<?php
/**
 * Activity log: records security events into the capped log table (see AjSec\Log).
 *
 * @package AjSec
 */

namespace AjSec\Features;

use AjSec\Log;
use AjSec\Settings;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Records logins, failed logins and settings changes. Lockouts, firewall blocks and scans are
 * written by their own modules through AjSec\Log, which checks the same switch.
 */
class ActivityLog extends Feature {

	/**
	 * {@inheritDoc}
	 */
	public function id() {
		return 'activity_log';
	}

	/**
	 * {@inheritDoc}
	 */
	public function label() {
		return __( 'Activity log', '007aj-security-scanner-firewall' );
	}

	/**
	 * {@inheritDoc}
	 */
	public function description() {
		/* translators: %d: maximum number of log rows. */
		return sprintf( __( 'Records logins, failed logins, lockouts, firewall blocks, scans and setting changes. Keeps the newest %d entries.', '007aj-security-scanner-firewall' ), Log::MAX_ROWS );
	}

	/**
	 * {@inheritDoc}
	 */
	public function register() {
		add_action( 'wp_login', array( $this, 'login' ), 10, 2 );
		add_action( 'wp_login_failed', array( $this, 'login_failed' ), 10, 2 );
	}

	/**
	 * Settings changes are logged even while the log is being turned on or off, so this hook is
	 * registered whatever the switch says (Log::add() still checks it).
	 */
	public static function watch_settings() {
		add_action( 'update_option_' . Settings::OPTION, array( __CLASS__, 'settings_changed' ), 10, 2 );
	}

	/**
	 * Successful login.
	 *
	 * @param string   $user_login Username.
	 * @param \WP_User $user       User.
	 */
	public function login( $user_login, $user = null ) {
		Log::add( 'login_success', '', $user instanceof \WP_User ? (int) $user->ID : 0, (string) $user_login );
	}

	/**
	 * Failed login.
	 *
	 * @param string         $username Username or email entered.
	 * @param \WP_Error|null $error    Error.
	 */
	public function login_failed( $username, $error = null ) {
		$detail = '';
		if ( $error instanceof \WP_Error ) {
			$detail = in_array( LoginLockout::ERROR, $error->get_error_codes(), true )
				? __( 'Refused: IP address is locked out', '007aj-security-scanner-firewall' )
				: sanitize_key( $error->get_error_code() );
		}
		Log::add( 'login_failed', $detail, 0, (string) $username );
	}

	/**
	 * Settings change.
	 *
	 * @param mixed $old_value Old value.
	 * @param mixed $new_value New value.
	 */
	public static function settings_changed( $old_value, $new_value ) {
		$old_value = is_array( $old_value ) ? $old_value : array();
		$new_value = is_array( $new_value ) ? $new_value : array();
		$changed   = array();
		foreach ( $new_value as $key => $value ) {
			if ( ! isset( $old_value[ $key ] ) || (string) $old_value[ $key ] !== (string) $value ) {
				$changed[] = $key . '=' . $value;
			}
		}
		if ( $changed ) {
			/* translators: %s: list of changed settings. */
			Log::add( 'settings_changed', sprintf( __( 'Changed: %s', '007aj-security-scanner-firewall' ), implode( ', ', $changed ) ), get_current_user_id() );
		}
	}
}