<?php
defined( 'ABSPATH' ) || exit;

class AgeOnce_Admin {

	public function __construct() {
		add_action( 'admin_menu', array( $this, 'register_menu_page' ) );
		add_action( 'admin_init', array( $this, 'register_settings' ) );
		add_action( 'current_screen', array( $this, 'clean_admin_notices' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_admin_scripts' ) );
		add_action( 'wp_ajax_ageonce_test_connection', array( $this, 'ajax_test_connection' ) );
		add_action( 'wp_ajax_ageonce_save_settings', array( $this, 'ajax_save_settings' ) );
	}

	public function enqueue_admin_scripts( $hook ) {
		if ( $hook !== 'toplevel_page_ageonce-settings' ) {
			return;
		}

		$version = defined( 'AGEONCE_VERIFICATION_VERSION' ) ? AGEONCE_VERIFICATION_VERSION : '1.0.0';
		$base    = defined( 'AGEONCE_VERIFICATION_PLUGIN_FILE' ) ? AGEONCE_VERIFICATION_PLUGIN_FILE : dirname( __DIR__ ) . '/ageonce-verification.php';
		$deps    = array( 'jquery' );

		if ( function_exists( 'wc_enqueue_js' ) ) {
			wp_enqueue_style( 'woocommerce_admin_styles' );
			wp_enqueue_script( 'wc-enhanced-select' );
			$deps[] = 'wc-enhanced-select';
		}

		wp_enqueue_script(
			'ageonce-admin-settings',
			plugins_url( 'assets/js/admin-settings.js', $base ),
			$deps,
			$version,
			true
		);

		wp_localize_script(
			'ageonce-admin-settings',
			'ageonceAdmin',
			array(
				'ajaxUrl'           => admin_url( 'admin-ajax.php' ),
				'testNonce'         => wp_create_nonce( 'ageonce_test_connection' ),
				'testingText'       => __( 'Testing connection...', 'age-verification-with-ageonce' ),
				'missingFieldsText' => __( 'Enter Client ID and Client Secret first.', 'age-verification-with-ageonce' ),
				'genericErrorText'  => __( 'Connection test failed. Please try again.', 'age-verification-with-ageonce' ),
				'successTitleText'  => __( 'Connection verified', 'age-verification-with-ageonce' ),
				'successHintText'   => __( 'Next: configure rules and run your first checkout/content test below.', 'age-verification-with-ageonce' ),
				'errorTitleText'    => __( 'Connection failed', 'age-verification-with-ageonce' ),
				'saveNonce'         => wp_create_nonce( 'ageonce_save_settings' ),
				'saveTitleText'     => __( 'Settings saved', 'age-verification-with-ageonce' ),
				'saveHintText'      => __( 'Changes were saved without page reload.', 'age-verification-with-ageonce' ),
				'savingText'        => __( 'Saving...', 'age-verification-with-ageonce' ),
				'selectedCountText' => __( '%d selected', 'age-verification-with-ageonce' ),
				'settingsUpdated'   => isset( $_GET['settings-updated'] ) && sanitize_text_field( wp_unslash( $_GET['settings-updated'] ) ) === 'true',
			)
		);
	}

	public function clean_admin_notices() {
		$screen = get_current_screen();
		if ( $screen && $screen->id === 'toplevel_page_ageonce-settings' ) {
			remove_all_actions( 'admin_notices' );
			remove_all_actions( 'all_admin_notices' );
		}
	}

	public function register_menu_page() {
		add_menu_page(
			__( 'AgeOnce Settings', 'age-verification-with-ageonce' ),
			__( 'AgeOnce', 'age-verification-with-ageonce' ),
			'manage_options',
			'ageonce-settings',
			array( $this, 'render_settings_page' ),
			'dashicons-shield',
			56
		);
	}

	public function register_settings() {
		register_setting(
			'ageonce_group',
			'ageonce_enabled',
			array(
				'type'              => 'string',
				'default'           => 'no',
				'sanitize_callback' => function ( $value ) {
					return in_array( $value, array( 'yes', 'no' ), true ) ? $value : 'no';
				},
			)
		);
		register_setting(
			'ageonce_group',
			'ageonce_client_id',
			array(
				'type'              => 'string',
				'default'           => '',
				'sanitize_callback' => 'sanitize_text_field',
			)
		);
		register_setting(
			'ageonce_group',
			'ageonce_client_secret',
			array(
				'type'              => 'string',
				'default'           => '',
				'sanitize_callback' => 'sanitize_text_field',
			)
		);
		register_setting(
			'ageonce_group',
			'ageonce_rules',
			array(
				'type'              => 'array',
				'default'           => array(),
				'sanitize_callback' => array( $this, 'sanitize_rules' ),
			)
		);
		register_setting(
			'ageonce_group',
			'ageonce_registration_enabled',
			array(
				'type'              => 'string',
				'default'           => 'no',
				'sanitize_callback' => function ( $value ) {
					return in_array( $value, array( 'yes', 'no' ), true ) ? $value : 'no';
				},
			)
		);
		register_setting(
			'ageonce_group',
			'ageonce_registration_age',
			array(
				'type'              => 'string',
				'default'           => '18',
				'sanitize_callback' => function ( $value ) {
					$age = (string) absint( $value );
					return in_array( $age, array( '16', '18', '21' ), true ) ? $age : '18';
				},
			)
		);
	}

	/**
	 * Sanitize content rules option (nested array).
	 *
	 * @param mixed $value Raw option value.
	 * @return array Sanitized rules.
	 */
	public function sanitize_rules( $value ) {
		if ( ! is_array( $value ) ) {
			return array();
		}

		$allowed_ages = array( '16', '18', '21' );
		$out          = array();

		foreach ( $value as $pt_raw => $data ) {
			$pt = sanitize_key( (string) $pt_raw );
			if ( $pt === '' || ! post_type_exists( $pt ) || ! is_array( $data ) ) {
				continue;
			}

