<?php
/**
 * Database clean-up: shared parts of every check.
 *
 * @package AdminPowerups
 */

namespace SmartWP\AdminPowerups\Modules\DatabaseCleanup;

use SmartWP\AdminPowerups\Support\DevGuard;
use SmartWP\AdminPowerups\Support\MetaMask;
use SmartWP\AdminPowerups\Support\SafeDump;
use SmartWP\AdminPowerups\Support\Str;

defined( 'ABSPATH' ) || exit;

/**
 * A check described by an array of facts, with helpers for budgets, thresholds, table checks
 * and masked samples. Subclasses implement count(), sample() and clean().
 *
 * Arguments: `id`, `group`, `label`, `description`, `consequence`, `risk`, `object_cap`,
 * `slow`, `tables`, `days` (callable returning the configured days, or null for no threshold),
 * `min_days`, `backup`, `unavailable` (callable returning a reason or ''), `setting` (the power-up
 * setting its days come from, so the row can link to Settings).
 *
 * @since 1.0.0
 */
abstract class BaseCheck implements Check {

	/**
	 * Masked value shown in samples.
	 */
	const MASK = '••••••';

	/**
	 * Longest value shown in a sample cell.
	 */
	const CELL_CHARS = 200;

	/**
	 * Bytes of a value checked for secrets and personal data before it is cut for a cell.
	 */
	const REDACT_BYTES = 1000;

	/**
	 * Facts.
	 *
	 * @var array<string, mixed>
	 */
	protected $args;

	/**
	 * Constructor.
	 *
	 * @since 1.0.0
	 * @param array<string, mixed> $args Facts (see the class comment).
	 */
	public function __construct( array $args ) {
		$this->args = array_merge(
			array(
				'id'          => '',
				'group'       => 'wordpress',
				'label'       => '',
				'description' => '',
				'consequence' => '',
				'risk'        => DevGuard::ADVANCED,
				'object_cap'  => '',
				'slow'        => false,
				'tables'      => array(),
				'days'        => null,
				'min_days'    => 1,
				'backup'      => false,
				'unavailable' => null,
				'setting'     => '',
			),
			$args
		);
	}

	/**
	 * {@inheritDoc}
	 */
	public function id(): string {
		return (string) $this->args['id'];
	}

	/**
	 * {@inheritDoc}
	 */
	public function group(): string {
		return (string) $this->args['group'];
	}

	/**
	 * {@inheritDoc}
	 */
	public function label(): string {
		return (string) $this->args['label'];
	}

	/**
	 * {@inheritDoc}
	 */
	public function description(): string {
		return (string) $this->args['description'];
	}

	/**
	 * {@inheritDoc}
	 */
	public function consequence(): string {
		return (string) $this->args['consequence'];
	}

	/**
	 * {@inheritDoc}
	 */
	public function risk(): string {
		$risk = $this->args['risk'];
		return is_callable( $risk ) ? (string) $risk() : (string) $risk;
	}

	/**
	 * {@inheritDoc}
	 */
	public function object_cap(): string {
		return (string) $this->args['object_cap'];
	}

	/**
	 * {@inheritDoc}
	 */
	public function slow(): bool {
		return (bool) $this->args['slow'];
	}

	/**
	 * {@inheritDoc}
	 */
	public function tables(): array {
		return array_values( array_filter( (array) $this->args['tables'], 'is_string' ) );
	}

	/**
	 * {@inheritDoc}
	 */
	public function requires_backup(): bool {
		return (bool) $this->args['backup'];
	}

	/**
	 * The power-up setting this check's age threshold comes from, or ''.
	 *
	 * @since 1.0.0
	 * @return string
	 */
	public function setting(): string {
		return is_string( $this->args['setting'] ) ? $this->args['setting'] : '';
	}

