<?php
/**
 * Admin view of participation entries — the only place where quiz
 * correctness is revealed. Includes a day filter and CSV export.
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class ADVK_Admin_Entries {

	public function hooks() {
		add_action( 'admin_menu', array( $this, 'add_menu' ) );
		add_action( 'admin_post_advk_export', array( $this, 'export_csv' ) );
		add_action( 'admin_post_advk_delete_entry', array( $this, 'delete_entry' ) );
		add_action( 'admin_post_advk_save_donation', array( $this, 'save_donation' ) );
		add_action( 'admin_post_advk_add_entry', array( $this, 'add_entry' ) );
		add_action( 'admin_post_advk_entry_toggle_winner', array( $this, 'toggle_winner' ) );
	}

	/**
	 * Manually mark/unmark an entry as a winner, right from the entries list
	 * (admin-post.php?action=advk_entry_toggle_winner). Redirects back to the
	 * entries page keeping the current day filter and page.
	 */
	public function toggle_winner() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Keine Berechtigung.', 'adventura-interactive-advent-calendar' ) );
		}
		$entry = isset( $_POST['entry'] ) ? (int) $_POST['entry'] : 0;
		check_admin_referer( 'advk_entry_toggle_winner_' . $entry );

		$flag      = ! empty( $_POST['flag'] ) ? 1 : 0;
		$entry_day = isset( $_POST['entry_day'] ) ? (int) $_POST['entry_day'] : 0;
		$prize     = isset( $_POST['prize'] ) ? sanitize_text_field( wp_unslash( $_POST['prize'] ) ) : '';
		if ( $entry ) {
			ADVK_Entries::set_winner( $entry, $flag );
			if ( $entry_day >= 1 && class_exists( 'ADVK_Winners' ) ) {
				if ( $flag ) {
					ADVK_Winners::set_prize_for_winner( $entry_day, $entry, $prize );
				} else {
					ADVK_Winners::clear_prize_for_winner( $entry_day, $entry );
				}
			}
		}

		$day   = isset( $_POST['advk_day'] ) ? (int) $_POST['advk_day'] : 0;
		$paged = isset( $_POST['paged'] ) ? max( 1, (int) $_POST['paged'] ) : 1;
		$url   = add_query_arg(
			array(
				'page'        => 'advk-entries',
				'advk_day'    => $day,
				'paged'       => $paged,
				'advk_notice' => $flag ? 'won' : 'unwon',
			),
			admin_url( 'admin.php' )
		);
		wp_safe_redirect( $url );
		exit;
	}

	/**
	 * Manually create a participation entry from the admin
	 * (admin-post.php?action=advk_add_entry).
	 */
	public function add_entry() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Keine Berechtigung.', 'adventura-interactive-advent-calendar' ) );
		}
		check_admin_referer( 'advk_add_entry' );

		$opts  = ADVK_Settings::get_options();
		$day   = isset( $_POST['advk_new_day'] ) ? (int) $_POST['advk_new_day'] : 0;
		$first = sanitize_text_field( wp_unslash( $_POST['advk_new_first'] ?? '' ) );
		$last  = sanitize_text_field( wp_unslash( $_POST['advk_new_last'] ?? '' ) );
		$email = sanitize_email( wp_unslash( $_POST['advk_new_email'] ?? '' ) );
		$consent   = ! empty( $_POST['advk_new_consent'] );
		$send_mail = ! empty( $_POST['advk_new_sendmail'] );
		$amount    = isset( $_POST['advk_new_donation'] )
			? (float) str_replace( ',', '.', (string) wp_unslash( $_POST['advk_new_donation'] ) )
			: 0;

		$notice = 'added';
		if ( $day < 1 || $day > ADVK_Data::door_count() || '' === $first || ! is_email( $email ) ) {
			$notice = 'add_error';
		} elseif ( ! empty( $opts['prevent_duplicates'] ) && ADVK_Entries::email_exists_for_day( $email, $day ) ) {
			$notice = 'add_dupe';
		}

		if ( 'added' === $notice ) {
			$losnr    = 'ADV-' . str_pad( (string) $day, 2, '0', STR_PAD_LEFT ) . '-' . wp_rand( 1000, 9999 );
			$ref_code = ! empty( $opts['referral_enabled'] ) ? ADVK_Entries::generate_ref_code() : '';

