<?php
/**
 * Virtual humans.txt output.
 *
 * Nothing is written to disk. A rewrite rule maps /humans.txt to a query var,
 * and the response is assembled and sent on template_redirect.
 *
 * @package Acknowledgify
 */

namespace Acknowledgify\Includes;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Builds and serves the humans.txt response.
 */
class Humans_Txt {

	/**
	 * Register the rewrite rule for /humans.txt.
	 *
	 * Registering a rule only pushes onto an in-memory array, so calling
	 * add_rewrite_rule() on every request costs nothing. What is expensive is
	 * flush_rewrite_rules(),
	 * which regenerates and re-saves the whole rule set; that runs on
	 * activation, on deactivation, and when the humans.txt toggle changes.
	 *
	 * @return void
	 */
	public static function add_rewrite_rules() {
		add_rewrite_rule( '^humans\.txt$', 'index.php?acknowledgify_humans_txt=1', 'top' );
	}

	/**
	 * Make our query var available to WP_Query.
	 *
	 * @param string[] $vars Registered public query vars.
	 * @return string[]
	 */
	public static function query_vars( $vars ) {
		$vars[] = 'acknowledgify_humans_txt';

		return $vars;
	}

	/**
	 * Whether the current request is for /humans.txt.
	 *
	 * The query var has to be public for the rewrite to survive parsing, which
	 * means /?acknowledgify_humans_txt=1 would otherwise serve the same file at
	 * a second address. Harmless in itself, but it is a duplicate URL a crawler
	 * can find, so the path is checked as well. Sites that want the query-var
	 * route can re-enable it with the filter below.
	 *
	 * @return bool
	 */
	private static function is_humans_txt_request() {
		if ( 1 !== (int) get_query_var( 'acknowledgify_humans_txt' ) ) {
			return false;
		}

		/**
		 * Filters whether /?acknowledgify_humans_txt=1 may serve the file.
		 *
		 * @param bool $allow Default false: only the /humans.txt path responds.
		 */
		if ( apply_filters( 'acknowledgify_allow_query_var_route', false ) ) {
			return true;
		}

		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Read only, parsed and compared as a path.
		$raw_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';

		$requested = (string) wp_parse_url( $raw_uri, PHP_URL_PATH );
		$expected  = (string) wp_parse_url( home_url( '/humans.txt' ), PHP_URL_PATH );

		return untrailingslashit( $requested ) === untrailingslashit( $expected );
	}

	/**
	 * Keep canonical redirects away from the humans.txt request only.
	 *
	 * WordPress would otherwise try to "correct" this URL. redirect_canonical
	 * runs on template_redirect at priority 10, so it has to be removed at a
	 * lower priority. Scope matters: 1.1.2 removed the filter for every request on
	 * the site, which disabled trailing-slash normalisation and old-slug
	 * redirects everywhere.
	 *
	 * @return void
	 */
	public static function handle_humans_txt_redirect() {
		if ( self::is_humans_txt_request() ) {
			remove_action( 'template_redirect', 'redirect_canonical' );
		}
	}

	/**
	 * The comment block at the top of the file.
	 *
	 * Resolved at call time rather than as a constant, so the text domain is
	 * loaded by the time the translation functions run. As a define() this was
	 * output to every visitor in English no matter the site language.
	 *
	 * @return string
	 */
	public static function get_header() {
		$lines = array(
			sprintf(
				/* translators: %s is the site address. */
				__( '# humans.txt for %s', 'acknowledgify' ),
				home_url( '/' )
			),
			__( '# This file acknowledges the people behind this website', 'acknowledgify' ),
			sprintf(
				/* translators: %s is the humanstxt.org address. */
				__( '# More about humans.txt: %s', 'acknowledgify' ),
				'https://humanstxt.org/'
			),
		);

		/**
		 * Filters the humans.txt header comment lines.
		 *
		 * @param string[] $lines One string per line, each already prefixed with #.
		 */
		$lines = (array) apply_filters( 'acknowledgify_humans_txt_header_lines', $lines );

		return implode( "\n", $lines ) . "\n\n";
	}

	/**
	 * Translated labels used by the humans.txt output and the admin preview.
	 *
	 * Resolved at call time for the same reason as the header. Section headers
	 * carry no newlines; callers add their own whitespace.
	 *
	 * @return array Label key => translated string.
	 */
	public static function get_labels() {
		$labels = array(
			// Section headers.
			'section_freelancer'      => __( 'Freelancer', 'acknowledgify' ),
			'section_team'            => __( 'Team', 'acknowledgify' ),
			'section_project_credits' => __( 'Project Credits', 'acknowledgify' ),

