<?php
/**
 * Settings storage (single option, registered with the WordPress settings screen).
 *
 * @package AjSec
 */

namespace AjSec;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Settings.
 */
final class Settings {

	const OPTION = 'ajsec_settings';
	const GROUP  = 'ajsec_settings_group';

	/**
	 * Hooks.
	 */
	public static function init() {
		add_action( 'admin_init', array( __CLASS__, 'register' ) );
	}

	/**
	 * Default values. Every protection starts off until the site owner turns it on.
	 *
	 * @return array
	 */
	public static function defaults() {
		return array(
			'delete_data'          => 0,
			// Login lockout.
			'login_lockout'        => 0,
			'lockout_attempts'     => 5,
			'lockout_window'       => 15,
			'lockout_duration'     => 30,
			'lockout_email'        => 0,
			// Firewall (lite).
			'waf_lite'             => 0,
			'waf_xmlrpc_off'       => 0,
			'waf_login_rate'       => 0,
			'waf_login_rate_max'   => 20,
			'waf_login_rate_win'   => 5,
			// Hardening.
			'harden_file_edit'     => 0,
			'harden_user_enum'     => 0,
			'harden_generator'     => 0,
			'harden_app_passwords' => 0,
			// Activity log.
			'activity_log'         => 0,
		);
	}

	/**
	 * Numeric settings: key => array( min, max ).
	 *
	 * @return array
	 */
	public static function ranges() {
		return array(
			'lockout_attempts'   => array( 2, 50 ),
			'lockout_window'     => array( 1, 1440 ),
			'lockout_duration'   => array( 1, 10080 ),
			'waf_login_rate_max' => array( 3, 500 ),
			'waf_login_rate_win' => array( 1, 60 ),
		);
	}

	/**
	 * All settings merged with defaults.
	 *
	 * @return array
	 */
	public static function all() {
		$saved = get_option( self::OPTION, array() );
		return array_merge( self::defaults(), is_array( $saved ) ? $saved : array() );
	}

	/**
	 * One setting.
	 *
	 * @param string $key Setting key.
	 * @return mixed
	 */
	public static function get( $key ) {
		$all = self::all();
		return isset( $all[ $key ] ) ? $all[ $key ] : null;
	}

	/**
	 * One numeric setting, clamped to its range.
	 *
	 * @param string $key Setting key.
	 * @return int
	 */
	public static function int( $key ) {
		$value  = (int) self::get( $key );
		$ranges = self::ranges();
		if ( isset( $ranges[ $key ] ) ) {
			$value = max( $ranges[ $key ][0], min( $ranges[ $key ][1], $value ) );
		}
		return $value;
	}

	/**
	 * Register the option.
	 */
	public static function register() {
		register_setting(
			self::GROUP,
			self::OPTION,
			array(
				'type'              => 'array',
				'sanitize_callback' => array( __CLASS__, 'sanitize' ),
				'default'           => self::defaults(),
				'show_in_rest'      => false,
			)
		);
	}

	/**
	 * Sanitize submitted settings. Only known keys survive. Flags become 0/1; numbers are clamped.
	 *
	 * @param mixed $input Raw input.
	 * @return array
	 */
	public static function sanitize( $input ) {
		$input  = is_array( $input ) ? $input : array();
		$ranges = self::ranges();
		$clean  = array();
		foreach ( self::defaults() as $key => $default ) {
			if ( isset( $ranges[ $key ] ) ) {
				$value         = isset( $input[ $key ] ) && is_scalar( $input[ $key ] ) ? (int) $input[ $key ] : $default;
				$clean[ $key ] = max( $ranges[ $key ][0], min( $ranges[ $key ][1], $value ) );
			} else {
				$clean[ $key ] = empty( $input[ $key ] ) ? 0 : 1;
			}
		}
		return $clean;
	}
}