	/**
	 * {@inheritDoc} The configured days, then the `apwc_database_cleanup_threshold` filter, then
	 * the check's minimum.
	 */
	public function threshold(): ?int {
		if ( ! is_callable( $this->args['days'] ) ) {
			return null;
		}
		$days = call_user_func( $this->args['days'] );
		if ( null === $days ) {
			return null;
		}
		/**
		 * Filter how old (days) rows must be before a Database clean-up check counts them.
		 * Clamped to the check's minimum.
		 *
		 * @since 1.0.0
		 * @param int    $days     Days from the power-up's settings (or the owner's setting).
		 * @param string $check_id Check ID, e.g. `wp-revisions`.
		 */
		$days = apply_filters( 'apwc_database_cleanup_threshold', (int) $days, $this->id() );
		$days = is_numeric( $days ) ? (int) $days : 0;
		return min( 36500, max( (int) $this->args['min_days'], $days ) );
	}

	/**
	 * {@inheritDoc} The configured reason first, then missing tables.
	 */
	public function unavailable(): string {
		if ( is_callable( $this->args['unavailable'] ) ) {
			$reason = (string) call_user_func( $this->args['unavailable'] );
			if ( '' !== $reason ) {
				return $reason;
			}
		}
		$tables = $this->tables();
		if ( $tables && ! self::table_exists( $tables[0] ) ) {
			return __( 'Its database table doesn’t exist on this site.', 'admin-powerups-for-woocommerce' );
		}
		return '';
	}

	/* ------------------------------------------------------------------ helpers */

	/**
	 * Whether a table exists (one query per request for all known tables).
	 *
	 * @since 1.0.0
	 * @param string $table Full table name.
	 * @return bool
	 */
	public static function table_exists( string $table ): bool {
		return Sizes::exists( $table );
	}

	/**
	 * Whether there is time left in a budget.
	 *
	 * @since 1.0.0
	 * @param float $start  microtime( true ) at the start.
	 * @param float $budget Seconds.
	 * @return bool
	 */
	protected static function time_left( float $start, float $budget ): bool {
		return microtime( true ) - $start < $budget;
	}

	/**
	 * A batch for API-based deletes: the check's own size, scaled like the `apwc_database_cleanup_batch` filter.
	 *
	 * @since 1.0.0
	 * @param int $batch Batch the Runner passed (default 500).
	 * @param int $own   The check's own batch at the default.
	 * @return int
	 */
	protected static function api_batch( int $batch, int $own ): int {
		return max( 1, (int) round( $own * $batch / Runner::DEFAULT_BATCH ) );
	}

	/**
	 * Why WooCommerce checks can't run: WooCommerce missing or waiting for a database update.
	 *
	 * @since 1.0.0
	 * @return string
	 */
	public static function woo_unavailable(): string {
		if ( ! function_exists( 'WC' ) || ! class_exists( '\WC_Install' ) ) {
			return __( 'Needs WooCommerce.', 'admin-powerups-for-woocommerce' );
		}
		if ( \WC_Install::needs_db_update() ) {
			return __( 'WooCommerce is waiting for a database update. Run it first.', 'admin-powerups-for-woocommerce' );
		}
		return '';
	}

	/**
	 * A value ready for a sample cell: text, invalid bytes replaced, cut to 200 characters.
	 *
	 * @since 1.0.0
	 * @param mixed $value Value from the database (never unserialized).
	 * @return string
	 */
	public static function cell( $value ): string {
		if ( null === $value ) {
			return '';
		}
		$value = SafeDump::to_array( Str::scalar( $value ), 1, self::CELL_CHARS );
		return is_string( $value ) ? $value : '';
	}

	/**
	 * A value for a sample cell with personal data and secrets hidden: secret-looking content
	 * (MetaMask::looks_like_secret()) is masked whole; email addresses (also %40-encoded), IP
	 * addresses (IPv4 and IPv6) and phone numbers inside the text are masked.
	 *
	 * @since 1.0.0
	 * @param mixed $value Raw value (never unserialized).
	 * @return string
	 */
	public static function value_cell( $value ): string {
		// Only the start is ever shown (200 characters), so only a bounded prefix is checked.
		$raw = substr( Str::scalar( $value ), 0, self::REDACT_BYTES );
		if ( '' !== $raw && MetaMask::looks_like_secret( $raw ) ) {
			return self::MASK;
		}
		return self::cell( self::redact( $raw ) );
	}

