<?php
// If this file is called directly, abort.
if ( ! defined( 'WPINC' ) ) {
	die;
}

class AIO_Security_Admin {

	public function __construct() {
		add_action( 'wp_ajax_aio_generate_2fa', [ $this, 'aio_generate_2fa_ajax' ] );
		add_action( 'wp_ajax_aio_verify_2fa', [ $this, 'aio_verify_2fa_ajax' ] );
		add_action( 'wp_ajax_aio_disable_2fa', [ $this, 'aio_disable_2fa_ajax' ] );
		add_action( 'wp_ajax_aio_regenerate_2fa_backup', [ $this, 'aio_regenerate_2fa_backup_ajax' ] );
		add_action( 'wp_ajax_aio_unblock_ip', [ $this, 'aio_unblock_ip_ajax' ] );
		add_action( 'wp_ajax_aio_block_ip', [ $this, 'aio_block_ip_ajax' ] );
		add_action( 'wp_ajax_aio_unlink_social', [ $this, 'aio_unlink_social_ajax' ] );

		add_action( 'show_user_profile', [ $this, 'render_user_profile_security_section' ] );
		add_action( 'edit_user_profile', [ $this, 'render_admin_edit_user_security_section' ] );
	}

	/**
	 * Verify 2FA AJAX nonce & capability (allows admins on Security Tab AND privileged staff on profile.php).
	 */
	private function verify_2fa_user_access() {
		$nonce = isset( $_POST['security'] ) ? sanitize_text_field( wp_unslash( $_POST['security'] ) ) : '';
		if ( ! wp_verify_nonce( $nonce, 'aio-settings-nonce' ) && ! wp_verify_nonce( $nonce, 'aio-profile-security-nonce' ) ) {
			wp_send_json_error( __( 'Security check failed. Please reload the page.', 'aio-tools' ) );
		}

		if ( ! is_user_logged_in() || ( ! current_user_can( 'manage_options' ) && ! current_user_can( 'edit_posts' ) && ! current_user_can( 'manage_woocommerce' ) ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}
	}

	public function aio_generate_2fa_ajax() {
		$this->verify_2fa_user_access();

		$user      = wp_get_current_user();
		$site_name = wp_strip_all_tags( get_bloginfo( 'name' ) );
		if ( empty( $site_name ) ) {
			$site_name = 'WordPress';
		}

		$secret      = AIO_TOTP::generate_secret();
		$otpauth_uri = AIO_TOTP::get_otpauth_uri( $site_name, $user->user_login, $secret );

		// Store pending secret server-side (encrypted) for 15 minutes — never trust secret from POST on verify
		set_transient( 'aio_2fa_pending_' . $user->ID, AIO_Crypto::encrypt( $secret ), 15 * MINUTE_IN_SECONDS );

		wp_send_json_success( [
			'secret'      => $secret,
			'otpauth_uri' => $otpauth_uri,
		] );
	}

	public function aio_verify_2fa_ajax() {
		$this->verify_2fa_user_access();

		$user_id       = get_current_user_id();
		$code          = isset( $_POST['code'] ) ? sanitize_text_field( wp_unslash( $_POST['code'] ) ) : '';
		$encrypted_tmp = get_transient( 'aio_2fa_pending_' . $user_id );
		$secret        = ! empty( $encrypted_tmp ) ? AIO_Crypto::decrypt( $encrypted_tmp ) : '';

		if ( empty( $code ) || empty( $secret ) ) {
			wp_send_json_error( __( '2FA setup session expired or missing code. Please click Setup 2FA again.', 'aio-tools' ) );
		}

