<?php
/**
 * Plugin Name: AIActify Compliance
 * Description: EU AI Act transparency toolkit. Label AI-generated content with the EU AI pictogram and machine-readable metadata, disclose AI chatbots — free and locally. Optionally connect the AIActify platform for automation, validation workflows and audit trails.
 * Version:     2.2.2
 * Author:      AIActify
 * Author URI:  https://aiactify.eu
 * License:     GPL-2.0+
 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain: aiactify-compliance
 * Requires at least: 5.0
 * Requires PHP: 7.4
 */

// Exit if accessed directly.
if (!defined('ABSPATH')) {
    exit;
}

define('AIACTIFY_VERSION', '2.2.2');
define('AIACTIFY_PLUGIN_DIR', plugin_dir_path(__FILE__));
define('AIACTIFY_PLUGIN_URL', plugin_dir_url(__FILE__));

// API Endpoint for the OPTIONAL AIActify platform connection
if (!defined('AIACTIFY_API_BASE')) {
    define('AIACTIFY_API_BASE', 'https://aiactify-backend.vercel.app/api');
}
// Same host, but its own constant: the enforcer is served from the domain root,
// not under /api. Overridable in wp-config.php so a staging instance can be
// pointed at a test backend (previously hard-coded, which made the plugin
// untestable outside production).
if (!defined('AIACTIFY_ENFORCER_URL')) {
    define('AIACTIFY_ENFORCER_URL', 'https://aiactify-backend.vercel.app/enforcer.js');
}

// Free, local features (no account required)
require_once AIACTIFY_PLUGIN_DIR . 'includes/eu-labels.php';
require_once AIACTIFY_PLUGIN_DIR . 'includes/labeling.php';

// Updates are handled exclusively by the WordPress.org plugin directory
// (Guidelines §8). No bundled self-hosted updater.

// Translations are loaded automatically by WordPress.org since WP 4.6 —
// no load_plugin_textdomain() call is needed for directory-hosted plugins.

/**
 * Register settings on init
 */
function aiactify_register_settings() {
    // Free / local features
    register_setting('aiactify_settings_group', 'aiactify_local_labeling', [
        'type'              => 'integer',
        'sanitize_callback' => 'absint',
        'default'           => 1,
    ]);
    // Label-Stil: 'custom' = eigenes Badge mit EU-Basis-Piktogramm (Default,
    // damit bestehende Seiten sich beim Update nicht veraendern),
    // 'official' = vollstaendiges EU-Label der Kommission 1:1.
    register_setting('aiactify_settings_group', 'aiactify_label_style', [
        'type'              => 'string',
        'sanitize_callback' => static function ($value) {
            return in_array($value, ['custom', 'official'], true) ? $value : 'custom';
        },
        'default'           => 'custom',
    ]);
    register_setting('aiactify_settings_group', 'aiactify_chatbot_disclosure', [
        'type'              => 'integer',
        'sanitize_callback' => 'absint',
        'default'           => 0,
    ]);
    register_setting('aiactify_settings_group', 'aiactify_chatbot_text', [
        'type'              => 'string',
        'sanitize_callback' => 'sanitize_text_field',
        'default'           => '',
    ]);
    // Optional platform connection
    register_setting('aiactify_settings_group', 'aiactify_site_id', [
        'type'              => 'string',
        'sanitize_callback' => 'sanitize_text_field',
        'default'           => '',
    ]);
    register_setting('aiactify_settings_group', 'aiactify_api_key', [
        'type'              => 'string',
        'sanitize_callback' => 'sanitize_text_field',
        'default'           => '',
    ]);
    register_setting('aiactify_settings_group', 'aiactify_is_active', [
        'type'              => 'integer',
        'sanitize_callback' => 'absint',
        'default'           => 1,
    ]);
}
add_action('admin_init', 'aiactify_register_settings');