			$out[ $pt ] = array();

			if ( isset( $data['enabled'] ) ) {
				$out[ $pt ]['enabled'] = ( $data['enabled'] === 'yes' ) ? 'yes' : 'no';
			}
			if ( isset( $data['manual_lock_enabled'] ) ) {
				$out[ $pt ]['manual_lock_enabled'] = ( $data['manual_lock_enabled'] === 'yes' ) ? 'yes' : 'no';
			}
			if ( $pt === 'product' ) {
				$out[ $pt ]['gate_product_pages'] = ( isset( $data['gate_product_pages'] ) && $data['gate_product_pages'] === 'yes' ) ? 'yes' : 'no';
			}
			if ( isset( $data['enabled_ages'] ) && is_array( $data['enabled_ages'] ) ) {
				$clean_ages = array();
				foreach ( $data['enabled_ages'] as $a ) {
					$a = (string) absint( $a );
					if ( in_array( $a, $allowed_ages, true ) ) {
						$clean_ages[] = $a;
					}
				}
				$clean_ages = array_values( array_unique( $clean_ages ) );
				if ( ! empty( $clean_ages ) ) {
					$out[ $pt ]['enabled_ages'] = $clean_ages;
				}
			}
			if ( isset( $data['ages'] ) && is_array( $data['ages'] ) ) {
				$tax_for_pt = get_object_taxonomies( $pt, 'names' );
				$out[ $pt ]['ages'] = array();

				foreach ( $data['ages'] as $age_key => $age_block ) {
					$age_str = (string) absint( $age_key );
					if ( ! in_array( $age_str, $allowed_ages, true ) || ! is_array( $age_block ) ) {
						continue;
					}
					if ( empty( $age_block['taxonomies'] ) || ! is_array( $age_block['taxonomies'] ) ) {
						continue;
					}

					$out[ $pt ]['ages'][ $age_str ] = array( 'taxonomies' => array() );

					foreach ( $age_block['taxonomies'] as $tax_raw => $term_ids ) {
						$tax = sanitize_key( (string) $tax_raw );
						if ( $tax === '' || ! in_array( $tax, $tax_for_pt, true ) || ! is_array( $term_ids ) ) {
							continue;
						}

						$valid_ids = array();
						foreach ( $term_ids as $tid ) {
							$tid = absint( $tid );
							if ( $tid <= 0 ) {
								continue;
							}
							$term = get_term( $tid, $tax );
							if ( $term && ! is_wp_error( $term ) ) {
								$valid_ids[] = $tid;
							}
						}
						$valid_ids = array_values( array_unique( $valid_ids ) );
						if ( ! empty( $valid_ids ) ) {
							$out[ $pt ]['ages'][ $age_str ]['taxonomies'][ $tax ] = $valid_ids;
						}
					}
				}
			}
		}

		return $out;
	}

	private function get_formatted_terms( $taxonomy ) {
		$terms = get_terms( array(
			'taxonomy'         => $taxonomy,
			'hide_empty'       => false,
			'suppress_filter'  => true,
		) );

		if ( empty( $terms ) || is_wp_error( $terms ) ) {
			return array();
		}

		$term_list = array();
		$id_map    = array();
		foreach ( $terms as $term ) {
			$id_map[ $term->term_id ] = $term;
		}

		foreach ( $terms as $term ) {
			$name_parts      = array( $term->name );
			$current_parent  = $term->parent;
			while ( $current_parent && isset( $id_map[ $current_parent ] ) ) {
				$parent_term   = $id_map[ $current_parent ];
				array_unshift( $name_parts, $parent_term->name );
				$current_parent = $parent_term->parent;
			}
			$term_list[ $term->term_id ] = implode( ' > ', $name_parts );
		}
		asort( $term_list );
		return $term_list;
	}

	private function has_configured_rules( array $rules ) {
		foreach ( $rules as $data ) {
			if ( ! is_array( $data ) || ! isset( $data['enabled'] ) || $data['enabled'] !== 'yes' ) {
				continue;
			}
			if ( ! empty( $data['manual_lock_enabled'] ) && $data['manual_lock_enabled'] === 'yes' ) {
				return true;
			}
			if ( ! empty( $data['ages'] ) && is_array( $data['ages'] ) ) {
				foreach ( $data['ages'] as $age_block ) {
					if ( ! empty( $age_block['taxonomies'] ) && is_array( $age_block['taxonomies'] ) ) {
						foreach ( $age_block['taxonomies'] as $term_ids ) {
							if ( ! empty( $term_ids ) ) {
								return true;
							}
						}
					}
				}
			}
		}
		return false;
	}

	private function get_connection_signature( $client_id, $client_secret ) {
		return hash( 'sha256', (string) $client_id . '|' . (string) $client_secret . '|' . AgeOnce_API::get_redirect_uri() );
	}

	private function is_connection_tested( $client_id, $client_secret ) {
		if ( trim( (string) $client_id ) === '' || trim( (string) $client_secret ) === '' ) {
			return false;
		}
		return get_option( 'ageonce_connection_test_signature', '' ) === $this->get_connection_signature( $client_id, $client_secret );
	}

