<?php
// If this file is called directly, abort.
if ( ! defined( 'WPINC' ) ) {
	die;
}

class AIO_Security_Admin {

	public function __construct() {
		add_action( 'wp_ajax_aio_generate_2fa', [ $this, 'aio_generate_2fa_ajax' ] );
		add_action( 'wp_ajax_aio_verify_2fa', [ $this, 'aio_verify_2fa_ajax' ] );
		add_action( 'wp_ajax_aio_disable_2fa', [ $this, 'aio_disable_2fa_ajax' ] );
		add_action( 'wp_ajax_aio_unblock_ip', [ $this, 'aio_unblock_ip_ajax' ] );
	}

	public function aio_generate_2fa_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio' ) );
		}
		
		$user = wp_get_current_user();
		$site_name = preg_replace('/[^a-zA-Z0-9]+/', '', get_bloginfo('name'));
		$secret = AIO_TOTP::generate_secret();
		$qr_url = AIO_TOTP::get_qr_url($site_name, $user->user_login, $secret);
		
		wp_send_json_success([
			'secret' => $secret,
			'qr_url' => $qr_url
		]);
	}

	public function aio_verify_2fa_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio' ) );
		}
		
		$code = isset($_POST['code']) ? sanitize_text_field($_POST['code']) : '';
		$secret = isset($_POST['secret']) ? sanitize_text_field($_POST['secret']) : '';
		
		if ( empty($code) || empty($secret) ) {
			wp_send_json_error( __( 'Missing information!', 'aio' ) );
		}
		
		$is_valid = AIO_TOTP::verify_code($secret, $code);
		
		if ( $is_valid ) {
			$user_id = get_current_user_id();
			update_user_meta( $user_id, '_aio_2fa_secret', $secret );
			update_user_meta( $user_id, '_aio_2fa_enabled', true );
			wp_send_json_success( __( 'Successfully activated!', 'aio' ) );
		} else {
			wp_send_json_error( __( 'Invalid 6-digit code! Please try again.', 'aio' ) );
		}
	}

	public function aio_disable_2fa_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio' ) );
		}
		
		$user_id = get_current_user_id();
		delete_user_meta( $user_id, '_aio_2fa_enabled' );
		delete_user_meta( $user_id, '_aio_2fa_secret' );
		
		wp_send_json_success( __( 'Successfully disabled!', 'aio' ) );
	}

	public function aio_unblock_ip_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio' ) );
		}
		
		$ip = isset($_POST['ip']) ? sanitize_text_field($_POST['ip']) : '';
		if (empty($ip)) {
			wp_send_json_error( __( 'Invalid IP', 'aio' ) );
		}

		global $wpdb;
		$lockouts_table = $wpdb->prefix . 'aio_lockouts';
		$wpdb->delete($lockouts_table, ['ip_address' => $ip], ['%s']);

		// Also delete the transient
		delete_transient('aio_lockout_' . md5($ip));
		delete_transient('aio_login_attempts_' . md5($ip));

		wp_send_json_success( __( 'IP has been unblocked successfully!', 'aio' ) );
	}
}