/**
 * Add Settings Menu
 */
function aiactify_add_admin_menu() {
    add_menu_page(
        __('AIActify Settings', 'aiactify-compliance'),
        'AIActify',
        'manage_options',
        'aiactify-compliance',
        'aiactify_settings_page',
        'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzMiAzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xNiA0TDYgOHY4YzAgNS41IDQuMyAxMC43IDEwIDEyIDUuNy0xLjMgMTAtNi41IDEwLTEyVjhMMTYgNHogTTExLjMgMTUuM0wxNC41IDE4LjVMMjAuNyAxMi4zTDE5LjMgMTAuOUwxNC41IDE1LjdMMTIuNyAxMy45WiIgZmlsbD0iIzNFQ0Y4RSIvPjwvc3ZnPg==',
        80
    );
}
add_action('admin_menu', 'aiactify_add_admin_menu');

/**
 * Enqueue Admin CSS
 */
function aiactify_admin_enqueue_scripts($hook) {
    if ($hook !== 'toplevel_page_aiactify-compliance') {
        return;
    }
    wp_enqueue_style('aiactify-admin-style', AIACTIFY_PLUGIN_URL . 'assets/admin-style.css', array(), AIACTIFY_VERSION);
    wp_enqueue_script('aiactify-admin-script', AIACTIFY_PLUGIN_URL . 'assets/admin-script.js', array('jquery'), AIACTIFY_VERSION, true);

    // Pass AJAX URL to script
    wp_localize_script('aiactify-admin-script', 'aiactify_ajax', array(
        'ajax_url' => admin_url('admin-ajax.php'),
        'nonce'    => wp_create_nonce('aiactify_editor_nonce')
    ));
}
add_action('admin_enqueue_scripts', 'aiactify_admin_enqueue_scripts');

/**
 * Handle AJAX request to generate editor token and get redirect URL
 */
function aiactify_ajax_open_editor() {
    check_ajax_referer('aiactify_editor_nonce', 'nonce');

    if (!current_user_can('manage_options')) {
        wp_send_json_error(__('Unauthorized', 'aiactify-compliance'));
    }

    $site_id = get_option('aiactify_site_id');
    $api_key = get_option('aiactify_api_key');

    if (empty($site_id) || empty($api_key)) {
        wp_send_json_error(__('API Key and Site Key must be configured and saved first.', 'aiactify-compliance'));
    }

    // Call AIActify Backend
    $response = wp_remote_post(AIACTIFY_API_BASE . '/auth/onsite-editor-token', array(
        'headers' => array(
            'Authorization' => 'Bearer ' . $api_key,
            'Content-Type'  => 'application/json'
        ),
        'body' => wp_json_encode(array(
            'siteId' => $site_id
        )),
        'timeout' => 15
    ));

    if (is_wp_error($response)) {
        wp_send_json_error(__('Failed to connect to AIActify servers.', 'aiactify-compliance'));
    }

    $body = wp_remote_retrieve_body($response);
    $data = json_decode($body, true);
    $status_code = wp_remote_retrieve_response_code($response);

    if ($status_code !== 200 || empty($data['editorToken'])) {
        wp_send_json_error(isset($data['error']) ? $data['error'] : __('Invalid API Key or Site Key.', 'aiactify-compliance'));
    }

    // Success! Generate frontend redirect URL
    // The snippet expects ?aiactify_edit=TOKEN (single parameter format)
    $frontend_url = home_url('/?aiactify_edit=' . urlencode($data['editorToken']));
    wp_send_json_success(array('url' => $frontend_url));
}
add_action('wp_ajax_aiactify_open_editor', 'aiactify_ajax_open_editor');

/**
 * Render Settings Page
 */
function aiactify_settings_page() {
    if (!current_user_can('manage_options')) {
        return;
    }