	private function render_setup_step( $is_done, $label, $description, $link_url = '', $link_label = '', $step_key = '' ) {
		$classes = 'ageonce-setup-step' . ( $is_done ? ' is-done' : '' );
		$icon    = $is_done ? 'dashicons-yes' : 'dashicons-marker';
		$step_attr = $step_key ? ' data-ageonce-setup-step="' . esc_attr( $step_key ) . '"' : '';
		?>
		<li class="<?php echo esc_attr( $classes ); ?>"<?php echo $step_attr; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Built from esc_attr above. ?>>
			<span class="ageonce-setup-step-icon" aria-hidden="true">
				<span class="dashicons <?php echo esc_attr( $icon ); ?>"></span>
			</span>
			<span class="ageonce-setup-step-body">
				<strong><?php echo esc_html( $label ); ?></strong>
				<span><?php echo esc_html( $description ); ?></span>
				<?php if ( $link_url && $link_label ) : ?>
					<a href="<?php echo esc_url( $link_url ); ?>" target="_blank" rel="noopener noreferrer"><?php echo esc_html( $link_label ); ?> ↗</a>
				<?php endif; ?>
			</span>
		</li>
		<?php
	}

	private function is_primary_taxonomy( $post_type, $taxonomy ) {
		$primary_map = array(
			'product' => array( 'product_cat', 'product_tag' ),
			'post'    => array( 'category', 'post_tag' ),
		);

		return isset( $primary_map[ $post_type ] ) && in_array( $taxonomy, $primary_map[ $post_type ], true );
	}

	private function render_taxonomy_rule_field( $pt_slug, $age, $tax_slug, $tax_obj, array $terms_list, array $selected_terms ) {
		$selected_count = count( array_unique( array_map( 'absint', $selected_terms ) ) );
		$select_id      = 'ageonce-select-' . sanitize_html_class( $pt_slug . '-' . $age . '-' . $tax_slug );
		?>
		<div class="ageonce-form-group ageonce-taxonomy-rule">
			<div class="ageonce-taxonomy-head">
				<div>
					<label class="ageonce-label" for="<?php echo esc_attr( $select_id ); ?>"><?php echo esc_html( $tax_obj->labels->name ); ?></label>
					<span class="ageonce-selected-count" data-selected-count-for="<?php echo esc_attr( $select_id ); ?>">
						<?php
						printf(
							/* translators: %d: selected terms count. */
							esc_html__( '%d selected', 'age-verification-with-ageonce' ),
							absint( $selected_count )
						);
						?>
					</span>
				</div>
				<div class="ageonce-action-links">
					<a href="#" class="ageonce-action-link select-all" title="<?php esc_attr_e( 'Select every item in this rule group.', 'age-verification-with-ageonce' ); ?>"><?php esc_html_e( 'Select all', 'age-verification-with-ageonce' ); ?></a>
					<span aria-hidden="true">/</span>
					<a href="#" class="ageonce-action-link select-none" title="<?php esc_attr_e( 'Clear every item in this rule group.', 'age-verification-with-ageonce' ); ?>"><?php esc_html_e( 'None', 'age-verification-with-ageonce' ); ?></a>
				</div>
			</div>

			<select id="<?php echo esc_attr( $select_id ); ?>"
					name="ageonce_rules[<?php echo esc_attr( $pt_slug ); ?>][ages][<?php echo esc_attr( $age ); ?>][taxonomies][<?php echo esc_attr( $tax_slug ); ?>][]"
					multiple class="wc-enhanced-select ageonce-select"
					title="<?php esc_attr_e( 'Select the terms that should require age verification.', 'age-verification-with-ageonce' ); ?>"
					aria-label="<?php echo esc_attr( $tax_obj->labels->name ); ?>">
				<?php foreach ( $terms_list as $term_id => $term_name ) : ?>
					<option value="<?php echo esc_attr( $term_id ); ?>"
						<?php echo ( in_array( $term_id, $selected_terms, true ) || in_array( (string) $term_id, $selected_terms, true ) ) ? 'selected' : ''; ?>>
						<?php echo esc_html( $term_name ); ?>
					</option>
				<?php endforeach; ?>
			</select>
		</div>
		<?php
	}

	public function ajax_test_connection() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error(
				array( 'message' => __( 'You do not have permission to test this connection.', 'age-verification-with-ageonce' ) ),
				403
			);
		}

		check_ajax_referer( 'ageonce_test_connection', 'nonce' );

		$client_id     = isset( $_POST['client_id'] ) ? sanitize_text_field( wp_unslash( $_POST['client_id'] ) ) : '';
		$client_secret = isset( $_POST['client_secret'] ) ? sanitize_text_field( wp_unslash( $_POST['client_secret'] ) ) : '';

		if ( $client_id === '' || $client_secret === '' ) {
			wp_send_json_error(
				array( 'message' => __( 'Enter Client ID and Client Secret first.', 'age-verification-with-ageonce' ) ),
				400
			);
		}

		$response = wp_remote_post(
			AGEONCE_API_URL . '/oauth/token',
			array(
				'headers' => array(
					'Authorization' => 'Basic ' . base64_encode( $client_id . ':' . $client_secret ),
					'Content-Type'  => 'application/x-www-form-urlencoded',
				),
				'body'    => array(
					'grant_type'   => 'authorization_code',
					'code'         => 'ageonce_connection_test',
					'redirect_uri' => AgeOnce_API::get_redirect_uri(),
					'state'        => 'ageonce_connection_test',
				),
				'timeout' => 15,
			)
		);

		if ( is_wp_error( $response ) ) {
			wp_send_json_error(
				array(
					'message' => sprintf(
						/* translators: %s: WordPress HTTP API error message. */
						__( 'Unable to reach AgeOnce API: %s', 'age-verification-with-ageonce' ),
						$response->get_error_message()
					),
				),
				500
			);
		}

