<?php
/**
 * Quick-Setup wizard — one-click site-type profiles.
 *
 * After plugin activation (or anytime via the dashboard tab), the admin
 * sees a banner asking "what kind of site is this?". Picking a profile
 * batch-updates the relevant settings to match: a school site is run
 * differently from an agency-managed e-commerce shop.
 *
 * Goal: get a non-expert to a sensible config in 1 click. They can still
 * fine-tune individual settings later.
 *
 * @package Brainwerk Security Suite
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

class Shieldforge_Quick_Setup {

    const DISMISSED_OPT = 'shieldforge_quick_setup_dismissed';
    const APPLIED_OPT   = 'shieldforge_quick_setup_applied_profile';
    const NONCE         = 'shieldforge_quick_setup';

    public static function register( Shieldforge_Loader $loader ) {
        $loader->add_action( 'admin_init', __CLASS__, 'handle_post' );
    }

    public static function profiles() {
        return array(
            'school' => array(
                'label'    => __( 'School / Education', 'brainwerk-security-suite' ),
                'icon'     => 'dashicons-welcome-learn-more',
                'desc'     => __( 'Multiple staff accounts, occasional content edits, low e-commerce surface. Forced 2FA for admins + editors, audit log on, vuln scanner on.', 'brainwerk-security-suite' ),
                'settings' => array(
                    'bruteforce_enabled'         => true,
                    'bf_user_lockout_enabled'    => true,
                    'hardening_disable_xmlrpc'   => true,
                    'hardening_disable_editor'   => true,
                    'hardening_hide_version'     => true,
                    'hardening_block_authors'    => true,
                    'hardening_rest_restrict'    => true,
                    'hardening_security_headers' => true,
                    'twofactor_enabled'          => true,
                    'twofactor_force_roles'      => array( 'administrator', 'editor' ),
                    'scanner_enabled'            => true,
                    'scanner_pattern_enabled'    => true,
                    'vulnscan_enabled'           => false,
                    'vulnscan_check_themes'      => true,
                    'vulnscan_check_core'        => true,
                    'audit_enabled'              => true,
                    'audit_track_posts'          => true,
                    'audit_track_users'          => true,
                    'audit_track_options'        => true,
                    'audit_track_updates'        => true,
                    'honeypot_enabled'           => true,
                    'honeypot_login'             => true,
                    'honeypot_register'          => true,
                    'honeypot_comment'           => true,
                    'anomaly_enabled'            => true,
                    'privacy_anonymize_ip'       => true,
                    'digest_enabled'             => true,
                ),
            ),
            'agency' => array(
                'label'    => __( 'Agency / Multi-client', 'brainwerk-security-suite' ),
                'icon'     => 'dashicons-businessperson',
                'desc'     => __( 'You manage many client sites. Maximum hardening, mandatory 2FA for ALL roles, every detection module on, audit-log retention longer.', 'brainwerk-security-suite' ),
                'settings' => array(
                    'bruteforce_enabled'         => true,
                    'bruteforce_threshold'       => 4,
                    'bf_user_lockout_enabled'    => true,
                    'hardening_disable_xmlrpc'   => true,
                    'hardening_disable_editor'   => true,
                    'hardening_hide_version'     => true,
                    'hardening_block_authors'    => true,
                    'hardening_rest_restrict'    => true,
                    'hardening_security_headers' => true,
                    'twofactor_enabled'          => true,
                    'twofactor_force_roles'      => array( 'administrator', 'editor', 'author' ),
                    'scanner_enabled'            => true,
                    'scanner_pattern_enabled'    => true,
                    'vulnscan_enabled'           => false,
                    'vulnscan_check_themes'      => true,
                    'vulnscan_check_core'        => true,
                    'audit_enabled'              => true,
                    'audit_track_posts'          => true,
                    'audit_track_users'          => true,
                    'audit_track_options'        => true,
