<?php
/** WordPress media workflow, explicit account actions and bounded task receipts. */
if (!defined('ABSPATH')) { exit; }

function fiftyw_media_label($cn, $en) {
    if (FIFTYW_MEDIA_REGION === 'cn') { return $cn; }
    $locale = function_exists('determine_locale') ? determine_locale() : get_locale();
    return str_starts_with($locale, 'zh_CN') ? $cn : $en;
}
function fiftyw_media_home() { return FIFTYW_MEDIA_REGION === 'cn' ? 'https://qzm.550wai.cn/' : 'https://eraser.550wai.com/'; }
function fiftyw_media_history_key() { return '_550w_tasks_' . FIFTYW_MEDIA_REGION; }

add_action('admin_menu', function() {
    add_management_page('550W', '550W', 'manage_options', '550w-media', 'fiftyw_media_page');
});

add_action('admin_enqueue_scripts', function($hook) {
    if ($hook !== 'tools_page_550w-media') { return; }
    wp_enqueue_media();
    wp_enqueue_script('550w-media-admin', plugins_url('assets/admin.js', FIFTYW_MEDIA_FILE), array('jquery'), FIFTYW_MEDIA_VERSION, true);
    wp_enqueue_style('550w-media-admin', plugins_url('assets/admin.css', FIFTYW_MEDIA_FILE), array(), FIFTYW_MEDIA_VERSION);
    wp_localize_script('550w-media-admin', 'fiftywMedia', array(
        'ajaxUrl' => admin_url('admin-ajax.php'), 'nonce' => wp_create_nonce('550w-media-request'),
        'labels' => array(
            'states' => array('processing' => fiftyw_media_label('处理中', __('Processing', '550w-media')), 'success' => fiftyw_media_label('已完成', __('Completed', '550w-media')), 'failed' => fiftyw_media_label('失败', __('Failed', '550w-media')), 'expired' => fiftyw_media_label('已过期', __('Expired', '550w-media')), 'accepted' => fiftyw_media_label('已受理', __('Accepted', '550w-media')), 'rejected' => fiftyw_media_label('已拒绝', __('Rejected', '550w-media'))),
            'kinds' => array('image' => fiftyw_media_label('图片', __('Image', '550w-media')), 'video' => fiftyw_media_label('视频', __('Video', '550w-media'))),

            'busy' => fiftyw_media_label('正在提交，请勿重复操作…', __('Submitting — do not repeat this operation…', '550w-media')),
            'unknown' => fiftyw_media_label('结果未知：请先查询任务，不要重新提交收费操作。', __('Outcome unknown. Check the task before resubmitting a charged operation.', '550w-media')),
            'newTask' => fiftyw_media_label('已收到回执。若任务处理中，请稍后点击查询。', __('Receipt received. If processing, check the task again later.', '550w-media')),
            'library' => fiftyw_media_label('选择图片或视频', __('Choose an image or video', '550w-media')),
            'query' => fiftyw_media_label('查询任务', __('Check task', '550w-media')),
            'openImage' => fiftyw_media_label('打开图片 / 下载', __('Open image / download', '550w-media')),
            'openVideo' => fiftyw_media_label('打开解析视频 / 下载', __('Open resolved video / download', '550w-media')),
            'processedImage' => fiftyw_media_label('处理后的图片', __('Processed image', '550w-media')),
        ),
    ));
});

function fiftyw_media_guard() {
    if (!current_user_can('manage_options')) { wp_die(esc_html__('You are not allowed to manage this account.', '550w-media'), '', array('response' => 403)); }
}

foreach (array('connect', 'disconnect', 'callback') as $fiftyw_media_verb) {
    add_action('admin_post_550w_oauth_' . $fiftyw_media_verb, function() use ($fiftyw_media_verb) {
        $verb = $fiftyw_media_verb;
        fiftyw_media_guard();
        nocache_headers();
        header('Referrer-Policy: no-referrer');
        $status = 'connected';
        try {
            if ($verb !== 'callback') { check_admin_referer('550w-oauth'); }
            if ($verb === 'connect') {
                $url = Fiftyw_Media_OAuth::start();
                // Fixed authorization destination; wp_safe_redirect intentionally rejects external OAuth hosts.
                add_filter('allowed_redirect_hosts', function($hosts) { $hosts[] = 'www.550wai.cn'; return $hosts; });
                wp_safe_redirect($url, 302, '550W OAuth');
                exit;
            }
            if ($verb === 'disconnect') { Fiftyw_Media_OAuth::disconnect(); $status = 'disconnected'; }
            if ($verb === 'callback') {
                $state = isset($_GET['state']) && is_string($_GET['state']) ? sanitize_text_field(wp_unslash($_GET['state'])) : '';
                $code = isset($_GET['code']) && is_string($_GET['code']) ? sanitize_text_field(wp_unslash($_GET['code'])) : '';
                Fiftyw_Media_OAuth::callback($state, $code);
            }
        } catch (Throwable $error) { $status = 'connection_failed'; }
        wp_safe_redirect(add_query_arg('connection', $status, admin_url('tools.php?page=550w-media')));
        exit;
    });
}