		$response_code = wp_remote_retrieve_response_code( $response );
		$body          = wp_remote_retrieve_body( $response );
		$data          = json_decode( $body, true );
		$error_code    = is_array( $data ) && isset( $data['error'] ) ? sanitize_key( (string) $data['error'] ) : '';

		if ( in_array( $error_code, array( 'invalid_grant', 'expired_code', 'code_already_used', 'verification_not_found' ), true ) ) {
			update_option( 'ageonce_client_id', $client_id, false );
			update_option( 'ageonce_client_secret', $client_secret, false );
			update_option( 'ageonce_connection_test_signature', $this->get_connection_signature( $client_id, $client_secret ), false );
			wp_send_json_success(
				array( 'message' => __( 'Connection looks good. Credentials were saved and the Redirect URL was accepted by AgeOnce.', 'age-verification-with-ageonce' ) )
			);
		}

		if ( $error_code === 'invalid_client' ) {
			delete_option( 'ageonce_connection_test_signature' );
			wp_send_json_error(
				array( 'message' => __( 'Invalid Client ID or Client Secret. Copy fresh credentials from the AgeOnce dashboard.', 'age-verification-with-ageonce' ) ),
				401
			);
		}

		if ( $error_code === 'invalid_redirect_uri' ) {
			delete_option( 'ageonce_connection_test_signature' );
			wp_send_json_error(
				array( 'message' => __( 'AgeOnce rejected the Redirect URL. Copy the Redirect URL below into your AgeOnce dashboard and try again.', 'age-verification-with-ageonce' ) ),
				400
			);
		}

		wp_send_json_error(
			array(
				'message' => sprintf(
					/* translators: 1: HTTP status code, 2: API error code. */
					__( 'Unexpected API response (%1$d%2$s). Check credentials and try again.', 'age-verification-with-ageonce' ),
					absint( $response_code ),
					$error_code ? ', ' . $error_code : ''
				),
			),
			$response_code ? $response_code : 500
		);
	}

	public function ajax_save_settings() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( array( 'message' => __( 'You do not have permission to save settings.', 'age-verification-with-ageonce' ) ), 403 );
		}

		check_ajax_referer( 'ageonce_save_settings', 'nonce' );

		$form_data = isset( $_POST['form_data'] ) ? (string) wp_unslash( $_POST['form_data'] ) : '';
		if ( $form_data === '' ) {
			wp_send_json_error( array( 'message' => __( 'No form data received.', 'age-verification-with-ageonce' ) ), 400 );
		}

		$parsed = array();
		parse_str( $form_data, $parsed );

		$enabled = isset( $parsed['ageonce_enabled'] ) && $parsed['ageonce_enabled'] === 'yes' ? 'yes' : 'no';
		$client_id = isset( $parsed['ageonce_client_id'] ) ? sanitize_text_field( (string) $parsed['ageonce_client_id'] ) : '';
		$client_secret = isset( $parsed['ageonce_client_secret'] ) ? sanitize_text_field( (string) $parsed['ageonce_client_secret'] ) : '';
		$rules = isset( $parsed['ageonce_rules'] ) ? $this->sanitize_rules( $parsed['ageonce_rules'] ) : array();
		$registration_enabled = isset( $parsed['ageonce_registration_enabled'] ) && $parsed['ageonce_registration_enabled'] === 'yes' ? 'yes' : 'no';
		$registration_age_raw = isset( $parsed['ageonce_registration_age'] ) ? (string) absint( $parsed['ageonce_registration_age'] ) : '18';
		$registration_age = in_array( $registration_age_raw, array( '16', '18', '21' ), true ) ? $registration_age_raw : '18';

		update_option( 'ageonce_enabled', $enabled, false );
		update_option( 'ageonce_client_id', $client_id, false );
		update_option( 'ageonce_client_secret', $client_secret, false );
		update_option( 'ageonce_rules', $rules, false );
		update_option( 'ageonce_registration_enabled', $registration_enabled, false );
		update_option( 'ageonce_registration_age', $registration_age, false );

		if ( ! $this->is_connection_tested( $client_id, $client_secret ) ) {
			delete_option( 'ageonce_connection_test_signature' );
		}

		wp_send_json_success(
			array(
				'message' => __( 'Settings saved.', 'age-verification-with-ageonce' ),
			)
		);
	}

	public function render_settings_page() {
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}

		$enabled      = get_option( 'ageonce_enabled', 'yes' );
		$client_id    = get_option( 'ageonce_client_id', '' );
		$client_secret = get_option( 'ageonce_client_secret', '' );
		$saved_rules   = (array) get_option( 'ageonce_rules', array() );
		$registration_enabled = get_option( 'ageonce_registration_enabled', 'no' );
		$registration_age     = (string) absint( get_option( 'ageonce_registration_age', '18' ) );
		if ( ! in_array( $registration_age, array( '16', '18', '21' ), true ) ) {
			$registration_age = '18';
		}
		$missing_credentials = ( trim( (string) $client_id ) === '' || trim( (string) $client_secret ) === '' );
		$has_rules     = $this->has_configured_rules( $saved_rules );
		$connection_tested = $this->is_connection_tested( $client_id, $client_secret );
		$plugin_base = defined( 'AGEONCE_VERIFICATION_PLUGIN_FILE' ) ? AGEONCE_VERIFICATION_PLUGIN_FILE : dirname( __DIR__ ) . '/ageonce-verification.php';
		$onboarding_image_url = plugins_url( 'assets/images/plan.png', $plugin_base );
		$has_woocommerce = class_exists( 'WooCommerce' );

		$all_post_types = get_post_types( array( 'public' => true ), 'objects' );
		unset( $all_post_types['attachment'] );
		$ordered_types   = array();
		$priority_slugs  = array( 'product', 'post', 'page' );
		foreach ( $priority_slugs as $slug ) {
			if ( isset( $all_post_types[ $slug ] ) ) {
				$ordered_types[ $slug ] = $all_post_types[ $slug ];
				unset( $all_post_types[ $slug ] );
			}
		}
		ksort( $all_post_types );
		$final_post_types = $ordered_types + $all_post_types;