		$matched_slice = null;
		$is_valid      = AIO_TOTP::verify_code( $secret, $code, 1, $matched_slice );

		if ( $is_valid ) {
			$backup = AIO_TOTP::generate_backup_codes( 8 );

			update_user_meta( $user_id, '_aio_2fa_secret', AIO_Crypto::encrypt( $secret ) );
			update_user_meta( $user_id, '_aio_2fa_enabled', 1 );
			update_user_meta( $user_id, '_aio_2fa_last_slice', (int) $matched_slice );
			update_user_meta( $user_id, '_aio_2fa_backup_codes', $backup['hashes'] );
			delete_transient( 'aio_2fa_pending_' . $user_id );

			wp_send_json_success( [
				'message'      => __( '2FA successfully activated! Please save your recovery codes below.', 'aio-tools' ),
				'backup_codes' => $backup['plain'],
			] );
		} else {
			wp_send_json_error( __( 'Invalid 6-digit code! Please check your authenticator app and try again.', 'aio-tools' ) );
		}
	}

	public function aio_regenerate_2fa_backup_ajax() {
		$this->verify_2fa_user_access();

		$user_id = get_current_user_id();
		if ( ! get_user_meta( $user_id, '_aio_2fa_enabled', true ) ) {
			wp_send_json_error( __( '2FA is not enabled on your account.', 'aio-tools' ) );
		}

		$backup = AIO_TOTP::generate_backup_codes( 8 );
		update_user_meta( $user_id, '_aio_2fa_backup_codes', $backup['hashes'] );

		wp_send_json_success( [
			'message'      => __( 'New recovery codes generated! Previous recovery codes have been invalidated.', 'aio-tools' ),
			'backup_codes' => $backup['plain'],
		] );
	}

	public function aio_disable_2fa_ajax() {
		$this->verify_2fa_user_access();

		$target_user_id = get_current_user_id();
		if ( ! empty( $_POST['target_user_id'] ) && current_user_can( 'manage_options' ) ) {
			$target_user_id = absint( $_POST['target_user_id'] );
		}

		delete_user_meta( $target_user_id, '_aio_2fa_enabled' );
		delete_user_meta( $target_user_id, '_aio_2fa_secret' );
		delete_user_meta( $target_user_id, '_aio_2fa_backup_codes' );
		delete_user_meta( $target_user_id, '_aio_2fa_last_slice' );
		delete_transient( 'aio_2fa_pending_' . $target_user_id );

		wp_send_json_success( __( 'Successfully disabled!', 'aio-tools' ) );
	}

	public function aio_unblock_ip_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		$ip = isset( $_POST['ip'] ) ? sanitize_text_field( wp_unslash( $_POST['ip'] ) ) : '';
		if ( empty( $ip ) ) {
			wp_send_json_error( __( 'Invalid IP', 'aio-tools' ) );
		}

		global $wpdb;
		$lockouts_table = $wpdb->prefix . 'aio_lockouts';
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
		$wpdb->delete( $lockouts_table, [ 'ip_address' => $ip ], [ '%s' ] );

		delete_transient( 'aio_lockout_' . md5( $ip ) );
		delete_transient( 'aio_login_attempts_' . md5( $ip ) );

		wp_send_json_success( __( 'IP has been unblocked successfully!', 'aio-tools' ) );
	}

	public function aio_block_ip_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		$ip       = isset( $_POST['ip'] ) ? trim( sanitize_text_field( wp_unslash( $_POST['ip'] ) ) ) : '';
		$duration = isset( $_POST['duration'] ) ? sanitize_text_field( wp_unslash( $_POST['duration'] ) ) : 'permanent';
		$reason   = isset( $_POST['reason'] ) ? sanitize_text_field( wp_unslash( $_POST['reason'] ) ) : __( 'Manual Admin Block', 'aio-tools' );

		if ( empty( $ip ) || false === filter_var( $ip, FILTER_VALIDATE_IP ) ) {
			wp_send_json_error( __( 'Please enter a valid IPv4 or IPv6 address.', 'aio-tools' ) );
		}

		if ( function_exists( 'aio_get_client_ip' ) && $ip === aio_get_client_ip() ) {
			wp_send_json_error( __( 'You cannot block your own current IP address.', 'aio-tools' ) );
		}

