<?php
/**
 * 2FA requirement enforcement class
 *
 * @package TwoFactorExtended
 * @since 0.1.0
 */

// Prevent direct access.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Class Two_Factor_Extended_Enforcement
 *
 * Enforces 2FA requirements based on user roles.
 *
 * @since 0.1.0
 */
class Two_Factor_Extended_Enforcement {

	/**
	 * User meta key for enforcement start date.
	 *
	 * @since 0.1.0
	 * @var string
	 */
	const META_ENFORCEMENT_START = 'two_factor_extended_enforcement_start';

	/**
	 * User meta key for grace period notified.
	 *
	 * @since 0.1.0
	 * @var string
	 */
	const META_GRACE_NOTIFIED = 'two_factor_extended_grace_notified';

	/**
	 * Constructor.
	 *
	 * @since 0.1.0
	 */
	public function __construct() {
		$this->init_hooks();
	}

	/**
	 * Initialize WordPress hooks.
	 *
	 * @since 0.1.0
	 */
	private function init_hooks(): void {
		add_filter( 'authenticate', array( $this, 'check_user_requirements' ), 30, 1 );
		add_action( 'admin_notices', array( $this, 'display_user_notices' ) );
		add_action( 'two_factor_extended_daily_check', array( $this, 'check_all_users_compliance' ) );
	}

	/**
	 * Check user's 2FA requirements on login.
	 *
	 * @since 0.1.0
	 *
	 * @param WP_User|WP_Error|null $user User object or error.
	 *
	 * @return WP_User|WP_Error|null User object or error if requirements not met.
	 */
	public function check_user_requirements( $user ) {
		// Skip if not a user object.
		if ( ! $user instanceof WP_User ) {
			return $user;
		}

		// Skip if Two Factor not available.
		if ( ! class_exists( 'Two_Factor_Core' ) ) {
			return $user;
		}

		// Get required providers for user.
		$required_providers = $this->get_required_providers_for_user( $user->ID );

		if ( empty( $required_providers ) ) {
			return $user;
		}

		// Check if user is in grace period.
		if ( $this->is_in_grace_period( $user->ID ) ) {
			$this->set_grace_period_notice( $user->ID );
			return $user;
		}

		// Check if user meets requirements.
		if ( ! $this->user_meets_requirements( $user->ID, $required_providers ) ) {
			return new WP_Error(
				'two_factor_extended_required',
				sprintf(
					/* translators: %s: Required providers list */
					__( 'Your account requires the following 2FA methods to be configured: %s. Please contact an administrator for assistance.', 'two-factor-extended' ),
					implode( ', ', $this->get_provider_labels( $required_providers ) )
				)
			);
		}

		return $user;
	}

	/**
	 * Get required providers for user based on their roles.
	 *
	 * @since 0.1.0
	 *
	 * @param int $user_id User ID.
	 *
	 * @return array<int, string> Array of required provider class names.
	 */
	public function get_required_providers_for_user( int $user_id ): array {
		$required = array();

		// Check if user is super admin (Multisite).
		if ( is_multisite() && Two_Factor_Extended_Role_Manager::is_super_admin( $user_id ) ) {
			$network_settings = get_site_option( TWO_FACTOR_EXTENDED_NETWORK_OPTION_SETTINGS, array() );
			if ( ! is_array( $network_settings ) ) {
				$network_settings = array();
			}

			if ( isset( $network_settings['super_admin_requirements'] ) && is_array( $network_settings['super_admin_requirements'] ) ) {
				foreach ( $network_settings['super_admin_requirements'] as $provider ) {
					if ( is_string( $provider ) ) {
						$required[] = $provider;
					}
				}
			}
		}

		// Check network-wide settings (Multisite).
		if ( is_multisite() ) {
			$network_settings = get_site_option( TWO_FACTOR_EXTENDED_NETWORK_OPTION_SETTINGS, array() );
			if ( ! is_array( $network_settings ) ) {
				$network_settings = array();
			}

			if ( ! empty( $network_settings['enforce_network_wide'] ) ) {
				// Network enforcement is enabled.
				$user_roles = Two_Factor_Extended_Role_Manager::get_user_roles( $user_id );

				if ( isset( $network_settings['role_requirements'] ) && is_array( $network_settings['role_requirements'] ) ) {
					foreach ( $user_roles as $role ) {
						if ( isset( $network_settings['role_requirements'][ $role ] ) && is_array( $network_settings['role_requirements'][ $role ] ) ) {
							foreach ( $network_settings['role_requirements'][ $role ] as $provider ) {
								if ( is_string( $provider ) ) {
									$required[] = $provider;
								}
							}
						}
					}
				}