	/**
	 * Text with email addresses, IP addresses and phone numbers masked.
	 *
	 * @since 1.0.0
	 * @param string $text Text.
	 * @return string
	 */
	public static function redact( string $text ): string {
		// Emails, also URL-encoded (%40).
		$text = preg_replace( '/[^\s@"\'<>;:,%]{1,64}(?:@|%40)[^\s@"\'<>;:,]{1,255}\.[a-z]{2,24}/i', self::MASK, $text );
		// IP addresses (IPv4 and IPv6, compressed forms and a :port included): bounded tokens that
		// validate as one.
		$text = null === $text ? null : preg_replace_callback(
			'/(?<![0-9A-Fa-f:.])[0-9A-Fa-f:.]{3,45}(?![0-9A-Fa-f:.])/',
			static function ( $m ) {
				$candidates = array( $m[0], rtrim( $m[0], '.' ), trim( $m[0], '.:' ), (string) preg_replace( '/:\d{1,5}$/', '', $m[0] ) );
				foreach ( array_unique( $candidates ) as $token ) {
					if ( '' !== $token && false !== filter_var( $token, FILTER_VALIDATE_IP ) ) {
						return str_replace( $token, self::mask_ip( $token ), $m[0] );
					}
				}
				return $m[0];
			},
			$text
		);
		// Phone numbers: "+" and 8+ digits, (area) 123-4567, or 555-123-4567. Dates, times, SKUs,
		// ISBNs and prices stay.
		$text = null === $text ? null : preg_replace(
			array(
				'/(?<![\w+])\+\d(?:[\s.-]?\d){7,14}(?!\d)/',
				'/(?<!\w)\(\d{2,5}\)\s?\d{3,4}[\s.-]?\d{3,4}(?!\d)/',
				'/(?<![\w.-])\d{3}[\s.-]\d{3}[\s.-]\d{4}(?![\w.-])/',
			),
			self::MASK,
			$text
		);
		// National numbers without "+": 10–11 digits starting with 0 written with spaces
		// (020 7946 0958, 07700 900123) are masked. Unseparated runs (07946095812, 5551234567: 10
		// digits starting 2–9, or 10–11 starting 0) are masked only after a phone cue (tel, phone,
		// mobile, call, fax, …) or when they are the whole value, so model, order, tracking and
		// batch numbers stay. Unix timestamps start with 1 (until 2033). Never inside or next to
		// other numbers (dates, times, prices, spaced amounts) or right after "ISBN".
		$subject = (string) $text;
		$text    = null === $text ? null : preg_replace_callback(
			'/(?<![\w.,+\/-])(?<!\d:)(?<!\d )(?:0\d(?: ?\d){8,9}|[2-9]\d{9})(?!\d| \d|[.,\/:-]\d|\w)/',
			static function ( $m ) use ( $subject ) {
				$number = (string) $m[0][0];
				$offset = (int) $m[0][1];
				$before = substr( $subject, max( 0, $offset - 24 ), min( 24, $offset ) );
				if ( preg_match( '/isbn(?:-?1[03])?[\s:#-]*$/i', $before ) ) {
					return $number;
				}
				if ( false !== strpos( $number, ' ' ) ) {
					return self::MASK; // Spaced national format.
				}
				$whole = trim( $subject ) === $number && ( '0' !== $number[0] || 11 === strlen( $number ) );
				$cue   = (bool) preg_match( '/\b(?:tel|phone|mobile|mob|cell|call|fax|whatsapp|contact)[^\d]{0,16}$/i', $before );
				return $whole || $cue ? self::MASK : $number;
			},
			$text,
			-1,
			$count,
			PREG_OFFSET_CAPTURE
		);
		return null === $text ? self::MASK : $text; // A regex that gave up masks the whole cell.
	}

