<?php
/**
 * Admin form handlers (admin-post.php). Each checks the capability and a nonce.
 *
 * @package AjSec
 */

namespace AjSec\Admin;

use AjSec\Features\LoginLockout;
use AjSec\Log;
use AjSec\Plugin;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Admin actions.
 */
final class Actions {

	const UNLOCK    = 'ajsec_unlock';
	const CLEAR_LOG = 'ajsec_clear_log';

	/**
	 * Hooks.
	 */
	public static function init() {
		add_action( 'admin_post_' . self::UNLOCK, array( __CLASS__, 'unlock' ) );
		add_action( 'admin_post_' . self::CLEAR_LOG, array( __CLASS__, 'clear_log' ) );
	}

	/**
	 * Capability check (each handler checks its own nonce right after).
	 */
	private static function require_cap() {
		if ( ! current_user_can( Plugin::capability() ) ) {
			wp_die( esc_html__( 'Sorry, you are not allowed to do that.', '007aj-security-scanner-firewall' ), 403 );
		}
	}

	/**
	 * Remove a lockout.
	 */
	public static function unlock() {
		self::require_cap();
		check_admin_referer( self::UNLOCK );
		$ip = isset( $_POST['ip'] ) ? sanitize_text_field( wp_unslash( $_POST['ip'] ) ) : '';
		$ok = filter_var( $ip, FILTER_VALIDATE_IP ) && LoginLockout::unlock( $ip );
		wp_safe_redirect( Menu::url( Menu::SLUG, array( 'ajsec_msg' => $ok ? 'unlocked' : 'not_locked' ) ) );
		exit;
	}

	/**
	 * Empty the log.
	 */
	public static function clear_log() {
		self::require_cap();
		check_admin_referer( self::CLEAR_LOG );
		Log::clear();
		wp_safe_redirect( Menu::url( LogPage::SLUG, array( 'ajsec_msg' => 'log_cleared' ) ) );
		exit;
	}
}