				// If site override is not allowed, return only network requirements.
				if ( empty( $network_settings['allow_site_override'] ) ) {
					$network_required = array_values( array_unique( $required ) );

					// Intersect with globally-available providers (Two Factor 0.16+).
					if ( class_exists( 'Two_Factor_Core' ) ) {
						$available        = array_keys( Two_Factor_Core::get_providers() );
						$network_required = ! empty( $available ) ? array_values( array_intersect( $network_required, $available ) ) : $network_required;
					}

					return $network_required;
				}
			}
		}

		// Get site-level requirements.
		$settings = get_option( TWO_FACTOR_EXTENDED_OPTION_SETTINGS, array() );
		if ( ! is_array( $settings ) ) {
			$settings = array();
		}
		$user_roles = Two_Factor_Extended_Role_Manager::get_user_roles( $user_id );

		if ( ! empty( $user_roles ) && isset( $settings['role_requirements'] ) && is_array( $settings['role_requirements'] ) ) {
			foreach ( $user_roles as $role ) {
				if ( isset( $settings['role_requirements'][ $role ] ) ) {
					$role_requirements = $settings['role_requirements'][ $role ];

					if ( is_array( $role_requirements ) ) {
						foreach ( $role_requirements as $provider ) {
							if ( is_string( $provider ) ) {
								$required[] = $provider;
							}
						}
					}
				}
			}
		}

		$required = array_values( array_unique( $required ) );

		// Intersect with globally-available providers (Two Factor 0.16+).
		// If Two-Factor has disabled a provider site-wide, it cannot be enforced.
		if ( class_exists( 'Two_Factor_Core' ) ) {
			$available = array_keys( Two_Factor_Core::get_providers() );

			if ( ! empty( $available ) ) {
				$required = array_values( array_intersect( $required, $available ) );
			}
		}

		return $required;
	}

	/**
	 * Check if user meets 2FA requirements.
	 *
	 * @since 0.1.0
	 *
	 * @param int                $user_id            User ID.
	 * @param array<int, string> $required_providers Required provider class names.
	 *
	 * @return bool True if user meets requirements, false otherwise.
	 */
	public function user_meets_requirements( int $user_id, array $required_providers ): bool {
		if ( empty( $required_providers ) ) {
			return true;
		}

		$enabled_providers = Two_Factor_Extended_Provider_Detector::get_user_enabled_providers( $user_id );

		foreach ( $required_providers as $provider_class ) {
			if ( ! isset( $enabled_providers[ $provider_class ] ) ) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Check if user is in grace period.
	 *
	 * @since 0.1.0
	 *
	 * @param int $user_id User ID.
	 *
	 * @return bool True if in grace period, false otherwise.
	 */
	public function is_in_grace_period( int $user_id ): bool {
		$settings = get_option( TWO_FACTOR_EXTENDED_OPTION_SETTINGS, array() );
		if ( ! is_array( $settings ) ) {
			$settings = array();
		}
		$grace_days = isset( $settings['grace_period_days'] ) && is_numeric( $settings['grace_period_days'] ) ? (int) $settings['grace_period_days'] : 0;

		// No grace period configured.
		if ( 0 === $grace_days ) {
			return false;
		}

		$start_date = get_user_meta( $user_id, self::META_ENFORCEMENT_START, true );

		// No enforcement start date set - set it now.
		if ( empty( $start_date ) ) {
			update_user_meta( $user_id, self::META_ENFORCEMENT_START, time() );
			return true;
		}

