<?php
/**
 * Plugin Name: AJO Membership
 * Description: A simple, secure membership portal to protect pages/posts and provide login, registration, password reset, and profile editing shortcodes.
 * License: GPL-2.0-or-later
 * Version: 1.0
 * Author: Ali J Online
 * Author URL: https://alijonline.com/
 * Text Domain: ajo-membership
 */

// Define the namespace as requested by the WordPress review team
namespace wgs2026\ajomembership;

// Exit if accessed directly for security
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

// Define a plugin directory constant with the required prefix
define( 'AJOME_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

class AJOME_Membership {

    public function __construct() {
        // Hooks for admin dashboard settings
        add_action( 'admin_menu', array( $this, 'add_plugin_page' ) );
        add_action( 'admin_init', array( $this, 'page_init' ) );

        // Hook for front-end page protection redirect
        add_action( 'template_redirect', array( $this, 'protect_content' ) );

        // Block non-admins from the dashboard
        add_action( 'admin_init', array( $this, 'block_dashboard_access' ) );

        // Hooks for shortcodes
        add_shortcode( 'ajome_login', array( $this, 'login_shortcode' ) );
        add_shortcode( 'ajome_register', array( $this, 'register_shortcode' ) );
        add_shortcode( 'ajome_password_reset', array( $this, 'password_reset_shortcode' ) );
        add_shortcode( 'ajome_edit_profile', array( $this, 'edit_profile_shortcode' ) );
    }

    /**
     * Redirects non-logged-in users if they try to access protected URLs
     */
    public function protect_content() {
        if ( is_user_logged_in() ) {
            return; // User is authenticated, let them view the content
        }

        $protected_urls = get_option( 'ajome_protected_urls', '' );
        $redirect_url   = get_option( 'ajome_redirect_url', wp_login_url() );

        if ( empty( $protected_urls ) ) {
            return; // Nothing to protect
        }

        // Get current path and normalize it
        $current_path = trailingslashit( parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ) );
        
        // Break the textarea into an array of lines
        $urls = explode( "\n", str_replace( "\r", "", $protected_urls ) );

        foreach ( $urls as $url ) {
            $url = trim( $url );
            if ( empty( $url ) ) continue;

            $protected_path = trailingslashit( parse_url( $url, PHP_URL_PATH ) );

            // If the current URL starts with the protected path, redirect them
            if ( strpos( $current_path, $protected_path ) === 0 ) {
                wp_safe_redirect( esc_url_raw( $redirect_url ) );
                exit;
            }
        }
    }

    /**
     * Redirects non-admins away from the WordPress dashboard
     */
    public function block_dashboard_access() {
        // Allow administrators to access the backend. Allow AJAX calls to function normally.
        if ( is_admin() && ! current_user_can( 'manage_options' ) && ! wp_doing_ajax() ) {
            wp_safe_redirect( home_url() );
            exit;
        }
    }

    /**
     * Add settings page under the "Settings" menu
     */
    public function add_plugin_page() {
        add_options_page(
            'AJO Membership Settings', 
            'AJO Membership', 
            'manage_options', 
            'ajome-membership', 
            array( $this, 'create_admin_page' )
        );
    }

    /**
     * Register settings and fields
     */
    public function page_init() {
        register_setting( 'ajome_membership_group', 'ajome_protected_urls', 'sanitize_textarea_field' );
        register_setting( 'ajome_membership_group', 'ajome_redirect_url', 'esc_url_raw' );

        add_settings_section(
            'ajome_membership_section',
            'Protection Settings',
            array( $this, 'section_info' ),
            'ajome-membership'
        );

        add_settings_field(
            'ajome_protected_urls',
            'Protected URLs / Paths',
            array( $this, 'protected_urls_callback' ),
            'ajome-membership',
            'ajome_membership_section'
        );

        add_settings_field(
            'ajome_redirect_url',
            'Redirection Link',
            array( $this, 'redirect_url_callback' ),
            'ajome-membership',
            'ajome_membership_section'
        );
    }