			$id = ADVK_Entries::insert(
				array(
					'day'             => $day,
					'first_name'      => $first,
					'last_name'       => $last,
					'email'           => $email,
					'consent'         => $consent,
					'losnr'           => $losnr,
					'answers'         => array(),
					'social'          => array(),
					'correct_count'   => 0,
					'total_questions' => 0,
					'ref_code'        => $ref_code,
					'referred_by'     => '',
					'ip'              => '',
					'consent_ref'     => __( 'Manuell im Admin angelegt', 'adventura-interactive-advent-calendar' ),
				)
			);

			if ( $id ) {
				if ( $amount > 0 ) {
					ADVK_Entries::set_donation( $id, $amount );
				}
				if ( $send_mail ) {
					// Fire the standard hook so the participant confirmation (and any
					// admin notification) is sent. No newsletter/reminder opt-in here.
					$extra = array(
						'first'      => $first,
						'last'       => $last,
						'newsletter' => false,
						'reminder'   => false,
						'ref'        => '',
					);
					do_action( 'advk_entry_created', $id, $day, $email, $losnr, $extra );
				}
			} else {
				$notice = 'add_error';
			}
		}

		$url = add_query_arg(
			array(
				'page'        => 'advk-entries',
				'advk_day'    => ( 'added' === $notice ) ? $day : 0,
				'advk_notice' => $notice,
			),
			admin_url( 'admin.php' )
		);
		wp_safe_redirect( $url );
		exit;
	}

	/**
	 * Record a donation amount for an entry (admin-post.php?action=advk_save_donation).
	 */
	public function save_donation() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Keine Berechtigung.', 'adventura-interactive-advent-calendar' ) );
		}
		$entry = isset( $_POST['entry'] ) ? (int) $_POST['entry'] : 0;
		check_admin_referer( 'advk_save_donation_' . $entry );

		$amount = isset( $_POST['amount'] ) ? (float) str_replace( ',', '.', (string) wp_unslash( $_POST['amount'] ) ) : 0;
		if ( $entry ) {
			ADVK_Entries::set_donation( $entry, $amount );
		}

		$day   = isset( $_POST['advk_day'] ) ? (int) $_POST['advk_day'] : 0;
		$paged = isset( $_POST['paged'] ) ? max( 1, (int) $_POST['paged'] ) : 1;
		$url   = add_query_arg(
			array( 'page' => 'advk-entries', 'advk_day' => $day, 'paged' => $paged ),
			admin_url( 'admin.php' )
		);
		wp_safe_redirect( $url );
		exit;
	}

	/**
	 * Handle deletion of a single entry (admin-post.php?action=advk_delete_entry).
	 */
	public function delete_entry() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Keine Berechtigung.', 'adventura-interactive-advent-calendar' ) );
		}
		$id = isset( $_GET['entry'] ) ? (int) $_GET['entry'] : 0;
		check_admin_referer( 'advk_delete_entry_' . $id );

		$deleted = $id > 0 ? ADVK_Entries::delete( $id ) : false;

		$redirect = add_query_arg(
			array(
				'page'        => 'advk-entries',
				'advk_day'    => isset( $_GET['advk_day'] ) ? (int) $_GET['advk_day'] : 0,
				'paged'       => isset( $_GET['paged'] ) ? max( 1, (int) $_GET['paged'] ) : 1,
				'advk_notice' => $deleted ? 'deleted' : 'delete_failed',
			),
			admin_url( 'admin.php' )
		);
		wp_safe_redirect( $redirect );
		exit;
	}

	public function add_menu() {
		add_submenu_page(
			ADVK_Dashboard::SLUG,
			__( 'Teilnahmen', 'adventura-interactive-advent-calendar' ),
			__( 'Teilnahmen', 'adventura-interactive-advent-calendar' ),
			'manage_options',
			'advk-entries',
			array( $this, 'render_page' )
		);
	}

