<?php
/**
 * Admin: Form Builder Backend Logic (AJAX and Asset Enqueueing)
 *
 * @package    24TT_Unrestricted_Forms
 * @subpackage 24TT_Unrestricted_Forms/admin
 * @since      1.0.0
 * Contributors: 24techtime, johniouspatriot
 */

// SECURITY FIRST: Prevent Direct Access
if ( ! defined( 'ABSPATH' ) ) {
    exit( 'Direct script access denied.' );
}

/**
 * TT24_Form_Builder Class
 * Handles enqueuing the necessary JavaScript for the drag-and-drop interface,
 * and processes the secure AJAX requests to save the form data to our custom tables.
 */
class TT24_Form_Builder {

    /**
     * Initialize the builder hooks.
     * @since 1.0.0
     * @return void
     */
    public function init() {
        // Enqueue scripts and styles only on our specific admin pages
        add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_assets' ) );

        // Hook for handling the AJAX save request from logged-in users
        add_action( 'wp_ajax_tt24_save_form', array( $this, 'ajax_save_form' ) );
    }

    /**
     * Enqueue the JavaScript and CSS required for the builder.
     * We conditionally load these ONLY on the builder page so we don't bloat the rest of the WP Admin.
     *
     * @since 1.0.0
     * @param string $hook_suffix The current admin page.
     * @return void
     */
    public function enqueue_assets( $hook_suffix ) {
        // Check if we are on the 'Add New Form' or 'Edit Form' page
        // FIX: Updated the check to match our new, reviewer-approved 'tt24-' menu slug prefix
        if ( strpos( $hook_suffix, 'tt24-forms-builder' ) === false ) {
            return; // Exit early if we are not on the builder page
        }

        // Enqueue the admin CSS file to style the builder visually
        wp_enqueue_style( 
            'tt24-admin-css', 
            TT24_FORMS_ASSETS_URL . 'css/admin.css', 
            array(), 
            TT24_FORMS_VERSION 
        );

        // Enqueue the main builder JavaScript file
        wp_enqueue_script( 
            'tt24-builder-js', 
            TT24_FORMS_ASSETS_URL . 'js/builder.js', 
            array( 'jquery' ), // We depend on jQuery for standard WP AJAX
            time(), // BUG FIX: Use time() instead of version to force browser cache to clear
            true // Load in the footer for better performance
        );

        // Localize the script to securely pass the AJAX URL and translatable strings to our JavaScript
        wp_localize_script( 'tt24-builder-js', 'tt24_builder_vars', array(
            'ajax_url'    => admin_url( 'admin-ajax.php' ),
            'error_msg'   => esc_html__( 'An error occurred while saving the form.', '24tt-unrestricted-forms' ),
            'success_msg' => esc_html__( 'Form saved successfully!', '24tt-unrestricted-forms' )
        ) );
    }

    /**
     * Process the AJAX request to save a form.
     * This is the fortress. We validate, sanitize, and prepare everything before it touches the DB.
     *
     * @since 1.0.0
     * @return void
     */
    public function ajax_save_form() {
        global $wpdb;

        // WALL 1: Nonce Verification (Protects against CSRF attacks)
        // 'tt24_save_form_action' matches the nonce we created in view-builder.php
        if ( ! check_ajax_referer( 'tt24_save_form_action', 'security', false ) ) {
            wp_send_json_error( array( 'message' => esc_html__( 'Security check failed. Please refresh the page.', '24tt-unrestricted-forms' ) ) );
        }

        // WALL 2: Capability Check (Role-Based Access Control)
        if ( ! current_user_can( 'manage_tt24_forms' ) ) {
            wp_send_json_error( array( 'message' => esc_html__( 'You do not have permission to build forms.', '24tt-unrestricted-forms' ) ) );
        }

        // WALL 3: Data Sanitization
        // We strict-cast the ID to an absolute integer. If it's new, it will be 0.
        $form_id = isset( $_POST['form_id'] ) ? absint( $_POST['form_id'] ) : 0;
        
        // Sanitize the title to remove any HTML or scripts
        $form_title = isset( $_POST['form_title'] ) ? sanitize_text_field( wp_unslash( $_POST['form_title'] ) ) : '';
        if ( empty( $form_title ) ) {
            $form_title = esc_html__( 'Untitled Form', '24tt-unrestricted-forms' );
        }

        // The layout data will come in as a JSON string representing the dragged-and-dropped fields.
        // BUG FIX: Securely decode and re-encode the JSON to prevent WordPress from stripping complex characters
        $raw_json_string = isset( $_POST['form_settings'] ) ? wp_unslash( $_POST['form_settings'] ) : '{}';
        $decoded_json = json_decode( $raw_json_string, true );
        $form_settings = $decoded_json ? wp_json_encode( $decoded_json ) : '{}';

        $table_forms = $wpdb->prefix . 'tt24_forms';

        // WALL 4: Database Interaction using $wpdb->prepare()
        if ( $form_id > 0 ) {
            // UPDATE EXISTING FORM
            // FIX: Silencing false-positive DB warnings
            // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
            // phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
            $updated = $wpdb->update(
                $table_forms,
                array(
                    'title'         => $form_title,
                    'form_settings' => $form_settings,
                    // updated_at is handled automatically by MySQL based on our schema
                ),
                array( 'id' => $form_id ), // WHERE clause
                array( '%s', '%s' ),       // Data formats: string, string
                array( '%d' )              // WHERE format: integer
            );
            // phpcs:enable

            if ( false === $updated ) {
                wp_send_json_error( array( 'message' => esc_html__( 'Failed to update the form in the database.', '24tt-unrestricted-forms' ) ) );
            }

            wp_send_json_success( array( 
                'message' => esc_html__( 'Form updated successfully!', '24tt-unrestricted-forms' ),
                'form_id' => $form_id 
            ) );

        } else {
            // INSERT NEW FORM
            // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
            // phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
            $inserted = $wpdb->insert(
                $table_forms,
                array(
                    'title'         => $form_title,
                    'form_settings' => $form_settings,
                    'status'        => 'publish'
                ),
                array( '%s', '%s', '%s' ) // Data formats: string, string, string
            );
            // phpcs:enable

            if ( false === $inserted ) {
                wp_send_json_error( array( 'message' => esc_html__( 'Failed to create the new form.', '24tt-unrestricted-forms' ) ) );
            }

            // Grab the newly generated ID
            $new_form_id = $wpdb->insert_id;

            wp_send_json_success( array( 
                'message' => esc_html__( 'Form created successfully!', '24tt-unrestricted-forms' ),
                'form_id' => $new_form_id 
            ) );
        }

        // Always exit at the end of an AJAX request
        wp_die();
    }
}

// Instantiate and initialize the class securely
$tt24_form_builder = new TT24_Form_Builder();
$tt24_form_builder->init();