    /**
     * Admin page HTML
     */
    public function create_admin_page() {
        ?>
        <div class="wrap">
            <h1>AJO Membership Settings</h1>
            <form method="post" action="options.php">
                <?php
                settings_fields( 'ajome_membership_group' );
                do_settings_sections( 'ajome-membership' );
                submit_button();
                ?>
            </form>
            <hr>
            <h2>Available Shortcodes</h2>
            <p>Use these shortcodes on your pages to display forms to your users:</p>
            <ul>
                <li><code>[ajome_login]</code> - Displays the login form.</li>
                <li><code>[ajome_register]</code> - Displays the registration form.</li>
                <li><code>[ajome_password_reset]</code> - Displays the lost password form.</li>
                <li><code>[ajome_edit_profile]</code> - Displays the frontend profile editor (First Name, Last Name, Email, Password).</li>
            </ul>
        </div>
        <?php
    }

    public function section_info() {
        echo '<p>Enter the links you want to protect from non-registered users, and where they should be sent instead.</p>';
    }

    public function protected_urls_callback() {
        $urls = get_option( 'ajome_protected_urls', '' );
        echo '<textarea name="ajome_protected_urls" rows="5" cols="50" class="large-text code" placeholder="/premium-page/&#10;https://yoursite.com/members-area/">' . esc_textarea( $urls ) . '</textarea>';
        echo '<p class="description">Enter one URL or path per line. Both relative paths (e.g. <code>/my-page/</code>) and full URLs are supported. Child pages of these paths will also be protected.</p>';
    }

    public function redirect_url_callback() {
        $url = get_option( 'ajome_redirect_url', '' );
        echo '<input type="url" name="ajome_redirect_url" value="' . esc_attr( $url ) . '" class="regular-text" placeholder="https://yoursite.com/login/" />';
        echo '<p class="description">Where should non-registered users be sent? (Leave blank to use the default WordPress login page).</p>';
    }

    /**
     * Shortcode: Login Form
     */
    public function login_shortcode() {
        if ( is_user_logged_in() ) {
            return '<p>You are already logged in.</p>';
        }
        return wp_login_form( array( 'echo' => false ) );
    }

    /**
     * Shortcode: Registration Form (Uses core WP processing)
     */
    public function register_shortcode() {
        if ( is_user_logged_in() ) {
            return '<p>You are already registered and logged in.</p>';
        }
        
        // Ensures the form sends data to WordPress's native registration handler
        $register_url = esc_url( site_url( 'wp-login.php?action=register', 'login_post' ) );
        
        ob_start();
        ?>
        <form name="registerform" id="registerform" action="<?php echo $register_url; ?>" method="post">
            <p>
                <label for="user_login">Username</label><br />
                <input type="text" name="user_login" id="user_login" class="input" value="" size="20" required />
            </p>
            <p>
                <label for="user_email">Email Address</label><br />
                <input type="email" name="user_email" id="user_email" class="input" value="" size="25" required />
            </p>
            <p id="reg_passmail">Registration confirmation and password setup will be emailed to you.</p>
            <p class="submit">
                <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="Register" />
            </p>
        </form>
        <?php
        return ob_get_clean();
    }

    /**
     * Shortcode: Password Reset Form (Uses core WP processing)
     */
    public function password_reset_shortcode() {
        if ( is_user_logged_in() ) {
            return '<p>You are already logged in.</p>';
        }

        // Ensures the form sends data to WordPress's native lost password handler
        $reset_url = esc_url( network_site_url( 'wp-login.php?action=lostpassword', 'login_post' ) );

        ob_start();
        ?>
        <form name="lostpasswordform" id="lostpasswordform" action="<?php echo $reset_url; ?>" method="post">
            <p>
                <label for="user_login">Username or Email Address</label><br />
                <input type="text" name="user_login" id="user_login" class="input" value="" size="20" required />
            </p>
            <input type="hidden" name="redirect_to" value="" />
            <p class="submit">
                <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="Get New Password" />
            </p>
        </form>
        <?php
        return ob_get_clean();
    }

    /**
     * Shortcode: Frontend Profile Editor
     */
    public function edit_profile_shortcode() {
        // Stop guests from seeing the form
        if ( ! is_user_logged_in() ) {
            return '<p>You must be logged in to edit your profile.</p>';
        }