	/**
	 * Map of day => quiz (with correct indices + option text). Cached per request.
	 *
	 * @return array
	 */
	private function quiz_map() {
		static $map = null;
		if ( null !== $map ) {
			return $map;
		}
		$map = array();
		foreach ( ADVK_Data::get_calendar() as $d ) {
			$map[ (int) $d['day'] ] = isset( $d['quiz'] ) ? (array) $d['quiz'] : array();
		}
		return $map;
	}

	/**
	 * Map of day => list of prize titles (for the manual winner prize picker).
	 * Cached per request.
	 *
	 * @return array
	 */
	private function prizes_map() {
		static $map = null;
		if ( null !== $map ) {
			return $map;
		}
		$map = array();
		foreach ( ADVK_Data::get_calendar() as $d ) {
			$titles = array();
			if ( ! empty( $d['prizes'] ) && is_array( $d['prizes'] ) ) {
				foreach ( $d['prizes'] as $p ) {
					$t = isset( $p['title'] ) ? trim( (string) $p['title'] ) : '';
					if ( '' !== $t ) {
						$titles[] = $t;
					}
				}
			}
			$map[ (int) $d['day'] ] = $titles;
		}
		return $map;
	}

	public function render_page() {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}

		$opts = ADVK_Settings::get_options();

		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only list filter via bookmarkable GET link; page is capability-guarded above.
		$day_filter = isset( $_GET['advk_day'] ) ? (int) $_GET['advk_day'] : 0;

		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only pagination via GET; page is capability-guarded above.
		$paged    = isset( $_GET['paged'] ) ? max( 1, (int) $_GET['paged'] ) : 1;
		$per_page = 25;
		$offset   = ( $paged - 1 ) * $per_page;

		$total   = ADVK_Entries::count( $day_filter );
		$entries = ADVK_Entries::query(
			array(
				'per_page' => $per_page,
				'offset'   => $offset,
				'day'      => $day_filter,
			)
		);
		$total_pages = max( 1, (int) ceil( $total / $per_page ) );
		$quiz_map    = $this->quiz_map();
		$prizes_map  = $this->prizes_map();

		$export_url = wp_nonce_url(
			admin_url( 'admin-post.php?action=advk_export&advk_day=' . $day_filter ),
			'advk_export'
		);
		?>
		<div class="wrap advk-wrap advk-wrap--wide">
			<h1 class="wp-heading-inline"><?php esc_html_e( 'Teilnahmen', 'adventura-interactive-advent-calendar' ); ?></h1>
			<a href="#advk-add-entry" class="page-title-action"><?php esc_html_e( 'Teilnehmer hinzufügen', 'adventura-interactive-advent-calendar' ); ?></a>
			<a href="<?php echo esc_url( $export_url ); ?>" class="page-title-action"><?php esc_html_e( 'CSV-Export', 'adventura-interactive-advent-calendar' ); ?></a>
			<hr class="wp-header-end" />

			<?php
			// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only admin notice flag set by our own post-redirect; page is capability-guarded above.
			$notice = isset( $_GET['advk_notice'] ) ? sanitize_key( wp_unslash( $_GET['advk_notice'] ) ) : '';
			if ( 'deleted' === $notice ) :
				?>
				<div class="notice notice-success is-dismissible"><p><?php esc_html_e( 'Teilnahme wurde gelöscht.', 'adventura-interactive-advent-calendar' ); ?></p></div>
			<?php elseif ( 'delete_failed' === $notice ) : ?>
				<div class="notice notice-error is-dismissible"><p><?php esc_html_e( 'Teilnahme konnte nicht gelöscht werden.', 'adventura-interactive-advent-calendar' ); ?></p></div>
			<?php elseif ( 'added' === $notice ) : ?>
					<div class="notice notice-success is-dismissible"><p><?php esc_html_e( 'Teilnehmer wurde angelegt.', 'adventura-interactive-advent-calendar' ); ?></p></div>
				<?php elseif ( 'won' === $notice ) : ?>
					<div class="notice notice-success is-dismissible"><p><?php esc_html_e( 'Als Gewinner markiert.', 'adventura-interactive-advent-calendar' ); ?></p></div>
				<?php elseif ( 'unwon' === $notice ) : ?>
					<div class="notice notice-success is-dismissible"><p><?php esc_html_e( 'Gewinner-Markierung entfernt.', 'adventura-interactive-advent-calendar' ); ?></p></div>
				<?php elseif ( 'add_dupe' === $notice ) : ?>
					<div class="notice notice-error is-dismissible"><p><?php esc_html_e( 'Für dieses Türchen existiert bereits eine Teilnahme mit dieser E-Mail-Adresse.', 'adventura-interactive-advent-calendar' ); ?></p></div>
				<?php elseif ( 'add_error' === $notice ) : ?>
					<div class="notice notice-error is-dismissible"><p><?php esc_html_e( 'Teilnehmer konnte nicht angelegt werden. Bitte Tag, Vorname und eine gültige E-Mail-Adresse angeben.', 'adventura-interactive-advent-calendar' ); ?></p></div>
				<?php endif; ?>

