<?php
/**
 * File integrity monitor.
 *
 * Periodically hashes a curated list of high-impact files (wp-config,
 * .htaccess, mu-plugins, every active plugin's main file, the active
 * theme's functions.php) and emits a `file_changed` event whenever a
 * hash drifts from the previous snapshot.
 *
 * @package ActivityPilot
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class APWPM_File_Integrity {

	const OPTION = 'apwpm_file_hashes';
	const CRON   = 'apwpm_file_integrity_scan';

	public static function init() {
		$s = (array) get_option( 'apwpm_settings', array() );
		if ( empty( $s['enable_file_monitor'] ) ) {
			return;
		}
		add_action( self::CRON, array( __CLASS__, 'scan' ) );
		if ( ! wp_next_scheduled( self::CRON ) ) {
			wp_schedule_event( time() + 10 * MINUTE_IN_SECONDS, 'hourly', self::CRON );
		}
	}

	/**
	 * WordPress installation root (trailing slash).
	 *
	 * @return string
	 */
	private static function wordpress_root() {
		if ( ! function_exists( 'get_home_path' ) ) {
			require_once ABSPATH . 'wp-admin/includes/file.php';
		}

		return trailingslashit( get_home_path() );
	}

	/**
	 * wp-content/plugins directory (trailing slash).
	 *
	 * @return string
	 */
	private static function plugins_directory() {
		return trailingslashit( dirname( dirname( plugin_dir_path( APWPM_PLUGIN_FILE ) ) ) );
	}

	/**
	 * wp-content/mu-plugins directory (trailing slash).
	 *
	 * @return string
	 */
	private static function mu_plugins_directory() {
		return path_join( dirname( untrailingslashit( self::plugins_directory() ) ), 'mu-plugins' );
	}

	/**
	 * Path relative to the WordPress root for display in logs.
	 *
	 * @param string $absolute_file Absolute filesystem path.
	 * @return string
	 */
	private static function relative_path( $absolute_file ) {
		$root = self::wordpress_root();
		if ( 0 === strpos( $absolute_file, $root ) ) {
			return substr( $absolute_file, strlen( $root ) );
		}

		return wp_normalize_path( $absolute_file );
	}

	public static function targets() {
		$root  = self::wordpress_root();
		$files = array(
			path_join( $root, 'wp-config.php' ),
			path_join( $root, '.htaccess' ),
		);

		// Every must-use plugin.
		$mu_dir = self::mu_plugins_directory();
		if ( is_dir( $mu_dir ) ) {
			foreach ( (array) glob( trailingslashit( $mu_dir ) . '*.php' ) as $f ) {
				$files[] = wp_normalize_path( $f );
			}
		}

		// Active theme's functions.php.
		$theme = wp_get_theme();
		if ( $theme && $theme->exists() ) {
			$functions = path_join( $theme->get_stylesheet_directory(), 'functions.php' );
			if ( file_exists( $functions ) ) {
				$files[] = wp_normalize_path( $functions );
			}
		}

		// Each active plugin's main file.
		$plugins_dir = self::plugins_directory();
		$active      = (array) get_option( 'active_plugins', array() );
		foreach ( $active as $plugin ) {
			$path = path_join( $plugins_dir, $plugin );
			if ( file_exists( $path ) ) {
				$files[] = wp_normalize_path( $path );
			}
		}

		return APWPM_Compat::filter( 'apwpm_file_integrity_targets', 'ap_file_integrity_targets', array_values( array_unique( $files ) ) );
	}

	public static function scan() {
		$prev = (array) get_option( self::OPTION, array() );
		$now  = array();

		foreach ( self::targets() as $file ) {
			if ( ! is_readable( $file ) ) {
				continue;
			}
			$h = md5_file( $file );
			if ( false === $h ) {
				continue;
			}
			$now[ $file ] = $h;

			if ( isset( $prev[ $file ] ) && $prev[ $file ] !== $h ) {
				APWPM_Logger::log(
					array(
						'action_type'  => 'file_changed',
						'object_type'  => 'file',
						'object_title' => self::relative_path( $file ),
						'description'  => sprintf(
							/* translators: %s: file path */
							__( 'File modified on disk: %s', 'activitypilot' ),
							self::relative_path( $file )
						),
						'severity'     => 'critical',
						'context'      => array(
							'path'     => $file,
							'old_hash' => $prev[ $file ],
							'new_hash' => $h,
						),
					)
				);
			} elseif ( ! isset( $prev[ $file ] ) && ! empty( $prev ) ) {
				APWPM_Logger::log(
					array(
						'action_type'  => 'file_added',
						'object_type'  => 'file',
						'object_title' => self::relative_path( $file ),
						'description'  => sprintf(
							/* translators: %s: file path */
							__( 'New file appeared on disk: %s', 'activitypilot' ),
							self::relative_path( $file )
						),
						'severity'     => 'warning',
					)
				);
			}
		}

		// Detect deletions.
		foreach ( $prev as $file => $h ) {
			if ( ! isset( $now[ $file ] ) ) {
				APWPM_Logger::log(
					array(
						'action_type'  => 'file_deleted',
						'object_type'  => 'file',
						'object_title' => self::relative_path( $file ),
						'description'  => sprintf(
							/* translators: %s: file path */
							__( 'File deleted from disk: %s', 'activitypilot' ),
							self::relative_path( $file )
						),
						'severity'     => 'critical',
					)
				);
			}
		}

		update_option( self::OPTION, $now, false );
	}
}