<?php
/**
 * Adverships_Affiliate_Settings
 *
 * The connect screen. The merchant pastes a one-time connection key (generated
 * from their Adverships dashboard); we exchange it for a permanent per-site
 * secret via Adverships_Affiliate_Client::connect(). Also shows connection
 * status, a disconnect button, and the external-service disclosure required for
 * distribution. (The API base is fixed to ADVERSHIPS_AFF_DEFAULT_API and is only
 * overridable via a wp-config constant for staging — never a merchant field.)
 */

if (!defined('ABSPATH')) {
    exit;
}

class Adverships_Affiliate_Settings {

    const NONCE = 'adverships_affiliate_settings';

    public function hooks() {
        add_action('admin_post_adverships_connect', array($this, 'handle_connect'));
        add_action('admin_post_adverships_disconnect', array($this, 'handle_disconnect'));
        add_action('admin_post_adverships_save_alerts', array($this, 'handle_save_alerts'));
    }

    /** POST handler: exchange the provision key for a connection. */
    public function handle_connect() {
        $this->guard();

        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified in guard() via check_admin_referer().
        $key = isset($_POST['provision_key']) ? sanitize_text_field(wp_unslash($_POST['provision_key'])) : '';

        // API base is fixed to ADVERSHIPS_AFF_DEFAULT_API (overridable only via a
        // wp-config constant for staging) — not a merchant-facing field.
        $result = Adverships_Affiliate_Client::connect($key);

        if (is_wp_error($result)) {
            $this->redirect_with('error', $result->get_error_message());
            return;
        }
        $isNew = !empty($result['is_new']);
        $msg = $isNew
            ? __('Connected to Adverships. Your store is now linked.', 'adverships-affiliate')
            : __('Reconnected to Adverships (connection refreshed).', 'adverships-affiliate');
        $this->redirect_with('success', $msg);
    }

    /** POST handler: clear local connection state. */
    public function handle_disconnect() {
        $this->guard();
        Adverships_Affiliate_Client::disconnect();
        $this->redirect_with('success', __('Disconnected from Adverships.', 'adverships-affiliate'));
    }

    /** POST handler: save the sales-alerts toggle + notification email. */
    public function handle_save_alerts() {
        $this->guard();

        // Nonce is verified in guard() (check_admin_referer) before we reach here.
        // phpcs:disable WordPress.Security.NonceVerification.Missing
        $enabled = !empty($_POST['alerts_enabled']);
        $emailIn = isset($_POST['alerts_email']) ? sanitize_email(wp_unslash($_POST['alerts_email'])) : '';
        $rawIn   = isset($_POST['alerts_email']) ? sanitize_text_field(wp_unslash($_POST['alerts_email'])) : '';
        // phpcs:enable WordPress.Security.NonceVerification.Missing

        // A non-empty entry that isn't a valid address is a user error.
        if ($rawIn !== '' && !is_email($emailIn)) {
            $this->redirect_with('error', __('Enter a valid notification email, or leave it blank to use the site admin email.', 'adverships-affiliate'));
            return;
        }

        Adverships_Affiliate_Client::update_settings(array(
            'alerts_enabled' => $enabled,
            'alerts_email'   => $rawIn === '' ? '' : $emailIn,
        ));

        // Arm/disarm the poll immediately rather than waiting for the next load.
        if (class_exists('Adverships_Affiliate_Alerts')) {
            ( new Adverships_Affiliate_Alerts() )->sync_schedule();
        }

        $this->redirect_with('success', __('Alert settings saved.', 'adverships-affiliate'));
    }

    /** Render the settings page. */
    public function render() {
        if (!current_user_can($this->cap())) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adverships-affiliate'));
        }
        $s         = Adverships_Affiliate_Client::settings();
        $connected = Adverships_Affiliate_Client::is_connected();

        $notice = '';
        // Read-only display of our own redirect status message; no state change → nonce not applicable.
        // phpcs:disable WordPress.Security.NonceVerification.Recommended
        if (isset($_GET['av_status'], $_GET['av_msg'])) {
            $type = sanitize_text_field(wp_unslash($_GET['av_status'])) === 'success' ? 'success' : 'error';
            $text = sanitize_text_field(wp_unslash($_GET['av_msg']));
            $notice = '<div class="notice notice-' . esc_attr($type) . ' is-dismissible"><p>' . esc_html($text) . '</p></div>';
        }
        // phpcs:enable WordPress.Security.NonceVerification.Recommended
        ?>
        <div class="wrap adverships-wrap">
            <h1><?php esc_html_e('Adverships — Settings', 'adverships-affiliate'); ?></h1>
            <?php echo $notice; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built from esc_* above ?>