			<details id="advk-add-entry" style="margin:12px 0;background:#fff;border:1px solid #dcdcde;border-radius:6px;padding:0 14px;" <?php echo in_array( $notice, array( 'add_error', 'add_dupe' ), true ) ? 'open' : ''; ?>>
				<summary style="cursor:pointer;padding:12px 0;font-weight:600;"><?php esc_html_e( 'Teilnehmer manuell anlegen', 'adventura-interactive-advent-calendar' ); ?></summary>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="padding:4px 0 14px;">
					<?php wp_nonce_field( 'advk_add_entry' ); ?>
					<input type="hidden" name="action" value="advk_add_entry" />
					<table class="form-table" role="presentation">
						<tr>
							<th scope="row"><label for="advk_new_day"><?php esc_html_e( 'Türchen', 'adventura-interactive-advent-calendar' ); ?> <span style="color:#b32d2e">*</span></label></th>
							<td><select id="advk_new_day" name="advk_new_day" required>
								<?php for ( $i = 1; $i <= ADVK_Data::door_count(); $i++ ) : ?>
									<?php /* translators: %d: door day number. */ ?>
									<option value="<?php echo esc_attr( $i ); ?>" <?php selected( $day_filter > 0 ? $day_filter : 1, $i ); ?>><?php echo esc_html( sprintf( __( 'Tag %d', 'adventura-interactive-advent-calendar' ), $i ) ); ?></option>
								<?php endfor; ?>
							</select></td>
						</tr>
						<tr>
							<th scope="row"><label for="advk_new_first"><?php esc_html_e( 'Vorname', 'adventura-interactive-advent-calendar' ); ?> <span style="color:#b32d2e">*</span></label></th>
							<td><input type="text" id="advk_new_first" name="advk_new_first" class="regular-text" required /></td>
						</tr>
						<tr>
							<th scope="row"><label for="advk_new_last"><?php esc_html_e( 'Nachname', 'adventura-interactive-advent-calendar' ); ?></label></th>
							<td><input type="text" id="advk_new_last" name="advk_new_last" class="regular-text" /></td>
						</tr>
						<tr>
							<th scope="row"><label for="advk_new_email"><?php esc_html_e( 'E-Mail', 'adventura-interactive-advent-calendar' ); ?> <span style="color:#b32d2e">*</span></label></th>
							<td><input type="email" id="advk_new_email" name="advk_new_email" class="regular-text" required /></td>
						</tr>
						<tr>
							<th scope="row"><label for="advk_new_donation"><?php esc_html_e( 'Spende (€)', 'adventura-interactive-advent-calendar' ); ?></label></th>
							<td><input type="number" id="advk_new_donation" name="advk_new_donation" step="0.01" min="0" class="small-text" />
								<p class="description"><?php esc_html_e( 'Optional. Wird wie eine erfasste Spende behandelt (Zusatzlos bzw. Direktgewinn ab Schwellenwert).', 'adventura-interactive-advent-calendar' ); ?></p></td>
						</tr>
						<tr>
							<th scope="row"><?php esc_html_e( 'Optionen', 'adventura-interactive-advent-calendar' ); ?></th>
							<td>
								<label><input type="checkbox" name="advk_new_consent" value="1" checked /> <?php esc_html_e( 'Einwilligung liegt vor (Teilnahmebedingungen/Datenschutz)', 'adventura-interactive-advent-calendar' ); ?></label><br />
								<label><input type="checkbox" name="advk_new_sendmail" value="1" /> <?php esc_html_e( 'Bestätigungs-E-Mail an den Teilnehmer senden', 'adventura-interactive-advent-calendar' ); ?></label>
							</td>
						</tr>
					</table>
					<?php submit_button( __( 'Teilnehmer anlegen', 'adventura-interactive-advent-calendar' ), 'primary', '', false ); ?>
				</form>
			</details>

