<?php
namespace Agentsia_Agents;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * One-click connection of the site to an Agentsia workspace (replaces pasting an API key and typing an
 * Application Password in the app).
 *
 *  1. « Connect to Agentsia » (admin, nonce) → the browser goes to `{api_base}/connect/wordpress` with the
 *     site address and a random `state` kept here for 10 minutes. The admin logs in to Agentsia there
 *     (Google, two-factor: Agentsia's own login, never a password typed in WordPress) and picks a workspace.
 *  2. Agentsia sends the browser back to `admin-post.php?action=agentsia_connect_return` with a one-time
 *     code. The `state` must match: a code sent by anyone else is ignored.
 *  3. The plugin creates (or reuses) a DEDICATED « Agentsia » user with its own limited role (content and
 *     media only: never users, plugins, themes or settings), revokes its previous Agentsia application
 *     passwords and creates a new one, then sends it server to server with the code.
 *  4. Agentsia proves the site really holds that password (it calls back `agentsia/v1/environment` and
 *     checks the random `nonce` / `site_uuid` set here), stores it encrypted, and returns the workspace API
 *     key used by the chatbot and booking features.
 *
 * Disconnect: the dedicated user's application passwords are revoked here and Agentsia is told (best effort).
 */
final class Connect {

	private const ROLE          = 'agentsia_seo';
	private const CAPABILITY    = 'agentsia_seo';
	private const OPT_USER      = 'agentsia_connect_user_id';
	private const OPT_SITE_UUID = 'agentsia_site_uuid';
	private const OPT_NONCE     = 'agentsia_connect_nonce';
	private const OPT_STATUS    = 'agentsia_connect_status';
	private const STATE_PREFIX  = 'agentsia_connect_state_';
	private const APP_NAME      = 'Agentsia';
	/** Bump when role_capabilities() changes: existing sites get the new set on the next request. */
	private const ROLE_VERSION  = '2';
	private const OPT_ROLE_VER  = 'agentsia_seo_role_version';

	private static ?self $instance = null;

	public static function instance(): self {
		if ( self::$instance === null ) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	public function register(): void {
		add_action( 'admin_post_agentsia_connect_start', [ $this, 'handle_start' ] );
		add_action( 'admin_post_agentsia_connect_return', [ $this, 'handle_return' ] );
		add_action( 'admin_post_agentsia_disconnect', [ $this, 'handle_disconnect' ] );
		add_action( 'rest_api_init', [ $this, 'register_routes' ] );
		add_action( 'init', [ $this, 'sync_role' ] );
	}

	/**
	 * Keeps the stored role equal to role_capabilities() (WordPress stores roles in the database: changing the
	 * list in code does nothing for sites already connected). Cheap: one autoloaded option read per request.
	 */
	public function sync_role(): void {
		if ( get_option( self::OPT_ROLE_VER ) === self::ROLE_VERSION ) {
			return;
		}
		$role = get_role( self::ROLE );
		if ( $role ) {
			$wanted = self::role_capabilities();
			foreach ( array_keys( $role->capabilities ) as $cap ) {
				if ( ! isset( $wanted[ $cap ] ) ) {
					$role->remove_cap( $cap );
				}
			}
			foreach ( $wanted as $cap => $grant ) {
				$role->add_cap( $cap, $grant );
			}
		}
		update_option( self::OPT_ROLE_VER, self::ROLE_VERSION, true );
	}

	/** Capabilities of the dedicated user: write content and media for the SEO agent, nothing else. */
	public static function role_capabilities(): array {
		return [
			'read'                 => true,
			'edit_posts'           => true,
			'edit_others_posts'    => true,
			'edit_published_posts' => true,
			'publish_posts'        => true,
			'edit_pages'           => true,
			'edit_others_pages'    => true,
			'edit_published_pages' => true,
			'publish_pages'        => true,
			'upload_files'         => true,
			self::CAPABILITY       => true,
		];
	}

	// ── Settings card ───────────────────────────────────────────────────────────

	/** Rendered at the top of the settings page, outside its options form. */
	public function render_card(): void {
		$status   = get_option( self::OPT_STATUS, [] );
		$status   = is_array( $status ) ? $status : [];
		$notice   = isset( $_GET['agentsia_connect'] ) ? sanitize_key( wp_unslash( $_GET['agentsia_connect'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$message  = get_transient( 'agentsia_connect_message_' . get_current_user_id() );
		$blocking = $this->blocking_reason();
		// Site relié AVANT le bouton, par une clé collée à la main : il fonctionne, on propose seulement de passer au bouton.
		$manual   = empty( $status['connected'] ) && ! empty( Plugin::get_settings()['api_key'] );
		?>
		<div class="agentsia-connect-card" style="border:1px solid #c9c9c9;border-radius:4px;background:#fff;padding:16px 20px;margin:16px 0;max-width:760px;">
			<?php if ( $notice !== '' && is_string( $message ) && $message !== '' ) : ?>
				<div class="notice <?php echo $notice === 'ok' ? 'notice-success' : 'notice-error'; ?> inline"><p><?php echo esc_html( $message ); ?></p></div>
				<?php delete_transient( 'agentsia_connect_message_' . get_current_user_id() ); ?>
			<?php endif; ?>