		$age_groups = array( '16', '18', '21' );
		?>
		<div class="wrap">
			<div class="ageonce-dashboard">
				<div class="ageonce-header">
					<h1 class="ageonce-title"><?php esc_html_e( 'AgeOnce Settings', 'age-verification-with-ageonce' ); ?></h1>
					<a href="https://docs.ageonce.com/" target="_blank" rel="noopener noreferrer" class="ageonce-docs-link"><?php esc_html_e( 'Documentation', 'age-verification-with-ageonce' ); ?> ↗</a>
				</div>

				<form method="post" action="options.php">
					<?php settings_fields( 'ageonce_group' ); ?>

					<div class="ageonce-notice ageonce-notice--hero">
						<div class="ageonce-notice-content">
							<strong><?php esc_html_e( 'Set up AgeOnce verification', 'age-verification-with-ageonce' ); ?></strong>
							<p><?php esc_html_e( 'Start with the free plan, connect OAuth credentials, choose what to protect, then test checkout or restricted content.', 'age-verification-with-ageonce' ); ?></p>
							<div class="ageonce-notice-links">
								<a class="ageonce-notice-link ageonce-notice-link--primary" href="https://www.ageonce.com/pricing" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Start free', 'age-verification-with-ageonce' ); ?> ↗</a>
								<a class="ageonce-notice-link ageonce-notice-link--ghost" href="https://www.ageonce.com/dashboard" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Open dashboard', 'age-verification-with-ageonce' ); ?> ↗</a>
								<a class="ageonce-notice-link ageonce-notice-link--ghost" href="https://docs.ageonce.com/wordpress" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'WordPress guide', 'age-verification-with-ageonce' ); ?> ↗</a>
							</div>
							<ol class="ageonce-setup-list ageonce-hero-steps">
								<?php
								$this->render_setup_step(
									! $missing_credentials,
									__( 'Create account', 'age-verification-with-ageonce' ),
									__( 'Start free and get OAuth keys.', 'age-verification-with-ageonce' ),
									'',
									'',
									'account'
								);
								$this->render_setup_step(
									! $missing_credentials,
									__( 'Paste credentials', 'age-verification-with-ageonce' ),
									__( 'Add Client ID and Secret below.', 'age-verification-with-ageonce' ),
									'',
									'',
									'credentials'
								);
								$this->render_setup_step(
									$connection_tested,
									__( 'Add Redirect URL', 'age-verification-with-ageonce' ),
									__( 'Copy this callback into AgeOnce.', 'age-verification-with-ageonce' ),
									'',
									'',
									'redirect'
								);
								$this->render_setup_step(
									$has_rules,
									__( 'Protect content', 'age-verification-with-ageonce' ),
									__( 'Choose products, posts, or pages.', 'age-verification-with-ageonce' ),
									'',
									'',
									'rules'
								);
								?>
							</ol>
						</div>
						<img src="<?php echo esc_url( $onboarding_image_url ); ?>" alt="<?php esc_attr_e( 'AgeOnce', 'age-verification-with-ageonce' ); ?>" class="ageonce-notice-image">
					</div>

					<div class="ageonce-card">
						<div class="ageonce-card-header ageonce-card-header--static">
							<h2 class="ageonce-card-title"><?php esc_html_e( 'API Credentials', 'age-verification-with-ageonce' ); ?></h2>
						</div>
						<div class="ageonce-card-body open">
							<div class="ageonce-form-group ageonce-form-group--lg-bottom">
								<div class="ageonce-row-inline">
									<input type="hidden" name="ageonce_enabled" value="no">
									<label class="ageonce-switch">
										<input type="checkbox" name="ageonce_enabled" value="yes" <?php checked( $enabled, 'yes' ); ?>>
										<span class="ageonce-slider"></span>
									</label>
									<span class="ageonce-label ageonce-label--inline"><?php esc_html_e( 'Status', 'age-verification-with-ageonce' ); ?></span>
								</div>
								<p class="ageonce-desc ageonce-desc--tight-top"><?php esc_html_e( 'Enable or disable age verification for this site.', 'age-verification-with-ageonce' ); ?></p>
							</div>
							<div class="ageonce-grid-2">
								<div class="ageonce-form-group">
									<div class="ageonce-label-row">
										<label class="ageonce-label"><?php esc_html_e( 'Client ID', 'age-verification-with-ageonce' ); ?></label>
										<a href="https://www.ageonce.com/dashboard/settings" target="_blank" rel="noopener noreferrer" class="ageonce-inline-link"><?php esc_html_e( 'Get from dashboard', 'age-verification-with-ageonce' ); ?> ↗</a>
									</div>
									<input type="text" name="ageonce_client_id" value="<?php echo esc_attr( $client_id ); ?>" class="ageonce-input">
								</div>
								<div class="ageonce-form-group">
									<div class="ageonce-label-row">
										<label class="ageonce-label"><?php esc_html_e( 'Client Secret', 'age-verification-with-ageonce' ); ?></label>
										<a href="https://www.ageonce.com/dashboard/settings" target="_blank" rel="noopener noreferrer" class="ageonce-inline-link"><?php esc_html_e( 'Get from dashboard', 'age-verification-with-ageonce' ); ?> ↗</a>
									</div>
									<input type="password" name="ageonce_client_secret" value="<?php echo esc_attr( $client_secret ); ?>" class="ageonce-input">
								</div>
							</div>
							<div class="ageonce-form-group ageonce-redirect-uri-wrap">
								<label class="ageonce-label"><?php esc_html_e( 'Redirect URL for AgeOnce Dashboard', 'age-verification-with-ageonce' ); ?></label>
								<p class="ageonce-desc ageonce-desc--spaced-bottom"><?php esc_html_e( 'Add this URL in your AgeOnce dashboard as the OAuth redirect URI. Copy and paste it there.', 'age-verification-with-ageonce' ); ?></p>
								<div class="ageonce-input-with-copy">
									<input type="text" id="ageonce-redirect-uri" class="ageonce-input" value="<?php echo esc_attr( AgeOnce_API::get_redirect_uri() ); ?>" readonly>
									<button type="button" class="ageonce-copy-icon" data-copy-target="ageonce-redirect-uri" title="<?php esc_attr_e( 'Copy', 'age-verification-with-ageonce' ); ?>" aria-label="<?php esc_attr_e( 'Copy', 'age-verification-with-ageonce' ); ?>">
										<span class="dashicons dashicons-admin-page"></span>
									</button>
								</div>
							</div>
							<div class="ageonce-test-connection">
								<button type="button" class="button ageonce-btn-secondary" id="ageonce-test-connection"><?php esc_html_e( 'Test connection', 'age-verification-with-ageonce' ); ?></button>
								<output class="ageonce-test-result" id="ageonce-test-result" aria-live="polite"></output>
							</div>
							<div class="ageonce-next-test">
								<strong><?php esc_html_e( 'Next: run your first real test', 'age-verification-with-ageonce' ); ?></strong>
								<p><?php esc_html_e( 'After connection is successful, run one live flow so the plugin is fully activated on your site.', 'age-verification-with-ageonce' ); ?></p>
								<div class="ageonce-next-test-grid">
									<div class="ageonce-next-test-item">
										<span class="dashicons dashicons-cart"></span>
										<div>
											<b><?php esc_html_e( 'WooCommerce checkout test', 'age-verification-with-ageonce' ); ?></b>
											<span><?php esc_html_e( 'Enable rules for Products/Categories, add a restricted product to cart, then verify at checkout.', 'age-verification-with-ageonce' ); ?></span>
										</div>
									</div>
									<div class="ageonce-next-test-item">
										<span class="dashicons dashicons-admin-page"></span>
										<div>
											<b><?php esc_html_e( 'Content gate test', 'age-verification-with-ageonce' ); ?></b>
											<span><?php esc_html_e( 'Enable Post/Page rules, open a restricted page in incognito, and confirm the age gate appears.', 'age-verification-with-ageonce' ); ?></span>
										</div>
									</div>
									<div class="ageonce-next-test-item">
										<span class="dashicons dashicons-admin-users"></span>
										<div>
											<b><?php esc_html_e( 'Store signup gate test', 'age-verification-with-ageonce' ); ?></b>
											<span><?php esc_html_e( 'Optional: enable WooCommerce customer signup below, open My Account as a guest, and confirm the create-account button stays locked until age verification.', 'age-verification-with-ageonce' ); ?></span>
										</div>
									</div>
								</div>
								<a href="https://docs.ageonce.com/wordpress/installation#verify-installation" target="_blank" rel="noopener noreferrer" class="ageonce-inline-link"><?php esc_html_e( 'Open full testing guide', 'age-verification-with-ageonce' ); ?> ↗</a>
							</div>
						</div>
					</div>