			<form method="get" style="margin:12px 0;">
				<input type="hidden" name="page" value="advk-entries" />
				<label for="advk_day_filter"><?php esc_html_e( 'Türchen filtern:', 'adventura-interactive-advent-calendar' ); ?></label>
				<select id="advk_day_filter" name="advk_day">
					<option value="0"><?php esc_html_e( 'Alle', 'adventura-interactive-advent-calendar' ); ?></option>
					<?php for ( $i = 1; $i <= ADVK_Data::door_count(); $i++ ) : ?>
						<?php /* translators: %d: door day number (1–24). */ ?>
						<option value="<?php echo esc_attr( $i ); ?>" <?php selected( $day_filter, $i ); ?>><?php echo esc_html( sprintf( __( 'Tag %d', 'adventura-interactive-advent-calendar' ), $i ) ); ?></option>
					<?php endfor; ?>
				</select>
				<?php submit_button( __( 'Filtern', 'adventura-interactive-advent-calendar' ), 'secondary', '', false ); ?>
				<?php /* translators: %d: total number of submissions. */ ?>
				<span style="margin-left:10px;color:#646970;"><?php echo esc_html( sprintf( __( '%d Einsendungen', 'adventura-interactive-advent-calendar' ), $total ) ); ?></span>
			</form>