			<?php if ( ! empty( $status['connected'] ) ) : ?>
				<h2 style="margin-top:0;"><?php esc_html_e( 'Site connecté à Agentsia', 'agentsia-agents' ); ?></h2>
				<p>
					<?php
					printf(
						/* translators: 1: workspace name, 2: date. */
						esc_html__( 'Espace « %1$s », depuis le %2$s. Vos agents (chatbot, rendez-vous, agent SEO) utilisent cette connexion.', 'agentsia-agents' ),
						esc_html( (string) ( $status['workspace'] ?? '' ) ),
						esc_html( wp_date( get_option( 'date_format' ), (int) ( $status['connected_at'] ?? time() ) ) )
					);
					?>
				</p>
				<p class="description">
					<?php
					printf(
						/* translators: %s: user login. */
						esc_html__( 'L\'agent SEO agit sous l\'utilisateur WordPress « %s », limité aux contenus et aux médias (jamais les extensions, les thèmes, les comptes ni les réglages).', 'agentsia-agents' ),
						esc_html( (string) ( $status['user_login'] ?? 'agentsia' ) )
					);
					?>
				</p>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
					<input type="hidden" name="action" value="agentsia_disconnect" />
					<?php wp_nonce_field( 'agentsia_disconnect' ); ?>
					<?php submit_button( __( 'Déconnecter', 'agentsia-agents' ), 'secondary', 'submit', false ); ?>
				</form>
			<?php elseif ( $manual ) : ?>
				<h2 style="margin-top:0;"><?php esc_html_e( 'Site connecté par clé API', 'agentsia-agents' ); ?></h2>
				<p><?php esc_html_e( 'Votre clé API continue de fonctionner (chatbot, rendez-vous). Vous pouvez passer à la connexion en un clic : elle donne aussi à l\'agent SEO un accès limité aux contenus, par un utilisateur dédié, au lieu du mot de passe d\'application d\'un administrateur.', 'agentsia-agents' ); ?></p>
				<?php if ( $blocking !== null ) : ?>
					<div class="notice notice-warning inline"><p><?php echo esc_html( $blocking ); ?></p></div>
				<?php else : ?>
					<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
						<input type="hidden" name="action" value="agentsia_connect_start" />
						<?php wp_nonce_field( 'agentsia_connect_start' ); ?>
						<?php submit_button( __( 'Passer à la connexion en un clic', 'agentsia-agents' ), 'secondary', 'submit', false ); ?>
					</form>
				<?php endif; ?>
			<?php else : ?>
				<h2 style="margin-top:0;"><?php esc_html_e( 'Connecter ce site à Agentsia', 'agentsia-agents' ); ?></h2>
				<p><?php esc_html_e( 'Vous vous connectez à votre compte Agentsia, vous choisissez l\'espace, et c\'est tout : plus de clé à copier.', 'agentsia-agents' ); ?></p>
				<p class="description"><?php esc_html_e( 'Agentsia crée sur ce site un utilisateur « Agentsia » au rôle limité (contenus et médias) pour son agent SEO. Votre extension de sécurité peut le signaler : c\'est normal.', 'agentsia-agents' ); ?></p>
				<?php if ( $blocking !== null ) : ?>
					<div class="notice notice-warning inline"><p><?php echo esc_html( $blocking ); ?></p></div>
				<?php else : ?>
					<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
						<input type="hidden" name="action" value="agentsia_connect_start" />
						<?php wp_nonce_field( 'agentsia_connect_start' ); ?>
						<?php submit_button( __( 'Connecter à Agentsia', 'agentsia-agents' ), 'primary', 'submit', false ); ?>
					</form>
				<?php endif; ?>
			<?php endif; ?>
		</div>
		<?php
	}

