<?php
/**
 * Authenticated AdminGrip AJAX writes.
 *
 * @package AdminGrip
 */

namespace AdminGrip;

/**
 * Saves and resets only the current user's site-specific preference.
 */
final class Ajax {
	/**
	 * Registers authenticated-only actions.
	 *
	 * @return void
	 */
	public function register() {
		add_action( 'wp_ajax_admingrip_save_order', array( $this, 'save_order' ) );
		add_action( 'wp_ajax_admingrip_reset_order', array( $this, 'reset_order' ) );
	}

	/**
	 * Saves a validated exact-slug order for the current user and site.
	 *
	 * @return void
	 */
	public function save_order() {
		$this->verify_request();

		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- verify_request() validated the action nonce.
		if ( ! isset( $_POST['order'] ) || ! is_array( $_POST['order'] ) ) {
			wp_send_json_error( array( 'message' => __( 'The menu order is invalid.', 'admingrip' ) ), 400 );
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Exact slugs are unslashed and strictly validated without identity-changing sanitization.
		$order      = wp_unslash( $_POST['order'] );
		$normalized = Admin_Menu_Order::normalize_order( $order );

		if ( null === $normalized ) {
			wp_send_json_error( array( 'message' => __( 'The menu order is invalid.', 'admingrip' ) ), 400 );
		}

		$user_id = get_current_user_id();
		$updated = update_user_option( $user_id, Admin_Menu_Order::OPTION_NAME, $normalized, false );

		if ( false === $updated && get_user_option( Admin_Menu_Order::OPTION_NAME, $user_id ) !== $normalized ) {
			wp_send_json_error( array( 'message' => __( 'The menu order could not be saved.', 'admingrip' ) ), 500 );
		}

		wp_send_json_success( array( 'order' => $normalized ) );
	}

	/**
	 * Clears only the current user's current-site preference.
	 *
	 * @return void
	 */
	public function reset_order() {
		global $wpdb;

		$this->verify_request();

		$user_id = get_current_user_id();
		delete_user_option( $user_id, Admin_Menu_Order::OPTION_NAME, false );
		wp_cache_delete( $user_id, 'user_meta' );

		$site_meta_key = $wpdb->get_blog_prefix() . Admin_Menu_Order::OPTION_NAME;

		if ( metadata_exists( 'user', $user_id, $site_meta_key ) ) {
			wp_send_json_error( array( 'message' => __( 'Menu order could not be reset.', 'admingrip' ) ), 500 );
		}

		wp_send_json_success();
	}

	/**
	 * Enforces nonce, session, capability, and supported admin context.
	 *
	 * @return void
	 */
	private function verify_request() {
		check_ajax_referer( 'admingrip_menu_order', 'nonce' );

		if ( ! is_user_logged_in() || ! current_user_can( 'read' ) || is_network_admin() || is_user_admin() ) {
			wp_send_json_error( array( 'message' => __( 'You are not allowed to change this menu order.', 'admingrip' ) ), 403 );
		}
	}
}