                    'audit_track_updates'        => true,
                    'honeypot_enabled'           => true,
                    'honeypot_login'             => true,
                    'honeypot_register'          => true,
                    'honeypot_comment'           => true,
                    'anomaly_enabled'            => true,
                    'log_retention_days'         => 90,
                    'privacy_anonymize_ip'       => true,
                    'digest_enabled'             => true,
                ),
            ),
            'shop' => array(
                'label'    => __( 'E-commerce / Shop', 'brainwerk-security-suite' ),
                'icon'     => 'dashicons-cart',
                'desc'     => __( 'Customer accounts, payment processing. Honeypot on every form, anomaly detection on, force 2FA for shop managers.', 'brainwerk-security-suite' ),
                'settings' => array(
                    'bruteforce_enabled'         => true,
                    'bf_user_lockout_enabled'    => true,
                    'bf_user_lockout_threshold'  => 6,
                    'hardening_disable_xmlrpc'   => true,
                    'hardening_disable_editor'   => true,
                    'hardening_hide_version'     => true,
                    'hardening_security_headers' => true,
                    'hardening_rest_restrict'    => false, // shops often need anonymous REST for cart/checkout
                    'twofactor_enabled'          => true,
                    'twofactor_force_roles'      => array( 'administrator', 'shop_manager' ),
                    'scanner_enabled'            => true,
                    'scanner_pattern_enabled'    => true,
                    'vulnscan_enabled'           => false,
                    'audit_enabled'              => true,
                    'audit_track_users'          => true,
                    'audit_track_options'        => true,
                    'audit_track_updates'        => true,
                    'honeypot_enabled'           => true,
                    'honeypot_login'             => true,
                    'honeypot_register'          => true,
                    'honeypot_comment'           => true,
                    'anomaly_enabled'            => true,
                    'privacy_anonymize_ip'       => true,
                    'digest_enabled'             => true,
                ),
            ),
            'blog' => array(
                'label'    => __( 'Personal blog / Portfolio', 'brainwerk-security-suite' ),
                'icon'     => 'dashicons-admin-post',
                'desc'     => __( 'One-or-two-person setup, comment spam is the main worry. Lighter defaults, honeypot on comments, no forced 2FA for casual contributors.', 'brainwerk-security-suite' ),
                'settings' => array(
                    'bruteforce_enabled'         => true,
                    'bf_user_lockout_enabled'    => true,
                    'hardening_disable_xmlrpc'   => true,
                    'hardening_disable_editor'   => true,
                    'hardening_hide_version'     => true,
                    'hardening_block_authors'    => true,
                    'hardening_security_headers' => true,
                    'twofactor_enabled'          => true,
                    'twofactor_force_roles'      => array( 'administrator' ),
                    'scanner_enabled'            => true,
                    'scanner_pattern_enabled'    => true,
                    'vulnscan_enabled'           => false,
                    'audit_enabled'              => true,
                    'audit_track_posts'          => false, // blog posts change a lot, would spam log
                    'audit_track_users'          => true,
                    'audit_track_options'        => true,
                    'audit_track_updates'        => true,
                    'honeypot_enabled'           => true,
                    'honeypot_comment'           => true,
                    'honeypot_login'             => true,
                    'anomaly_enabled'            => false, // 1-2 users → not enough baseline data
                    'privacy_anonymize_ip'       => true,
                    'digest_enabled'             => true,
                ),
            ),
        );
    }

    public static function is_dismissed() {
        return (bool) get_site_option( self::DISMISSED_OPT, 0 );
    }

    public static function applied_profile() {
        $p = get_site_option( self::APPLIED_OPT, '' );
        return is_string( $p ) ? $p : '';
    }