        $current_user = wp_get_current_user();
        $message = '';

        // Check if the form was submitted
        if ( isset( $_POST['ajome_profile_submit'] ) ) {
            
            // VERIFY SECURITY NONCE EXACTLY AS REQUESTED BY WORDPRESS
            if ( ! isset( $_POST['ajome_profile_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['ajome_profile_nonce'] ) ), 'ajome_update_profile_action' ) ) {
                $message = '<p style="color:red;">Security check failed. Please refresh and try again.</p>';
            } else {
                // Sanitize user inputs
                $email      = sanitize_email( wp_unslash( $_POST['ajome_email'] ) );
                $first_name = sanitize_text_field( wp_unslash( $_POST['ajome_first_name'] ) );
                $last_name  = sanitize_text_field( wp_unslash( $_POST['ajome_last_name'] ) );

                // Validate email
                if ( ! is_email( $email ) ) {
                    $message = '<p style="color:red;">Please enter a valid email address.</p>';
                } elseif ( email_exists( $email ) && email_exists( $email ) !== $current_user->ID ) {
                    $message = '<p style="color:red;">That email is already registered to another account.</p>';
                } else {
                    // Prepare data for WordPress update function
                    $userdata = array(
                        'ID'         => $current_user->ID,
                        'user_email' => $email,
                        'first_name' => $first_name,
                        'last_name'  => $last_name,
                    );

                    // Handle password update if fields are not empty
                    if ( ! empty( $_POST['ajome_pass1'] ) || ! empty( $_POST['ajome_pass2'] ) ) {
                        if ( $_POST['ajome_pass1'] === $_POST['ajome_pass2'] ) {
                            $userdata['user_pass'] = $_POST['ajome_pass1'];
                        } else {
                            $message = '<p style="color:red;">The passwords you entered do not match.</p>';
                        }
                    }

                    // If there are no errors, update the user
                    if ( empty( $message ) ) {
                        $user_id = wp_update_user( $userdata );
                        
                        if ( is_wp_error( $user_id ) ) {
                            $message = '<p style="color:red;">' . esc_html( $user_id->get_error_message() ) . '</p>';
                        } else {
                            $message = '<p style="color:green;">Profile updated successfully.</p>';
                            // Refresh user data so the form shows the new data
                            $current_user = wp_get_current_user();
                        }
                    }
                }
            }
        }

        // Output the frontend form
        ob_start();
        ?>
        <div class="ajome-profile-editor">
            <?php echo $message; ?>
            <form method="post" action="">
                <?php wp_nonce_field( 'ajome_update_profile_action', 'ajome_profile_nonce' ); ?>
                
                <p>
                    <label for="ajome_first_name">First Name</label><br>
                    <input type="text" name="ajome_first_name" id="ajome_first_name" value="<?php echo esc_attr( $current_user->first_name ); ?>" class="regular-text" />
                </p>

                <p>
                    <label for="ajome_last_name">Last Name</label><br>
                    <input type="text" name="ajome_last_name" id="ajome_last_name" value="<?php echo esc_attr( $current_user->last_name ); ?>" class="regular-text" />
                </p>

                <p>
                    <label for="ajome_email">Email Address (Required)</label><br>
                    <input type="email" name="ajome_email" id="ajome_email" value="<?php echo esc_attr( $current_user->user_email ); ?>" class="regular-text" required />
                </p>

                <hr style="margin: 20px 0;">
                <h4>Change Password</h4>
                <p><em>Leave blank if you do not want to change your password.</em></p>

                <p>
                    <label for="ajome_pass1">New Password</label><br>
                    <input type="password" name="ajome_pass1" id="ajome_pass1" class="regular-text" />
                </p>

                <p>
                    <label for="ajome_pass2">Confirm New Password</label><br>
                    <input type="password" name="ajome_pass2" id="ajome_pass2" class="regular-text" />
                </p>

                <p>
                    <input type="submit" name="ajome_profile_submit" class="button button-primary" value="Update Profile" />
                </p>
            </form>
        </div>
        <?php
        return ob_get_clean();
    }
}

// Initialize the plugin
new AJOME_Membership();