function fiftyw_media_public_result($value, $action) {
    $data = is_array($value['data'] ?? null) ? $value['data'] : $value;
    if (is_array($data['task'] ?? null)) { $data = $data['task']; }
    $code = $value['code'];
    $status = isset($data['status']) && is_scalar($data['status']) ? (string) $data['status'] : ($code === 200 ? 'accepted' : 'rejected');
    $task = $data['taskId'] ?? $value['taskId'] ?? '';
    if (!is_string($task) && !is_int($task)) { $task = ''; }
    $task = substr((string) $task, 0, 128);
    $url = '';
    $candidate = $action === 'share' ? ($data['video'] ?? '') : ($status === 'success' ? ($data['resultUrl'] ?? '') : '');
    if (is_string($candidate) && $candidate) {
        try { $url = fiftyw_media_url($candidate); } catch (InvalidArgumentException $error) { $url = ''; }
        if (wp_parse_url($url, PHP_URL_SCHEME) !== 'https') { $url = ''; }
    }
    return array('code' => $code, 'status' => $status, 'taskId' => $task, 'resultUrl' => $url,
        'kind' => str_starts_with($action, 'image') ? 'image' : 'video',
        'message' => $code === 200 ? fiftyw_media_label('请求已返回，请查看状态与结果。', __('Request returned. Review the status and result.', '550w-media')) : fiftyw_media_label('服务未受理，请检查凭据、积分或素材条件。', __('Service rejected the request. Check credentials, credits and media requirements.', '550w-media')));
}

add_action('wp_ajax_550w_media_request', function() {
    fiftyw_media_guard();
    check_ajax_referer('550w-media-request', 'nonce');
    $input = wp_unslash($_POST);
    foreach ($input as $value) {
        if (!is_string($value)) { wp_send_json_error(array('message' => fiftyw_media_label('无效请求。', __('Invalid request.', '550w-media'))), 400); }
    }
    $operation = $input['operationId'] ?? '';
    $input['action'] = $input['mediaAction'] ?? '';
    try {
        // Uploaded temporary paths must not be text-sanitized. fiftyw_media_source verifies
        // is_uploaded_file, error, extension, detected image MIME and size before reading.
        $value = fiftyw_media_execute($input, $_FILES['media'] ?? null); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
        $result = fiftyw_media_public_result($value, $input['action']);
        $history = get_user_meta(get_current_user_id(), fiftyw_media_history_key(), true);
        $history = is_array($history) ? $history : array();
        $entry = array_merge($result, array('operationId' => $operation, 'authMode' => $input['authMode'], 'createdAt' => time()));
        if ($result['taskId']) {
            $history = array_values(array_filter($history, function($item) use ($result) { return ($item['taskId'] ?? '') !== $result['taskId']; }));
        }
        array_unshift($history, $entry);
        $history = array_slice(array_values(array_filter($history, function($item) { return ($item['createdAt'] ?? 0) > time() - 7 * DAY_IN_SECONDS; })), 0, 20);
        // Receipts are business state, never telemetry. No account credentials or source paths are stored here.
        update_user_meta(get_current_user_id(), fiftyw_media_history_key(), $history);
        wp_send_json_success($entry);
    } catch (InvalidArgumentException $error) {
        wp_send_json_error(array('message' => fiftyw_media_label('请检查素材、账户、积分确认及高级区域参数。', __('Check the media, account, credit consent and region parameters.', '550w-media')), 'outcome' => 'not_submitted'), 400);
    } catch (Throwable $error) {
        wp_send_json_error(array('message' => fiftyw_media_label('结果未确认。请先查询现有任务，避免重复收费提交。', __('Outcome not confirmed. Query existing tasks before resubmitting.', '550w-media')), 'outcome' => 'unknown'), 502);
    }
});

add_action('wp_ajax_550w_media_clear_history', function() {
    fiftyw_media_guard();
    check_ajax_referer('550w-media-request', 'nonce');
    delete_user_meta(get_current_user_id(), fiftyw_media_history_key());
    wp_send_json_success();
});