	/** Why the connection cannot work on this site (checked before sending anyone away), or null. */
	private function blocking_reason(): ?string {
		if ( ! function_exists( 'wp_is_application_passwords_available' ) ) {
			return __( 'WordPress 5.6 ou plus est requis.', 'agentsia-agents' );
		}
		if ( ! wp_is_application_passwords_available() ) {
			return wp_is_using_https() || is_ssl()
				? __( 'Les mots de passe d\'application sont désactivés sur ce site, souvent par une extension de sécurité (Wordfence les désactive par défaut : Wordfence › Tous les réglages › « Désactiver les mots de passe d\'application »). Réactivez-les pour connecter Agentsia ; cela abaisse légèrement la protection, l\'accès d\'Agentsia restant limité à un utilisateur au rôle restreint.', 'agentsia-agents' )
				: __( 'Ce site n\'est pas servi en HTTPS : WordPress n\'autorise pas les mots de passe d\'application. Activez le HTTPS (certificat) puis revenez ici.', 'agentsia-agents' );
		}
		return null;
	}

	// ── Step 1: send the admin to Agentsia ────────────────────────────────────

	public function handle_start(): void {
		$this->guard( 'agentsia_connect_start' );
		$blocking = $this->blocking_reason();
		if ( $blocking !== null ) {
			$this->back( 'error', $blocking );
		}
		$state = bin2hex( random_bytes( 24 ) );
		set_transient( self::STATE_PREFIX . get_current_user_id(), $state, 10 * MINUTE_IN_SECONDS );

		$settings = Plugin::get_settings();
		$target   = add_query_arg(
			[
				'site'    => rawurlencode( home_url( '/' ) ),
				'rest'    => rawurlencode( get_rest_url() ),
				'state'   => $state,
				'return'  => rawurlencode( admin_url( 'admin-post.php?action=agentsia_connect_return' ) ),
				'version' => rawurlencode( AGENTSIA_AGENTS_VERSION ),
			],
			untrailingslashit( (string) $settings['api_base'] ) . '/connect/wordpress'
		);
		wp_redirect( $target ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- external by design: the Agentsia app.
		exit;
	}

	// ── Step 2: back from Agentsia with a one-time code ────────────────────────

	public function handle_return(): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Accès refusé.', 'agentsia-agents' ), 403 );
		}
		$code  = isset( $_GET['agentsia_code'] ) ? sanitize_text_field( wp_unslash( $_GET['agentsia_code'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- the `state` below is the CSRF check.
		$state = isset( $_GET['agentsia_state'] ) ? sanitize_text_field( wp_unslash( $_GET['agentsia_state'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$key   = self::STATE_PREFIX . get_current_user_id();
		$saved = get_transient( $key );
		delete_transient( $key ); // single use, whatever happens next
		if ( ! is_string( $saved ) || $saved === '' || $state === '' || ! hash_equals( $saved, $state ) || ! preg_match( '/^[A-Za-z0-9_-]{20,128}$/', $code ) ) {
			$this->back( 'error', __( 'Connexion expirée ou invalide : recommencez depuis le bouton « Connecter à Agentsia ».', 'agentsia-agents' ) );
		}

		$user = $this->dedicated_user();
		if ( is_wp_error( $user ) ) {
			$this->back( 'error', $user->get_error_message() );
		}
		if ( ! wp_is_application_passwords_available_for_user( $user ) ) {
			$this->back( 'error', __( 'Les mots de passe d\'application sont bloqués pour cet utilisateur (extension de sécurité ?).', 'agentsia-agents' ) );
		}
		$this->revoke_passwords( $user->ID );
		$created = \WP_Application_Passwords::create_new_application_password( $user->ID, [ 'name' => self::APP_NAME ] );
		if ( is_wp_error( $created ) ) {
			$this->back( 'error', $created->get_error_message() );
		}
		[ $password ] = $created;

		$site_uuid = (string) get_option( self::OPT_SITE_UUID, '' );
		if ( $site_uuid === '' ) {
			$site_uuid = wp_generate_uuid4();
			update_option( self::OPT_SITE_UUID, $site_uuid, false );
		}
		$nonce = bin2hex( random_bytes( 24 ) );
		update_option( self::OPT_NONCE, $nonce, false );

		$settings = Plugin::get_settings();
		$response = wp_remote_post(
			untrailingslashit( (string) $settings['api_base'] ) . '/api/public/wp/connect',
			[
				'timeout' => 30,
				'headers' => [ 'Content-Type' => 'application/json', 'Accept' => 'application/json' ],
				'body'    => wp_json_encode(
					[
						'code'              => $code,
						'state'             => $state,
						'site_url'          => home_url( '/' ),
						'rest_url'          => get_rest_url(),
						'site_uuid'         => $site_uuid,
						'username'          => $user->user_login,
						'app_password'      => $password,
						'plugin_nonce'      => $nonce,
						'plugin_version'    => AGENTSIA_AGENTS_VERSION,
						// Articles published by the agent are signed by the admin who connected the site, not by « Agentsia ».
						'default_author_id' => get_current_user_id(),
					]
				),
			]
		);
		delete_option( self::OPT_NONCE ); // the proof of possession happened during that request

