<?php
// If this file is called directly, abort.
if ( ! defined( 'WPINC' ) ) {
	die;
}

class AIO_Utility_Admin {

	public function __construct() {
		add_action( 'wp_ajax_aio_start_bulk_webp', [ $this, 'aio_start_bulk_webp_ajax' ] );
		add_action( 'wp_ajax_aio_get_webp_bulk_status', [ $this, 'aio_get_webp_bulk_status_ajax' ] );
		add_action( 'wp_ajax_aio_stop_bulk_webp', [ $this, 'aio_stop_bulk_webp_ajax' ] );
		add_action( 'wp_ajax_aio_update_redirect_rules', [ $this, 'aio_update_redirect_rules_ajax' ] );
		add_action( 'wp_ajax_aio_clear_404_logs', [ $this, 'aio_clear_404_logs_ajax' ] );
		add_action( 'wp_ajax_aio_scan_file_integrity', [ $this, 'aio_scan_file_integrity_ajax' ] );
		add_action( 'wp_ajax_aio_scan_malware', [ $this, 'aio_scan_malware_ajax' ] );
	}

	public function aio_start_bulk_webp_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		global $wpdb;
		$query = "
			SELECT p.ID
			FROM {$wpdb->posts} p
			LEFT JOIN {$wpdb->postmeta} pm
				ON ( p.ID = pm.post_id AND pm.meta_key = '_aio_webp_converted' )
			WHERE p.post_type = 'attachment'
			AND p.post_mime_type IN ('image/jpeg', 'image/png')
			AND ( pm.meta_value IS NULL OR pm.meta_value = '' OR pm.meta_value = '0' )
		";

		// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
		$convertible_ids = array_map( 'intval', (array) $wpdb->get_col( $query ) );

		if ( empty( $convertible_ids ) ) {
			wp_send_json_error( __( 'No convertible images found. Everything is already optimized!', 'aio-tools' ) );
		}

		$stats = [
			'queue'          => $convertible_ids,
			'processed'      => 0,
			'total'          => count( $convertible_ids ),
			'original_bytes' => 0,
			'webp_bytes'     => 0,
			'is_running'     => true,
		];
		update_option( 'aio_webp_bulk_stats', $stats, false );

		if ( ! wp_next_scheduled( 'aio_process_webp_bulk_queue' ) ) {
			wp_schedule_event( time(), 'aio_every_minute', 'aio_process_webp_bulk_queue' );
		}

		wp_send_json_success( $stats );
	}

	public function aio_get_webp_bulk_status_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		$stats = get_option( 'aio_webp_bulk_stats', false );
		if ( ! $stats ) {
			wp_send_json_success( [ 'is_running' => false, 'processed' => 0, 'total' => 0 ] );
		}

		wp_send_json_success( $stats );
	}

	public function aio_stop_bulk_webp_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		$stats = get_option( 'aio_webp_bulk_stats', false );
		if ( $stats ) {
			$stats['is_running'] = false;
			$stats['queue']      = [];
			update_option( 'aio_webp_bulk_stats', $stats, false );
		}

		wp_clear_scheduled_hook( 'aio_process_webp_bulk_queue' );
		wp_send_json_success();
	}

	public function aio_update_redirect_rules_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
		$raw_rules = isset( $_POST['rules'] ) ? $_POST['rules'] : '';
		$rules     = json_decode( wp_unslash( $raw_rules ), true );
		if ( ! is_array( $rules ) && ! empty( $raw_rules ) ) {
			$rules = json_decode( $raw_rules, true );
		}
		if ( ! is_array( $rules ) ) {
			$rules = [];
		}

		$sanitized_rules = [];
		foreach ( $rules as $old => $new ) {
			$clean_old = '/' . ltrim( sanitize_text_field( (string) $old ), '/' );
			$raw_new   = trim( (string) $new );
			if ( $clean_old === '/' || $raw_new === '' ) {
				continue;
			}
			if ( preg_match( '#^https?://#i', $raw_new ) ) {
				$clean_new = esc_url_raw( $raw_new );
			} else {
				$clean_new = '/' . ltrim( sanitize_text_field( $raw_new ), '/' );
			}
			if ( ! empty( $clean_new ) ) {
				$sanitized_rules[ $clean_old ] = $clean_new;
			}
		}

		update_option( 'aio_redirect_rules', $sanitized_rules );
		wp_send_json_success( $sanitized_rules );
	}

	public function aio_clear_404_logs_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		global $wpdb;
		$table_name = $wpdb->prefix . 'aio_404_logs';
		if ( $wpdb->get_var( $wpdb->prepare( 'SHOW TABLES LIKE %s', $table_name ) ) === $table_name ) {
			// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
			$wpdb->query( "TRUNCATE TABLE {$table_name}" );
		}
		delete_option( 'aio_404_logs' );

		wp_send_json_success( __( '404 logs cleared successfully!', 'aio-tools' ) );
	}

	public function aio_scan_file_integrity_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		if ( ! function_exists( 'aio_scan_core_files' ) ) {
			require_once AIO_MODULES_PATH . 'security/public-security.php';
		}