					<?php if ( $has_woocommerce ) : ?>
					<div class="ageonce-card">
						<div class="ageonce-card-header ageonce-card-header--static">
							<h2 class="ageonce-card-title"><?php esc_html_e( 'WooCommerce customer signup', 'age-verification-with-ageonce' ); ?></h2>
						</div>
						<div class="ageonce-card-body open">
							<p class="ageonce-desc ageonce-desc--spaced-bottom"><?php esc_html_e( 'This controls store customer accounts on your WooCommerce My Account page — not your AgeOnce merchant account.', 'age-verification-with-ageonce' ); ?></p>
							<div class="ageonce-form-group ageonce-form-group--lg-bottom">
								<div class="ageonce-row-inline">
									<input type="hidden" name="ageonce_registration_enabled" value="no">
									<label class="ageonce-switch">
										<input type="checkbox" name="ageonce_registration_enabled" value="yes" <?php checked( $registration_enabled, 'yes' ); ?>>
										<span class="ageonce-slider"></span>
									</label>
									<span class="ageonce-label ageonce-label--inline"><?php esc_html_e( 'Require age verification before customers can sign up', 'age-verification-with-ageonce' ); ?></span>
								</div>
								<p class="ageonce-desc ageonce-desc--tight-top"><?php esc_html_e( 'When enabled, guests must complete AgeOnce verification on the WooCommerce registration form before creating a store account. Off by default.', 'age-verification-with-ageonce' ); ?></p>
							</div>
							<div class="ageonce-form-group">
								<label class="ageonce-label" for="ageonce_registration_age"><?php esc_html_e( 'Minimum age to create a store account', 'age-verification-with-ageonce' ); ?></label>
								<select name="ageonce_registration_age" id="ageonce_registration_age" class="ageonce-input">
									<option value="16" <?php selected( $registration_age, '16' ); ?>><?php esc_html_e( '16+', 'age-verification-with-ageonce' ); ?></option>
									<option value="18" <?php selected( $registration_age, '18' ); ?>><?php esc_html_e( '18+', 'age-verification-with-ageonce' ); ?></option>
									<option value="21" <?php selected( $registration_age, '21' ); ?>><?php esc_html_e( '21+', 'age-verification-with-ageonce' ); ?></option>
								</select>
								<p class="ageonce-desc ageonce-desc--tight-top"><?php esc_html_e( 'Applies only when customer signup verification is enabled above.', 'age-verification-with-ageonce' ); ?></p>
							</div>
						</div>
					</div>
					<?php endif; ?>

					<h2 class="ageonce-title ageonce-title--section"><?php esc_html_e( 'Content Rules', 'age-verification-with-ageonce' ); ?></h2>
					<div class="ageonce-rules-guide">
						<div>
							<strong><?php esc_html_e( 'Choose what should require age verification', 'age-verification-with-ageonce' ); ?></strong>
							<p><?php esc_html_e( 'Start with categories or tags for the simplest setup. Product rules apply at checkout; posts and pages use the content gate. Use advanced taxonomies only when you need tighter control.', 'age-verification-with-ageonce' ); ?></p>
						</div>
						<ol>
							<li><?php esc_html_e( 'Turn on a content type', 'age-verification-with-ageonce' ); ?></li>
							<li><?php esc_html_e( 'Pick active age groups', 'age-verification-with-ageonce' ); ?></li>
							<li><?php esc_html_e( 'Select categories, tags, posts, or products to protect', 'age-verification-with-ageonce' ); ?></li>
						</ol>
					</div>