		$expires_at = '2099-12-31 23:59:59';
		if ( is_numeric( $duration ) && (int) $duration > 0 ) {
			$expires_at = wp_date( 'Y-m-d H:i:s', time() + ( (int) $duration * MINUTE_IN_SECONDS ) );
		}

		global $wpdb;
		$lockouts_table = $wpdb->prefix . 'aio_lockouts';
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
		$wpdb->delete( $lockouts_table, [ 'ip_address' => $ip ], [ '%s' ] );
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
		$wpdb->insert(
			$lockouts_table,
			[
				'ip_address' => substr( $ip, 0, 45 ),
				'reason'     => substr( $reason ?: 'Manual Admin Block', 0, 255 ),
				'blocked_at' => current_time( 'mysql' ),
				'expires_at' => $expires_at,
			],
			[ '%s', '%s', '%s', '%s' ]
		);

		wp_send_json_success( [
			'message'    => __( 'IP address blocked successfully.', 'aio-tools' ),
			'ip_address' => $ip,
			'reason'     => $reason ?: 'Manual Admin Block',
			'blocked_at' => current_time( 'mysql' ),
			'expires_at' => $expires_at,
		] );
	}

	public function aio_unlink_social_ajax() {
		$nonce = isset( $_POST['security'] ) ? sanitize_text_field( wp_unslash( $_POST['security'] ) ) : '';
		if ( ! wp_verify_nonce( $nonce, 'aio-profile-security-nonce' ) && ! wp_verify_nonce( $nonce, 'aio-settings-nonce' ) ) {
			wp_send_json_error( __( 'Security check failed.', 'aio-tools' ) );
		}
		if ( ! is_user_logged_in() ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		$provider = isset( $_POST['provider'] ) ? sanitize_key( wp_unslash( $_POST['provider'] ) ) : '';
		if ( ! in_array( $provider, [ 'google', 'facebook' ], true ) ) {
			wp_send_json_error( __( 'Invalid social provider.', 'aio-tools' ) );
		}

		delete_user_meta( get_current_user_id(), 'aio_social_' . $provider . '_id' );
		wp_send_json_success( __( 'Social account unlinked successfully.', 'aio-tools' ) );
	}

	/**
	 * Render 2FA setup & Social Account unlinking on WordPress User Profile (profile.php).
	 */
	public function render_user_profile_security_section( $user ) {
		$can_use_2fa   = aio_is_module_active( 'opt-module-security' ) && ( user_can( $user, 'manage_options' ) || user_can( $user, 'edit_posts' ) || user_can( $user, 'manage_woocommerce' ) );
		$social_active = aio_is_module_active( 'opt-module-social-login' );
		$google_id     = get_user_meta( $user->ID, 'aio_social_google_id', true );
		$facebook_id   = get_user_meta( $user->ID, 'aio_social_facebook_id', true );

		if ( ! $can_use_2fa && ! $social_active && empty( $google_id ) && empty( $facebook_id ) ) {
			return;
		}