			// Freelancer field labels.
			'freelancer_name'         => __( 'Freelancer', 'acknowledgify' ),
			'freelancer_website'      => __( 'Website', 'acknowledgify' ),
			'freelancer_email'        => __( 'Email', 'acknowledgify' ),
			'freelancer_location'     => __( 'Location', 'acknowledgify' ),
			'freelancer_project'      => __( 'Project', 'acknowledgify' ),
			'freelancer_role'         => __( 'Role', 'acknowledgify' ),
			'freelancer_thanks_to'    => __( 'Thanks To', 'acknowledgify' ),

			// Agency field labels.
			'agency_name'             => __( 'Agency', 'acknowledgify' ),
			'agency_website'          => __( 'Website', 'acknowledgify' ),
			'agency_contact'          => __( 'Contact', 'acknowledgify' ),
			'agency_location'         => __( 'Location', 'acknowledgify' ),
			'agency_project'          => __( 'Project', 'acknowledgify' ),
			'agency_thanks'           => __( 'Special Thanks', 'acknowledgify' ),
		);

		/**
		 * Filters the labels used in humans.txt output and the admin preview.
		 *
		 * Lets a site change wording without supplying a translation file.
		 *
		 * @param array $labels Label key => string.
		 */
		return apply_filters( 'acknowledgify_humans_txt_labels', $labels );
	}

	/**
	 * Suggested role names offered in the Credits repeater.
	 *
	 * Suggestions only. The Role field is free text, so a user is never
	 * limited to this list and no release is needed to add to it.
	 *
	 * @return string[]
	 */
	public static function get_role_suggestions() {
		$roles = array(
			__( 'Design', 'acknowledgify' ),
			__( 'Development', 'acknowledgify' ),
			__( 'SEO & Performance', 'acknowledgify' ),
			__( 'Hosting & Maintenance', 'acknowledgify' ),
			__( 'Photography', 'acknowledgify' ),
			__( 'Videography', 'acknowledgify' ),
			__( 'Copywriting', 'acknowledgify' ),
			__( 'Branding', 'acknowledgify' ),
			__( 'Illustration', 'acknowledgify' ),
			__( 'Content Strategy', 'acknowledgify' ),
			__( 'Accessibility', 'acknowledgify' ),
			__( 'Project Management', 'acknowledgify' ),
			__( 'Translation', 'acknowledgify' ),
			__( 'Analytics', 'acknowledgify' ),
		);

		/**
		 * Filters the suggested role names in the Credits repeater.
		 *
		 * @param string[] $roles Suggested role names.
		 */
		return (array) apply_filters( 'acknowledgify_role_suggestions', $roles );
	}

	/**
	 * Render the stored credit rows as humans.txt lines.
	 *
	 * A row needs both a role and a name to produce output. A part-filled row
	 * is kept in the database so a half-finished edit is not thrown away on
	 * save, but it prints nothing.
	 *
	 * @return string Zero or more lines, each ending in a newline.
	 */
	public static function render_credits() {
		$output = '';

		foreach ( Helper::get_credits() as $credit ) {
			$role = Helper::plain_text( Tokens::resolve( $credit['role'] ) );
			$name = Helper::plain_text( Tokens::resolve( $credit['name'] ) );
			$url  = Helper::plain_text( Tokens::resolve( $credit['url'] ) );

			if ( '' === $role || '' === $name ) {
				continue;
			}

			$line = $role . ': ' . $name;

			if ( '' !== $url ) {
				$line .= ' (' . $url . ')';
			}

			$output .= $line . "\n";
		}

		return $output;
	}

	/**
	 * Assemble the file body for the saved template.
	 *
	 * Separated from output_humans_txt() so the body can be built without
	 * sending headers, which makes it testable and reusable.
	 *
	 * @return string
	 */
	public static function get_body() {
		$labels   = self::get_labels();
		$template = (string) Helper::get_setting( 'humans_template', 'freelancer' );
		$allowed  = Helper::get_allowed_values()['humans_template'];

		if ( ! in_array( $template, $allowed, true ) ) {
			$template = 'freelancer';
		}