		$status_code = (int) wp_remote_retrieve_response_code( $response );
		$body        = json_decode( (string) wp_remote_retrieve_body( $response ), true );
		if ( is_wp_error( $response ) || $status_code !== 200 || ! is_array( $body ) || empty( $body['api_key'] ) ) {
			$this->revoke_passwords( $user->ID ); // nothing must stay usable after a failed connection
			$reason = is_wp_error( $response ) ? $response->get_error_message() : ( is_array( $body ) && ! empty( $body['error'] ) ? (string) $body['error'] : sprintf( 'HTTP %d', $status_code ) );
			/* translators: %s: reason. */
			$this->back( 'error', sprintf( __( 'Agentsia n\'a pas pu finaliser la connexion : %s', 'agentsia-agents' ), $reason ) );
		}

		$api_key = (string) $body['api_key'];
		if ( ! preg_match( '/^agsk_[a-f0-9]{48}$/', $api_key ) ) {
			$this->revoke_passwords( $user->ID );
			$this->back( 'error', __( 'Réponse inattendue d\'Agentsia.', 'agentsia-agents' ) );
		}
		$current            = Plugin::get_settings();
		$current['api_key'] = $api_key;
		update_option( Plugin::OPTION_KEY, $current );
		update_option(
			self::OPT_STATUS,
			[
				'connected'    => true,
				'workspace'    => isset( $body['workspace'] ) ? sanitize_text_field( (string) $body['workspace'] ) : '',
				'connected_at' => time(),
				'user_login'   => $user->user_login,
			],
			false
		);
		$previous = isset( $body['previous_username'] ) && is_string( $body['previous_username'] ) ? sanitize_user( $body['previous_username'] ) : '';
		$this->back(
			'ok',
			$previous !== ''
				/* translators: %s: WordPress user login. */
				? sprintf( __( 'Site connecté à Agentsia. Le mot de passe d\'application du compte « %1$s » n\'est plus utilisé par Agentsia : vous pouvez le révoquer (Utilisateurs › %1$s › Mots de passe d\'application).', 'agentsia-agents' ), $previous )
				: __( 'Site connecté à Agentsia.', 'agentsia-agents' )
		);
	}

	// ── Disconnect ──────────────────────────────────────────────────────────────

	public function handle_disconnect(): void {
		$this->guard( 'agentsia_disconnect' );
		$settings = Plugin::get_settings();
		if ( ! empty( $settings['api_key'] ) ) {
			// Best effort: Agentsia marks the integration disconnected and revokes the key.
			wp_remote_post(
				untrailingslashit( (string) $settings['api_base'] ) . '/api/public/wp/disconnect',
				[
					'timeout' => 10,
					'headers' => [ 'Authorization' => 'Bearer ' . $settings['api_key'], 'Content-Type' => 'application/json' ],
					'body'    => wp_json_encode( [ 'site_uuid' => (string) get_option( self::OPT_SITE_UUID, '' ) ] ),
				]
			);
		}
		$user_id = (int) get_option( self::OPT_USER, 0 );
		if ( $user_id > 0 ) {
			$this->revoke_passwords( $user_id );
		}
		$settings['api_key'] = '';
		update_option( Plugin::OPTION_KEY, $settings );
		delete_option( self::OPT_STATUS );
		$this->back( 'ok', __( 'Site déconnecté d\'Agentsia : son accès est révoqué.', 'agentsia-agents' ) );
	}

	// ── Proof of possession ─────────────────────────────────────────────────────

	public function register_routes(): void {
		register_rest_route(
			Seo_Meta::REST_NAMESPACE,
			'/environment',
			[
				'methods'             => 'GET',
				'callback'            => [ $this, 'handle_environment' ],
				'permission_callback' => static function () {
					return current_user_can( self::CAPABILITY ) || current_user_can( 'manage_options' );
				},
			]
		);
		register_rest_route(
			Seo_Meta::REST_NAMESPACE,
			'/authors',
			[
				'methods'             => 'GET',
				'callback'            => [ $this, 'handle_authors' ],
				'permission_callback' => static function () {
					return current_user_can( self::CAPABILITY ) || current_user_can( 'list_users' );
				},
			]
		);
	}