			<table class="wp-list-table widefat fixed striped">
				<thead>
					<tr>
						<th><?php esc_html_e( 'Datum', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Tag', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Name', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'E-Mail', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Quiz-Ergebnis', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Antworten', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Social', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Empfehlung', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Los-Nr.', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Gewinner', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Spende (€)', 'adventura-interactive-advent-calendar' ); ?></th>
						<th><?php esc_html_e( 'Aktion', 'adventura-interactive-advent-calendar' ); ?></th>
					</tr>
				</thead>
				<tbody>
				<?php if ( empty( $entries ) ) : ?>
					<tr><td colspan="12"><?php esc_html_e( 'Noch keine Teilnahmen.', 'adventura-interactive-advent-calendar' ); ?></td></tr>
				<?php else : ?>
					<?php foreach ( $entries as $e ) : ?>
						<?php
						$answers = json_decode( (string) $e->answers, true );
						$answers = is_array( $answers ) ? $answers : array();
						$social  = json_decode( (string) $e->social, true );
						$social  = is_array( $social ) ? $social : array();
						$quiz    = isset( $quiz_map[ (int) $e->day ] ) ? $quiz_map[ (int) $e->day ] : array();
						?>
						<tr>
							<td><?php echo esc_html( mysql2date( 'd.m.Y H:i', $e->created_at ) ); ?></td>
							<td><?php echo (int) $e->day; ?></td>
							<td><?php echo esc_html( trim( $e->first_name . ' ' . $e->last_name ) ); ?></td>
							<td><a href="mailto:<?php echo esc_attr( $e->email ); ?>"><?php echo esc_html( $e->email ); ?></a></td>
							<td>
								<?php $is_full = ( (int) $e->correct_count === (int) $e->total_questions && (int) $e->total_questions > 0 ); ?>
								<strong style="<?php echo esc_attr( $is_full ? 'color:#1a7f37' : '' ); ?>">
									<?php echo (int) $e->correct_count; ?>/<?php echo (int) $e->total_questions; ?>
								</strong>
							</td>
							<?php // render_answers() returns markup whose dynamic parts are already escaped. ?>
							<td><?php echo $this->render_answers( $quiz, $answers ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></td>
							<td><?php echo esc_html( $social ? implode( ', ', $social ) : '—' ); ?></td>
							<td>
								<?php
								$ref_by  = isset( $e->referred_by ) ? (string) $e->referred_by : '';
								$my_code = isset( $e->ref_code ) ? (string) $e->ref_code : '';
								if ( '' !== $ref_by ) :
									$ref_name = ADVK_Entries::name_for_ref_code( $ref_by );
									?>
									<span class="advk-badge" style="background:#e7f0ff;color:#1e40af;" title="<?php echo esc_attr( $ref_by ); ?>">
										<?php
										/* translators: %s: name (or code) of the referrer. */
										echo esc_html( sprintf( __( 'über %s', 'adventura-interactive-advent-calendar' ), '' !== $ref_name ? $ref_name : $ref_by ) );
										?>
									</span>
								<?php endif; ?>
								<?php if ( '' !== $my_code ) : ?>
									<div style="font-size:11px;color:#666;margin-top:<?php echo '' !== $ref_by ? '4px' : '0'; ?>;">
										<code><?php echo esc_html( $my_code ); ?></code>
										<?php
										$inv = ADVK_Entries::referral_count( $my_code );
										/* translators: %d: number of people this participant referred. */
										echo ' · ' . esc_html( sprintf( _n( '%d Einladung', '%d Einladungen', $inv, 'adventura-interactive-advent-calendar' ), $inv ) );
										?>
									</div>
								<?php endif; ?>
								<?php if ( '' === $ref_by && '' === $my_code ) : ?>
									<span style="color:#9aa0a6;">—</span>
								<?php endif; ?>
							</td>
							<td><code><?php echo esc_html( $e->losnr ); ?></code></td>
							<td>
								<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="margin:0;">
									<?php wp_nonce_field( 'advk_entry_toggle_winner_' . (int) $e->id ); ?>
									<input type="hidden" name="action" value="advk_entry_toggle_winner" />
									<input type="hidden" name="entry" value="<?php echo (int) $e->id; ?>" />
									<input type="hidden" name="advk_day" value="<?php echo (int) $day_filter; ?>" />
									<input type="hidden" name="paged" value="<?php echo (int) $paged; ?>" />
									<input type="hidden" name="entry_day" value="<?php echo (int) $e->day; ?>" />
									<?php $day_prizes = isset( $prizes_map[ (int) $e->day ] ) ? $prizes_map[ (int) $e->day ] : array(); ?>
									<?php if ( (int) $e->is_winner === 1 ) : ?>
										<span class="advk-badge is-winner"><?php esc_html_e( 'Gewinner', 'adventura-interactive-advent-calendar' ); ?></span>
										<?php $assigned = ADVK_Winners::prize_for_winner( (int) $e->day, (int) $e->id ); ?>
										<?php if ( '' !== $assigned ) : ?>
											<div style="font-size:11px;color:#1a7f37;margin-top:2px;"><?php echo esc_html( $assigned ); ?></div>
										<?php endif; ?>
										<input type="hidden" name="flag" value="0" />
										<div style="margin-top:4px;"><button type="submit" class="button-link" style="color:#b32d2e;"><?php esc_html_e( 'entfernen', 'adventura-interactive-advent-calendar' ); ?></button></div>
									<?php else : ?>
										<input type="hidden" name="flag" value="1" />
										<?php if ( ! empty( $day_prizes ) ) : ?>
											<select name="prize" style="max-width:140px;margin-bottom:4px;">
												<option value="">— <?php esc_html_e( 'Preis (optional)', 'adventura-interactive-advent-calendar' ); ?> —</option>
												<?php foreach ( $day_prizes as $pt ) : ?>
													<option value="<?php echo esc_attr( $pt ); ?>"><?php echo esc_html( $pt ); ?></option>
												<?php endforeach; ?>
											</select><br />
										<?php endif; ?>
										<button type="submit" class="button button-small"><?php esc_html_e( 'Als Gewinner', 'adventura-interactive-advent-calendar' ); ?></button>
									<?php endif; ?>
								</form>
							</td>
							<td>
								<?php
								$donation   = ADVK_Entries::donation_for( (int) $e->id );
								$direct_min = (int) $opts['donation_direct_min'];
								?>
								<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="display:flex;gap:4px;align-items:center;margin:0;">
									<?php wp_nonce_field( 'advk_save_donation_' . (int) $e->id ); ?>
									<input type="hidden" name="action" value="advk_save_donation" />
									<input type="hidden" name="entry" value="<?php echo (int) $e->id; ?>" />
									<input type="hidden" name="advk_day" value="<?php echo (int) $day_filter; ?>" />
									<input type="hidden" name="paged" value="<?php echo (int) $paged; ?>" />
									<input type="number" name="amount" step="0.01" min="0" value="<?php echo $donation > 0 ? esc_attr( $donation ) : ''; ?>" style="width:74px;" />
									<button type="submit" class="button button-small">✓</button>
								</form>
								<?php if ( $donation > 0 ) : ?>
									<div style="margin-top:4px;">
										<?php if ( $direct_min > 0 && $donation >= $direct_min ) : ?>
											<span class="advk-badge is-winner"><?php esc_html_e( 'Direktgewinn', 'adventura-interactive-advent-calendar' ); ?></span>
										<?php else : ?>
											<span style="font-size:11px;color:#1a7f37;"><?php esc_html_e( '+ Zusatzlos', 'adventura-interactive-advent-calendar' ); ?></span>
										<?php endif; ?>
									</div>
								<?php endif; ?>
							</td>
							<td>
								<?php
								$delete_url = wp_nonce_url(
									add_query_arg(
										array(
											'action'   => 'advk_delete_entry',
											'entry'    => (int) $e->id,
											'advk_day' => $day_filter,
											'paged'    => $paged,
										),
										admin_url( 'admin-post.php' )
									),
									'advk_delete_entry_' . (int) $e->id
								);
								?>
								<a href="<?php echo esc_url( $delete_url ); ?>"
									class="advk-delete-entry"
									style="color:#b32d2e;"
									onclick="return confirm('<?php echo esc_js( __( 'Diese Teilnahme wirklich löschen? Das kann nicht rückgängig gemacht werden.', 'adventura-interactive-advent-calendar' ) ); ?>');">
									<?php esc_html_e( 'Löschen', 'adventura-interactive-advent-calendar' ); ?>
								</a>
							</td>
						</tr>
					<?php endforeach; ?>
				<?php endif; ?>
				</tbody>
			</table>