					<?php foreach ( $final_post_types as $pt_slug => $pt_obj ) :
						$taxonomies    = get_object_taxonomies( $pt_slug, 'objects' );
						$is_enabled    = isset( $saved_rules[ $pt_slug ]['enabled'] ) && $saved_rules[ $pt_slug ]['enabled'] === 'yes';
						$enabled_ages  = isset( $saved_rules[ $pt_slug ]['enabled_ages'] ) ? (array) $saved_rules[ $pt_slug ]['enabled_ages'] : array( '18' );
						?>

						<div class="ageonce-card" id="card-<?php echo esc_attr( $pt_slug ); ?>">
							<div class="ageonce-card-header" onclick="document.getElementById('toggle-<?php echo esc_attr( $pt_slug ); ?>').click()" title="<?php esc_attr_e( 'Click to open or close rules for this content type.', 'age-verification-with-ageonce' ); ?>">
								<div>
									<h2 class="ageonce-card-title ageonce-card-title--sm">
										<?php echo esc_html( $pt_obj->labels->name ); ?>
									</h2>
									<span class="ageonce-desc">
										<?php
										printf(
											/* translators: %s: post type slug. */
											esc_html__( 'Rules for %s', 'age-verification-with-ageonce' ),
											esc_html( $pt_slug )
										);
										?>
									</span>
								</div>
								<label class="ageonce-switch" onclick="event.stopPropagation()">
									<input type="checkbox" id="toggle-<?php echo esc_attr( $pt_slug ); ?>"
										   name="ageonce_rules[<?php echo esc_attr( $pt_slug ); ?>][enabled]" value="yes"
										   <?php checked( $is_enabled ); ?>
										   onchange="toggleAccordion('<?php echo esc_js( $pt_slug ); ?>')"
										   title="<?php esc_attr_e( 'Enable age verification rules for this content type.', 'age-verification-with-ageonce' ); ?>">
									<span class="ageonce-slider"></span>
								</label>
							</div>

							<div class="ageonce-card-body <?php echo $is_enabled ? 'open' : ''; ?>" id="body-<?php echo esc_attr( $pt_slug ); ?>">

								<?php if ( $pt_slug === 'product' ) : ?>
								<div class="ageonce-form-group ageonce-form-group--mb">
									<p class="ageonce-desc"><?php esc_html_e( 'Product rules choose which items require Verify Age at checkout. Product pages stay visible unless you turn on the option below.', 'age-verification-with-ageonce' ); ?></p>
									<input type="hidden" name="ageonce_rules[<?php echo esc_attr( $pt_slug ); ?>][gate_product_pages]" value="no">
									<label class="ageonce-toggle-label" title="<?php esc_attr_e( 'Replace the product description with the age gate until the visitor is verified.', 'age-verification-with-ageonce' ); ?>">
										<input type="checkbox" name="ageonce_rules[<?php echo esc_attr( $pt_slug ); ?>][gate_product_pages]" value="yes"
											class="ageonce-checkbox-inline"
											<?php checked( isset( $saved_rules[ $pt_slug ]['gate_product_pages'] ) ? $saved_rules[ $pt_slug ]['gate_product_pages'] : '', 'yes' ); ?>>
										<?php esc_html_e( 'Also hide product descriptions until verified', 'age-verification-with-ageonce' ); ?>
									</label>
									<p class="ageonce-desc ageonce-desc--tight-top"><?php esc_html_e( 'Off by default. Use this only when the product page itself should be blocked, not just checkout.', 'age-verification-with-ageonce' ); ?></p>
								</div>
								<?php endif; ?>

								<div class="ageonce-form-group ageonce-form-group--mb">
									<label class="ageonce-toggle-label" title="<?php esc_attr_e( 'Adds a per-item metabox so editors can manually lock individual posts, pages, or products.', 'age-verification-with-ageonce' ); ?>">
										<input type="checkbox" name="ageonce_rules[<?php echo esc_attr( $pt_slug ); ?>][manual_lock_enabled]" value="yes"
											class="ageonce-checkbox-inline"
											<?php checked( isset( $saved_rules[ $pt_slug ]['manual_lock_enabled'] ) ? $saved_rules[ $pt_slug ]['manual_lock_enabled'] : '', 'yes' ); ?>>
										<?php esc_html_e( 'Allow Manual Locking via Metabox', 'age-verification-with-ageonce' ); ?>
									</label>
									<p class="ageonce-desc ageonce-desc--tight-top"><?php esc_html_e( 'Optional: lets editors lock individual items without selecting a category or tag.', 'age-verification-with-ageonce' ); ?></p>
								</div>

								<div class="ageonce-age-selector">
									<span class="ageonce-age-selector-label"><?php esc_html_e( 'Active Age Groups:', 'age-verification-with-ageonce' ); ?></span>
									<?php foreach ( $age_groups as $age ) : ?>
										<label class="ageonce-age-option" title="<?php echo esc_attr( sprintf(
											/* translators: %s: age group, e.g. 18. */
											__( 'Show a %s+ rules tab for this content type.', 'age-verification-with-ageonce' ),
											$age
										) ); ?>">
											<input type="checkbox" name="ageonce_rules[<?php echo esc_attr( $pt_slug ); ?>][enabled_ages][]" value="<?php echo esc_attr( $age ); ?>"
												<?php checked( in_array( $age, $enabled_ages ) ); ?>
												onchange="toggleTabs('<?php echo esc_js( $pt_slug ); ?>')">
											<?php echo esc_html( $age ); ?>+
										</label>
									<?php endforeach; ?>
								</div>