		$is_2fa_enabled = (bool) get_user_meta( $user->ID, '_aio_2fa_enabled', true );
		$profile_nonce  = wp_create_nonce( 'aio-profile-security-nonce' );
		?>
		<h2><?php esc_html_e( 'AIO Tools — Account Security & Social Login', 'aio-tools' ); ?></h2>
		<table class="form-table" role="presentation">
			<?php if ( $can_use_2fa ) : ?>
			<tr>
				<th scope="row"><?php esc_html_e( 'Two-Factor Authentication (2FA)', 'aio-tools' ); ?></th>
				<td>
					<?php if ( $is_2fa_enabled ) : ?>
						<p style="color:#059669; font-weight:600; margin-bottom:10px;">&#10003; <?php esc_html_e( '2FA is currently ACTIVE on your account.', 'aio-tools' ); ?></p>
						<button type="button" class="button" id="aio-prof-regen-2fa"><?php esc_html_e( 'Regenerate Recovery Codes', 'aio-tools' ); ?></button>
						<button type="button" class="button" id="aio-prof-disable-2fa" style="color:#dc2626; border-color:#fca5a5; margin-left:6px;"><?php esc_html_e( 'Disable 2FA', 'aio-tools' ); ?></button>
					<?php else : ?>
						<p class="description" style="margin-bottom:10px;"><?php esc_html_e( 'Protect your account with a 6-digit code from Google Authenticator, Authy, or 1Password.', 'aio-tools' ); ?></p>
						<button type="button" class="button button-primary" id="aio-prof-setup-2fa"><?php esc_html_e( 'Set Up 2FA Authenticator', 'aio-tools' ); ?></button>
						<div id="aio-prof-2fa-setup-box" style="display:none; margin-top:15px; padding:16px; background:#fff; border:1px solid #cbd5e1; border-radius:8px; max-width:440px;">
							<p style="margin-top:0; font-weight:600;"><?php esc_html_e( '1. Scan this QR code or enter the secret key in your Authenticator app:', 'aio-tools' ); ?></p>
							<div id="aio-prof-2fa-qr" style="margin:12px 0;"></div>
							<p><code style="word-break:break-all;"><strong id="aio-prof-2fa-secret"></strong></code></p>
							<p style="font-weight:600; margin-bottom:6px;"><?php esc_html_e( '2. Enter the 6-digit verification code:', 'aio-tools' ); ?></p>
							<div style="display:flex; gap:8px; align-items:center; flex-wrap:wrap;">
								<input type="text" id="aio-prof-2fa-code" class="regular-text" style="max-width:160px; text-align:center; letter-spacing:2px; font-family:monospace;" maxlength="6" placeholder="000000">
								<button type="button" class="button button-primary" id="aio-prof-verify-2fa"><?php esc_html_e( 'Verify & Activate', 'aio-tools' ); ?></button>
							</div>
						</div>
					<?php endif; ?>
					<div id="aio-prof-2fa-backup-box" style="display:none; margin-top:14px; padding:14px; background:#f8fafc; border:1px solid #94a3b8; border-radius:8px; max-width:440px;">
						<p style="margin-top:0; font-weight:600; color:#0f172a;"><?php esc_html_e( 'Save Your Recovery Codes (One-Time Display):', 'aio-tools' ); ?></p>
						<pre id="aio-prof-2fa-backup-list" style="background:#fff; padding:10px; border:1px solid #e2e8f0; font-size:13px;"></pre>
					</div>
				</td>
			</tr>
			<?php endif; ?>

			<?php if ( $social_active || ! empty( $google_id ) || ! empty( $facebook_id ) ) : ?>
			<tr>
				<th scope="row"><?php esc_html_e( 'Linked Social Accounts', 'aio-tools' ); ?></th>
				<td>
					<div style="display:flex; flex-direction:column; gap:8px;">
						<div>
							<strong>Google:</strong>
							<?php if ( ! empty( $google_id ) ) : ?>
								<span style="color:#059669; margin:0 8px;"><?php esc_html_e( 'Connected', 'aio-tools' ); ?></span>
								<button type="button" class="button button-small aio-prof-unlink-social" data-provider="google"><?php esc_html_e( 'Unlink', 'aio-tools' ); ?></button>
							<?php else : ?>
								<span style="color:#64748b; margin-left:8px;"><?php esc_html_e( 'Not linked', 'aio-tools' ); ?></span>
							<?php endif; ?>
						</div>
						<div>
							<strong>Facebook:</strong>
							<?php if ( ! empty( $facebook_id ) ) : ?>
								<span style="color:#059669; margin:0 8px;"><?php esc_html_e( 'Connected', 'aio-tools' ); ?></span>
								<button type="button" class="button button-small aio-prof-unlink-social" data-provider="facebook"><?php esc_html_e( 'Unlink', 'aio-tools' ); ?></button>
							<?php else : ?>
								<span style="color:#64748b; margin-left:8px;"><?php esc_html_e( 'Not linked', 'aio-tools' ); ?></span>
							<?php endif; ?>
						</div>
					</div>
				</td>
			</tr>
			<?php endif; ?>
		</table>
		<?php
		if ( $can_use_2fa && ! $is_2fa_enabled ) {
			wp_enqueue_script( 'aio-qrcode', AIO_URL . 'assets/js/vendor/qrcode.min.js', [], AIO_VERSION, true );
		}
		?>
		<script>
		jQuery(function($) {
			var nonce = <?php echo wp_json_encode( $profile_nonce ); ?>;
			$('#aio-prof-setup-2fa').on('click', function() {
				var $btn = $(this).prop('disabled', true);
				$.post(ajaxurl, { action: 'aio_generate_2fa', security: nonce }, function(res) {
					$btn.prop('disabled', false);
					if (res && res.success) {
						$('#aio-prof-2fa-secret').text(res.data.secret);
						$('#aio-prof-2fa-qr').empty();
						if (typeof QRCode !== 'undefined') {
							new QRCode(document.getElementById('aio-prof-2fa-qr'), { text: res.data.otpauth_uri, width: 160, height: 160 });
						}
						$('#aio-prof-2fa-setup-box').slideDown(150);
					} else {
						alert((res && res.data) ? res.data : 'Error');
					}
				});
			});
			$('#aio-prof-verify-2fa').on('click', function() {
				var code = $('#aio-prof-2fa-code').val();
				$.post(ajaxurl, { action: 'aio_verify_2fa', security: nonce, code: code }, function(res) {
					if (res && res.success) {
						$('#aio-prof-2fa-setup-box').hide();
						$('#aio-prof-2fa-backup-list').text((res.data.backup_codes || []).join('\n'));
						$('#aio-prof-2fa-backup-box').show();
					} else {
						alert((res && res.data) ? res.data : 'Invalid code');
					}
				});
			});
			$('#aio-prof-regen-2fa').on('click', function() {
				$.post(ajaxurl, { action: 'aio_regenerate_2fa_backup', security: nonce }, function(res) {
					if (res && res.success) {
						$('#aio-prof-2fa-backup-list').text((res.data.backup_codes || []).join('\n'));
						$('#aio-prof-2fa-backup-box').show();
					}
				});
			});
			$('#aio-prof-disable-2fa').on('click', function() {
				if (!confirm(<?php echo wp_json_encode( __( 'Disable Two-Factor Authentication for your account?', 'aio-tools' ) ); ?>)) return;
				$.post(ajaxurl, { action: 'aio_disable_2fa', security: nonce }, function(res) {
					if (res && res.success) location.reload();
				});
			});
			$('.aio-prof-unlink-social').on('click', function() {
				var provider = $(this).data('provider');
				$.post(ajaxurl, { action: 'aio_unlink_social', security: nonce, provider: provider }, function(res) {
					if (res && res.success) location.reload();
				});
			});
		});
		</script>
		<?php
	}

