<?php

namespace AgoLab\Legal;

defined( 'ABSPATH' ) || exit;

class Consent {

    public const DB_VERSION = '2.0';

    private static function table(): string {
        global $wpdb;
        return $wpdb->prefix . 'agolegal_consents';
    }

    public static function create_table(): void {
        global $wpdb;
        $table = self::table();
        $table   = self::table();
        $charset = $wpdb->get_charset_collate();

        $sql = "CREATE TABLE {$table} (
            id bigint(20) unsigned NOT NULL AUTO_INCREMENT,
            ip_address varchar(45) DEFAULT '',
            user_agent varchar(500) DEFAULT '',
            consent_data text DEFAULT '',
            entry_hash varchar(64) DEFAULT '',
            created_at datetime DEFAULT CURRENT_TIMESTAMP,
            PRIMARY KEY (id),
            KEY entry_hash (entry_hash),
            KEY created_at (created_at)
        ) {$charset};";

        require_once ABSPATH . 'wp-admin/includes/upgrade.php';
        dbDelta( $sql );
        update_option( 'agolegal_consents_db_version', self::DB_VERSION );
    }

    /** SHA-256 of canonical (ip|ua|json|timestamp). Stored to verify integrity. */
    public static function compute_hash( string $ip, string $ua, string $json, string $created_at ): string {
        return hash( 'sha256', $ip . '|' . $ua . '|' . $json . '|' . $created_at );
    }

    public static function insert( array $data, string $ip, string $ua ): int {
        global $wpdb;
        $created = current_time( 'mysql' );
        $json    = wp_json_encode( $data );
        $hash    = self::compute_hash( $ip, substr( $ua, 0, 500 ), $json, $created );
        $wpdb->insert( self::table(), [
            'ip_address'   => $ip,
            'user_agent'   => substr( $ua, 0, 500 ),
            'consent_data' => $json,
            'entry_hash'   => $hash,
            'created_at'   => $created,
        ] );
        return (int) $wpdb->insert_id;
    }

    public static function get_list( int $page = 1, int $per_page = 20 ): array {
        global $wpdb;
        $table = self::table();
        $table = self::table();
        $table  = self::table();
        $offset = ( $page - 1 ) * $per_page;

        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Custom table; query is safe.
        $total = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$table}" );
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Custom table; query is safe.
        $items = $wpdb->get_results( $wpdb->prepare(
            "SELECT * FROM {$table} ORDER BY created_at DESC LIMIT %d OFFSET %d",
            $per_page, $offset
        ) );

        foreach ( $items as &$item ) {
            $item->consent_data = json_decode( $item->consent_data, true );
        }

        return [
            'items'    => $items,
            'total'    => $total,
            'page'     => $page,
            'per_page' => $per_page,
            'pages'    => (int) ceil( $total / $per_page ),
        ];
    }

    public static function export_csv(): string {
        global $wpdb;
        $table = self::table();
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Custom table; query is safe.
        $items = $wpdb->get_results( "SELECT * FROM {$table} ORDER BY created_at DESC" );
        $csv = "ID,IP,User Agent,Necessary,Analytics,Marketing,Functional,Date,Hash\n";
        foreach ( $items as $item ) {
            $data = json_decode( $item->consent_data, true ) ?: [];
            $csv .= sprintf(
                "%d,%s,%s,%s,%s,%s,%s,%s,%s\n",
                $item->id,
                Csv::cell( (string) $item->ip_address ),
                Csv::cell( substr( (string) $item->user_agent, 0, 100 ) ),
                ! empty( $data['necessary'] ) ? 'yes' : 'no',
                ! empty( $data['analytics'] ) ? 'yes' : 'no',
                ! empty( $data['marketing'] ) ? 'yes' : 'no',
                ! empty( $data['functional'] ) ? 'yes' : 'no',
                $item->created_at,
                $item->entry_hash
            );
        }
        return $csv;
    }

