<?php
namespace AcrossAI_MCP_Manager\Includes;

use AcrossAI_MCP_Manager\Includes\AccessControl\AcrossAI_MCP_Access_Control;
use AcrossAI_MCP_Manager\Includes\Database\MCPServer\Table as MCPServerTable;
use AcrossAI_MCP_Manager\Includes\Database\MCPServer\CreatedColumnBackfill;
use AcrossAI_MCP_Manager\Includes\Database\MCPServer\DefaultServerSeeder;
use AcrossAI_MCP_Manager\Includes\Database\SchemaReconciler;
use AcrossAI_MCP_Manager\Includes\Database\OAuthDataMigration;
use AcrossAI_MCP_Manager\Includes\Database\CliAuthLog\Table as CliAuthLogTable;
use AcrossAI_MCP_Manager\Includes\Database\ActivityLog\Table as ActivityLogTable;
use AcrossAI_MCP_Manager\Includes\Database\ActivityLog\Cleanup as ActivityLogCleanup;
use AcrossAI_MCP_Manager\Includes\Database\MCPServerAbility\Table as MCPServerAbilityTable;
use AcrossAI_MCP_Manager\Includes\Database\MCPServerTool\Table as MCPServerToolTable;
use AcrossAI_MCP_Manager\Includes\Database\MCPServerMeta\Table as MCPServerMetaTable;
use AcrossAI_MCP_Manager\Includes\Database\OAuthTokens\Table as OAuthTokensTable;
use AcrossAI_MCP_Manager\Includes\Database\OAuthAuthCodes\Table as OAuthAuthCodesTable;
use AcrossAI_MCP_Manager\Includes\Database\OAuthClients\Table as OAuthClientsTable;
use AcrossAI_MCP_Manager\Includes\Database\ConnectorApprovedUsers\Table as ConnectorApprovedUsersTable;
use AcrossAI_MCP_Manager\Public\Partials\FrontendAuth;
use WPBoilerplate\AccessControl\Database\Rule\RuleTable as WPB_AccessControl_RuleTable;

defined( 'ABSPATH' ) || exit;

/**
 * Fired during plugin activation.
 *
 * @package    AcrossAI_MCP_Manager
 * @subpackage AcrossAI_MCP_Manager/includes
 */
class Activator {

	/**
	 * Runs on plugin activation: create DB tables via BerlinDB, seed the default
	 * MCP server row, and register rewrite rules.
	 *
	 * Per FR-015: NO class_exists() defensive guards and NO try/catch — after
	 * FR-011 the autoloader is live and any exception should propagate to
	 * fail activation loudly (per Clarification Q2).
	 *
	 * @since 0.0.1
	 */
	public static function activate() {

		// Feature 011: BerlinDB Table subclasses handle create/upgrade lifecycle.
		// Feature 016 retired the two dedicated Connectors BerlinDB modules;
		// operator drops pre-016 physical tables manually per spec.md §User
		// Story 2.
		//
		// ORDER IS LOAD-BEARING, and BOTH tables below are part of it.
		//
		// `DefaultServerSeeder::seed()` writes two things for each row it
		// INSERTs: the `tool_*` boolean columns on the servers table, and the
		// type's curated tool slugs as rows in the server-tools table. So both
		// tables must exist BEFORE it runs, not just the servers one.
		//
		// Until 0.3.6 the tools table was created ten lines further down, and
		// the curated write went to a table that did not exist yet. It did not
		// fail loudly: `$wpdb` returns false, BerlinDB's Query has no DDL of its
		// own, and nothing threw — so activation "succeeded" while every
		// `toolset/*` row on the seeded AcrossAI server was silently dropped.
		// Nothing recovered them either, because a later reconcile run finds the
		// row already present and never reaches the curated write again.
		//
		// F091 widened this rule. It is no longer only that both tables must
		// EXIST before the seeder — every column the seeder writes must exist
		// too. On a drifted install the seeder's INSERT names columns the table
		// does not have, `$wpdb` returns false, nothing throws, and the row is
		// written without them. That is the same silent-write-loss shape as the
		// 0.3.6 bug described above, one level down. So the reconciler runs
		// before the seeder, not after it.
		//
		// Servers table stays first: the seeder's column write needs it.
		MCPServerTable::instance()->maybe_upgrade();
		// Feature 020 — per-server tool selection. Presence-based storage; the
		// empty-table state is the correct initial state for a server the seeder
		// does not touch. Moved above the seeder in 0.3.6 — see the note above.
		// Co-commit invariant with the Main.php request-time boot below
		// (DEC-BERLINDB-TABLE-REQUEST-BOOT).
		MCPServerToolTable::instance()->maybe_upgrade();
		CliAuthLogTable::instance()->maybe_upgrade();
		// F096 — the activity log. Empty-table state is the correct initial
		// state: both enable toggles ship off, so nothing writes until an
		// operator opts in.
		ActivityLogTable::instance()->maybe_upgrade();
		// Feature 017 — per-server ability exposure overrides. No seeder call —
		// the empty-table state IS the correct backwards-compatible initial state.
		MCPServerAbilityTable::instance()->maybe_upgrade();