	/**
	 * Authors the agent may sign articles with, for the author choices of the Agentsia app: users who can
	 * publish posts, plus the « Signataire Agentsia » and contributors (they sign what the agent publishes).
	 * Only id, name and slug: the dedicated user does not get `list_users` (the full directory, e-mails
	 * included), which WordPress requires for `/wp/v2/users?context=edit`.
	 */
	public function handle_authors(): \WP_REST_Response {
		$base = [
			'number'  => 200,
			'orderby' => 'display_name',
			'exclude' => array_filter( [ (int) get_option( self::OPT_USER, 0 ) ] ),
			'fields'  => [ 'ID', 'display_name', 'user_nicename' ],
		];
		// `capability` exists since WordPress 5.9; before, the default publishing roles.
		$publishers = version_compare( get_bloginfo( 'version' ), '5.9', '>=' )
			? $base + [ 'capability' => [ 'publish_posts' ] ]
			: $base + [ 'role__in' => [ 'administrator', 'editor', 'author' ] ];
		$signers    = $base + [ 'role__in' => [ Site_Members::SIGNATAIRE_ROLE, 'contributor' ] ];
		$authors    = [];
		foreach ( array_merge( get_users( $publishers ), get_users( $signers ) ) as $u ) {
			$authors[ (int) $u->ID ] = [ 'id' => (int) $u->ID, 'name' => (string) $u->display_name, 'slug' => (string) $u->user_nicename ];
		}
		uasort(
			$authors,
			static function ( $a, $b ) {
				return strcasecmp( $a['name'], $b['name'] );
			}
		);
		return new \WP_REST_Response( array_values( $authors ), 200 );
	}

	public function handle_environment(): \WP_REST_Response {
		return new \WP_REST_Response(
			[
				'site_uuid'      => (string) get_option( self::OPT_SITE_UUID, '' ),
				// Only present while a connection is being finalised: Agentsia checks it matches what it received.
				'nonce'          => (string) get_option( self::OPT_NONCE, '' ),
				'plugin_version' => AGENTSIA_AGENTS_VERSION,
				'wp_version'     => get_bloginfo( 'version' ),
				'user'           => wp_get_current_user()->user_login,
			],
			200
		);
	}

	// ── Helpers ─────────────────────────────────────────────────────────────────

	/** @return \WP_User|\WP_Error */
	private function dedicated_user() {
		if ( ! get_role( self::ROLE ) ) {
			add_role( self::ROLE, __( 'Agentsia (agent SEO)', 'agentsia-agents' ), self::role_capabilities() );
			update_option( self::OPT_ROLE_VER, self::ROLE_VERSION, true );
		}
		$user_id = (int) get_option( self::OPT_USER, 0 );
		$user    = $user_id > 0 ? get_userdata( $user_id ) : false;
		if ( $user instanceof \WP_User ) {
			// Keep the role exactly as declared (an admin could have widened it).
			$user->set_role( self::ROLE );
			return $user;
		}
		$login   = 'agentsia-' . strtolower( wp_generate_password( 6, false, false ) );
		$user_id = wp_insert_user(
			[
				'user_login'   => $login,
				'user_pass'    => wp_generate_password( 64, true, true ), // never given to anyone: no interactive login
				'display_name' => 'Agentsia',
				'nickname'     => 'Agentsia',
				'role'         => self::ROLE,
				'description'  => __( 'Utilisateur technique de l\'agent SEO Agentsia (contenus et médias seulement). Son accès est révoqué quand vous déconnectez le site dans Réglages › Agentsia Agents.', 'agentsia-agents' ),
			]
		);
		if ( is_wp_error( $user_id ) ) {
			return $user_id;
		}
		update_option( self::OPT_USER, (int) $user_id, false );
		return get_userdata( (int) $user_id );
	}

	private function revoke_passwords( int $user_id ): void {
		foreach ( \WP_Application_Passwords::get_user_application_passwords( $user_id ) as $item ) {
			if ( ( $item['name'] ?? '' ) === self::APP_NAME ) {
				\WP_Application_Passwords::delete_application_password( $user_id, $item['uuid'] );
			}
		}
	}

	private function guard( string $action ): void {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Accès refusé.', 'agentsia-agents' ), 403 );
		}
		check_admin_referer( $action );
	}

	/** Back to the settings page with a message (kept per user, shown once). */
	private function back( string $kind, string $message ): void {
		set_transient( 'agentsia_connect_message_' . get_current_user_id(), $message, MINUTE_IN_SECONDS );
		wp_safe_redirect( add_query_arg( 'agentsia_connect', $kind === 'ok' ? 'ok' : 'error', admin_url( 'options-general.php?page=agentsia-agents' ) ) );
		exit;
	}
}