		$result = aio_scan_core_files();
		if ( $result['success'] ) {
			wp_send_json_success( $result['modified'] );
		} else {
			wp_send_json_error( $result['message'] );
		}
	}

	public function aio_scan_malware_ajax() {
		check_ajax_referer( 'aio-settings-nonce', 'security' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( __( 'Unauthorized', 'aio-tools' ) );
		}

		$wp_content_dir  = wp_normalize_path( WP_CONTENT_DIR );
		$uploads_info    = wp_upload_dir();
		$uploads_basedir = ! empty( $uploads_info['basedir'] ) ? wp_normalize_path( $uploads_info['basedir'] ) : $wp_content_dir . '/uploads';
		$self_plugin_dir = wp_normalize_path( AIO_PATH );
		$abspath_norm    = wp_normalize_path( ABSPATH );

		$suspicious_files = [];
		$php_extensions   = [ 'php', 'phtml', 'php3', 'php4', 'php5', 'php7', 'php8', 'phar' ];

		// High-signal malware / webshell patterns (low false-positive rate)
		$patterns = [
			'eval\s*\(\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|\$_)',
			'base64_decode\s*\(\s*[\'"][A-Za-z0-9+\/=]{80,}',
			'(?:shell_exec|passthru|proc_open|popen)\s*\(',
			'assert\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE)',
			'\$_(?:GET|POST|REQUEST|COOKIE)\s*\[[^\]]+\]\s*\(',
			'create_function\s*\(',
			'preg_replace\s*\(\s*[\'"].+\/[a-z]*e[a-z]*[\'"]',
		];
		$regex = '/' . implode( '|', $patterns ) . '/i';

		try {
			$dir_iterator = new RecursiveDirectoryIterator( $wp_content_dir, RecursiveDirectoryIterator::SKIP_DOTS );
			$iterator     = new RecursiveIteratorIterator( $dir_iterator, RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD );

			$count     = 0;
			$max_files = 10000;

			foreach ( $iterator as $file ) {
				if ( $count >= $max_files ) {
					break;
				}
				if ( ! $file->isFile() ) {
					continue;
				}

				$ext = strtolower( $file->getExtension() );
				if ( ! in_array( $ext, $php_extensions, true ) ) {
					continue;
				}

				$filepath = wp_normalize_path( $file->getPathname() );

				// Skip cache, upgrade temp directories, and AIO Tools itself
				if (
					strpos( $filepath, '/cache/' ) !== false ||
					strpos( $filepath, '/aio-cache/' ) !== false ||
					strpos( $filepath, '/upgrade/' ) !== false ||
					strpos( $filepath, $self_plugin_dir ) === 0
				) {
					continue;
				}

				$count++;
				$rel_path   = ltrim( str_replace( $abspath_norm, '', $filepath ), '/' );
				$in_uploads = strpos( $filepath, $uploads_basedir . '/' ) === 0;

				// Any non-stub PHP file inside wp-content/uploads is highly suspicious
				if ( $in_uploads ) {
					$size    = $file->getSize();
					$content = $size <= 524288 ? @file_get_contents( $filepath ) : '';
					$trimmed = is_string( $content ) ? trim( $content ) : '';
					// Allow standard WordPress empty index.php stub ("<?php\n// Silence is golden.")
					if ( basename( $filepath ) === 'index.php' && $size <= 64 && preg_match( '/^<\?php\s*(\/\/\s*Silence is golden\.?)?\s*(\?>)?$/i', $trimmed ) ) {
						continue;
					}
					$suspicious_files[] = [
						'file'  => $rel_path,
						'line'  => 1,
						'match' => __( 'Executable PHP file inside uploads directory', 'aio-tools' ),
					];
					continue;
				}

				// Skip oversized files > 2MB
				if ( $file->getSize() > 2097152 ) {
					continue;
				}

				$content = @file_get_contents( $filepath );
				if ( is_string( $content ) && $content !== '' && preg_match( $regex, $content, $matches, PREG_OFFSET_CAPTURE ) ) {
					$offset   = (int) $matches[0][1];
					$line_num = substr_count( substr( $content, 0, $offset ), "\n" ) + 1;

					$suspicious_files[] = [
						'file'  => $rel_path,
						'line'  => $line_num,
						'match' => substr( $matches[0][0], 0, 60 ),
					];
				}
			}

			wp_send_json_success( $suspicious_files );
		} catch ( Exception $e ) {
			wp_send_json_error( $e->getMessage() );
		}
	}
}