            <?php if ($connected) : ?>
                <div class="adverships-card adverships-card--ok">
                    <h2><?php esc_html_e('Connected', 'adverships-affiliate'); ?></h2>
                    <p>
                        <a class="button button-primary" href="<?php echo esc_url(Adverships_Affiliate_Client::api_base() . '/clients/'); ?>" target="_blank" rel="noopener">
                            <?php esc_html_e('Open Adverships dashboard', 'adverships-affiliate'); ?>
                        </a>
                        <span class="description" style="margin-left:8px;"><?php esc_html_e('Sign in to manage creators, payouts, and your full analytics on adverships.com.', 'adverships-affiliate'); ?></span>
                    </p>
                    <table class="form-table" role="presentation">
                        <tr>
                            <th><?php esc_html_e('Adverships account', 'adverships-affiliate'); ?></th>
                            <td><code><?php echo esc_html($s['business_username']); ?></code></td>
                        </tr>
                        <tr>
                            <th><?php esc_html_e('Site ID', 'adverships-affiliate'); ?></th>
                            <td><code><?php echo esc_html($s['site_id']); ?></code></td>
                        </tr>
                        <tr>
                            <th><?php esc_html_e('Connected', 'adverships-affiliate'); ?></th>
                            <td><?php echo esc_html($s['connected_at'] ? date_i18n(get_option('date_format') . ' ' . get_option('time_format'), (int) $s['connected_at']) : '—'); ?></td>
                        </tr>
                        <?php if (!empty($s['invite_url'])) : ?>
                        <tr>
                            <th><?php esc_html_e('Partner invite link', 'adverships-affiliate'); ?></th>
                            <td><a href="<?php echo esc_url($s['invite_url']); ?>" target="_blank" rel="noopener"><?php echo esc_html($s['invite_url']); ?></a></td>
                        </tr>
                        <?php endif; ?>
                    </table>
                    <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" onsubmit="return confirm('<?php echo esc_js(__('Disconnect this store from Adverships? Tracking will stop until you reconnect.', 'adverships-affiliate')); ?>');">
                        <?php wp_nonce_field(self::NONCE); ?>
                        <input type="hidden" name="action" value="adverships_disconnect" />
                        <button type="submit" class="button button-secondary"><?php esc_html_e('Disconnect', 'adverships-affiliate'); ?></button>
                    </form>
                </div>