add_filter('media_row_actions', function($actions, $post) {
    if (current_user_can('manage_options') && current_user_can('edit_post', $post->ID) && preg_match('~^(image|video)/~', get_post_mime_type($post))) {
        $actions['550w_erase'] = '<a href="' . esc_url(add_query_arg(array('page' => '550w-media', 'attachment' => $post->ID), admin_url('tools.php'))) . '">' . esc_html(fiftyw_media_label('550W 擦除', __('Erase with 550W', '550w-media'))) . '</a>';
    }
    return $actions;
}, 10, 2);

function fiftyw_media_page() {
    fiftyw_media_guard();
    // Read-only page hints, not state changes: capability checks apply, IDs are absint,
    // connection messages use a fixed allowlist and every output is escaped.
    // phpcs:disable WordPress.Security.NonceVerification.Recommended
    $home = fiftyw_media_home();
    $cn = FIFTYW_MEDIA_REGION === 'cn';
    $history = get_user_meta(get_current_user_id(), fiftyw_media_history_key(), true);
    $history = is_array($history) ? array_filter($history, function($entry) { return ($entry['createdAt'] ?? 0) > time() - 7 * DAY_IN_SECONDS; }) : array();
    $selected_attachment = isset($_GET['attachment']) ? absint($_GET['attachment']) : 0;
    if ($selected_attachment && (!current_user_can('edit_post', $selected_attachment) || get_post_type($selected_attachment) !== 'attachment')) { $selected_attachment = 0; }
    $initial = $selected_attachment && str_starts_with((string) get_post_mime_type($selected_attachment), 'video/') ? 'video' : 'image';
    ?>
    <div class="wrap fiftyw-media">
      <div class="fiftyw-heading"><img src="<?php echo esc_url(plugins_url('assets/icon.png', FIFTYW_MEDIA_FILE)); ?>" width="48" height="48" alt=""><div><h1><?php echo esc_html(fiftyw_media_label('550W AI去字幕去水印', __('550W Watermark & Text Eraser', '550w-media'))); ?></h1><p><?php echo esc_html(fiftyw_media_label('清理素材，保留创作。原始媒体文件不会被覆盖。', __('Clean your media, keep your creativity. Original media files are never overwritten.', '550w-media'))); ?></p></div></div>
      <?php if (isset($_GET['connection'])) : ?>
      <div class="notice notice-info"><p><?php echo esc_html(fiftyw_media_label('账户连接状态：', __('Account connection: ', '550w-media')) . (in_array(sanitize_key(wp_unslash($_GET['connection'])), array('connected', 'disconnected'), true) ? (sanitize_key(wp_unslash($_GET['connection'])) === 'connected' ? fiftyw_media_label('已连接', __('Connected', '550w-media')) : fiftyw_media_label('已断开', __('Disconnected', '550w-media'))) : fiftyw_media_label('连接未完成，请确认网站 HTTPS、PHP sodium 和当前登录会话后重试。', __('Not connected. Check site HTTPS, PHP sodium and your WordPress session, then reconnect.', '550w-media')))); ?></p></div>
      <?php endif; ?>
      <section class="fiftyw-card">
        <h2><?php echo esc_html(fiftyw_media_label('账户', __('Account', '550w-media'))); ?></h2>
        <p><?php echo esc_html(fiftyw_media_label('授权仅连接当前 WordPress 管理员，按地区隔离。素材仅在你点击处理后上传。', __('Authorization belongs to the current WordPress administrator and region. Media is uploaded only when you choose to process it.', '550w-media'))); ?></p>
        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="fiftyw-inline">
          <?php wp_nonce_field('550w-oauth'); ?>
          <input type="hidden" name="action" value="<?php echo esc_attr(Fiftyw_Media_OAuth::connected() ? '550w_oauth_disconnect' : '550w_oauth_connect'); ?>">
          <button class="button <?php echo Fiftyw_Media_OAuth::connected() ? '' : 'button-primary'; ?>"><?php echo esc_html(Fiftyw_Media_OAuth::connected() ? fiftyw_media_label('断开授权', __('Disconnect account', '550w-media')) : fiftyw_media_label('连接 550W 账户', __('Connect 550W account', '550w-media'))); ?></button>
        </form>
      </section>
      <form id="fiftyw-process" enctype="multipart/form-data">
        <section class="fiftyw-card">
          <h2><?php echo esc_html(fiftyw_media_label('选择功能和素材', __('Choose a tool and media', '550w-media'))); ?></h2>