	/**
	 * An IP address with its end masked (IPv4 keeps two parts, IPv6 the first 32 bits); anything
	 * that isn't one address is masked whole.
	 *
	 * @since 1.0.0
	 * @param string $ip Address.
	 * @return string
	 */
	public static function mask_ip( string $ip ): string {
		$ip = trim( $ip );
		if ( '' === $ip ) {
			return '';
		}
		if ( false !== filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
			$parts = explode( '.', $ip );
			return $parts[0] . '.' . $parts[1] . '.x.x';
		}
		if ( false !== filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 ) ) {
			$hex   = bin2hex( (string) inet_pton( $ip ) ); // 32 hex digits: the full address.
			$group = static fn( int $at ): string => ltrim( substr( $hex, $at, 4 ), '0' ) ?: '0'; // phpcs:ignore Universal.Operators.DisallowShortTernary.Found -- "0" for an all-zero group.
			return $group( 0 ) . ':' . $group( 4 ) . '::';
		}
		return self::MASK;
	}

	/**
	 * A meta value for a sample: masked when its key looks sensitive or personal, otherwise
	 * value_cell().
	 *
	 * @since 1.0.0
	 * @param string $key   Meta key.
	 * @param mixed  $value Raw value.
	 * @return string
	 */
	public static function meta_cell( string $key, $value ): string {
		return MetaMask::matches( $key, self::sensitive_patterns() ) ? self::MASK : self::value_cell( $value );
	}

	/**
	 * Key patterns whose values samples never show: the shared sensitive patterns (context
	 * `cleanup` of `apwc_sensitive_arg_patterns`) plus keys that carry hashes, passwords,
	 * capabilities and keys, and personal data (contact details, phones, addresses, names,
	 * companies, recipients, IPs, user agents).
	 *
	 * @since 1.0.0
	 * @return string[]
	 */
	public static function sensitive_patterns(): array {
		static $extra = array( '*hash*', '*pass*', '*capabilities*', '*activation*', '*key*', '*email*', '*phone*', '*mobile*', '*tel*', '*address*', '*billing*', '*shipping*', '*name*', '*nickname*', '*company*', '*city*', '*country*', '*postcode*', '*zip*', '*contact*', '*recipient*', '*user_agent*', '*_ip', '*_ip_*', 'ip', 'ip_*', '*ip_address*', '*description*' );
		return array_values( array_unique( array_merge( MetaMask::arg_patterns( 'cleanup' ), $extra ) ) );
	}

	/**
	 * A GMT date for a sample cell, in the site's format.
	 *
	 * @since 1.0.0
	 * @param int $timestamp Unix time.
	 * @return string
	 */
	public static function date_cell( int $timestamp ): string {
		if ( $timestamp <= 0 ) {
			return '';
		}
		return (string) wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), $timestamp );
	}

	/**
	 * Empty result of clean().
	 *
	 * @since 1.0.0
	 * @param array<string, mixed> $state State.
	 * @param bool                 $done  Finished.
	 * @return array{deleted: int, skipped: int, notes: array<string, int>, done: bool, state: array<string, mixed>}
	 */
	protected static function cleaned( array $state = array(), bool $done = true ): array {
		return array(
			'deleted' => 0,
			'skipped' => 0,
			'notes'   => array(),
			'done'    => $done,
			'state'   => $state,
		);
	}

	/**
	 * An `IN (…)` list of %d placeholders.
	 *
	 * @since 1.0.0
	 * @param int    $count Items.
	 * @param string $type  Placeholder (%d or %s).
	 * @return string
	 */
	public static function placeholders( int $count, string $type = '%d' ): string {
		return implode( ',', array_fill( 0, max( 1, $count ), $type ) );
	}
}