    /* ==================================================================
     *  POST handler — apply profile or dismiss banner
     * ================================================================== */

    public static function handle_post() {
        if ( empty( $_POST['shieldforge_quick_setup_action'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
            return;
        }
        if ( ! check_admin_referer( self::NONCE ) ) {
            return;
        }
        if ( ! current_user_can( 'manage_options' ) && ! current_user_can( 'manage_network_options' ) ) {
            return;
        }
        $action = sanitize_key( wp_unslash( $_POST['shieldforge_quick_setup_action'] ) );

        if ( 'apply' === $action ) {
            $profile_key = isset( $_POST['profile'] ) ? sanitize_key( wp_unslash( $_POST['profile'] ) ) : '';
            $profiles    = self::profiles();
            if ( isset( $profiles[ $profile_key ] ) ) {
                Shieldforge_Settings::update( $profiles[ $profile_key ]['settings'] );
                update_site_option( self::APPLIED_OPT, $profile_key );
                update_site_option( self::DISMISSED_OPT, 1 );
                add_settings_error(
                    'brainwerk-security-suite',
                    'sf_quick_setup',
                    sprintf(
                        /* translators: %s: profile label */
                        __( 'Quick-setup profile applied: %s. You can fine-tune any individual setting from here.', 'brainwerk-security-suite' ),
                        $profiles[ $profile_key ]['label']
                    ),
                    'updated'
                );
            }
        } elseif ( 'dismiss' === $action ) {
            update_site_option( self::DISMISSED_OPT, 1 );
        } elseif ( 'reopen' === $action ) {
            delete_site_option( self::DISMISSED_OPT );
        }

        // Stay on the same page after the post.
        $referer = wp_get_referer();
        wp_safe_redirect( $referer ? $referer : admin_url( 'admin.php?page=brainwerk-security-suite' ) );
        exit;
    }

    /* ==================================================================
     *  Render — called from page-dashboard.php at the very top
     * ================================================================== */

    public static function render_banner() {
        if ( self::is_dismissed() ) {
            return;
        }
        $profiles = self::profiles();
        ?>
        <div class="sf-quick-setup">
            <div class="sf-quick-setup-header">
                <span class="sf-quick-setup-emoji">🚀</span>
                <div>
                    <h2 class="sf-quick-setup-title"><?php esc_html_e( 'Quick start: pick a site profile', 'brainwerk-security-suite' ); ?></h2>
                    <p class="sf-quick-setup-sub"><?php esc_html_e( 'One click sets sensible defaults for your site type. You can fine-tune any individual setting later.', 'brainwerk-security-suite' ); ?></p>
                </div>
                <form method="post" action="" style="margin-left:auto;">
                    <?php wp_nonce_field( self::NONCE ); ?>
                    <input type="hidden" name="shieldforge_quick_setup_action" value="dismiss">
                    <button type="submit" class="button-link sf-quick-setup-dismiss" title="<?php esc_attr_e( 'Hide this banner — you can re-open it from the Tools tab', 'brainwerk-security-suite' ); ?>">×</button>
                </form>
            </div>
            <div class="sf-quick-setup-grid">
                <?php foreach ( $profiles as $key => $p ) : ?>
                    <form method="post" action="" class="sf-quick-setup-card">
                        <?php wp_nonce_field( self::NONCE ); ?>
                        <input type="hidden" name="shieldforge_quick_setup_action" value="apply">
                        <input type="hidden" name="profile" value="<?php echo esc_attr( $key ); ?>">
                        <button type="submit" class="sf-quick-setup-card-btn">
                            <span class="dashicons <?php echo esc_attr( $p['icon'] ); ?> sf-quick-setup-card-icon"></span>
                            <span class="sf-quick-setup-card-title"><?php echo esc_html( $p['label'] ); ?></span>
                            <span class="sf-quick-setup-card-desc"><?php echo esc_html( $p['desc'] ); ?></span>
                            <span class="sf-quick-setup-card-cta"><?php esc_html_e( 'Apply this profile →', 'brainwerk-security-suite' ); ?></span>
                        </button>
                    </form>
                <?php endforeach; ?>
            </div>
        </div>
        <?php
    }
}