          <div class="fiftyw-tools" role="group" aria-label="<?php echo esc_attr(fiftyw_media_label('媒体工具', __('Media tools', '550w-media'))); ?>">
            <?php foreach (array('image' => fiftyw_media_label('图片去文字去水印', __('Image text & watermark', '550w-media')), 'video' => fiftyw_media_label('视频去字幕去水印', __('Video subtitles & watermark', '550w-media')), 'share' => fiftyw_media_label('分享视频链接去水印', __('Shared video watermark', '550w-media'))) as $key => $label) : ?>
            <label><input type="radio" name="tool" value="<?php echo esc_attr($key); ?>" <?php checked($initial, $key); ?>><?php echo esc_html($label); ?></label>
            <?php endforeach; ?>
          </div>
          <input type="hidden" name="action" value="<?php echo esc_attr($initial); ?>" id="fiftyw-action">
          <input type="hidden" name="operationId" value="<?php echo esc_attr(wp_generate_uuid4()); ?>" id="fiftyw-operation">
          <input type="hidden" name="attachmentId" value="<?php echo esc_attr($selected_attachment); ?>" id="fiftyw-attachment">
          <div data-tools="image video">
            <p><button type="button" class="button" id="fiftyw-library"><?php echo esc_html(fiftyw_media_label('从媒体库选择', __('Choose from Media Library', '550w-media'))); ?></button> <?php echo esc_html(fiftyw_media_label('或上传本地文件', __('or upload a local file', '550w-media'))); ?></p>
            <input type="file" name="media" id="fiftyw-file" accept=".png,.jpg,.jpeg,.webp,.mp4,.mov">
            <p id="fiftyw-selected" aria-live="polite"><?php echo esc_html($selected_attachment ? get_the_title($selected_attachment) : ''); ?></p>
            <p class="description"><?php echo esc_html(fiftyw_media_label('图片支持 JPG、PNG、WebP；视频支持 MP4、MOV。上传上限：', __('Images: JPG, PNG, WebP. Videos: MP4, MOV. Site upload limit: ', '550w-media')) . size_format(wp_max_upload_size())); ?></p>
          </div>
          <div data-tools="share"><label for="fiftyw-share"><?php echo esc_html(fiftyw_media_label('在抖音、快手、哔哩哔哩、微博等平台点击分享并复制链接。', __('Use Share → Copy link in TikTok, X or another supported platform.', '550w-media'))); ?></label><textarea id="fiftyw-share" name="shareText" rows="3" class="large-text"></textarea></div>
          <div data-tools="video"><p><?php echo esc_html(fiftyw_media_label('默认全屏擦除字幕和水印。', __('Subtitles and watermarks are erased across the full frame by default.', '550w-media'))); ?></p><details><summary><?php echo esc_html(fiftyw_media_label('高级选项：限定擦除区域', __('Advanced: limit the erase region', '550w-media'))); ?></summary><p><label for="fiftyw-region"><?php echo esc_html(fiftyw_media_label('像素坐标 [左,上,右,下]，留空为全屏', __('Pixel coordinates [left,top,right,bottom]; leave blank for full frame', '550w-media'))); ?></label></p><input id="fiftyw-region" name="rectangle" type="text" placeholder="[0,0,640,100]"></details></div>
        </section>
        <section class="fiftyw-card">
          <h2><?php echo esc_html(fiftyw_media_label('使用哪个账户连接？', __('Which account connection?', '550w-media'))); ?></h2>
          <label><input type="radio" name="authMode" value="oauth" <?php checked(Fiftyw_Media_OAuth::connected()); ?>><?php echo esc_html(fiftyw_media_label('授权账户', __('Connected OAuth account', '550w-media'))); ?></label>
          <label><input type="radio" name="authMode" value="api_key" <?php checked(!Fiftyw_Media_OAuth::connected()); ?>>API Key</label>
          <div id="fiftyw-api-fields"><p><label><?php echo esc_html(fiftyw_media_label('用户编号', __('User ID', '550w-media'))); ?> <input name="userNo" type="text" autocomplete="off"></label></p><p><label>API Key <input name="apiKey" type="password" autocomplete="off" class="regular-text"></label></p><a href="<?php echo esc_url(fiftyw_media_site_url('api')); ?>" target="_blank" rel="noopener noreferrer"><?php echo esc_html(fiftyw_media_label('获取和管理 API Key', __('Get and manage API keys', '550w-media'))); ?></a></div>
