<?php
/**
 * Migration: Add Visual Editor Fields to Appearance Presets
 *
 * Adds the new JSON columns for Week 21 V2 Visual Element Editor:
 * - global_values (colors, typography, buttons, form fields, effects)
 * - element_settings (chat interface components)
 * - widget_settings (widget-specific settings)
 *
 * @package BoostBot
 * @since   1.5.0
 */

// Prevent direct access
// phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

/**
 * Class BoostBot_Migration_Add_Visual_Editor_Fields
 *
 * @since 1.5.0
 */
class BoostBot_Migration_Add_Visual_Editor_Fields {

    /**
     * Run the migration.
     *
     * @return bool Success or failure.
     */
    public static function run() {
        global $wpdb;

        $table_name = self::sanitize_identifier( $wpdb->prefix . 'boostbot_appearance_presets' );

        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
        $table_exists = $wpdb->get_var(
            $wpdb->prepare( 'SHOW TABLES LIKE %s', $table_name )
        );

        if ( ! $table_exists ) {
            return false;
        }

        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- DDL cannot use placeholders for identifiers; $table is sanitized, definitions are literals.
        $columns = $wpdb->get_results( "SHOW COLUMNS FROM `{$table_name}`" );

        $existing_columns = array();
        foreach ( $columns as $column ) {
            $existing_columns[] = $column->Field;
        }

        $columns_to_add = array(
            'global_values'    => 'longtext DEFAULT NULL',
            'element_settings' => 'longtext DEFAULT NULL',
            'widget_settings'  => 'longtext DEFAULT NULL',
        );

        foreach ( $columns_to_add as $column_name => $column_definition ) {
            if ( in_array( $column_name, $existing_columns, true ) ) {
                continue;
            }
            $safe_column = self::sanitize_identifier( $column_name );

            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- DDL cannot use placeholders for identifiers; $table is sanitized, definitions are literals.
            $wpdb->query( "ALTER TABLE `{$table_name}` ADD COLUMN `{$safe_column}` {$column_definition}" );

            if ( $wpdb->last_error ) {
                if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
                    BoostBot_Logger::error( '[Migration] Visual editor fields: ' . $wpdb->last_error );
                }
                return false;
            }
        }

        return true;
    }

    /**
     * Restrict a SQL identifier to [A-Za-z0-9_] characters.
     *
     * @param string $identifier Raw identifier.
     * @return string Identifier with disallowed characters removed.
     */
    private static function sanitize_identifier( $identifier ) {
        return preg_replace( '/[^A-Za-z0-9_]/', '', (string) $identifier );
    }
}


