<?php
/**
 * Detect an OpenAI/ChatGPT Ads pixel already present on the store — ours or,
 * far more likely, somebody else's.
 *
 * WHY DETECTION COMES BEFORE INSTALLATION
 * ---------------------------------------
 * Pixel Manager (50,000 installs) already ships an OpenAI pixel with CAPI in its
 * Pro tier. AdTribes and CTX Feed own the feed lane at 80,000 and 70,000. A
 * merchant running one of those has no reason to install a second pixel, and
 * asking them to is how you earn a one-star review about double-counted
 * conversions.
 *
 * So we verify theirs. That turns three incumbents from competitors into a
 * compatibility list, and it is the one thing none of them does: they install
 * and hope. It is also the hedge if the platform ever ships a native pixel —
 * a native launch becomes a lead source ("is it actually firing?") rather than
 * an extinction event.
 *
 * ⛔ This class NEVER writes to the storefront and never makes an outbound
 * request. It inspects registered scripts and, at most, the store's own
 * front-page HTML fetched locally via WordPress' HTTP API against our own site.
 *
 * @package AgenticCommerceForWooCommerce
 */

defined( 'ABSPATH' ) || exit;

/**
 * Class Xpay_Pixel_Detect.
 */
class Xpay_Pixel_Detect {

	const CACHE_KEY = 'xpay_wc_pixel_detect';
	const CACHE_TTL = 6 * HOUR_IN_SECONDS;

	/**
	 * Plugins known to ship an OpenAI/ChatGPT pixel, by plugin-file fragment.
	 * Presence of the plugin is evidence the capability may be configured — it
	 * is deliberately reported as "present", never as "firing", because we
	 * cannot confirm the latter without observing a real event.
	 *
	 * @return array<string,string>
	 */
	private static function known_plugins() {
		return array(
			'woocommerce-google-adwords-conversion-tracking-tag/' => 'Pixel Manager for WooCommerce',
			'pixelyoursite/'                    => 'PixelYourSite',
			'pixelyoursite-pro/'                => 'PixelYourSite Pro',
			'gtm4wp/'                           => 'GTM4WP (Google Tag Manager)',
			'duracelltomi-google-tag-manager/'  => 'GTM4WP (Google Tag Manager)',
			'measurement-pixel-for-openai-ads/' => 'Measurement Pixel for OpenAI Ads',
			'woocommerce-conversion-tracking/'  => 'Conversion Tracking for WooCommerce',
		);
	}

	/**
	 * Markers that indicate an OpenAI pixel snippet in rendered HTML.
	 *
	 * @return string[]
	 */
	private static function html_markers() {
		return array( 'oaiq', 'bzr.openai.com', 'openai-ads', 'openai_pixel' );
	}

	/**
	 * Run detection (cached).
	 *
	 * @param bool $force Bypass cache.
	 * @return array{plugins:array<int,string>,html:bool,checked:bool,error:string}
	 */
	public static function detect( $force = false ) {
		if ( ! $force ) {
			$cached = get_transient( self::CACHE_KEY );
			if ( is_array( $cached ) ) {
				return $cached;
			}
		}

		$result = array(
			'plugins' => array(),
			'html'    => false,
			'checked' => false,
			'error'   => '',
		);

		// 1. Which known tracking plugins are active. Cheap, no HTTP.
		if ( ! function_exists( 'get_option' ) ) {
			return $result;
		}
		$active = (array) get_option( 'active_plugins', array() );
		if ( is_multisite() ) {
			$active = array_merge( $active, array_keys( (array) get_site_option( 'active_sitewide_plugins', array() ) ) );
		}
		foreach ( self::known_plugins() as $fragment => $label ) {
			foreach ( $active as $file ) {
				if ( false !== strpos( (string) $file, $fragment ) && ! in_array( $label, $result['plugins'], true ) ) {
					$result['plugins'][] = $label;
				}
			}
		}