			<?php if ( $total_pages > 1 ) : ?>
				<div class="tablenav bottom">
					<div class="tablenav-pages">
						<?php
						echo wp_kses_post(
							paginate_links(
								array(
									'base'      => add_query_arg( 'paged', '%#%' ),
									'format'    => '',
									'current'   => $paged,
									'total'     => $total_pages,
									'prev_text' => '‹',
									'next_text' => '›',
								)
							)
						);
						?>
					</div>
				</div>
			<?php endif; ?>
		</div>
		<?php
	}

	/**
	 * Render per-question answers with correctness marks (escaped HTML string).
	 *
	 * @param array $quiz    Door quiz (with correct + options).
	 * @param array $answers Map qIndex => selectedIndex.
	 * @return string
	 */
	private function render_answers( $quiz, $answers ) {
		if ( empty( $quiz ) ) {
			return '—';
		}
		$rows = array();
		foreach ( $quiz as $qi => $q ) {
			$sel     = isset( $answers[ $qi ] ) ? (int) $answers[ $qi ] : null;
			$options = isset( $q['options'] ) ? (array) $q['options'] : array();
			$correct = isset( $q['correct'] ) ? (int) $q['correct'] : -1;

			if ( null === $sel || ! isset( $options[ $sel ] ) ) {
				/* translators: %d: question number (1, 2, 3 …). */
				$rows[] = '<div>' . sprintf( esc_html__( 'F%d: keine Antwort', 'adventura-interactive-advent-calendar' ), $qi + 1 ) . '</div>';
				continue;
			}

			$is_right = ( $sel === $correct );
			$mark     = $is_right
				? '<span style="color:#1a7f37;font-weight:700">✓</span>'
				: '<span style="color:#b32d2e;font-weight:700">✗</span>';

			/* translators: %d: question number (1, 2, 3 …). */
			$label  = sprintf( esc_html__( 'F%d:', 'adventura-interactive-advent-calendar' ), $qi + 1 );
			$rows[] = '<div>' . $mark . ' ' . $label . ' ' . esc_html( $options[ $sel ] ) . '</div>';
		}
		return implode( '', $rows );
	}