		$output = self::get_header();

		if ( 'custom' === $template ) {
			// Plain-text response: the author's line breaks are preserved
			// verbatim. Content is sanitised on input.
			$output .= Helper::plain_text(
				Tokens::resolve( (string) Helper::get_setting( 'humans_custom_content', '' ) ),
				true
			);

			return $output;
		}

		if ( 'agency' === $template ) {
			$identity_label = $labels['section_team'];
			$identity_keys  = array(
				'agency_name'     => $labels['agency_name'],
				'agency_website'  => $labels['agency_website'],
				'agency_contact'  => $labels['agency_contact'],
				'agency_location' => $labels['agency_location'],
			);
			$before_credits = array( 'agency_project' => $labels['agency_project'] );
			$after_credits  = array( 'agency_thanks' => $labels['agency_thanks'] );
		} else {
			$identity_label = $labels['section_freelancer'];
			$identity_keys  = array(
				'freelancer_name'     => $labels['freelancer_name'],
				'freelancer_website'  => $labels['freelancer_website'],
				'freelancer_email'    => $labels['freelancer_email'],
				'freelancer_location' => $labels['freelancer_location'],
			);
			$before_credits = array(
				'freelancer_project' => $labels['freelancer_project'],
				'freelancer_role'    => $labels['freelancer_role'],
			);
			$after_credits  = array( 'freelancer_thanks_to' => $labels['freelancer_thanks_to'] );
		}

		$identity = '';

		foreach ( $identity_keys as $key => $label ) {
			$identity .= Helper::format_setting( $key, $label );
		}

		if ( '' !== $identity ) {
			$output .= $identity_label . "\n" . $identity;
		}

		$credits = '';

		foreach ( $before_credits as $key => $label ) {
			$credits .= Helper::format_setting( $key, $label );
		}

		// Credit rows sit exactly where the four fixed agency role fields used
		// to print, so an upgraded site's file is unchanged.
		$credits .= self::render_credits();

		foreach ( $after_credits as $key => $label ) {
			$credits .= Helper::format_setting( $key, $label );
		}

		if ( '' !== $credits ) {
			$output .= "\n\n" . $labels['section_project_credits'] . "\n" . $credits;
		}

		return $output;
	}

	/**
	 * Send the humans.txt response, or a 404 when the feature is off.
	 *
	 * @return void
	 */
	public static function output_humans_txt() {
		if ( ! self::is_humans_txt_request() ) {
			return;
		}

		if ( 1 !== (int) Helper::get_setting( 'enable_humans_txt', 0 ) ) {
			global $wp_query;

			if ( $wp_query instanceof \WP_Query ) {
				$wp_query->set_404();
			}

			status_header( 404 );
			nocache_headers();

			return;
		}

		$output = self::get_body();

		status_header( 200 );
		send_nosniff_header();
		header( 'Content-Type: text/plain; charset=utf-8' );

		/**
		 * Filters how long humans.txt may be cached, in seconds.
		 *
		 * The response used to send no-cache headers, which meant every hit
		 * booted WordPress in full. The file changes only when someone edits
		 * the settings, so it is safe to cache. Return 0 to send no-cache
		 * headers instead.
		 *
		 * @param int $max_age Default one hour.
		 */
		$max_age = (int) apply_filters( 'acknowledgify_humans_txt_max_age', HOUR_IN_SECONDS );

		if ( $max_age > 0 ) {
			header( 'Cache-Control: public, max-age=' . $max_age );
		} else {
			nocache_headers();
		}

		/*
		 * This response is text/plain, not HTML. Escaping here would send
		 * entities to the reader verbatim: "Smith &amp; Jones" instead of
		 * "Smith & Jones". The safeguards for this context are the
		 * Content-Type header above, nosniff, and the control-character and
		 * line-ending normalisation Helper::plain_text() applies to every
		 * value on the way in. Values are also sanitised when saved.
		 */
		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Plain-text response; see comment above.
		echo $output;
		exit;
	}

	/**
	 * Advertise the file in <head>, per the humanstxt.org convention.
	 *
	 * @return void
	 */
	public static function add_humans_txt_link() {
		if ( 1 !== (int) Helper::get_setting( 'enable_humans_txt', 0 ) ) {
			return;
		}

		printf(
			'<link rel="author" type="text/plain" href="%s" />' . "\n",
			esc_url( home_url( '/humans.txt' ) )
		);
	}
}