		// F037 — per-server key-value meta. This was the only BerlinDB table the
		// activator did not create: it relied on admin_init@3
		// (Main::reconcile_database_schemas) to appear, so between activation and
		// the first wp-admin request every read hit "table doesn't exist". Any
		// front-end or REST request in that window — exactly where the Embeds
		// feature reads `_embeds_enabled` — ran against a missing table.
		MCPServerMetaTable::instance()->maybe_upgrade();

		// F095 — OAuth tables. Created here for exactly the reason the F037 note
		// above records: a table that waits for admin_init@3 does not exist
		// between activation and the first wp-admin request, and every read in
		// that window hits "table doesn't exist". For OAuth that window is the
		// token endpoint, so the failure would be connected clients unable to
		// authenticate. Co-commit invariant with the Main.php request-time boot
		// (DEC-BERLINDB-TABLE-REQUEST-BOOT).
		//
		// Order is Tokens -> AuthCodes -> Clients per D31 (F032).
		OAuthTokensTable::instance()->maybe_upgrade();
		OAuthAuthCodesTable::instance()->maybe_upgrade();
		OAuthClientsTable::instance()->maybe_upgrade();
		ConnectorApprovedUsersTable::instance()->maybe_upgrade();

		// F091 — heal any column a migration could not deliver, THEN give the
		// just-created columns their values, and only then seed. All three
		// orderings are load-bearing: the backfill consumes the reconciler's
		// created-column report, and the seeder writes columns both of them
		// repair.
		$created = SchemaReconciler::maybe_reconcile(
			array(
				MCPServerTable::instance(),
				CliAuthLogTable::instance(),
				ActivityLogTable::instance(),
				MCPServerAbilityTable::instance(),
				MCPServerToolTable::instance(),
				MCPServerMetaTable::instance(),
			)
		);

		CreatedColumnBackfill::apply( $created['acrossai_mcp_servers'] ?? array() );

		DefaultServerSeeder::seed();

		// F095 — copy OAuth rows from the companion. After the seeder for the
		// same reason as in Main::reconcile_database_schemas(): destinations must
		// be present and current first.
		OAuthDataMigration::maybe_migrate();

		// F095 — daily expiry sweep for OAuth tokens and auth codes. Hook name is
		// a contract preserved from before the F040 split, and Deactivator already
		// clears this exact name.
		if ( ! wp_next_scheduled( 'acrossai_mcp_manager_oauth_cleanup' ) ) {
			wp_schedule_event( time() + HOUR_IN_SECONDS, 'daily', 'acrossai_mcp_manager_oauth_cleanup' );
		}

		// F096 — daily retention + ceiling sweep for the activity log. Scheduled
		// only while a bound is configured; `sync_schedule()` also unschedules
		// when both retention periods and the ceiling are 0, so an operator who
		// turns everything off does not keep a daily event that deletes nothing.
		ActivityLogCleanup::sync_schedule();

		// Feature 015 — Access Control v2 adoption. Create the
		// {$wpdb->prefix}mcp_access_control table via the vendor-owned
		// RuleTable BerlinDB subclass. SEC-015-001 defense-in-depth: the
		// class_exists guard protects against a vendor-uninstall-then-reactivate
		// race where the Composer package was removed since the last activation.
		if ( class_exists( WPB_AccessControl_RuleTable::class ) ) {
			global $wpdb;
			$ac_table   = $wpdb->prefix . AcrossAI_MCP_Access_Control::TABLE_SLUG . '_access_control';
			$version_op = 'wpb_ac_' . AcrossAI_MCP_Access_Control::TABLE_SLUG . '_db_version';

			// Phantom-version guard (WORKLOG 2026-07-02 lesson). The vendor's
			// RuleTable does NOT ship this guard (unlike our F011 subclasses),
			// so if the operator manually dropped the table, BerlinDB's
			// needs_upgrade() would return false (version option still stamped)
			// and silently skip the CREATE. Wiping the option first forces a
			// fresh install. SILENT — no error_log, no admin notice.
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
			$exists = (string) $wpdb->get_var( $wpdb->prepare( 'SHOW TABLES LIKE %s', $ac_table ) );
			if ( '' === $exists ) {
				delete_option( $version_op );
			}

			( new WPB_AccessControl_RuleTable( AcrossAI_MCP_Access_Control::TABLE_SLUG ) )->maybe_upgrade();
		}

		// FrontendAuth — Phase 6.0 absorbs the full class. Activator delegates
		// rewrite-rule registration so the pattern definition lives in
		// exactly one place (loader contract).
		if ( class_exists( FrontendAuth::class ) ) {
			FrontendAuth::instance()->register_rewrite_rule();
		}

		// npm / CLI login is enabled by default on fresh installs.
		// add_option() is idempotent — it fails silently if the row already
		// exists, so operators who explicitly stored `false` (unchecked
		// + saved) keep their choice; only sites with no stored row pick
		// up the new default. register_setting()'s metadata default in
		// SettingsMenu.php stays `false` so the PHPUnit assertion at
		// tests/phpunit/Admin/SettingsMenuTest.php:81 still holds — the
		// row-is-always-present-after-activation invariant is what makes
		// the runtime behaviour "enabled by default".
		add_option( 'acrossai_mcp_npm_login_enabled', 1 );

		flush_rewrite_rules();
	}
}