	/**
	 * Allow Administrators editing another user's profile (user-edit.php) to reset a locked-out staff member's 2FA.
	 */
	public function render_admin_edit_user_security_section( $user ) {
		if ( ! current_user_can( 'manage_options' ) || ! aio_is_module_active( 'opt-module-security' ) ) {
			return;
		}
		$is_2fa_enabled = (bool) get_user_meta( $user->ID, '_aio_2fa_enabled', true );
		if ( ! $is_2fa_enabled ) {
			return;
		}
		$profile_nonce = wp_create_nonce( 'aio-profile-security-nonce' );
		?>
		<h2><?php esc_html_e( 'AIO Tools — Account Security', 'aio-tools' ); ?></h2>
		<table class="form-table" role="presentation">
			<tr>
				<th scope="row"><?php esc_html_e( 'Two-Factor Authentication (2FA)', 'aio-tools' ); ?></th>
				<td>
					<p style="color:#059669; font-weight:600; margin-bottom:8px;">&#10003; <?php esc_html_e( '2FA is enabled for this user.', 'aio-tools' ); ?></p>
					<button type="button" class="button" id="aio-admin-reset-user-2fa" style="color:#dc2626; border-color:#fca5a5;"><?php esc_html_e( 'Reset / Disable 2FA for This User', 'aio-tools' ); ?></button>
					<script>
					jQuery(function($){
						$('#aio-admin-reset-user-2fa').on('click', function(){
							if (!confirm(<?php echo wp_json_encode( __( 'Reset Two-Factor Authentication for this user?', 'aio-tools' ) ); ?>)) return;
							$.post(ajaxurl, { action: 'aio_disable_2fa', security: <?php echo wp_json_encode( $profile_nonce ); ?>, target_user_id: <?php echo (int) $user->ID; ?> }, function(res){
								if (res && res.success) location.reload();
							});
						});
					});
					</script>
				</td>
			</tr>
		</table>
		<?php
	}
}