	/**
	 * Build a single RFC-4180 CSV line (fields quoted, inner quotes doubled).
	 *
	 * @param array $fields Field values.
	 * @return string
	 */
	private function csv_row( $fields ) {
		$escaped = array();
		foreach ( $fields as $f ) {
			$escaped[] = '"' . str_replace( '"', '""', (string) $f ) . '"';
		}
		return implode( ',', $escaped ) . "\r\n";
	}

	public function export_csv() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Keine Berechtigung.', 'adventura-interactive-advent-calendar' ) );
		}
		check_admin_referer( 'advk_export' );

		$day_filter = isset( $_GET['advk_day'] ) ? (int) $_GET['advk_day'] : 0;
		$quiz_map   = $this->quiz_map();

		$entries = ADVK_Entries::query(
			array(
				'per_page' => 100000,
				'offset'   => 0,
				'day'      => $day_filter,
			)
		);

		$filename = 'adventura-teilnahmen' . ( $day_filter ? '-tag-' . $day_filter : '' ) . '-' . wp_date( 'Y-m-d' ) . '.csv';

		nocache_headers();
		header( 'Content-Type: text/csv; charset=utf-8' );
		header( 'Content-Disposition: attachment; filename="' . $filename . '"' );

		// Build the CSV in memory (no direct filesystem handles) and stream it.
		// UTF-8 BOM so Excel reads umlauts correctly.
		$csv  = chr( 0xEF ) . chr( 0xBB ) . chr( 0xBF );
		$csv .= $this->csv_row(
			array( 'Datum', 'Tag', 'Vorname', 'Nachname', 'E-Mail', 'Einwilligung', 'IP', 'Einwilligung Version', 'Spende (€)', 'Geworben von', 'Eigener Ref-Code', 'Einladungen', 'Los-Nr.', 'Richtig', 'Fragen gesamt', 'Gewinner', 'Antworten', 'Social' )
		);

		foreach ( $entries as $e ) {
			$answers = json_decode( (string) $e->answers, true );
			$answers = is_array( $answers ) ? $answers : array();
			$social  = json_decode( (string) $e->social, true );
			$social  = is_array( $social ) ? $social : array();
			$quiz    = isset( $quiz_map[ (int) $e->day ] ) ? $quiz_map[ (int) $e->day ] : array();

			$answer_parts = array();
			foreach ( $quiz as $qi => $q ) {
				$sel     = isset( $answers[ $qi ] ) ? (int) $answers[ $qi ] : null;
				$options = isset( $q['options'] ) ? (array) $q['options'] : array();
				$correct = isset( $q['correct'] ) ? (int) $q['correct'] : -1;
				if ( null === $sel || ! isset( $options[ $sel ] ) ) {
					$answer_parts[] = 'F' . ( $qi + 1 ) . ': -';
					continue;
				}
				$answer_parts[] = 'F' . ( $qi + 1 ) . ': ' . $options[ $sel ] . ( $sel === $correct ? ' (richtig)' : ' (falsch)' );
			}

			$csv .= $this->csv_row(
				array(
					mysql2date( 'd.m.Y H:i', $e->created_at ),
					(int) $e->day,
					$e->first_name,
					$e->last_name,
					$e->email,
					$e->consent ? 'ja' : 'nein',
					isset( $e->ip ) ? (string) $e->ip : '',
					isset( $e->consent_ref ) ? (string) $e->consent_ref : '',
					( ADVK_Entries::donation_for( (int) $e->id ) > 0 ) ? number_format_i18n( ADVK_Entries::donation_for( (int) $e->id ), 2 ) : '',
					isset( $e->referred_by ) ? (string) $e->referred_by : '',
					isset( $e->ref_code ) ? (string) $e->ref_code : '',
					isset( $e->ref_code ) && '' !== (string) $e->ref_code ? (int) ADVK_Entries::referral_count( $e->ref_code ) : 0,
					$e->losnr,
					(int) $e->correct_count,
					(int) $e->total_questions,
					( (int) $e->is_winner === 1 ) ? 'ja' : 'nein',
					implode( ' | ', $answer_parts ),
					implode( ', ', $social ),
				)
			);
		}

		echo $csv; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CSV file download, not HTML; values are quote-escaped in csv_row().
		exit;
	}
}