    /** Audit-ready HTML report with all hashes plus batch hash at the end. */
    public static function export_html_report(): string {
        global $wpdb;
        $table = self::table();
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Custom table; query is safe.
        $items     = $wpdb->get_results( "SELECT * FROM {$table} ORDER BY created_at DESC" );
        $batch_str = '';
        foreach ( $items as $i ) $batch_str .= $i->entry_hash;
        $batch_hash = hash( 'sha256', $batch_str );
        $site       = esc_html( get_bloginfo( 'name' ) );
        $generated  = current_time( 'mysql' );

        ob_start();
        ?>
        <!DOCTYPE html>
        <html><head><meta charset="utf-8"><title>Consent log - <?php echo esc_html( $site ); ?></title>
        <style>
        body{font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif;margin:0;padding:24px;color:#1d2327;font-size:12px}
        h1{font-size:20px;margin:0 0 4px}.meta{color:#666;margin-bottom:16px}
        table{width:100%;border-collapse:collapse;margin-top:8px}
        th{background:#f0f0f1;text-align:left;padding:6px 8px;border-bottom:2px solid #c3c4c7}
        td{padding:6px 8px;border-bottom:1px solid #e0e0e0;vertical-align:top}
        .y{color:#00a32a;font-weight:600}.n{color:#d63638}
        code{font-family:Consolas,Monaco,monospace;font-size:10px;word-break:break-all}
        .footer{margin-top:24px;padding:12px;background:#f0fff4;border:1px solid #1e8a4a;border-radius:4px}
        @media print { body { padding: 0 } }
        </style></head><body>
        <h1>Consent Log Audit Report</h1>
        <div class="meta">Site: <?php echo esc_html( $site ); ?> &middot; Generated: <?php echo esc_html( $generated ); ?> &middot; Total entries: <?php echo count( $items ); ?></div>
        <table>
            <thead><tr><th>ID</th><th>Date</th><th>IP</th><th>Nec</th><th>Ana</th><th>Mkt</th><th>Fun</th><th>SHA-256</th></tr></thead>
            <tbody>
            <?php foreach ( $items as $item ) :
                $d = json_decode( $item->consent_data, true ) ?: []; ?>
                <tr>
                    <td><?php echo (int) $item->id; ?></td>
                    <td><?php echo esc_html( $item->created_at ); ?></td>
                    <td><?php echo esc_html( $item->ip_address ); ?></td>
                    <td class="<?php echo ! empty( $d['necessary'] ) ? 'y' : 'n'; ?>"><?php echo ! empty( $d['necessary'] ) ? 'YES' : 'NO'; ?></td>
                    <td class="<?php echo ! empty( $d['analytics'] ) ? 'y' : 'n'; ?>"><?php echo ! empty( $d['analytics'] ) ? 'YES' : 'NO'; ?></td>
                    <td class="<?php echo ! empty( $d['marketing'] ) ? 'y' : 'n'; ?>"><?php echo ! empty( $d['marketing'] ) ? 'YES' : 'NO'; ?></td>
                    <td class="<?php echo ! empty( $d['functional'] ) ? 'y' : 'n'; ?>"><?php echo ! empty( $d['functional'] ) ? 'YES' : 'NO'; ?></td>
                    <td><code><?php echo esc_html( $item->entry_hash ); ?></code></td>
                </tr>
            <?php endforeach; ?>
            </tbody>
        </table>
        <div class="footer">
            <strong>Batch hash (SHA-256 of all entry hashes concatenated):</strong><br>
            <code><?php echo esc_html( $batch_hash ); ?></code>
            <p style="margin:8px 0 0;color:#666">To verify integrity: recompute SHA-256 of (ip|user_agent|consent_json|created_at) for each row and confirm it matches the stored hash. Concatenate all row hashes in this order and SHA-256 the result; it must equal the batch hash above.</p>
        </div>
        </body></html>
        <?php
        return ob_get_clean();
    }
}