin_email_user_list',
		),
		'inspry_toolkit_disable_admin_notice'         => array(
			'inspry_toolkit_disable_admin_notice_user_list',
		),

		// Performance TAB
		'inspry_toolkit_limit_post_revisions'         => array(
			'inspry_toolkit_limit_post_revisions_number',
		),

		// Email Notifications TAB
		'inspry_toolkit_change_email_sender'          => array(
			'inspry_toolkit_change_email_sender_address',
			'inspry_toolkit_change_email_sender_name',
		),
		'inspry_toolkit_change_user_notifications_email' => array(
			'inspry_toolkit_change_user_notifications_email_sender',
		),
		'inspry_toolkit_enable_plugin_update_admin_notifications' => array(
			'inspry_toolkit_enable_plugin_update_admin_notifications_list',
			'inspry_toolkit_enable_plugin_update_admin_notifications_plugin_list',
		),
		// 'inspry_toolkit_comment_notification_recipients' has a sub-field
		// (_list) that is deliberately NOT exported and skipped on import: it holds one client's inbox,
		// and importing it elsewhere would mail that site's comments, with commenter
		// names, emails and IPs, to the wrong client. The toggle still exports; an
		// imported site gets the setting on with an empty list, which keeps
		// WordPress's own recipients until the list is filled in on that site.
	);

	// EXPORT: option value
	foreach ( $toolkit_all_options as $option ) {
		$option_name  = 'inspry_toolkit_' . $option['name'];
		$option_value = get_option( $option_name );

		if ( $option_value ) {
			$export_data[] = array(
				'option_name'  => $option_name,
				'option_value' => $option_value,
			);

			// Option Have sub field
			if ( array_key_exists( $option_name, $sub_option_array ) ) {

				$option_sub_field_name = $sub_option_array[ $option_name ];

				$sub_field_value = array();
				foreach ( $option_sub_field_name  as $sub_field_name ) {

					if (
						$sub_field_name == 'inspry_toolkit_limit_admins_list'
						|| $sub_field_name == 'inspry_toolkit_development_environment_user_list'
						|| $sub_field_name == 'inspry_toolkit_disable_installs_and_updates_list'
						|| $sub_field_name == 'inspry_toolkit_remove_site_health_user_list'
						|| $sub_field_name == 'inspry_toolkit_limit_users_modify_admin_email_user_list'
						|| $sub_field_name == 'inspry_toolkit_disable_admin_notice_user_list'
						|| $sub_field_name == 'inspry_toolkit_enable_plugin_update_admin_notifications_list'
					) {

						$user_info = array();

						$user_ids = get_option( $sub_field_name );

						if ( ! empty( $user_ids ) ) {
							foreach ( $user_ids as $user_id ) {
								$user_info = get_userdata( $user_id );

								if ( $user_info ) {
									$sub_field_value[] = $user_info->user_login;
								}
							}
						}
					} else {
						$sub_field_value = get_option( $sub_field_name );
					}

					$export_data[] = array(
						'option_name'  => $sub_field_name,
						'option_value' => $sub_field_value,
					);
				}
			}
		}
	}

	$json = json_encode( $export_data );
	header( 'Content-disposition: attachment; filename=agency-toolkit.json' );
	header( 'Content-type: application/json' );
	file_put_contents( 'php://output', $json );
	exit;
}
add_action( 'init', 'inspry_toolkit_process_settings_export' );

// settings import file
function inspry_toolkit_import_options_settings() {

	if ( ! isset( $_POST['agency_toolkit_import'] ) ) {
		return;
	}

	// Capability + nonce. Without the nonce this handler is reachable by CSRF
	// from any page, since it is hooked to init.
	if ( ! current_user_can( 'manage_options' ) ) {
		return;
	}
	if ( ! isset( $_POST['agency_toolkit_import_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['agency_toolkit_import_nonce'] ) ), 'agency_toolkit_import' ) ) {
		wp_die( esc_html__( 'Security check failed. Please go back and try again.', 'agency-toolkit' ) );
	}

	// Make sure a file actually arrived before touching it
	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- a server-side temp path, checked with is_uploaded_file(), never stored or output.
	if ( empty( $_FILES['import_file']['tmp_name'] ) || ! is_uploaded_file( $_FILES['import_file']['tmp_name'] ) ) {
		return;
	}

	// Get the file and decode JSON
	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- the temp path verified just above.
	$filename        = file_get_contents( $_FILES['import_file']['tmp_name'] );
	$option_settings = json_decode( $filename );

	if ( ! is_array( $option_settings ) ) {
		return;
	}

	// Loop through the options in the file
	foreach ( $option_settings as $option ) {

		if ( ! is_object( $option ) || ! isset( $option->option_name ) || ! is_string( $option->option_name ) ) {
			continue;
		}

		// Site-specific values that must never travel between sites, whatever the file says.
		if ( 'inspry_toolkit_comment_notification_recipients_list' === $option->option_name ) {
			continue;
		}

		// Check if option is an admin selectable option
		if (
			$option->option_name == 'inspry_toolkit_limit_admins_list'
			|| $option->option_name == 'inspry_toolkit_development_environment_user_list'
			|| $option->option_name == 'inspry_toolkit_disable_installs_and_updates_list'
			|| $option->option_name == 'inspry_toolkit_remove_site_health_user_list'
			|| $option->option_name == 'inspry_toolkit_limit_users_modify_admin_email_user_list'
			|| $option->option_name == 'inspry_toolkit_disable_admin_notice_user_list'
			|| $option->option_name == 'inspry_toolkit_enable_plugin_update_admin_notifications_list'
		) {

			// Exports carry user logins; resolve them to local IDs, admins only.
			$user_logins = is_array( $option->option_value ) ? $option->option_value : array();
			$user_ids    = array();

			foreach ( $user_logins as $user_login ) {
				if ( ! is_string( $user_login ) ) {
					continue;
				}
				$user = get_user_by( 'login', $user_login );
				if ( $user && in_array( 'administrator', (array) $user->roles, true ) ) {
					$user_ids[] = $user->ID;
				}
			}
			if ( empty( $user_ids ) ) {
				continue;
			}
			$option->option_value = $user_ids;
		}

		// Get option name
		$option_name = $option->option_name;

		// Make sure option name has "inspry_toolkit_" prefix
		if ( strpos( $option_name, 'inspry_toolkit_' ) === 0 ) {
			// Update the option
			update_option( $option_name, $option->option_value );
		}
	}
}
add_action( 'init', 'inspry_toolkit_import_options_settings' );