    $local_labeling      = get_option('aiactify_local_labeling', 1);
    $chatbot_disclosure  = get_option('aiactify_chatbot_disclosure', 0);
    $chatbot_text        = get_option('aiactify_chatbot_text', '');
    $site_id             = get_option('aiactify_site_id', '');
    $api_key             = get_option('aiactify_api_key', '');
    $is_active           = get_option('aiactify_is_active', 1); // default active
    ?>
    <div class="wrap aiactify-wrap">
        <?php
        // WordPress' common.js verschiebt jedes .notice hinter die erste h1
        // innerhalb von .wrap — und unsere h1 sitzt in der dunklen Kopfkarte.
        // Die Fehlermeldung landete dadurch mitten im Header und hat den Titel
        // umbrochen. Ein leeres Screenreader-h1 plus wp-header-end gibt
        // WordPress einen sauberen Ankerpunkt oberhalb der Karte.
        ?>
        <h1 class="screen-reader-text">AIActify Compliance</h1>
        <hr class="wp-header-end">
        <div class="aiactify-header">
            <div class="aiactify-logo">
                <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
                  <rect width="32" height="32" rx="8" fill="#0a0a0a"/>
                  <path d="M16 4L6 8v8c0 5.5 4.3 10.7 10 12 5.7-1.3 10-6.5 10-12V8L16 4z" fill="#3ECF8E"/>
                  <path d="M12 16l2.5 2.5L20 13" stroke="#0a0a0a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
                </svg>
                <h1>AIActify Compliance</h1>
            </div>
            <p><?php esc_html_e('EU AI Act transparency for your website (Art. 50 applies from 2 August 2026).', 'aiactify-compliance'); ?></p>
        </div>

        <form method="post" action="options.php" class="aiactify-form">
            <?php settings_fields('aiactify_settings_group'); ?>

            <div class="aiactify-card">
                <h2><?php esc_html_e('1. Local Labeling (free — no account needed)', 'aiactify-compliance'); ?></h2>
                <p><?php esc_html_e('Mark posts as AI-generated in the editor sidebar. The plugin renders a visible label with the EU AI pictogram and machine-readable Schema.org/IPTC metadata.', 'aiactify-compliance'); ?></p>

                <table class="form-table">
                    <tr valign="top">
                        <th scope="row"><?php esc_html_e('Content labels', 'aiactify-compliance'); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="aiactify_local_labeling" value="1" <?php checked(1, $local_labeling); ?> />
                                <?php esc_html_e('Show labels for posts marked as AI-generated', 'aiactify-compliance'); ?>
                            </label>
                        </td>
                    </tr>
                    <tr valign="top">
                        <th scope="row"><?php esc_html_e('Label style', 'aiactify-compliance'); ?></th>
                        <td>
                            <?php $label_style = get_option('aiactify_label_style', 'custom'); ?>
                            <label style="display:block;margin-bottom:6px;">
                                <input type="radio" name="aiactify_label_style" value="custom" <?php checked('custom', $label_style); ?> />
                                <?php esc_html_e('Custom label with the official EU pictogram', 'aiactify-compliance'); ?>
                            </label>
                            <label style="display:block;">
                                <input type="radio" name="aiactify_label_style" value="official" <?php checked('official', $label_style); ?> />
                                <?php esc_html_e('Official EU label (rendered 1:1, English wording)', 'aiactify-compliance'); ?>
                            </label>
                            <p class="description" style="margin-top:8px;">
                                <?php esc_html_e('The European Commission publishes complete labels ("AI GENERATED" / "AI MODIFIED"). Like the CE mark they are deliberately not translated or recoloured — uniform recognition across the EU is the point.', 'aiactify-compliance'); ?>
                            </p>
                        </td>
                    </tr>
                    <tr valign="top">
                        <th scope="row"><?php esc_html_e('Chatbot disclosure', 'aiactify-compliance'); ?></th>
                        <td>
                            <label>
                                <input type="checkbox" name="aiactify_chatbot_disclosure" value="1" <?php checked(1, $chatbot_disclosure); ?> />
                                <?php esc_html_e('Show a site-wide AI chatbot disclosure notice (Art. 50(1))', 'aiactify-compliance'); ?>
                            </label>
                            <p style="margin-top:8px;">
                                <input type="text" name="aiactify_chatbot_text" value="<?php echo esc_attr($chatbot_text); ?>" class="regular-text" placeholder="<?php esc_attr_e('This website uses an AI-powered chat assistant.', 'aiactify-compliance'); ?>" />
                            </p>
                        </td>
                    </tr>
                </table>
            </div>