		$days_elapsed = ( time() - ( is_numeric( $start_date ) ? (int) $start_date : 0 ) ) / DAY_IN_SECONDS;

		return $days_elapsed < $grace_days;
	}

	/**
	 * Get remaining grace period days.
	 *
	 * @since 0.1.0
	 *
	 * @param int $user_id User ID.
	 *
	 * @return int Remaining days in grace period.
	 */
	public function get_grace_period_remaining_days( int $user_id ): int {
		$settings = get_option( TWO_FACTOR_EXTENDED_OPTION_SETTINGS, array() );
		if ( ! is_array( $settings ) ) {
			$settings = array();
		}
		$grace_days = isset( $settings['grace_period_days'] ) && is_numeric( $settings['grace_period_days'] ) ? (int) $settings['grace_period_days'] : 0;
		$start_date = get_user_meta( $user_id, self::META_ENFORCEMENT_START, true );

		if ( empty( $start_date ) || 0 === $grace_days ) {
			return 0;
		}

		$days_elapsed = ( time() - ( is_numeric( $start_date ) ? (int) $start_date : 0 ) ) / DAY_IN_SECONDS;
		$remaining    = $grace_days - $days_elapsed;

		return max( 0, (int) ceil( $remaining ) );
	}

	/**
	 * Set grace period notice flag.
	 *
	 * @since 0.1.0
	 *
	 * @param int $user_id User ID.
	 */
	private function set_grace_period_notice( int $user_id ): void {
		update_user_meta( $user_id, self::META_GRACE_NOTIFIED, time() );
	}

	/**
	 * Display user notices for 2FA requirements.
	 *
	 * @since 0.1.0
	 */
	public function display_user_notices(): void {
		$user_id = get_current_user_id();

		if ( ! $user_id ) {
			return;
		}

		$required_providers = $this->get_required_providers_for_user( $user_id );

		if ( empty( $required_providers ) ) {
			return;
		}

		// Check if user meets requirements.
		if ( $this->user_meets_requirements( $user_id, $required_providers ) ) {
			return;
		}

		// Check if in grace period.
		if ( $this->is_in_grace_period( $user_id ) ) {
			$remaining_days = $this->get_grace_period_remaining_days( $user_id );

			?>
			<div class="notice notice-warning">
				<p>
					<strong><?php esc_html_e( 'Two-Factor Extended:', 'two-factor-extended' ); ?></strong>
					<?php
					printf(
						esc_html(
						/* translators: 1: Number of days, 2: Required providers list */
							_n(
								'You have %1$d day remaining to configure the required 2FA methods: %2$s',
								'You have %1$d days remaining to configure the required 2FA methods: %2$s',
								$remaining_days,
								'two-factor-extended'
							)
						),
						(int) $remaining_days,
						esc_html( implode( ', ', $this->get_provider_labels( $required_providers ) ) )
					);
					?>
				</p>
				<p>
					<a href="<?php echo esc_url( admin_url( 'profile.php#two-factor-options' ) ); ?>" class="button button-primary">
						<?php esc_html_e( 'Configure 2FA Now', 'two-factor-extended' ); ?>
					</a>
				</p>
			</div>
			<?php
		} else {
			?>
			<div class="notice notice-error">
				<p>
					<strong><?php esc_html_e( 'Two-Factor Extended:', 'two-factor-extended' ); ?></strong>
					<?php
					printf(
						/* translators: %s: Required providers list */
						esc_html__( 'Your account requires the following 2FA methods: %s. Your access may be restricted until you configure them.', 'two-factor-extended' ),
						esc_html( implode( ', ', $this->get_provider_labels( $required_providers ) ) )
					);
					?>
				</p>
				<p>
					<a href="<?php echo esc_url( admin_url( 'profile.php#two-factor-options' ) ); ?>" class="button button-primary">
						<?php esc_html_e( 'Configure 2FA Now', 'two-factor-extended' ); ?>
					</a>
				</p>
			</div>
			<?php
		}
	}

	/**
	 * Get provider labels from class names.
	 *
	 * @since 0.1.0
	 *
	 * @param array<int, string> $provider_classes Array of provider class names.
	 *
	 * @return array<int, string> Array of provider labels.
	 */
	private function get_provider_labels( array $provider_classes ): array {
		$names  = Two_Factor_Extended_Provider_Detector::get_provider_names();
		$labels = array();

		foreach ( $provider_classes as $class ) {
			$labels[] = $names[ $class ] ?? $class;
		}

		return $labels;
	}

	/**
	 * Check compliance for all users (scheduled task).
	 *
	 * @since 0.1.0
	 */
	public function check_all_users_compliance(): void {
		// This will be implemented for reporting/audit purposes.
		// For now, it's a placeholder for the daily scheduled check.
	}
}