								<?php if ( ! empty( $taxonomies ) ) : ?>

									<div class="ageonce-tabs-nav" id="tabs-nav-<?php echo esc_attr( $pt_slug ); ?>">
										<?php
										$first_active = true;
										foreach ( $age_groups as $age ) :
											$is_age_enabled = in_array( $age, $enabled_ages );
											$active_class   = ( $is_age_enabled && $first_active ) ? 'active' : '';
											if ( $is_age_enabled ) {
												$first_active = false;
											}
											$tab_link_classes = array( 'ageonce-tab-link' );
											if ( $active_class ) {
												$tab_link_classes[] = $active_class;
											}
											if ( ! $is_age_enabled ) {
												$tab_link_classes[] = 'ageonce-tab-link-hidden';
											}
											?>
											<div class="<?php echo esc_attr( implode( ' ', $tab_link_classes ) ); ?>"
												 id="tab-link-<?php echo esc_attr( $pt_slug . '-' . $age ); ?>"
												 onclick="switchTab('<?php echo esc_js( $pt_slug ); ?>', '<?php echo esc_js( $age ); ?>')">
												<?php
												/* translators: %s: age group, e.g. 18 */
												printf( esc_html__( '%s+ Rules', 'age-verification-with-ageonce' ), esc_html( $age ) );
											?>
											</div>
										<?php endforeach; ?>
									</div>

									<?php
									$first_active = true;
									foreach ( $age_groups as $age ) :
										$is_age_enabled = in_array( $age, $enabled_ages );
										$active_class   = ( $is_age_enabled && $first_active ) ? 'active' : '';
										if ( $is_age_enabled ) {
											$first_active = false;
										}
										?>
										<div class="ageonce-tab-content <?php echo esc_attr( $active_class ); ?>" id="tab-content-<?php echo esc_attr( $pt_slug . '-' . $age ); ?>">
											<p class="ageonce-desc ageonce-desc--tab-intro">
												<?php
												/* translators: %s: age number, e.g. 18 */
												printf( esc_html__( 'Select items requiring users to be %s or older.', 'age-verification-with-ageonce' ), '<strong>' . esc_html( $age ) . '</strong>' );
												?>
											</p>

											<?php
											$taxonomy_fields     = array();
											$primary_taxonomies  = array();
											$advanced_taxonomies = array();
											foreach ( $taxonomies as $tax_slug => $tax_obj ) :
												$terms_list = $this->get_formatted_terms( $tax_slug );
												if ( empty( $terms_list ) ) {
													continue;
												}

												$selected_terms = isset( $saved_rules[ $pt_slug ]['ages'][ $age ]['taxonomies'][ $tax_slug ] )
													? $saved_rules[ $pt_slug ]['ages'][ $age ]['taxonomies'][ $tax_slug ]
													: array();
												$field = array(
													'slug'     => $tax_slug,
													'object'   => $tax_obj,
													'terms'    => $terms_list,
													'selected' => (array) $selected_terms,
												);
												$taxonomy_fields[] = $field;
											endforeach;

											foreach ( $taxonomy_fields as $field ) {
												if ( $this->is_primary_taxonomy( $pt_slug, $field['slug'] ) ) {
													$primary_taxonomies[] = $field;
												} else {
													$advanced_taxonomies[] = $field;
												}
											}

											if ( empty( $primary_taxonomies ) && ! empty( $advanced_taxonomies ) ) {
												$primary_taxonomies = array_splice( $advanced_taxonomies, 0, 1 );
											}
											?>

											<?php if ( ! empty( $primary_taxonomies ) ) : ?>
												<div class="ageonce-rule-section">
													<div class="ageonce-rule-section-heading">
														<strong><?php esc_html_e( 'Recommended rules', 'age-verification-with-ageonce' ); ?></strong>
														<span><?php esc_html_e( 'Best for most stores and sites.', 'age-verification-with-ageonce' ); ?></span>
													</div>
													<div class="ageonce-grid-2">
														<?php
														foreach ( $primary_taxonomies as $field ) {
															$this->render_taxonomy_rule_field( $pt_slug, $age, $field['slug'], $field['object'], $field['terms'], $field['selected'] );
														}
														?>
													</div>
												</div>
											<?php endif; ?>

											<?php if ( ! empty( $advanced_taxonomies ) ) : ?>
												<details class="ageonce-advanced-rules">
													<summary><?php esc_html_e( 'Advanced taxonomies', 'age-verification-with-ageonce' ); ?></summary>
													<p class="ageonce-desc"><?php esc_html_e( 'Use these only if you want to trigger age verification from product attributes, visibility, or custom taxonomies.', 'age-verification-with-ageonce' ); ?></p>
													<div class="ageonce-grid-2">
														<?php
														foreach ( $advanced_taxonomies as $field ) {
															$this->render_taxonomy_rule_field( $pt_slug, $age, $field['slug'], $field['object'], $field['terms'], $field['selected'] );
														}
														?>
													</div>
												</details>
											<?php endif; ?>
										</div>
									<?php endforeach; ?>

								<?php endif; ?>
							</div>
						</div>
					<?php endforeach; ?>

					<div class="ageonce-actions">
						<button type="submit" class="ageonce-btn-primary button button-primary"><?php esc_html_e( 'Save Changes', 'age-verification-with-ageonce' ); ?></button>
					</div>
				</form>
			</div>
		</div>
		<div class="ageonce-toast ageonce-toast--hidden" id="ageonce-live-status" aria-live="polite">
			<span class="dashicons" aria-hidden="true"></span>
			<div>
				<strong></strong>
				<p></p>
			</div>
		</div>
		<?php
	}
}