            <div class="aiactify-card">
                <h2><?php esc_html_e('2. AIActify Platform (optional)', 'aiactify-compliance'); ?></h2>
                <p>
                    <?php esc_html_e('Connect your AIActify account for automated content detection, validation workflows, Art. 5 script monitoring and tamper-evident audit trails.', 'aiactify-compliance'); ?>
                    <a href="https://app.aiactify.eu/sites" target="_blank"><?php esc_html_e('Get your Site Key in the AIActify Dashboard', 'aiactify-compliance'); ?></a>
                </p>

                <table class="form-table">
                    <tr valign="top">
                        <th scope="row"><label for="aiactify_site_id"><?php esc_html_e('Site Key', 'aiactify-compliance'); ?></label></th>
                        <td>
                            <input type="text" id="aiactify_site_id" name="aiactify_site_id" value="<?php echo esc_attr($site_id); ?>" class="regular-text" placeholder="a1b2c3d4e5f6a7b8" />
                            <p class="description">
                                <?php esc_html_e('16 characters, letters a–f and digits only. You find it in the AIActify dashboard under your website → Integration (labelled "Site Key").', 'aiactify-compliance'); ?>
                            </p>
                            <?php if (!empty($site_id) && !preg_match('/^[0-9a-f]{16}$/i', $site_id)) : ?>
                                <p style="margin-top:8px;padding:10px 12px;border-left:4px solid #d63638;background:#fcf0f1;">
                                    <strong><?php esc_html_e('This does not look like a Site Key.', 'aiactify-compliance'); ?></strong><br>
                                    <?php esc_html_e('Labelling will not work until this is corrected. The Site Key is not your e-mail address and not the website URL — copy it from the dashboard under your website → Integration.', 'aiactify-compliance'); ?>
                                </p>
                            <?php endif; ?>
                        </td>
                    </tr>
                    <tr valign="top">
                        <th scope="row"><label for="aiactify_api_key"><?php esc_html_e('API Key (Optional)', 'aiactify-compliance'); ?></label></th>
                        <td>
                            <input type="password" id="aiactify_api_key" name="aiactify_api_key" value="<?php echo esc_attr($api_key); ?>" class="regular-text" placeholder="aak_..." />
                            <p class="description"><?php esc_html_e('Required if you want to launch the On-Site Visual Editor directly from WordPress.', 'aiactify-compliance'); ?></p>
                        </td>
                    </tr>
                    <tr valign="top">
                        <th scope="row"><?php esc_html_e('Status', 'aiactify-compliance'); ?></th>
                        <td>
                            <label class="aiactify-switch">
                                <input type="checkbox" name="aiactify_is_active" value="1" <?php checked(1, $is_active); ?> />
                                <span class="aiactify-slider"></span>
                            </label>
                            <span class="aiactify-status-text"><?php echo $is_active ? esc_html__('Platform connection active', 'aiactify-compliance') : esc_html__('Platform connection disabled', 'aiactify-compliance'); ?></span>
                        </td>
                    </tr>
                </table>

                <?php submit_button(__('Save Configuration', 'aiactify-compliance'), 'primary aiactify-btn-save'); ?>
            </div>
        </form>

        <div class="aiactify-card aiactify-editor-card">
            <h2><?php esc_html_e('3. Visual Content Auditor', 'aiactify-compliance'); ?></h2>
            <p><?php esc_html_e('Classify AI-generated texts and images visually on your live website (requires platform connection).', 'aiactify-compliance'); ?></p>
            <?php if (!empty($api_key) && !empty($site_id)) : ?>
                <button id="aiactify-launch-editor" class="aiactify-btn-editor">
                    <span class="dashicons dashicons-visibility"></span> <?php esc_html_e('Launch On-Site Editor', 'aiactify-compliance'); ?>
                </button>
                <div id="aiactify-editor-feedback"></div>
            <?php else : ?>
                <div class="notice notice-warning inline"><p><?php esc_html_e('Save your Site Key and API Key to enable the Visual Editor shortcut.', 'aiactify-compliance'); ?></p></div>
            <?php endif; ?>
        </div>
    </div>
    <?php
}