          <p class="description"><?php echo esc_html(fiftyw_media_label('不会自动切换认证方式；API Key 不保存。', __('No automatic authentication fallback. API keys are not saved.', '550w-media'))); ?></p>
        </section>
        <p><label><input type="checkbox" name="confirmCharge" value="yes"><?php echo esc_html(fiftyw_media_label('我有权处理素材，并确认使用账户积分。', __('I have permission to process this media and approve account credit usage.', '550w-media'))); ?></label></p>
        <button type="submit" class="button button-primary" id="fiftyw-submit"><?php echo esc_html(fiftyw_media_label('开始处理', __('Process media', '550w-media'))); ?></button>
        <button type="button" class="button" id="fiftyw-new"><?php echo esc_html(fiftyw_media_label('开始新任务', __('Start a new task', '550w-media'))); ?></button>
      </form>
      <p id="fiftyw-notice" role="status" aria-live="polite"></p>
      <section class="fiftyw-card"><h2><?php echo esc_html(fiftyw_media_label('结果与最近任务', __('Results & recent tasks', '550w-media'))); ?></h2><div id="fiftyw-result"></div>
        <p><?php echo esc_html(fiftyw_media_label('仅保存最近 20 条回执，展示最近 7 天；不自动轮询。查询前选择对应认证方式，API Key 模式需重新填写凭据。', __('Up to 20 receipts from the last 7 days. No automatic polling. Select the matching connection before checking; re-enter credentials for API Key tasks.', '550w-media'))); ?></p>
        <ul id="fiftyw-history">
        <?php foreach ($history as $entry) : ?>
          <li><?php echo esc_html(fiftyw_media_state_label($entry['kind'] ?? '') . ' · ' . fiftyw_media_state_label($entry['status'] ?? '')); ?> · <bdi dir="ltr"><?php echo esc_html($entry['taskId'] ?? ''); ?></bdi>
          <?php if (!empty($entry['taskId'])) : ?><button class="button fiftyw-query" type="button" data-task="<?php echo esc_attr($entry['taskId']); ?>" data-kind="<?php echo esc_attr($entry['kind']); ?>" data-mode="<?php echo esc_attr($entry['authMode']); ?>"><?php echo esc_html(fiftyw_media_label('查询', __('Check', '550w-media'))); ?></button><?php endif; ?></li>
        <?php endforeach; ?>
        </ul>
        <p><input type="text" id="fiftyw-task-id" placeholder="<?php echo esc_attr(fiftyw_media_label('任务编号', __('Task ID', '550w-media'))); ?>"><select id="fiftyw-task-kind"><option value="image"><?php echo esc_html(fiftyw_media_label('图片', __('Image', '550w-media'))); ?></option><option value="video"><?php echo esc_html(fiftyw_media_label('视频', __('Video', '550w-media'))); ?></option></select><button class="button" type="button" id="fiftyw-check"><?php echo esc_html(fiftyw_media_label('查询任务', __('Check task', '550w-media'))); ?></button></p>
        <button class="button" type="button" id="fiftyw-clear"><?php echo esc_html(fiftyw_media_label('清除本地回执', __('Clear local receipts', '550w-media'))); ?></button>
      </section>
      <p><a href="<?php echo esc_url(fiftyw_media_site_url()); ?>" target="_blank" rel="noopener noreferrer"><?php echo esc_html(fiftyw_media_label('网页处理入口', __('Web processing', '550w-media'))); ?></a> · <a href="<?php echo esc_url(fiftyw_media_site_url('purchase')); ?>" target="_blank" rel="noopener noreferrer"><?php echo esc_html(fiftyw_media_label('积分管理', __('Manage credits', '550w-media'))); ?></a></p>
    </div>
    <?php
    // phpcs:enable WordPress.Security.NonceVerification.Recommended
}

function fiftyw_media_state_label($value) {
    $labels = array('image' => fiftyw_media_label('图片', __('Image', '550w-media')), 'video' => fiftyw_media_label('视频', __('Video', '550w-media')), 'processing' => fiftyw_media_label('处理中', __('Processing', '550w-media')), 'success' => fiftyw_media_label('已完成', __('Completed', '550w-media')), 'failed' => fiftyw_media_label('失败', __('Failed', '550w-media')), 'expired' => fiftyw_media_label('已过期', __('Expired', '550w-media')), 'accepted' => fiftyw_media_label('已受理', __('Accepted', '550w-media')), 'rejected' => fiftyw_media_label('已拒绝', __('Rejected', '550w-media')));
    return $labels[$value] ?? fiftyw_media_label('结果未知', __('Outcome unknown', '550w-media'));
}