                <div class="adverships-card">
                    <h2><?php esc_html_e('Sales alerts', 'adverships-affiliate'); ?></h2>
                    <p class="description"><?php esc_html_e('Get notified when a new affiliate sale is recorded. Adverships is checked about every 15 minutes; new sales appear as an admin notice and (optionally) an email.', 'adverships-affiliate'); ?></p>
                    <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
                        <?php wp_nonce_field(self::NONCE); ?>
                        <input type="hidden" name="action" value="adverships_save_alerts" />
                        <table class="form-table" role="presentation">
                            <tr>
                                <th><?php esc_html_e('Email alerts', 'adverships-affiliate'); ?></th>
                                <td>
                                    <label>
                                        <input type="checkbox" name="alerts_enabled" value="1" <?php checked(!empty($s['alerts_enabled'])); ?> />
                                        <?php esc_html_e('Notify me about new sales', 'adverships-affiliate'); ?>
                                    </label>
                                </td>
                            </tr>
                            <tr>
                                <th><label for="adverships_alerts_email"><?php esc_html_e('Notification email', 'adverships-affiliate'); ?></label></th>
                                <td>
                                    <input name="alerts_email" id="adverships_alerts_email" type="email" class="regular-text" value="<?php echo esc_attr($s['alerts_email']); ?>" placeholder="<?php echo esc_attr(get_bloginfo('admin_email')); ?>" />
                                    <p class="description"><?php esc_html_e('Leave blank to use the site admin email.', 'adverships-affiliate'); ?></p>
                                </td>
                            </tr>
                        </table>
                        <p><button type="submit" class="button button-primary"><?php esc_html_e('Save alert settings', 'adverships-affiliate'); ?></button></p>
                    </form>
                    <p class="description"><?php esc_html_e('Note: on low-traffic stores, WordPress only runs scheduled checks when someone visits the site, so alerts may be delayed until the next visit.', 'adverships-affiliate'); ?></p>
                </div>
            <?php else : ?>
                <div class="adverships-card">
                    <h2><?php esc_html_e('Connect your store', 'adverships-affiliate'); ?></h2>
                    <ol class="adverships-steps">
                        <li><?php
                            /* translators: %s: link to adverships.com */
                            printf(wp_kses(__('Sign in to your <a href="%s" target="_blank" rel="noopener">Adverships dashboard</a> (or create a business account).', 'adverships-affiliate'), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()))), esc_url(ADVERSHIPS_AFF_DEFAULT_API));
                        ?></li>
                        <li><?php esc_html_e('On your dashboard, click the “Tracking pixel not live yet” notice and select WordPress to generate a connection key.', 'adverships-affiliate'); ?></li>
                        <li><?php esc_html_e('Paste the key below within 15 minutes and click Connect.', 'adverships-affiliate'); ?></li>
                    </ol>
                    <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
                        <?php wp_nonce_field(self::NONCE); ?>
                        <input type="hidden" name="action" value="adverships_connect" />
                        <table class="form-table" role="presentation">
                            <tr>
                                <th><label for="adverships_provision_key"><?php esc_html_e('Connection key', 'adverships-affiliate'); ?></label></th>
                                <td><input name="provision_key" id="adverships_provision_key" type="text" class="regular-text" autocomplete="off" placeholder="avwp_…" required /></td>
                            </tr>
                        </table>
                        <p><button type="submit" class="button button-primary"><?php esc_html_e('Connect', 'adverships-affiliate'); ?></button></p>
                    </form>
                </div>
            <?php endif; ?>

            <div class="adverships-card adverships-card--muted">
                <h2><?php esc_html_e('Data this plugin sends to Adverships', 'adverships-affiliate'); ?></h2>
                <p><?php esc_html_e('When connected, this plugin transmits the following to the Adverships service (adverships.com):', 'adverships-affiliate'); ?></p>
                <ul class="adverships-bullets">
                    <li><?php esc_html_e('On connect: your site URL, site name, admin email, and WordPress/WooCommerce versions.', 'adverships-affiliate'); ?></li>
                    <li><?php esc_html_e('On each tracked visit: the affiliate code from the link and the landing URL (storefront click tracking).', 'adverships-affiliate'); ?></li>
                    <li><?php esc_html_e('On a completed order: the order id, total, currency, and the affiliate attribution captured at click time.', 'adverships-affiliate'); ?></li>
                    <li><?php esc_html_e('On a refund: the order id and the new total refunded amount.', 'adverships-affiliate'); ?></li>
                </ul>
                <p><?php
                    printf(
                        /* translators: 1: privacy policy URL, 2: terms URL */
                        wp_kses(__('See the Adverships <a href="%1$s" target="_blank" rel="noopener">Privacy Policy</a> and <a href="%2$s" target="_blank" rel="noopener">Terms</a>.', 'adverships-affiliate'), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()))),
                        esc_url(ADVERSHIPS_AFF_DEFAULT_API . '/privacy'),
                        esc_url(ADVERSHIPS_AFF_DEFAULT_API . '/terms')
                    );
                ?></p>
            </div>
        </div>
        <?php
    }

    // ---- helpers ----------------------------------------------------------

    private function cap() {
        return current_user_can('manage_woocommerce') ? 'manage_woocommerce' : 'manage_options';
    }

    private function guard() {
        if (!current_user_can($this->cap())) {
            wp_die(esc_html__('You do not have permission to do this.', 'adverships-affiliate'));
        }
        check_admin_referer(self::NONCE);
    }

    private function redirect_with($status, $msg) {
        $url = add_query_arg(
            array(
                'page'      => 'adverships-settings',
                'av_status' => $status,
                'av_msg'    => rawurlencode($msg),
            ),
            admin_url('admin.php')
        );
        wp_safe_redirect($url);
        exit;
    }
}