/**
 * Inject Snippet into Frontend Head via wp_enqueue_script
 * (only when the OPTIONAL platform connection is configured)
 */
function aiactify_enqueue_snippet() {
    $is_active = get_option('aiactify_is_active', 1);
    if (!$is_active) return;

    $site_id = get_option('aiactify_site_id');
    if (empty($site_id)) return;

    // Ungueltige Werte gar nicht erst ins oeffentliche Frontend schreiben.
    // Vorher landete der Feldinhalt ungeprueft als data-site-id im Quelltext
    // JEDER oeffentlichen Seite — im realen Support-Fall also die E-Mail-
    // Adresse des Betreibers, weltweit abgreifbar. Zusaetzlich laedt jeder
    // Besucher einen Enforcer, der garantiert scheitert. Das Admin-Notice
    // unten erklaert weiterhin, warum nichts ausgeliefert wird.
    if (!preg_match('/^[0-9a-f]{16}$/i', $site_id)) return;

    wp_enqueue_script(
        'aiactify-enforcer',
        AIACTIFY_ENFORCER_URL,
        array(),
        AIACTIFY_VERSION,
        false // Load in head, not footer — must intercept before other scripts
    );
}
// Priority 0 ensures it loads before other tracking scripts (Art. 5 network monitoring)
add_action('wp_enqueue_scripts', 'aiactify_enqueue_snippet', 0);

/**
 * Admin-Hinweis bei ungueltigem Site Key.
 *
 * Realer Support-Fall (August 2026): Das Feld hiess frueher "Site ID (UUID)"
 * und hatte einen UUID-Platzhalter — die Plattform erwartet aber den Site Key
 * (16 Hex-Zeichen). Wer das Feld nach seiner eigenen Beschriftung ausfuellte,
 * bekam still einen 404 und gar keine Kennzeichnung. Diese Meldung erscheint
 * deshalb auf ALLEN Admin-Seiten, nicht nur in den Einstellungen.
 */
function aiactify_admin_notice_invalid_key() {
    if (!current_user_can('manage_options')) {
        return;
    }
    $site_id = get_option('aiactify_site_id');
    if (empty($site_id) || preg_match('/^[0-9a-f]{16}$/i', $site_id)) {
        return;
    }
    printf(
        '<div class="notice notice-error"><p><strong>%s</strong> %s <a href="%s">%s</a></p></div>',
        esc_html__('AIActify: labelling is not active.', 'aiactify-compliance'),
        esc_html__('The configured Site Key is invalid, so no AI labels are being shown on your website. The Site Key has 16 characters (letters a–f and digits) and can be copied from the AIActify dashboard under your website → Integration.', 'aiactify-compliance'),
        esc_url(admin_url('admin.php?page=aiactify-compliance')),
        esc_html__('Open settings', 'aiactify-compliance')
    );
}
add_action('admin_notices', 'aiactify_admin_notice_invalid_key');

/**
 * Serverseitige Pruefung: kennt die Plattform diesen Site Key ueberhaupt?
 *
 * Die Formatpruefung oben faengt nur offensichtlichen Unsinn ab (E-Mail, UUID).
 * Ein Key, der formal stimmt, aber falsch ist — aus einer anderen Website
 * kopiert, Site im Dashboard geloescht, Staging-Key auf der Produktivseite,
 * Tippfehler innerhalb von a–f — sieht korrekt aus und liefert trotzdem
 * KEINE einzige Kennzeichnung. Sichtbar war das bisher ausschliesslich als
 * console.error in den Entwicklertools des Besuchers. Genau diese Fehlerklasse
 * hat eine echte Kundeninstallation vier Tage lang unbemerkt lahmgelegt.
 *
 * Geprueft wird beim Speichern der Einstellungen und danach einmal taeglich.
 * Das Ergebnis liegt in einer Option, damit die Anzeige keinen Request kostet.
 */
function aiactify_verify_site_key($site_id = null) {
    if (null === $site_id) {
        $site_id = get_option('aiactify_site_id');
    }
    if (empty($site_id) || !preg_match('/^[0-9a-f]{16}$/i', $site_id)) {
        delete_option('aiactify_site_key_check');
        return;
    }