		// 2. Look for the snippet in our own home page.
		//
		// ⛔ This is a request to the merchant's OWN site, not to a third party.
		// It is also why detection is cached for hours rather than run on render:
		// a settings screen must never make a blocking HTTP call on every view.
		// ⛔ Check a PRODUCT page as well as the home page. Conversion pixels —
		// Pixel Manager's included — commonly fire only on product, cart,
		// checkout or thank-you pages. Reading the home page alone and then
		// telling a merchant "no pixel found" is wrong precisely for the
		// merchants who are running ads and have one configured correctly.
		$urls = array( home_url( '/' ) );
		if ( function_exists( 'wc_get_products' ) ) {
			$sample = wc_get_products(
				array(
					'limit'  => 1,
					'status' => 'publish',
					'return' => 'objects',
				)
			);
			if ( is_array( $sample ) && $sample && is_a( $sample[0], 'WC_Product' ) ) {
				$permalink = $sample[0]->get_permalink();
				if ( $permalink ) {
					$urls[] = $permalink;
				}
			}
		}

		foreach ( $urls as $url ) {
			$found = self::scan_url( $url, $result );
			if ( $found ) {
				break;
			}
		}

		set_transient( self::CACHE_KEY, $result, self::CACHE_TTL );
		return $result;
	}

	/**
	 * Fetch one of our own URLs and look for the snippet.
	 *
	 * @param string $url    URL on this site.
	 * @param array  $result Result array, by reference.
	 * @return bool True when a marker was found.
	 */
	private static function scan_url( $url, &$result ) {
		$response = wp_remote_get(
			$url,
			array(
				'timeout'    => 8,
				'sslverify'  => apply_filters( 'https_local_ssl_verify', false ), // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- core's loopback filter, applied as core does. Loopback; staging clones have self-signed certs.
				'user-agent' => 'xpay-pixel-check/1.0',
				'headers'    => array( 'X-Xpay-Probe' => '1' ),
			)
		);
		if ( is_wp_error( $response ) ) {
			$result['error'] = $response->get_error_message();
			return false;
		}

		$body = (string) wp_remote_retrieve_body( $response );
		if ( '' === $body ) {
			return false;
		}
		$result['checked'] = true;
		foreach ( self::html_markers() as $marker ) {
			if ( false !== stripos( $body, $marker ) ) {
				$result['html'] = true;
				return true;
			}
		}
		return false;
	}

	/**
	 * Plain-English summary of the detection result.
	 *
	 * ⛔ Never claims a pixel is "working". Presence in markup is evidence it is
	 * installed; only an observed accepted event proves it fires, and we do not
	 * have that until the merchant connects an ads account.
	 *
	 * @param array $d Detection result.
	 * @return array{state:string,headline:string,detail:string}
	 */
	public static function summarize( $d ) {
		if ( $d['html'] ) {
			return array(
				'state'    => 'pass',
				'headline' => __( 'An OpenAI Ads pixel is present on your storefront', 'agentic-commerce-for-woocommerce' ),
				'detail'   => __( 'We found the snippet in your home page markup. We have not yet confirmed that events are being accepted — that needs an ads account linked.', 'agentic-commerce-for-woocommerce' ),
			);
		}
		if ( $d['plugins'] ) {
			return array(
				'state'    => 'med',
				'headline' => __( 'A tracking plugin is installed, but no OpenAI pixel was found', 'agentic-commerce-for-woocommerce' ),
				'detail'   => sprintf(
					/* translators: %s: comma-separated plugin names. */
					__( 'We detected %s. It can carry an OpenAI Ads pixel, but we could not see one in your storefront — it may be switched off or unconfigured.', 'agentic-commerce-for-woocommerce' ),
					implode( ', ', $d['plugins'] )
				),
			);
		}
		if ( ! $d['checked'] ) {
			return array(
				'state'    => 'low',
				'headline' => __( 'We could not read your storefront to check', 'agentic-commerce-for-woocommerce' ),
				'detail'   => $d['error']
					? sprintf( /* translators: %s: error text. */ __( 'The check failed: %s. This is about our request, not your store — it does not mean anything is wrong.', 'agentic-commerce-for-woocommerce' ), $d['error'] )
					: __( 'The check did not complete. It does not mean anything is wrong with your store.', 'agentic-commerce-for-woocommerce' ),
			);
		}
		return array(
			'state'    => 'low',
			'headline' => __( 'No OpenAI Ads pixel found on the pages we checked', 'agentic-commerce-for-woocommerce' ),
			'detail'   => __( 'We looked at your home page and one product page. A pixel that fires only at checkout or on the thank-you page would not show up here, so this is not proof you have none. If you are not running ChatGPT Ads, none of this matters yet — a pixel only records what happens after someone clicks one of your ads.', 'agentic-commerce-for-woocommerce' ),
		);
	}
}