    $response = wp_remote_get(
        AIACTIFY_API_BASE . '/sites/config/' . rawurlencode($site_id),
        array('timeout' => 5)
    );

    if (is_wp_error($response)) {
        // Netzwerkfehler ist KEIN Beweis fuer einen falschen Key — nicht als
        // Fehler melden, sonst warnen wir bei jedem Aussetzer grundlos.
        $state = 'unreachable';
    } else {
        $code  = (int) wp_remote_retrieve_response_code($response);
        $state = (404 === $code) ? 'unknown' : (($code >= 200 && $code < 300) ? 'ok' : 'unreachable');
    }

    update_option('aiactify_site_key_check', array(
        'state'   => $state,
        'site_id' => $site_id,
        'time'    => time(),
    ), false);
}

// Beim Speichern der Einstellungen pruefen (auch wenn der Wert gleich bleibt).
add_action('update_option_aiactify_site_id', function ($old, $new) {
    aiactify_verify_site_key($new);
}, 10, 2);
add_action('add_option_aiactify_site_id', function ($option, $value) {
    aiactify_verify_site_key($value);
}, 10, 2);

// Taeglich nachpruefen — eine geloeschte Site faellt sonst nie auf.
add_action('aiactify_daily_key_check', 'aiactify_verify_site_key');
register_activation_hook(__FILE__, function () {
    if (!wp_next_scheduled('aiactify_daily_key_check')) {
        wp_schedule_event(time() + HOUR_IN_SECONDS, 'daily', 'aiactify_daily_key_check');
    }
});
register_deactivation_hook(__FILE__, function () {
    wp_clear_scheduled_hook('aiactify_daily_key_check');
});

/**
 * Hinweis, wenn die Plattform den (formal gueltigen) Site Key nicht kennt.
 */
function aiactify_admin_notice_unknown_key() {
    if (!current_user_can('manage_options')) {
        return;
    }
    $check = get_option('aiactify_site_key_check');
    if (empty($check['state']) || 'unknown' !== $check['state']) {
        return;
    }
    // Nur melden, wenn die Pruefung zum aktuell gespeicherten Key gehoert.
    if (!isset($check['site_id']) || $check['site_id'] !== get_option('aiactify_site_id')) {
        return;
    }
    printf(
        '<div class="notice notice-error"><p><strong>%s</strong> %s <a href="%s">%s</a></p></div>',
        esc_html__('AIActify: labelling is not active.', 'aiactify-compliance'),
        esc_html__('The Site Key has the right format, but your AIActify account does not know it — so no AI labels are being shown on your website. This usually means the key belongs to a different website, or that website was deleted in the dashboard.', 'aiactify-compliance'),
        esc_url(admin_url('admin.php?page=aiactify-compliance')),
        esc_html__('Open settings', 'aiactify-compliance')
    );
}
add_action('admin_notices', 'aiactify_admin_notice_unknown_key');

/**
 * Add data-site-id attribute to the enforcer script tag
 */
function aiactify_add_site_id_attribute($tag, $handle, $src) {
    if ('aiactify-enforcer' !== $handle) {
        return $tag;
    }
    $site_id = get_option('aiactify_site_id');
    return str_replace(' src=', ' data-site-id="' . esc_attr($site_id) . '" src=', $tag);
}
add_filter('script_loader_tag', 'aiactify_add_site_id_attribute', 10, 3);

/**
 * Show a custom plugin action link to the AIActify settings
 */
function aiactify_plugin_action_links($links) {
    $settings_link = '<a href="' . admin_url('admin.php?page=aiactify-compliance') . '">' . esc_html__('Settings', 'aiactify-compliance') . '</a>';
    array_unshift($links, $settings_link);
    return $links;
}
add_filter('plugin_action_links_' . plugin_basename(__FILE__), 'aiactify_plugin_action_links');